chore: import upstream snapshot with attribution

.github/workflows/automated-tests.yaml

@@ -0,0 +1,72 @@
+# This workflow will do a clean install of node dependencies, build the source code and run tests across different versions of node
+# For more information see: https://help.github.com/actions/language-and-framework-guides/using-nodejs-with-github-actions
+
+name: "Run Automated Tests"
+
+on:
+  push:
+    branches: [master, develop]
+  pull_request:
+    branches: [master, develop]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  code-style-check:
+    runs-on: ubuntu-slim
+    timeout-minutes: 15
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@v7
+      - name: "Use Node.js"
+        uses: actions/setup-node@v6
+        with:
+          node-version: lts/*
+          cache: "npm"
+      - name: "Install dependencies"
+        run: |
+          node --run install-mm:dev
+      - name: "Run linter tests"
+        run: |
+          node --run test:lint
+  test:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    strategy:
+      matrix:
+        node-version: [22.x, 24.x, 26.x]
+    steps:
+      - name: Install electron dependencies and labwc
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libnss3 libasound2t64 labwc
+      - name: "Checkout code"
+        uses: actions/checkout@v7
+      - name: "Use Node.js ${{ matrix.node-version }}"
+        uses: actions/setup-node@v6
+        with:
+          node-version: ${{ matrix.node-version }}
+          check-latest: true
+          cache: "npm"
+      - name: "Install MagicMirror²"
+        run: |
+          node --run install-mm:dev
+      - name: "Install Playwright browsers"
+        run: |
+          npx playwright install --with-deps chromium
+      - name: "Prepare environment for tests"
+        run: |
+          # Download electron binary
+          npx install-electron
+          # Start labwc
+          WLR_BACKENDS=headless WLR_LIBINPUT_NO_DEVICES=1 WLR_RENDERER=pixman labwc &
+          touch config/custom.css
+      - name: "Run tests"
+        run: |
+          export WAYLAND_DISPLAY=wayland-0
+          node --run test

.github/workflows/codeql.yaml

@@ -0,0 +1,37 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [develop, master]
+  pull_request:
+    branches: [develop]
+  schedule:
+    - cron: "0 4 * * 1"
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [actions, javascript-typescript]
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          queries: security-and-quality
+
+      - uses: github/codeql-action/autobuild@v4
+
+      - uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/dep-review.yaml

@@ -0,0 +1,18 @@
+# This workflow scans your pull requests for dependency changes, and will raise an error if any vulnerabilities or invalid licenses are being introduced.
+# For more information see: https://github.com/actions/dependency-review-action
+
+name: "Review Dependencies"
+
+on: [pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-slim
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@v7
+      - name: "Dependency Review"
+        uses: actions/dependency-review-action@v5

.github/workflows/electron-rebuild.yaml

@@ -0,0 +1,31 @@
+name: "Electron Rebuild Testing"
+
+permissions:
+  contents: read
+
+on: [pull_request]
+
+jobs:
+  rebuild:
+    name: Run electron-rebuild
+    runs-on: ubuntu-slim
+    strategy:
+      matrix:
+        node-version: [22.x, 24.x, 26.x]
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+      - name: "Use Node.js ${{ matrix.node-version }}"
+        uses: actions/setup-node@v6
+        with:
+          node-version: ${{ matrix.node-version }}
+          check-latest: true
+      - name: Install MagicMirror
+        run: node --run install-mm
+      - name: Install @electron/rebuild
+        run: npm install @electron/rebuild
+      - name: Install test library (serialport) to be rebuilt
+        run: npm install serialport
+      - name: Run electron-rebuild
+        run: npx electron-rebuild
+        continue-on-error: false

.github/workflows/enforce-pullrequest-rules.yaml

@@ -0,0 +1,29 @@
+# This workflow enforces on every pull request that the PR is not based against master,
+# taken from https://github.com/oppia/oppia-android/blob/develop/.github/workflows/static_checks.yml
+
+name: "Enforce Pull-Request Rules"
+
+permissions:
+  contents: read
+
+on:
+  pull_request:
+  push:
+    branches-ignore:
+      - develop
+      - master
+
+jobs:
+  check:
+    runs-on: ubuntu-slim
+    if: github.event_name == 'pull_request'
+    timeout-minutes: 10
+    steps:
+      - name: "Branch is not based on develop"
+        if: ${{ github.base_ref != 'develop' && !contains(github.event.pull_request.labels.*.name, 'mastermerge') }}
+        run: |
+          echo "Current base branch: $BASE_BRANCH"
+          echo "Note: PRs should only ever be merged into develop so please rebase your branch on develop and try again."
+          exit 1
+        env:
+          BASE_BRANCH: ${{ github.base_ref }}

.github/workflows/release-notes.yaml

@@ -0,0 +1,33 @@
+# This workflow writes a draft release on GitHub named `unreleased` after every push on develop
+
+name: "Create Release Notes"
+
+on:
+  push:
+    branches: [develop]
+
+permissions:
+  contents: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  release-notes:
+    runs-on: ubuntu-slim
+    timeout-minutes: 15
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: "0"
+      - name: "Use Node.js"
+        uses: actions/setup-node@v6
+        with:
+          node-version: lts/*
+          cache: "npm"
+      - name: "Create Markdown content"
+        run: |
+          export GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
+          node js/releasenotes.js

.github/workflows/spellcheck.yaml

@@ -0,0 +1,31 @@
+# This workflow will run a spellcheck on the codebase.
+# It runs a few days before each release. At 00:00 on day-of-month 27 in March, June, September, and December.
+
+name: Run Spellcheck
+
+on:
+  schedule:
+    - cron: "0 0 27 3,6,9,12 *"
+
+permissions:
+  contents: read
+
+jobs:
+  spellcheck:
+    runs-on: ubuntu-slim
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+        with:
+          ref: develop
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: lts/*
+          check-latest: true
+          cache: "npm"
+      - name: Install dependencies
+        run: |
+          node --run install-mm:dev
+      - name: Run Spellcheck
+        run: node --run test:spelling

.github/workflows/stale.yaml

@@ -0,0 +1,22 @@
+name: "Close stale issues and PRs"
+
+on:
+  workflow_dispatch: # needed for manually running this workflow
+  schedule:
+    - cron: "30 1 * * 6" # every Saturday at 1:30
+
+permissions:
+  issues: write
+
+jobs:
+  stale:
+    runs-on: ubuntu-slim
+    steps:
+      - uses: actions/stale@v10
+        with:
+          stale-issue-message: "This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions."
+          days-before-issue-stale: 60
+          days-before-issue-close: 7
+          operations-per-run: 100
+          stale-issue-label: "wontfix"
+          exempt-issue-labels: "pinned,security,under investigation,pr welcome,ready (coming with next release)"