chore: import upstream snapshot with attribution

.github/DISCUSSION_TEMPLATE/issue-triage.yml

@@ -0,0 +1,162 @@
+labels: ["needs-confirmation"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        > [!IMPORTANT]
+        > Please read through [the Discussion rules](https://github.com/ghostty-org/ghostty/discussions/6937), review [the FAQs](https://ghostty.org/docs/help#common-issues-and-solutions), and check for both existing [Discussions](https://github.com/ghostty-org/ghostty/discussions?discussions_q=) and [Issues](https://github.com/ghostty-org/ghostty/issues?q=sort%3Areactions-desc) prior to opening a new Discussion.
+  - type: markdown
+    attributes:
+      value: "# Issue Details"
+  - type: textarea
+    attributes:
+      label: Issue Description
+      description: |
+        Provide a detailed description of the issue.  Include relevant information, such as:
+        - The feature or configuration option you encounter the issue with.
+        - Screenshots, screen recordings, or other supporting media (as needed).
+        - If this is a regression of an existing issue that was closed or resolved, please include the previous item reference (Discussion, Issue, PR, commit) in your description.
+
+        > [!TIP]
+        > **Not sure what information to include?**
+        > Here are some recommendations:
+        > - **Input issues:** include your keyboard layout, a screenshot of logged keystrokes from the terminal inspector's "Keyboard" tab (Linux: <kbd>ctrl</kbd>+<kbd>shift</kbd>+<kbd>i</kbd>; MacOS: <kbd>cmd</kbd>+<kbd>alt</kbd>+<kbd>i</kbd>), input method, Linux input method engine (IBus, Fcitx 5, or none) and its version.
+        > - **Font issues:** include the problematic character(s), the output of `ghostty +show-face` for these character(s), and if they work in other applications.
+        > - **Terminal emulation issues (including image rendering issues):** attach an [asciinema](https://docs.asciinema.org/getting-started/) cast file, shell script, or text file for reproduction.
+        > - **Renderer issues:** (Linux) include your OpenGL version, graphics card, driver version.
+        > - **Crashes:** (macOS) include the [Sentry UUID](https://github.com/ghostty-org/ghostty?tab=readme-ov-file#crash-reports); (Linux) try to reproduce using a debug build and provide the stack trace.
+      placeholder: |
+        When using SSH to connect to my remote Linux machine from my local macOS device in Ghostty, I try to run `clear`, and the screen does not clear.  Instead, I see the following error message printed to the terminal: `Error opening terminal: xterm-ghostty.`
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Expected Behavior
+      description: |
+        Describe how you expect Ghostty to behave in this situation.  Include any relevant documentation links.
+      placeholder: |
+        The screen is cleared and the prompt is redrawn at the top of the window.
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Actual Behavior
+      description: |
+        Describe how Ghostty actually behaves in this situation.  If it is not immediately obvious how the actual behavior differs from the expected behavior described above, please be sure to mention the deviation specifically.
+      placeholder: |
+        The screen is not cleared, and an error is printed: `Error opening terminal: xterm-ghostty`.
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Reproduction Steps
+      description: |
+        Provide a detailed set of step-by-step instructions for reproducing this issue.
+      placeholder: |
+        1. Open Ghostty.
+        2. Connect to a remote server via SSH.
+        3. Try to execute `clear`.
+        4. Observe `xterm-ghostty` error message above.
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Ghostty Logs
+      description: |
+        Provide any captured Ghostty logs or stacktraces during your issue reproduction in this field.  On Linux, logs can be found by running `ghostty` from the command-line; on macOS, logs can be viewed with `sudo log stream --level debug --predicate 'subsystem=="com.mitchellh.ghostty"'` from another terminal emulator.
+      render: text
+  - type: textarea
+    attributes:
+      label: Ghostty Version
+      description: Paste the output of `ghostty +version` here.
+      placeholder: |
+        Ghostty 1.1.3
+
+        Version
+          - version: 1.1.3
+          - channel: stable
+        Build Config
+          - Zig version: 0.13.0
+          - build mode : builtin.OptimizeMode.ReleaseFast
+          - app runtime: apprt.Runtime.none
+          - font engine: font.main.Backend.coretext
+          - renderer   : renderer.Metal
+          - libxev     : main.Backend.kqueue
+      render: text
+    validations:
+      required: true
+  - type: input
+    attributes:
+      label: OS Version Information
+      description: |
+        Please tell us what operating system (name and version) you are using.
+      placeholder: Ubuntu 24.04.1 (Noble Numbat)
+    validations:
+      required: true
+  - type: dropdown
+    attributes:
+      label: (Linux only) Display Server
+      description: |
+        If you run Linux, please tell us if you use X11 or Wayland. If you aren't sure, you can determine this by running `[ -z "$WAYLAND_DISPLAY" ] && echo X11 || echo Wayland`.
+      options:
+        - X11
+        - Wayland
+        - Other
+    validations:
+      required: false
+  - type: input
+    attributes:
+      label: (Linux only) Desktop Environment/Window Manager
+      description: |
+        If you run Linux, please tell us what Desktop Environment/Window Manager you are using (include the name and version).
+      placeholder: GNOME 47.4
+    validations:
+      required: false
+  - type: textarea
+    attributes:
+      label: Minimal Ghostty Configuration
+      description: |
+        Please provide the **minimum** configuration needed to reproduce this issue.  If you can still reproduce the issue with one of the lines removed, do not include that line.  If and **only** if you are not able to determine this, paste the contents of your Ghostty configuration file here.
+      placeholder: |
+        font-family = CommitMono Nerd Font
+        font-family-bold = CommitMono Nerd Font
+        font-family-italic = CommitMono Nerd Font
+        font-family-bold-italic = CommitMono Nerd Font
+        font-feature = +cv07
+        font-size = 16
+        font-thicken = true
+        theme = catppuccin-mocha
+      render: ini
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Additional Relevant Configuration
+      description: |
+        If your issue involves other programs, tools, or applications in addition to Ghostty (e.g. Neovim, tmux, Zellij, etc.), please provide the minimum configuration and versions needed for all relevant programs to reproduce the issue here.  If you use custom CSS or shaders for Ghostty, also include them here, if applicable to your issue.
+      placeholder: |
+        #### `tmux.conf` (tmux 3.5a)
+        ```
+        set  -g default-terminal "tmux-256color"
+        set-option -sa terminal-overrides ",xterm*:Tc"
+        set  -g base-index      1
+        setw -g pane-base-index 1
+        ```
+    validations:
+      required: false
+  - type: markdown
+    attributes:
+      value: |
+        # User Acknowledgements
+        > [!TIP]
+        > Use these links to review the existing Ghostty [Discussions](https://github.com/ghostty-org/ghostty/discussions?discussions_q=) and [Issues](https://github.com/ghostty-org/ghostty/issues?q=sort%3Areactions-desc).
+  - type: checkboxes
+    attributes:
+      label: "I acknowledge that:"
+      options:
+        - label: I have reviewed the FAQ and confirm that my issue is NOT among them.
+          required: true
+        - label: I have searched the Ghostty repository (both open and closed Discussions and Issues) and confirm this is not a duplicate of an existing issue or discussion.
+          required: true
+        - label: I have checked the "Preview" tab on all text fields to ensure that everything looks right, and have wrapped all configuration and code in code blocks with a group of three backticks (` ``` `) on separate lines.
+          required: true

.github/DISCUSSION_TEMPLATE/vouch-request.yml

@@ -0,0 +1,42 @@
+body:
+  - type: markdown
+    attributes:
+      value: |
+        > [!IMPORTANT]
+        > This form is for **first-time contributors** who need to be vouched before submitting pull requests. Please read the [Contributing Guide](https://github.com/ghostty-org/ghostty/blob/main/CONTRIBUTING.md) and [AI Usage Policy](https://github.com/ghostty-org/ghostty/blob/main/AI_POLICY.md) before submitting.
+        >
+        > Keep your request **concise** and write it **in your own voice** — do not have an AI write this for you. A maintainer will comment `!vouch` if your request is approved, after which you can submit PRs.
+  - type: textarea
+    attributes:
+      label: What do you want to change?
+      description: |
+        Describe the change you'd like to make to Ghostty. If there is an existing issue or discussion, link to it.
+      placeholder: |
+        I'd like to fix the rendering issue described in #1234 where...
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Why do you want to make this change?
+      description: |
+        Explain your motivation. Why is this change important or useful?
+      placeholder: |
+        This bug affects users who...
+    validations:
+      required: true
+  - type: checkboxes
+    attributes:
+      label: "I acknowledge that:"
+      options:
+        - label: >-
+            I have read the [Contributing Guide](https://github.com/ghostty-org/ghostty/blob/main/CONTRIBUTING.md)
+            and understand the contribution process.
+          required: true
+        - label: >-
+            I have read and agree to follow the
+            [AI Usage Policy](https://github.com/ghostty-org/ghostty/blob/main/AI_POLICY.md).
+          required: true
+        - label: >-
+            I wrote this vouch request myself, in my
+            own voice, without AI generating it.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Features, Bug Reports, Questions
+    url: https://github.com/ghostty-org/ghostty/discussions/new/choose
+    about: Our preferred starting point if you have any questions or suggestions about configuration, features or behavior.

.github/ISSUE_TEMPLATE/preapproved.md

@@ -0,0 +1,9 @@
+---
+name: Pre-Discussed and Approved Topics
+about: |-
+  Only for topics already discussed and approved in the GitHub Discussions section.
+---
+
+**DO NOT OPEN A NEW ISSUE. PLEASE USE THE DISCUSSIONS SECTION.**
+
+**I DIDN'T READ THE ABOVE LINE. PLEASE CLOSE THIS ISSUE.**

.github/VOUCHED.td

@@ -0,0 +1,295 @@
+# The list of vouched (or actively denounced) users for this repository.
+#
+# The high-level idea is that only vouched users can participate in
+# contributing to this project. And a denounced user is explicitly
+# blocked from contributing (issues, PRs, etc. auto-closed). 
+#
+# We choose to maintain a denouncement list rather than or in addition to
+# using the platform's block features so other projects can slurp in our 
+# list of denounced users if they trust us and want to adopt our prior
+# knowledge about bad actors.
+#
+# Syntax:
+#  - One handle per line (without @). Sorted alphabetically.
+#  - Optionally specify platform: `platform:username` (e.g., `github:mitchellh`).
+#  - To denounce a user, prefix with minus: `-username` or `-platform:username`.
+#  - Optionally, add comments after a space following the handle.
+#
+# Maintainers can vouch for new contributors by commenting "!vouch" on a
+# discussion by the author. Maintainers can denounce users by commenting
+# "!denounce" or "!denounce [username]" on a discussion.
+00-kat
+007hacky007
+00jciv00
+04cb
+0xdvc
+-4rh1t3ct0r7
+52dyd
+aalhendi
+aaron-ang
+abdurrahmanski
+abudvytis
+adrum
+agoodkind
+aindriu80
+ajiblock
+ajr-khll
+akimiojr
+alaasdk
+alanmoyano
+alaviss
+alexbathome
+alexfeijoo44
+alexjuca
+alosarjos
+amadeus
+andrejdaskalov
+anhthang
+anmitalidev
+anthonyzhoon
+arvin7liu
+athaapa
+atomk
+b0uks
+b1nar10
+balazs-szucs
+barutsrb
+bch
+bennettp123
+benodiwal
+bernsno
+beryesa
+bitigchi
+bkircher
+bleikurr
+bo2themax
+brentschroeter
+brianc442
+c0x0o
+cespare
+charliie-dev
+chernetskyi
+chronologos
+cmwetherell
+crayxt
+craziestowl
+curtismoncoq
+-cznorth Automated advertising + likely AI communication
+d-dudas
+-daedaevibin
+daiimus
+damyanbogoev
+danneu
+danulqua
+dariogriffo
+davidsanchez222
+deblasis
+dervedro
+devsunb
+diaaeddin
+dkinzler
+dmehala
+dobbylee
+doprz
+douglance
+douglas
+douglas-macgregor
+drepper
+dzhlobo
+ekaterinepapava
+elias8
+-enkr1
+enzowilliam
+ephemera
+-eric-assetpass Try talking, not botting
+eriksremess
+erral
+escalonc
+eunos-1128
+exlee
+-f1813483-netizen
+faukah
+filip7
+flou
+fornwall
+francescarpi
+fru1tworld
+gagbo
+ghokun
+gmile
+gordonbondon
+gpanders
+guilhermetk
+h3nock
+hakonhagland
+halosatrio
+heaths
+heddxh heddxh
+-highimpact-dev Disrespectful AI user
+hlcfan
+hqnna
+hulet
+i999rri
+icodesign
+illiakrauchanka
+j0hnm4r5
+jacobsandlund
+jake-stewart
+jamesarch
+jamylak
+jarred-sumner
+jcollie
+jesusvazquez
+jguthmiller
+jmcgover
+jmr
+johnslavik
+jordandm
+josephmart
+jparise
+juniqlim
+justonia
+karesansui-u
+kataokatsuki
+kawarimidoll
+kayleung
+kenvandine
+khipp
+kierancanter
+kirwiisp
+kjvdven
+kloneets
+knu
+-kody-w
+koranir
+kostich
+kristina8888
+kristofersoler
+kylesower
+laxystem
+lebdron
+lepips
+liby
+linustalacko
+lonsagisawa
+louisunlimited
+luisnquin
+lynicis
+mac0ne
+mahnokropotkinvich
+marijagjorgjieva
+markdorison
+markhuot
+marler8997
+marrocco-simone
+masterflitzer
+matkotiric
+mattn
+micaeljarniac
+michielvk
+miguelelgallo
+mihi314
+mikailmm
+minorcell
+misairuzame
+mischief
+mitchellh
+miupa
+mjbommar
+mohshami
+molechowski
+moonmao42
+-morgengeluk Appears to be using AI inappropriately even after it was requested they abide by the AI policy (there is clear evidence of the person-in-the-loop not attempting to clean up AI generated text, and their AI disclosure itself reads like AI-generated text and shows no signs of remorse or intent to improve).
+mpatankar6
+mrconnorkenway
+mrmage
+mtak
+mustafa0x
+nagato-yuzuru
+natesmyth
+neo773
+neurosnap
+nicholas-ochoa
+nicosuave
+nikicat
+nilsherzig
+nmggithub
+noib3
+nolinmcfarland
+nouritsu
+nwehg
+ocean6954
+oshdubh
+otomn
+paaloeye
+pan93412
+pangoraw
+pauley-unsaturated
+pearkes
+peilingjiang
+peterdavehello
+philocalyst
+phush0
+piedrahitac
+pluiedev
+pouwerkerk
+poweruser64
+prakhar54-byte
+priyans-hu
+puzza007
+qappell
+quinnypig
+qwerasd205
+raphamorim
+reo101
+rewdy
+rgehan
+rhodes-b
+rightaditya
+rjwittams
+rmengelbrecht
+rmunn
+rockorager
+rpfaeffle
+ruoyouz
+sahilkmishra
+samasaur1
+sandydoo
+-schickling-assistant NHITL
+secrus
+seruman
+seyoungjeong
+silveirapf
+slsrepo
+sunshine-syz
+tasselx
+tbrundige
+tdgroot
+tdslot
+thirstycrow
+thoutbeckers
+ticclick
+tnagatomi
+trag1c
+tristan957
+turbolent
+tweedbeetle
+uhojin
+unphased
+uzaaft
+vancluever
+vaughanandrews
+-vectorpeak Stupid bot cosplaying as a maintainer
+viruslobster
+vlsi
+voidnv
+williamhcarter
+wyounas
+yabbal
+yak3d
+yamshta
+ydah
+-zaviro
+zenyr
+zeshi09
+zubb

.github/dependabot.yml

@@ -0,0 +1,8 @@
+version: 2
+updates:
+  # Maintain dependencies for GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      # Check for updates to GitHub Actions every weekday
+      interval: "daily"

.github/issue-unvouched-message

@@ -0,0 +1,5 @@
+Hi @{author}, thanks for your interest!
+
+Non-maintainers are not allowed to create issues in this repository — we ask that you create a discussion first. For more details on the why, see #3558 and our [CONTRIBUTING.md](https://github.com/ghostty-org/ghostty/blob/main/CONTRIBUTING.md).
+
+This issue will be closed automatically.

.github/pinact.yml

@@ -0,0 +1,4 @@
+version: 3
+ignore_actions:
+  - name: "DeterminateSystems/nix-installer-action"
+    ref: "main"

.github/scripts/check-translations.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+
+set -euxo pipefail
+
+old_pot=$(mktemp)
+cp po/com.mitchellh.ghostty.pot "$old_pot"
+zig build update-translations
+
+# Compare previous POT to current POT
+msgcmp "$old_pot" po/com.mitchellh.ghostty.pot --use-untranslated
+
+# Compare all other POs to current POT
+for f in po/*.po; do
+  # Ignore untranslated entries
+  msgcmp --use-untranslated "$f" po/com.mitchellh.ghostty.pot;
+done

.github/scripts/ghostty-tip

@@ -0,0 +1,19 @@
+#!/usr/bin/env nu
+
+# Check if a given commit SHA has a corresponding tip release.
+#
+# This does not validate that the commit SHA is valid for the
+# Ghostty repository, only that a tip release exists for it.
+def main [
+  commit: string, # The full length commit SHA 
+] {
+  let url = $"https://tip.files.ghostty.org/($commit)/ghostty-macos-universal.zip"
+
+  try {
+    http head $url
+    exit 0
+  } catch {
+    print -e $"The SHA ($commit) does not have a corresponding tip release."
+    exit 1
+  }
+}

.github/workflows/clean-artifacts.yml

@@ -0,0 +1,17 @@
+name: Clean Artifacts
+on:
+  schedule:
+    # Once a day
+    - cron: "0 0 * * *"
+  workflow_dispatch:
+jobs:
+  remove-old-artifacts:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Remove old artifacts
+        uses: c-hive/gha-remove-artifacts@44fc7acaf1b3d0987da0e8d4707a989d80e9554b # v1.4.0
+        with:
+          age: "1 week"
+          skip-tags: true
+          skip-recent: 5

.github/workflows/flatpak.yml

@@ -0,0 +1,50 @@
+on:
+  workflow_dispatch:
+    inputs:
+      source-run-id:
+        description: run id of the workflow that generated the artifact
+        required: true
+        type: string
+      source-artifact-id:
+        description: source tarball built during build-dist
+        required: true
+        type: string
+
+name: Flatpak
+
+jobs:
+  build:
+    if: github.repository == 'ghostty-org/ghostty'
+    name: "Flatpak"
+    container:
+      image: ghcr.io/flathub-infra/flatpak-github-actions:gnome-47
+      options: --privileged
+    strategy:
+      fail-fast: false
+      matrix:
+        variant:
+          - arch: x86_64
+            runner: namespace-profile-ghostty-md
+          - arch: aarch64
+            runner: namespace-profile-ghostty-md-arm64
+    runs-on: ${{ matrix.variant.runner }}
+    steps:
+      - name: Download Source Tarball Artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          run-id: ${{ inputs.source-run-id }}
+          artifact-ids: ${{ inputs.source-artifact-id }}
+          github-token: ${{ github.token }}
+
+      - name: Extract tarball
+        run: |
+          mkdir dist
+          tar --verbose --extract --strip-components 1 --directory dist --file ghostty-source.tar.gz
+
+      - uses: flatpak/flatpak-github-actions/flatpak-builder@401fe28a8384095fc1531b9d320b292f0ee45adb # v6.7
+        with:
+          bundle: com.mitchellh.ghostty
+          manifest-path: dist/flatpak/com.mitchellh.ghostty.yml
+          cache-key: flatpak-builder-${{ github.sha }}
+          arch: ${{ matrix.variant.arch }}
+          verbose: true

.github/workflows/milestone.yml

@@ -0,0 +1,33 @@
+# Description:
+#   - Add milestone to a merged PR automatically
+#   - Add milestone to a closed issue that has a merged PR fix (if any)
+
+name: Milestone Action
+on:
+  issues:
+    types: [closed]
+  pull_request_target:
+    types: [closed]
+
+jobs:
+  update-milestone:
+    # Ignore bot-authored pull requests (dependabot, app bots, etc)
+    # and CI-only PRs.
+    if: github.event_name == 'issues' || (github.event.pull_request.user.type != 'Bot' && !startsWith(github.event.pull_request.title, 'ci:'))
+    runs-on: namespace-profile-ghostty-sm
+    name: Milestone Update
+    steps:
+      - name: Set Milestone for PR
+        uses: hustcer/milestone-action@ebed8d5daafd855a600d7e665c1b130f06d24130 # v3.1
+        if: github.event.pull_request.merged == true && !contains(github.event.pull_request.title, 'VOUCHED') && !startsWith(github.event.pull_request.title, 'ci:')
+        with:
+          action: bind-pr # `bind-pr` is the default action
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      # Bind milestone to closed issue that has a merged PR fix
+      - name: Set Milestone for Issue
+        uses: hustcer/milestone-action@ebed8d5daafd855a600d7e665c1b130f06d24130 # v3.1
+        if: github.event.issue.state == 'closed'
+        with:
+          action: bind-issue
+          github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/nix.yml

@@ -0,0 +1,59 @@
+on: [push, pull_request]
+name: Nix
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref_name != 'main' && github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  required:
+    name: "Required Checks: Nix"
+    runs-on: namespace-profile-ghostty-sm
+    needs:
+      - check-zig-cache-hash
+    steps:
+      - id: status
+        name: Determine status
+        run: |
+          results=$(tr -d '\n' <<< '${{ toJSON(needs.*.result) }}')
+          if ! grep -q -v -E '(failure|cancelled)' <<< "$results"; then
+            result="failed"
+          else
+            result="success"
+          fi
+          {
+            echo "result=${result}"
+            echo "results=${results}"
+          } | tee -a "$GITHUB_OUTPUT"
+      - if: always() && steps.status.outputs.result != 'success'
+        name: Check for failed status
+        run: |
+          echo "One or more required build workflows failed: ${{ steps.status.outputs.results }}"
+          exit 1
+
+  check-zig-cache-hash:
+    if: github.repository == 'ghostty-org/ghostty'
+    runs-on: namespace-profile-ghostty-sm
+    env:
+      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
+      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Setup Cache
+        uses: namespacelabs/nscloud-cache-action@58bf6e08898e88803c098e2b522668541cd3b2e3 # v1.6.0
+        with:
+          path: |
+            /nix
+            /zig
+      - name: Setup Nix
+        uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
+        with:
+          name: ghostty
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+          useDaemon: false # sometimes fails on short jobs
+      - name: Check Zig cache
+        run: nix develop -c ./nix/build-support/check-zig-cache.sh

.github/workflows/publish-tag.yml

@@ -0,0 +1,74 @@
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to deploy (format: vX.Y.Z)"
+        required: true
+
+name: Publish Tagged Release
+
+# We must only run one release workflow at a time to prevent corrupting
+# our release artifacts.
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+jobs:
+  setup:
+    runs-on: namespace-profile-ghostty-sm
+    outputs:
+      version: ${{ steps.extract_version.outputs.version }}
+    steps:
+      - name: Validate Version Input
+        run: |
+          if [[ ! "${{ github.event.inputs.version }}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Error: Version must follow the format vX.Y.Z (e.g., v1.0.0)."
+            exit 1
+          fi
+
+          echo "Version is valid: ${{ github.event.inputs.version }}"
+
+      - name: Extract the Version
+        id: extract_version
+        run: |
+          VERSION=${{ github.event.inputs.version }}
+          VERSION=${VERSION#v}
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+
+  upload:
+    needs: [setup]
+    runs-on: namespace-profile-ghostty-sm
+    env:
+      GHOSTTY_VERSION: ${{ needs.setup.outputs.version }}
+    steps:
+      - name: Validate Release Files
+        run: |
+          BASE="https://release.files.ghostty.org/${GHOSTTY_VERSION}"
+          curl -I -s -o /dev/null -w "%{http_code}" "${BASE}/ghostty-${GHOSTTY_VERSION}.tar.gz" | grep -q "^200$" || exit 1
+          curl -I -s -o /dev/null -w "%{http_code}" "${BASE}/ghostty-${GHOSTTY_VERSION}.tar.gz.minisig" | grep -q "^200$" || exit 1
+          curl -I -s -o /dev/null -w "%{http_code}" "${BASE}/ghostty-source.tar.gz" | grep -q "^200$" || exit 1
+          curl -I -s -o /dev/null -w "%{http_code}" "${BASE}/ghostty-source.tar.gz.minisig" | grep -q "^200$" || exit 1
+          curl -I -s -o /dev/null -w "%{http_code}" "${BASE}/ghostty-macos-universal.zip" | grep -q "^200$" || exit 1
+          curl -I -s -o /dev/null -w "%{http_code}" "${BASE}/ghostty-macos-universal-dsym.zip" | grep -q "^200$" || exit 1
+          curl -I -s -o /dev/null -w "%{http_code}" "${BASE}/Ghostty.dmg" | grep -q "^200$" || exit 1
+          curl -I -s -o /dev/null -w "%{http_code}" "${BASE}/appcast-staged.xml" | grep -q "^200$" || exit 1
+
+      - name: Download Staged Appcast
+        run: |
+          curl -L https://release.files.ghostty.org/${GHOSTTY_VERSION}/appcast-staged.xml > appcast-staged.xml
+          mv appcast-staged.xml appcast.xml
+
+      - name: Upload Appcast
+        run: |
+          rm -rf blob
+          mkdir blob
+          mv appcast.xml blob/appcast.xml
+      - name: Upload Appcast to R2
+        uses: ryand56/r2-upload-action@b801a390acbdeb034c5e684ff5e1361c06639e7c # v1.4
+        with:
+          r2-account-id: ${{ secrets.CF_R2_RELEASE_ACCOUNT_ID }}
+          r2-access-key-id: ${{ secrets.CF_R2_RELEASE_AWS_KEY }}
+          r2-secret-access-key: ${{ secrets.CF_R2_RELEASE_SECRET_KEY }}
+          r2-bucket: ghostty-release
+          source-dir: blob
+          destination-dir: ./

.github/workflows/release-tag.yml

@@ -0,0 +1,410 @@
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to deploy (format: vX.Y.Z)"
+        required: true
+      upload:
+        description: "Upload final artifacts to R2"
+        default: false
+
+  push:
+    tags:
+      - "v[0-9]+.[0-9]+.[0-9]+"
+
+name: Release Tag
+
+# We must only run one release workflow at a time to prevent corrupting
+# our release artifacts.
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+jobs:
+  setup:
+    runs-on: namespace-profile-ghostty-sm
+    outputs:
+      version: ${{ steps.extract_version.outputs.version }}
+      build: ${{ steps.extract_build_info.outputs.build }}
+      commit: ${{ steps.extract_build_info.outputs.commit }}
+      commit_long: ${{ steps.extract_build_info.outputs.commit_long }}
+    steps:
+      - name: Validate Version Input
+        if: github.event_name == 'workflow_dispatch'
+        run: |
+          if [[ ! "${{ github.event.inputs.version }}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Error: Version must follow the format vX.Y.Z (e.g., v1.0.0)."
+            exit 1
+          fi
+
+          echo "Version is valid: ${{ github.event.inputs.version }}"
+
+      - name: Extract the Version
+        id: extract_version
+        run: |
+          if [[ "${{ github.event_name }}" == "push" ]]; then
+            # Remove the leading 'v' from the tag
+            VERSION=${GITHUB_REF#refs/tags/v}
+            echo "version=$VERSION" >> $GITHUB_OUTPUT
+          elif [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+            VERSION=${{ github.event.inputs.version }}
+            VERSION=${VERSION#v}
+            echo "version=$VERSION" >> $GITHUB_OUTPUT
+          else
+            echo "Error: Unsupported event type."
+            exit 1
+          fi
+
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          # Important so that build number generation works
+          fetch-depth: 0
+
+      - name: Extract build info
+        id: extract_build_info
+        run: |
+          GHOSTTY_BUILD=$(git rev-list --count HEAD)
+          GHOSTTY_COMMIT=$(git rev-parse --short HEAD)
+          GHOSTTY_COMMIT_LONG=$(git rev-parse HEAD)
+          echo "build=$GHOSTTY_BUILD" >> $GITHUB_OUTPUT
+          echo "commit=$GHOSTTY_COMMIT" >> $GITHUB_OUTPUT
+          echo "commit_long=$GHOSTTY_COMMIT_LONG" >> $GITHUB_OUTPUT
+          cat $GITHUB_OUTPUT
+
+  source-tarball:
+    runs-on: namespace-profile-ghostty-md
+    needs: [setup]
+    env:
+      GHOSTTY_VERSION: ${{ needs.setup.outputs.version }}
+      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
+      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Setup Cache
+        uses: namespacelabs/nscloud-cache-action@58bf6e08898e88803c098e2b522668541cd3b2e3 # v1.6.0
+        with:
+          path: |
+            /nix
+            /zig
+
+      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+
+      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
+        with:
+          name: ghostty
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+
+      - name: Create Tarball
+        run: |
+          rm -rf zig-out/dist
+          nix develop -c zig build distcheck
+          cp zig-out/dist/ghostty-${GHOSTTY_VERSION}.tar.gz .
+          cp zig-out/dist/ghostty-${GHOSTTY_VERSION}.tar.gz ghostty-source.tar.gz
+
+      - name: Sign Tarball
+        run: |
+          echo -n "${{ secrets.MINISIGN_KEY }}" > minisign.key
+          echo -n "${{ secrets.MINISIGN_PASSWORD }}" > minisign.password
+          nix develop -c minisign -S -m "ghostty-${GHOSTTY_VERSION}.tar.gz" -s minisign.key < minisign.password
+          nix develop -c minisign -S -m "ghostty-source.tar.gz" -s minisign.key < minisign.password
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: source-tarball
+          path: |-
+            ghostty-${{ env.GHOSTTY_VERSION }}.tar.gz
+            ghostty-${{ env.GHOSTTY_VERSION }}.tar.gz.minisig
+            ghostty-source.tar.gz
+            ghostty-source.tar.gz.minisig
+
+  build-macos:
+    needs: [setup]
+    runs-on: namespace-profile-ghostty-macos-tahoe
+    timeout-minutes: 90
+    env:
+      GHOSTTY_VERSION: ${{ needs.setup.outputs.version }}
+      GHOSTTY_BUILD: ${{ needs.setup.outputs.build }}
+      GHOSTTY_COMMIT: ${{ needs.setup.outputs.commit }}
+      ZIG_LOCAL_CACHE_DIR: /Users/runner/zig/local-cache
+      ZIG_GLOBAL_CACHE_DIR: /Users/runner/zig/global-cache
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Setup Cache
+        uses: namespacelabs/nscloud-cache-action@58bf6e08898e88803c098e2b522668541cd3b2e3 # v1.6.0
+        with:
+          cache: |
+            xcode
+          path: |
+            /Users/runner/zig
+
+      - uses: DeterminateSystems/nix-installer-action@main
+        with:
+          determinate: true
+      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
+        with:
+          name: ghostty
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+
+      - name: XCode Select
+        run: sudo xcode-select -s /Applications/Xcode_26.3.app
+
+      - name: Xcode Version
+        run: xcodebuild -version
+
+      - name: Setup Sparkle
+        env:
+          SPARKLE_VERSION: 2.9.0
+        run: |
+          mkdir -p .action/sparkle
+          cd .action/sparkle
+          curl -L https://github.com/sparkle-project/Sparkle/releases/download/${SPARKLE_VERSION}/Sparkle-for-Swift-Package-Manager.zip > sparkle.zip
+          unzip sparkle.zip
+          echo "$(pwd)/bin" >> $GITHUB_PATH
+
+      # GhosttyKit is the framework that is built from Zig for our native
+      # Mac app to access. Build this in release mode.
+      - name: Build GhosttyKit
+        run: |
+          nix develop -c \
+            zig build \
+            -Doptimize=ReleaseFast \
+            -Demit-macos-app=false \
+            -Dversion-string=${GHOSTTY_VERSION}
+
+      # The native app is built with native XCode tooling. This also does
+      # codesigning. IMPORTANT: this must NOT run in a Nix environment.
+      # Nix breaks xcodebuild so this has to be run outside.
+      - name: Build Ghostty.app
+        run: |
+          cd macos
+          xcodebuild -target Ghostty -configuration Release \
+            COMPILATION_CACHE_CAS_PATH=/Users/runner/Library/Developer/Xcode/DerivedData/CompilationCache.noindex \
+            COMPILATION_CACHE_KEEP_CAS_DIRECTORY=YES
+
+      # Add all our metadata to Info.plist so we can reference it later.
+      - name: Update Info.plist
+        env:
+          SPARKLE_KEY_PUB: ${{ secrets.PROD_MACOS_SPARKLE_KEY_PUB }}
+        run: |
+          # Version Info
+          /usr/libexec/PlistBuddy -c "Set :GhosttyCommit $GHOSTTY_COMMIT" "macos/build/Release/Ghostty.app/Contents/Info.plist"
+          /usr/libexec/PlistBuddy -c "Set :CFBundleVersion $GHOSTTY_BUILD" "macos/build/Release/Ghostty.app/Contents/Info.plist"
+          /usr/libexec/PlistBuddy -c "Set :CFBundleShortVersionString $GHOSTTY_VERSION" "macos/build/Release/Ghostty.app/Contents/Info.plist"
+
+          # Updater
+          /usr/libexec/PlistBuddy -c "Set :SUPublicEDKey $SPARKLE_KEY_PUB" "macos/build/Release/Ghostty.app/Contents/Info.plist"
+          /usr/libexec/PlistBuddy -c "Delete :SUEnableAutomaticChecks" "macos/build/Release/Ghostty.app/Contents/Info.plist"
+
+      - name: Codesign app bundle
+        env:
+          MACOS_CERTIFICATE: ${{ secrets.PROD_MACOS_CERTIFICATE }}
+          MACOS_CERTIFICATE_PWD: ${{ secrets.PROD_MACOS_CERTIFICATE_PWD }}
+          MACOS_CERTIFICATE_NAME: ${{ secrets.PROD_MACOS_CERTIFICATE_NAME }}
+          MACOS_CI_KEYCHAIN_PWD: ${{ secrets.PROD_MACOS_CI_KEYCHAIN_PWD }}
+        run: |
+          # Turn our base64-encoded certificate back to a regular .p12 file
+          echo $MACOS_CERTIFICATE | base64 --decode > certificate.p12
+
+          # We need to create a new keychain, otherwise using the certificate will prompt
+          # with a UI dialog asking for the certificate password, which we can't
+          # use in a headless CI environment
+          security create-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain
+          security default-keychain -s build.keychain
+          security unlock-keychain -p "$MACOS_CI_KEYCHAIN_PWD" build.keychain
+          security import certificate.p12 -k build.keychain -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign
+          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_CI_KEYCHAIN_PWD" build.keychain
+
+          # Codesign Sparkle. Some notes here:
+          #   - The XPC services aren't used since we don't sandbox Ghostty,
+          #     but since they're part of the build, they still need to be
+          #     codesigned.
+          #   - The binaries in the "Versions" folders need to NOT be symlinks.
+          /usr/bin/codesign --verbose -f -s "$MACOS_CERTIFICATE_NAME" -o runtime "macos/build/Release/Ghostty.app/Contents/Frameworks/Sparkle.framework/Versions/B/XPCServices/Downloader.xpc"
+          /usr/bin/codesign --verbose -f -s "$MACOS_CERTIFICATE_NAME" -o runtime "macos/build/Release/Ghostty.app/Contents/Frameworks/Sparkle.framework/Versions/B/XPCServices/Installer.xpc"
+          /usr/bin/codesign --verbose -f -s "$MACOS_CERTIFICATE_NAME" -o runtime "macos/build/Release/Ghostty.app/Contents/Frameworks/Sparkle.framework/Versions/B/Autoupdate"
+          /usr/bin/codesign --verbose -f -s "$MACOS_CERTIFICATE_NAME" -o runtime "macos/build/Release/Ghostty.app/Contents/Frameworks/Sparkle.framework/Versions/B/Updater.app"
+          /usr/bin/codesign --verbose -f -s "$MACOS_CERTIFICATE_NAME" -o runtime "macos/build/Release/Ghostty.app/Contents/Frameworks/Sparkle.framework"
+          /usr/bin/codesign --verbose -f -s "$MACOS_CERTIFICATE_NAME" -o runtime "macos/build/Release/Ghostty.app/Contents/PlugIns/DockTilePlugin.plugin"
+
+          # Codesign the app bundle
+          /usr/bin/codesign --verbose -f -s "$MACOS_CERTIFICATE_NAME" -o runtime --entitlements "macos/Ghostty.entitlements" macos/build/Release/Ghostty.app
+
+      - name: Create DMG
+        env:
+          MACOS_CERTIFICATE_NAME: ${{ secrets.PROD_MACOS_CERTIFICATE_NAME }}
+        run: |
+          npm install --global create-dmg
+          create-dmg \
+            --identity="$MACOS_CERTIFICATE_NAME" \
+            ./macos/build/Release/Ghostty.app \
+            ./
+          mv ./Ghostty*.dmg ./Ghostty.dmg
+
+      - name: "Notarize DMG"
+        env:
+          APPLE_NOTARIZATION_ISSUER: ${{ secrets.APPLE_NOTARIZATION_ISSUER }}
+          APPLE_NOTARIZATION_KEY_ID: ${{ secrets.APPLE_NOTARIZATION_KEY_ID }}
+          APPLE_NOTARIZATION_KEY: ${{ secrets.APPLE_NOTARIZATION_KEY }}
+        run: |
+          # Store the notarization credentials so that we can prevent a UI password dialog
+          # from blocking the CI
+          echo "Create keychain profile"
+          echo "$APPLE_NOTARIZATION_KEY" > notarization_key.p8
+          xcrun notarytool store-credentials "notarytool-profile" --key notarization_key.p8 --key-id "$APPLE_NOTARIZATION_KEY_ID" --issuer "$APPLE_NOTARIZATION_ISSUER"
+          rm notarization_key.p8
+
+          # Here we send the notarization request to the Apple's Notarization service, waiting for the result.
+          # This typically takes a few seconds inside a CI environment, but it might take more depending on the App
+          # characteristics. Visit the Notarization docs for more information and strategies on how to optimize it if
+          # you're curious
+          echo "Notarize dmg"
+          xcrun notarytool submit "Ghostty.dmg" --keychain-profile "notarytool-profile" --wait
+
+          # Finally, we need to "attach the staple" to our executable, which will allow our app to be
+          # validated by macOS even when an internet connection is not available. We do this to
+          # both the app and the dmg
+          echo "Attach staple"
+          xcrun stapler staple "Ghostty.dmg"
+          xcrun stapler staple "macos/build/Release/Ghostty.app"
+
+      # Zip up the app and symbols
+      - name: Zip App
+        run: |
+          cd macos/build/Release
+          zip -9 -r --symlinks ../../../ghostty-macos-universal.zip Ghostty.app
+          zip -9 -r --symlinks ../../../ghostty-macos-universal-dsym.zip Ghostty.app.dSYM/
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: macos
+          path: |-
+            Ghostty.dmg
+            ghostty-macos-universal.zip
+            ghostty-macos-universal-dsym.zip
+
+  sentry-dsym:
+    runs-on: namespace-profile-ghostty-sm
+    needs: [build-macos]
+    steps:
+      - name: Install sentry-cli
+        run: |
+          curl -sL https://sentry.io/get-cli/ | bash
+
+      - name: Download macOS Artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: macos
+
+      - name: Upload dSYM to Sentry
+        env:
+          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+        run: |
+          sentry-cli dif upload --project ghostty --wait ghostty-macos-universal-dsym.zip
+
+  appcast:
+    needs: [setup, build-macos]
+    runs-on: namespace-profile-ghostty-macos-tahoe
+    env:
+      GHOSTTY_VERSION: ${{ needs.setup.outputs.version }}
+      GHOSTTY_BUILD: ${{ needs.setup.outputs.build }}
+      GHOSTTY_COMMIT: ${{ needs.setup.outputs.commit }}
+      GHOSTTY_COMMIT_LONG: ${{ needs.setup.outputs.commit_long }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Download macOS Artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: macos
+
+      - name: Setup Sparkle
+        env:
+          SPARKLE_VERSION: 2.9.0
+        run: |
+          mkdir -p .action/sparkle
+          cd .action/sparkle
+          curl -L https://github.com/sparkle-project/Sparkle/releases/download/${SPARKLE_VERSION}/Sparkle-for-Swift-Package-Manager.zip > sparkle.zip
+          unzip sparkle.zip
+          echo "$(pwd)/bin" >> $GITHUB_PATH
+
+      - name: Generate Appcast
+        env:
+          SPARKLE_KEY: ${{ secrets.PROD_MACOS_SPARKLE_KEY }}
+        run: |
+          echo "GHOSTTY_VERSION=$GHOSTTY_VERSION"
+          echo "GHOSTTY_BUILD=$GHOSTTY_BUILD"
+          echo "GHOSTTY_COMMIT=$GHOSTTY_COMMIT"
+          echo "GHOSTTY_COMMIT_LONG=$GHOSTTY_COMMIT_LONG"
+
+          echo $SPARKLE_KEY > signing.key
+          sign_update -f signing.key Ghostty.dmg > sign_update.txt
+          curl -L https://release.files.ghostty.org/appcast.xml > appcast.xml
+          python3 ./dist/macos/update_appcast_tag.py
+          test -f appcast_new.xml
+          mv appcast_new.xml appcast.xml
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: sparkle
+          path: |-
+            appcast.xml
+
+  upload:
+    if: |-
+      (github.event_name == 'workflow_dispatch' &&
+        github.event.inputs.upload == 'true') ||
+      github.event_name == 'push'
+    needs: [setup, source-tarball, build-macos, appcast]
+    runs-on: namespace-profile-ghostty-sm
+    env:
+      GHOSTTY_VERSION: ${{ needs.setup.outputs.version }}
+    steps:
+      - name: Download macOS Artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: macos
+
+      - name: Download Sparkle Artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: sparkle
+
+      - name: Download Source Tarball Artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: source-tarball
+
+      # Upload all of our files EXCEPT the appcast. The appcast triggers
+      # updates in clients and we don't want to do that until we're
+      # sure these are uploaded.
+      - name: Prep Files
+        run: |
+          mkdir blob
+          mkdir -p blob/${GHOSTTY_VERSION}
+          mv "ghostty-${GHOSTTY_VERSION}.tar.gz" blob/${GHOSTTY_VERSION}/ghostty-${GHOSTTY_VERSION}.tar.gz
+          mv "ghostty-${GHOSTTY_VERSION}.tar.gz.minisig" blob/${GHOSTTY_VERSION}/ghostty-${GHOSTTY_VERSION}.tar.gz.minisig
+          mv ghostty-source.tar.gz blob/${GHOSTTY_VERSION}/ghostty-source.tar.gz
+          mv ghostty-source.tar.gz.minisig blob/${GHOSTTY_VERSION}/ghostty-source.tar.gz.minisig
+          mv ghostty-macos-universal.zip blob/${GHOSTTY_VERSION}/ghostty-macos-universal.zip
+          mv ghostty-macos-universal-dsym.zip blob/${GHOSTTY_VERSION}/ghostty-macos-universal-dsym.zip
+          mv Ghostty.dmg blob/${GHOSTTY_VERSION}/Ghostty.dmg
+          mv appcast.xml blob/${GHOSTTY_VERSION}/appcast-staged.xml
+      - name: Upload to R2
+        uses: ryand56/r2-upload-action@b801a390acbdeb034c5e684ff5e1361c06639e7c # v1.4
+        with:
+          r2-account-id: ${{ secrets.CF_R2_RELEASE_ACCOUNT_ID }}
+          r2-access-key-id: ${{ secrets.CF_R2_RELEASE_AWS_KEY }}
+          r2-secret-access-key: ${{ secrets.CF_R2_RELEASE_SECRET_KEY }}
+          r2-bucket: ghostty-release
+          source-dir: blob
+          destination-dir: ./

.github/workflows/snap.yml

@@ -0,0 +1,59 @@
+on:
+  workflow_dispatch:
+    inputs:
+      source-run-id:
+        description: run id of the workflow that generated the artifact
+        required: true
+        type: string
+      source-artifact-id:
+        description: source tarball built during build-dist
+        required: true
+        type: string
+
+name: Snap
+
+jobs:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          [namespace-profile-ghostty-snap, namespace-profile-ghostty-snap-arm64]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 45
+    env:
+      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
+      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
+    steps:
+      - name: Download Source Tarball Artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          run-id: ${{ inputs.source-run-id }}
+          artifact-ids: ${{ inputs.source-artifact-id }}
+          github-token: ${{ github.token }}
+
+      - name: Extract tarball
+        run: |
+          mkdir dist
+          tar --verbose --extract --strip-components 1 --directory dist --file ghostty-source.tar.gz
+
+      - name: Setup Cache
+        uses: namespacelabs/nscloud-cache-action@58bf6e08898e88803c098e2b522668541cd3b2e3 # v1.6.0
+        with:
+          path: |
+            /nix
+            /zig
+
+      - run: sudo apt install -y udev
+
+      - run: sudo systemctl start systemd-udevd
+
+      # Workaround until this is fixed: https://github.com/canonical/lxd-pkg-snap/pull/789
+      - run: |
+          _LXD_SNAP_DEVCGROUP_CONFIG="/var/lib/snapd/cgroup/snap.lxd.device"
+          sudo mkdir -p /var/lib/snapd/cgroup
+          echo 'self-managed=true' | sudo tee  "${_LXD_SNAP_DEVCGROUP_CONFIG}"
+
+      - uses: snapcore/action-build@3bdaa03e1ba6bf59a65f84a751d943d549a54e79 # v1.3.0
+        with:
+          path: dist

.github/workflows/update-colorschemes.yml

@@ -0,0 +1,96 @@
+name: Update iTerm2 colorschemes
+on:
+  schedule:
+    # Once a week
+    - cron: "0 0 * * 0"
+  workflow_dispatch:
+jobs:
+  update-iterm2-schemes:
+    if: github.repository == 'ghostty-org/ghostty'
+    runs-on: namespace-profile-ghostty-sm
+    permissions:
+      # Needed for create-pull-request action
+      contents: write
+      pull-requests: write
+    env:
+      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
+      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+
+      - name: Setup Cache
+        uses: namespacelabs/nscloud-cache-action@58bf6e08898e88803c098e2b522668541cd3b2e3 # v1.6.0
+        with:
+          path: |
+            /nix
+            /zig
+
+      - name: Setup Nix
+        uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
+        with:
+          name: ghostty
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+
+      - name: Download colorschemes
+        id: download
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # Get the latest release from iTerm2-Color-Schemes
+          RELEASE_INFO=$(gh api repos/mbadolato/iTerm2-Color-Schemes/releases/latest)
+          TAG_NAME=$(echo "$RELEASE_INFO" | jq -r '.tag_name')
+          FILENAME="ghostty-themes-${TAG_NAME}.tgz"
+          mkdir -p upload
+          curl -L -o "upload/${FILENAME}" "https://github.com/mbadolato/iTerm2-Color-Schemes/releases/download/${TAG_NAME}/ghostty-themes.tgz"
+          echo "tag_name=$TAG_NAME" >> $GITHUB_OUTPUT
+          echo "filename=$FILENAME" >> $GITHUB_OUTPUT
+
+      - name: Upload to R2
+        uses: ryand56/r2-upload-action@b801a390acbdeb034c5e684ff5e1361c06639e7c # v1.4
+        with:
+          r2-account-id: ${{ secrets.CF_R2_DEPS_ACCOUNT_ID }}
+          r2-access-key-id: ${{ secrets.CF_R2_DEPS_AWS_KEY }}
+          r2-secret-access-key: ${{ secrets.CF_R2_DEPS_SECRET_KEY }}
+          r2-bucket: ghostty-deps
+          source-dir: upload
+          destination-dir: ./
+
+      - name: Run zig fetch
+        run: |
+          nix develop -c zig fetch --save="iterm2_themes" "https://deps.files.ghostty.org/${{ steps.download.outputs.filename }}"
+
+      - name: Update zig cache hash
+        run: |
+          # Only proceed if build.zig.zon has changed
+          if ! git diff --exit-code build.zig.zon; then
+            nix develop -c ./nix/build-support/check-zig-cache.sh --update
+            nix develop -c ./nix/build-support/check-zig-cache.sh
+          fi
+
+      # Verify the build still works. We choose an arbitrary build type
+      # as a canary instead of testing all build types.
+      - name: Test Build
+        run: nix build .#ghostty
+
+      - name: Create pull request
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          title: Update iTerm2 colorschemes
+          base: main
+          branch: iterm2_colors_action
+          commit-message: "deps: Update iTerm2 color schemes"
+          add-paths: |
+            build.zig.zon
+            build.zig.zon.nix
+            build.zig.zon.txt
+            build.zig.zon.json
+            flatpak/zig-packages.json
+          body: |
+            Upstream release: https://github.com/mbadolato/iTerm2-Color-Schemes/releases/tag/${{ steps.download.outputs.tag_name }}
+          labels: dependencies

.github/workflows/vouch-check-issue.yml

@@ -0,0 +1,28 @@
+on:
+  issues:
+    types: [opened, reopened]
+
+name: "Vouch - Check Issue"
+
+jobs:
+  check:
+    runs-on: namespace-profile-ghostty-xsm
+    steps:
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        id: app-token
+        with:
+          app-id: ${{ secrets.VOUCH_APP_ID }}
+          private-key: ${{ secrets.VOUCH_APP_PRIVATE_KEY }}
+
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          sparse-checkout: .github/issue-unvouched-message
+
+      - uses: mitchellh/vouch/action/check-issue@baeb3bf7c7e6c12d6e33bab3870b7e936580a934 # unreleased main
+        with:
+          issue-number: ${{ github.event.issue.number }}
+          auto-close: true
+          auto-lock: true
+          template-file: .github/issue-unvouched-message
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}

.github/workflows/vouch-check-pr.yml

@@ -0,0 +1,22 @@
+on:
+  pull_request_target:
+    types: [opened, reopened]
+
+name: "Vouch - Check PR"
+
+jobs:
+  check:
+    runs-on: namespace-profile-ghostty-xsm
+    steps:
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        id: app-token
+        with:
+          app-id: ${{ secrets.VOUCH_APP_ID }}
+          private-key: ${{ secrets.VOUCH_APP_PRIVATE_KEY }}
+
+      - uses: mitchellh/vouch/action/check-pr@c6d80ead49839655b61b422700b7a3bc9d0804a9 # v1.4.2
+        with:
+          pr-number: ${{ github.event.pull_request.number }}
+          auto-close: true
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}

.github/workflows/vouch-manage-by-discussion.yml

@@ -0,0 +1,35 @@
+on:
+  discussion_comment:
+    types: [created]
+
+name: "Vouch - Manage by Discussion"
+
+concurrency:
+  group: vouch-manage
+  cancel-in-progress: false
+
+jobs:
+  manage:
+    runs-on: namespace-profile-ghostty-xsm
+    steps:
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        id: app-token
+        with:
+          app-id: ${{ secrets.VOUCH_APP_ID }}
+          private-key: ${{ secrets.VOUCH_APP_PRIVATE_KEY }}
+
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+
+      - uses: mitchellh/vouch/action/manage-by-discussion@c6d80ead49839655b61b422700b7a3bc9d0804a9 # v1.4.2
+        with:
+          discussion-number: ${{ github.event.discussion.number }}
+          comment-node-id: ${{ github.event.comment.node_id }}
+          vouch-keyword: "!vouch"
+          denounce-keyword: "!denounce"
+          unvouch-keyword: "!unvouch"
+          pull-request: "true"
+          merge-immediately: "true"
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}

.github/workflows/vouch-manage-by-issue.yml

@@ -0,0 +1,36 @@
+on:
+  issue_comment:
+    types: [created]
+
+name: "Vouch - Manage by Issue"
+
+concurrency:
+  group: vouch-manage
+  cancel-in-progress: false
+
+jobs:
+  manage:
+    runs-on: namespace-profile-ghostty-xsm
+    steps:
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        id: app-token
+        with:
+          app-id: ${{ secrets.VOUCH_APP_ID }}
+          private-key: ${{ secrets.VOUCH_APP_PRIVATE_KEY }}
+
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+
+      - uses: mitchellh/vouch/action/manage-by-issue@c6d80ead49839655b61b422700b7a3bc9d0804a9 # v1.4.2
+        with:
+          repo: ${{ github.repository }}
+          issue-id: ${{ github.event.issue.number }}
+          comment-id: ${{ github.event.comment.id }}
+          vouch-keyword: "!vouch"
+          denounce-keyword: "!denounce"
+          unvouch-keyword: "!unvouch"
+          pull-request: "true"
+          merge-immediately: "true"
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}

.github/workflows/vouch-sync-codeowners.yml

@@ -0,0 +1,32 @@
+on:
+  schedule:
+    - cron: "0 0 * * 1" # Every Monday at midnight UTC
+  workflow_dispatch:
+
+name: "Vouch - Sync CODEOWNERS"
+
+concurrency:
+  group: vouch-manage
+  cancel-in-progress: false
+
+jobs:
+  sync:
+    runs-on: namespace-profile-ghostty-xsm
+    steps:
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        id: app-token
+        with:
+          app-id: ${{ secrets.VOUCH_APP_ID }}
+          private-key: ${{ secrets.VOUCH_APP_PRIVATE_KEY }}
+
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+
+      - uses: mitchellh/vouch/action/sync-codeowners@c6d80ead49839655b61b422700b7a3bc9d0804a9 # v1.4.2
+        with:
+          repo: ${{ github.repository }}
+          pull-request: "true"
+          merge-immediately: "true"
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}