Merge remote-tracking branch 'origin/develop' into pr-7444-finish

.dialyzer_ignore.exs

@@ -2,5 +2,8 @@
 {"lib/cachex.ex", "Unknown type: Spec.cache/0."},
 {"lib/pleroma/web/plugs/rate_limiter.ex", "The pattern can never match the type {:commit, _} | {:ignore, _}."},
 {"lib/pleroma/web/plugs/rate_limiter.ex", "Function get_scale/2 will never be called."},
-{"lib/pleroma/web/plugs/rate_limiter.ex", "Function initialize_buckets!/1 will never be called."}
+{"lib/pleroma/web/plugs/rate_limiter.ex", "Function initialize_buckets!/1 will never be called."},
+{"lib/pleroma/workers/receiver_worker.ex", :call},
+{"lib/pleroma/workers/receiver_worker.ex", :pattern_match},
+{"lib/pleroma/workers/receiver_worker.ex", :pattern_match_cov},
 ]

.forgejo/issue_template/bug.yaml

@@ -0,0 +1,25 @@
+name: 'Bug report'
+about: 'Report a bug in Pleroma'
+body:
+- type: markdown
+  attributes:
+    value: |
+      ### Precheck
+
+      * For support use https://git.pleroma.social/pleroma/pleroma-support or [community channels](https://git.pleroma.social/pleroma/pleroma#community-channels).
+      * Please do a quick search to ensure no similar bug has been reported before. If the bug has not been addressed after 2 weeks, it's fine to bump it.
+      * Try to ensure that the bug is actually related to the Pleroma backend. For example, if a bug happens in Pleroma-FE but not in Mastodon-FE or mobile clients, it's likely that the bug should be filed in [Pleroma-FE](https://git.pleroma.social/pleroma/pleroma-fe/issues/new) repository.
+- type: textarea
+  id: environment
+  attributes:
+    label: Environment
+    value: |
+      * Installation type (OTP or From Source):
+      * Pleroma version (could be found in the "Version" tab of settings in Pleroma-FE): 
+      * Elixir version (`elixir -v` for from source installations, N/A for OTP):
+      * Operating system:
+      * PostgreSQL version (`psql -V`):
+- type: textarea
+  id: bug-description
+  attributes:
+    label: Bug description

.forgejo/pull_request_template.md

@@ -0,0 +1,13 @@
+### Checklist
+
+- [ ] Adding a changelog: In the `changelog.d` directory, create a file named `<code>.<type>`.
+
+<!--
+  `<code>` can be anything, but we recommend using a more or less unique identifier to avoid collisions, such as the branch name.
+
+  `<type>` can be `add`, `change`, `remove`, `fix`, `security` or `skip`. `skip` is only used if there is no user-visible change in the PR (for example, only editing comments in the code). Otherwise, choose a type that corresponds to your change.
+
+  In the file, write the changelog entry. For example, if a PR adds group functionality, we can create a file named `group.add` and write `Add group functionality` in it.
+
+  If one changelog entry is not enough, you may add more. But that might mean you can split it into two PRs. Only use more than one changelog entry if you really need to (for example, when one change in the code fix two different bugs, or when refactoring).
+-->

.gitignore

@@ -6,7 +6,7 @@
 /test/instance
 /test/uploads
 /.elixir_ls
-/test/fixtures/DSCN0010_tmp.jpg
+/test/fixtures/DSCN0010_tmp*
 /test/fixtures/test_tmp.txt
 /test/fixtures/image_tmp.jpg
 /test/tmp/
@@ -56,7 +56,16 @@ pleroma.iml
 # asdf
 .tool-versions
 
+# mise
+mise.toml
+
 # Editor temp files
 *~
 *#
 *.swp
+
+archive-*
+.gitlab-ci-local
+
+# Test files should be named *.exs
+test/pleroma/**/*.ex

.gitlab-ci.yml

@@ -1,26 +1,32 @@
-image: git.pleroma.social:5050/pleroma/pleroma/ci-base:elixir-1.13.4-otp-24
+image: git.pleroma.social:5050/pleroma/pleroma/ci-base:elixir-1.15.8-otp-26
 
 variables: &global_variables
   # Only used for the release
-  ELIXIR_VER: 1.13.4
+  ELIXIR_VER: 1.17.3
   POSTGRES_DB: pleroma_test
   POSTGRES_USER: postgres
   POSTGRES_PASSWORD: postgres
   DB_HOST: postgres
   DB_PORT: "5432"
   MIX_ENV: test
+  GIT_STRATEGY: fetch
 
 workflow:
   rules:
     - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    - if: $CI_COMMIT_BRANCH == "develop"
+    - if: $CI_COMMIT_BRANCH == "stable"
+    - if: $CI_PIPELINE_SOURCE == "web"
+    - if: $CI_COMMIT_TAG
     - if: $CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS
       when: never
-    - if: $CI_COMMIT_BRANCH
+
+# Default artifacts configuration
+.default_artifacts: &default_artifacts
+  expire_in: 30 days
 
 cache: &global_cache_policy
-  key:
+  key: $CI_JOB_IMAGE-$CI_COMMIT_SHORT_SHA
-    files:
-      - mix.lock
   paths:
     - deps
     - _build
@@ -56,6 +62,7 @@ check-changelog:
   before_script: ''
   after_script: ''
   cache: {}
+  artifacts: *default_artifacts
   script:
     - apk add git
     - sh ./tools/check-changelog
@@ -71,8 +78,9 @@ check-changelog:
 .using-ci-base:
   tags:
     - amd64
+  artifacts: *default_artifacts
 
-build-1.13.4:
+build-1.15.8-otp-26:
   extends:
   - .build_changes_policy
   - .using-ci-base
@@ -80,13 +88,12 @@ build-1.13.4:
   script:
   - mix compile --force
 
-build-1.15.7-otp-25:
+build-1.18.3-otp-27:
   extends:
   - .build_changes_policy
   - .using-ci-base
   stage: build
-  image: git.pleroma.social:5050/pleroma/pleroma/ci-base:elixir-1.15-otp25
+  image: git.pleroma.social:5050/pleroma/pleroma/ci-base:elixir-1.18.3-otp-27
-  allow_failure: true
   script:
   - mix compile --force
 
@@ -102,8 +109,12 @@ spec-build:
   artifacts:
     paths:
     - spec.json
+    reports:
+      dotenv: build.env
+    expire_in: 42 years
   script:
   - mix pleroma.openapi_spec spec.json
+  - echo "SPEC_BUILD_JOB_ID=$CI_JOB_ID" >> build.env
 
 benchmark:
   extends:
@@ -121,7 +132,7 @@ benchmark:
     - mix ecto.migrate
     - mix pleroma.load_testing
 
-unit-testing-1.12.3:
+unit-testing-1.15.8-otp-26:
   extends:
   - .build_changes_policy
   - .using-ci-base
@@ -133,45 +144,48 @@ unit-testing-1.12.3:
   - name: postgres:13-alpine
     alias: postgres
     command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
+  before_script: &testing_before_script
+    - echo $MIX_ENV
+    - rm -rf _build/*/lib/pleroma
+    # Create a non-root user for running tests
+    - useradd -m -s /bin/bash testuser
+    # Install dependencies as root first
+    - mix deps.get
+    # Set proper ownership for everything
+    - chown -R testuser:testuser .
+    - chown -R testuser:testuser /root/.mix || true
+    - chown -R testuser:testuser /root/.hex || true
+    # Create user-specific directories
+    - su testuser -c "HOME=/home/testuser mix local.hex --force"
+    - su testuser -c "HOME=/home/testuser mix local.rebar --force"
   script: &testing_script
-    - mix ecto.create
+    # Run tests as non-root user
-    - mix ecto.migrate
+    - su testuser -c "HOME=/home/testuser mix ecto.create"
-    - mix test --cover --preload-modules
+    - su testuser -c "HOME=/home/testuser mix ecto.migrate"
+    - su testuser -c "HOME=/home/testuser mix pleroma.test_runner --cover --preload-modules"
   coverage: '/^Line total: ([^ ]*%)$/'
   artifacts:
+    expire_in: 30 days
     reports:
       coverage_report:
         coverage_format: cobertura
         path: coverage.xml
 
-unit-testing-1.15.7-otp-25:
+unit-testing-1.18.3-otp-27:
   extends:
   - .build_changes_policy
   - .using-ci-base
   stage: test
-  image: git.pleroma.social:5050/pleroma/pleroma/ci-base:elixir-1.15-otp25
+  image: git.pleroma.social:5050/pleroma/pleroma/ci-base:elixir-1.18.3-otp-27
-  allow_failure: true
   cache: *testing_cache_policy
   services: *testing_services
+  before_script: *testing_before_script
   script: *testing_script
 
-unit-testing-1.12-erratic:
+formatting-1.15:
-  extends:
-  - .build_changes_policy
-  - .using-ci-base
-  stage: test
-  retry: 2
-  allow_failure: true
-  cache: *testing_cache_policy
-  services: *testing_services
-  script:
-    - mix ecto.create
-    - mix ecto.migrate
-    - mix test --only=erratic
-
-formatting-1.13:
   extends: .build_changes_policy
-  image: &formatting_elixir elixir:1.13-alpine
+  artifacts: *default_artifacts
+  image: &formatting_elixir elixir:1.15-alpine
   stage: lint
   cache: *testing_cache_policy
   before_script: &current_bfr_script
@@ -183,8 +197,9 @@ formatting-1.13:
   script:
     - mix format --check-formatted
 
-cycles-1.13:
+cycles-1.15:
   extends: .build_changes_policy
+  artifacts: *default_artifacts
   image: *formatting_elixir
   stage: lint
   cache: {}
@@ -208,7 +223,7 @@ dialyzer:
   - .using-ci-base
   stage: lint
   allow_failure: true
-  when: manual 
+  when: manual
   cache: *testing_cache_policy
   tags:
     - feld
@@ -217,15 +232,14 @@ dialyzer:
 
 docs-deploy:
   stage: deploy
-  cache: *testing_cache_policy
+  trigger:
-  image: alpine:latest
+    project: pleroma/docs
+    branch: master
+    strategy: depend
   only:
   - stable@pleroma/pleroma
   - develop@pleroma/pleroma
-  before_script:
+
-  - apk add curl
-  script:
-  - curl --fail-with-body -X POST -F"token=$CI_JOB_TOKEN" -F'ref=master' -F"variables[BRANCH]=$CI_COMMIT_REF_NAME" https://git.pleroma.social/api/v4/projects/673/trigger/pipeline
 review_app:
   image: alpine:3.9
   stage: deploy
@@ -241,6 +255,7 @@ review_app:
   except:
     - master
     - develop
+  artifacts: *default_artifacts
   script:
     - echo "$CI_ENVIRONMENT_SLUG"
     - mkdir -p ~/.ssh
@@ -257,21 +272,19 @@ review_app:
 
 spec-deploy:
   stage: deploy
-  artifacts:
+  trigger:
-    paths:
+    project: pleroma/api-docs
-    - spec.json
+    branch: master
+    strategy: depend
   only:
     - develop@pleroma/pleroma
-  image: alpine:latest
+  variables:
-  before_script:
+    SPEC_BUILD_JOB_ID: $SPEC_BUILD_JOB_ID
-    - apk add curl
-  script:
-    - curl --fail-with-body -X POST -F"token=$CI_JOB_TOKEN" -F'ref=master' -F"variables[BRANCH]=$CI_COMMIT_REF_NAME" -F"variables[JOB_REF]=$CI_JOB_ID" https://git.pleroma.social/api/v4/projects/1130/trigger/pipeline
-
 
 stop_review_app:
   image: alpine:3.9
   stage: deploy
+  artifacts: *default_artifacts
   before_script:
     - apk update && apk add openssh-client git
   when: manual
@@ -289,7 +302,8 @@ stop_review_app:
 
 amd64:
   stage: release
-  image: elixir:$ELIXIR_VER
+  image: 
+    name: hexpm/elixir-amd64:1.17.3-erlang-27.3.4.2-ubuntu-noble-20250716
   only: &release-only
   - stable@pleroma/pleroma
   - develop@pleroma/pleroma
@@ -314,8 +328,9 @@ amd64:
   variables: &release-variables
     MIX_ENV: prod
     VIX_COMPILATION_MODE: PLATFORM_PROVIDED_LIBVIPS
+    DEBIAN_FRONTEND: noninteractive
   before_script: &before-release
-  - apt-get update && apt-get install -y cmake libmagic-dev libvips-dev erlang-dev
+  - apt-get update && apt-get install -y cmake libmagic-dev libvips-dev erlang-dev git build-essential
   - echo "import Config" > config/prod.secret.exs
   - mix local.hex --force
   - mix local.rebar --force
@@ -330,7 +345,8 @@ amd64-musl:
   stage: release
   artifacts: *release-artifacts
   only: *release-only
-  image: elixir:$ELIXIR_VER-alpine
+  image: 
+    name: hexpm/elixir-amd64:1.17.3-erlang-27.3.4.2-alpine-3.22.1
   tags:
     - amd64
   cache: *release-cache
@@ -344,6 +360,7 @@ amd64-musl:
 
 arm:
   stage: release
+  allow_failure: true
   artifacts: *release-artifacts
   only: *release-only
   tags:
@@ -372,7 +389,8 @@ arm64:
   only: *release-only
   tags:
     - arm
-  image: arm64v8/elixir:$ELIXIR_VER
+  image: 
+    name: hexpm/elixir-arm64:1.17.3-erlang-27.3.4.2-ubuntu-noble-20250716
   cache: *release-cache
   variables: *release-variables
   before_script: *before-release
@@ -384,7 +402,8 @@ arm64-musl:
   only: *release-only
   tags:
     - arm
-  image: arm64v8/elixir:$ELIXIR_VER-alpine
+  image: 
+    name: hexpm/elixir-arm64:1.17.3-erlang-27.3.4.2-alpine-3.22.1
   cache: *release-cache
   variables: *release-variables
   before_script: *before-release-musl

.woodpecker/changelog.yaml

@@ -0,0 +1,20 @@
+when:
+  - event: pull_request
+    evaluate: 'CI_COMMIT_SOURCE_BRANCH != "weblate"'
+
+labels:
+  platform: linux/amd64
+
+variables:
+  script_file_entrypoint: &script_file_entrypoint
+    - /bin/sh
+    - -c
+    - 'printf "%s" "$CI_SCRIPT" | base64 -d > /tmp/ci-script.sh && /bin/sh -xe /tmp/ci-script.sh'
+
+steps:
+  check-changelog:
+    image: docker.io/alpine:3.23
+    entrypoint: *script_file_entrypoint
+    commands:
+      - apk add --no-cache git
+      - sh ./tools/check-changelog

.woodpecker/docker-combine.yaml

@@ -0,0 +1,60 @@
+when:
+  - event: push
+    branch: ${CI_REPO_DEFAULT_BRANCH}
+    path: [ "**/*.ex", "**/*.eex", "**/*.exs", "mix.lock", ".woodpecker/**", "Dockerfile" ]
+  - event: tag
+  - event: manual
+    branch: ${CI_REPO_DEFAULT_BRANCH}
+  - event: manual
+    branch: stable
+
+depends_on:
+  - docker
+
+skip_clone: true
+
+labels:
+  platform: linux/amd64
+
+steps:
+  docker-develop-combine:
+    image: git.fluffytail.org/phnt/wpc-docker-tagger:latest
+    when:
+      - event: push
+        branch: ${CI_REPO_DEFAULT_BRANCH}
+      - event: manual
+        branch: ${CI_REPO_DEFAULT_BRANCH}
+    settings: &docker_settings
+      registry: "git.pleroma.social"
+      image: "pleroma/pleroma"
+      architectures: [amd64, arm64, armv7]
+      tags:
+        - latest
+        - develop
+        - ${CI_COMMIT_SHA:0:8}
+      username:
+        from_secret: pleroma-ci-user
+      password:
+        from_secret: pleroma-ci-password
+
+  docker-stable-combine:
+    image: git.fluffytail.org/phnt/wpc-docker-tagger:latest
+    when:
+      - evaluate: 'CI_PIPELINE_EVENT == "manual" && CI_COMMIT_BRANCH == "stable" && CI_COMMIT_TAG == ""'
+    settings:
+      <<: *docker_settings
+      tags: &stable_docker_tags
+        - latest
+        - stable
+        - ${CI_COMMIT_SHA:0:8}
+
+  docker-stable-tag-combine:
+    image: git.fluffytail.org/phnt/wpc-docker-tagger:latest
+    when:
+      - event: tag
+      - evaluate: 'CI_PIPELINE_EVENT == "manual" && CI_COMMIT_BRANCH == "stable" && CI_COMMIT_TAG != ""'
+    settings:
+      <<: *docker_settings
+      tags:
+        - <<: *stable_docker_tags
+        - ${CI_COMMIT_TAG}

.woodpecker/docker.yaml

@@ -0,0 +1,150 @@
+when:
+  - event: push
+    branch: ${CI_REPO_DEFAULT_BRANCH}
+    path: [ "**/*.ex", "**/*.eex", "**/*.exs", "mix.lock", ".woodpecker/**", "Dockerfile" ]
+  - event: tag
+  - event: manual
+    branch: ${CI_REPO_DEFAULT_BRANCH}
+  - event: manual
+    branch: stable
+
+matrix:
+  platform:
+    - linux/amd64
+    - linux/arm64
+    - linux/arm
+
+# This is needed for the when clauses below.
+labels:
+  platform: ${platform}
+  memory: 'high'
+
+variables:
+  docker_variables: &docker_variables
+    repo: pleroma/pleroma
+    registry: git.pleroma.social
+    username:
+      from_secret: pleroma-ci-user
+    password:
+      from_secret: pleroma-ci-password
+  armv7_docker_variables: &armv7_docker_variables
+    <<: *docker_variables
+    build_args:
+      - ELIXIR_IMG=docker.io/arm32v7/elixir
+      - ELIXIR_TAG=1.17.3-otp-26-alpine
+      - ALPINE_IMG=docker.io/arm32v7/alpine
+      - ALPINE_VER=3.20
+    extra_opts: --custom-platform=linux/arm/v7
+  kaniko_image: &kaniko_image docker.io/woodpeckerci/plugin-kaniko:2.3.2
+
+steps:
+  docker-develop-amd64:
+    image: *kaniko_image
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+    settings:
+      <<: *docker_variables
+      tags:
+        - latest-amd64
+        - develop-amd64
+        - ${CI_COMMIT_SHA:0:8}-amd64
+
+  docker-develop-arm64:
+    image: *kaniko_image
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+    settings:
+      <<: *docker_variables
+      tags:
+        - latest-arm64
+        - develop-arm64
+        - ${CI_COMMIT_SHA:0:8}-arm64
+
+  docker-develop-armv7:
+    image: *kaniko_image
+    when:
+      - evaluate: 'platform == "linux/arm" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+    settings:
+      <<: *armv7_docker_variables
+      tags:
+        - latest-armv7
+        - develop-armv7
+        - ${CI_COMMIT_SHA:0:8}-armv7
+
+  docker-stable-amd64:
+    image: *kaniko_image
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "manual" && CI_COMMIT_BRANCH == "stable" && CI_COMMIT_TAG == ""'
+    settings:
+      <<: *docker_variables
+      tags: &amd64_tags
+        - latest-amd64
+        - stable-amd64
+        - ${CI_COMMIT_SHA:0:8}-amd64
+
+  # FE workflow runs only on linux/amd64
+  docker-stable-e2e-amd64:
+    image: *kaniko_image
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "tag"'
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "manual" && CI_COMMIT_BRANCH == "stable"'
+    settings:
+      <<: *docker_variables
+      dockerfile: Dockerfile-e2e
+      tags:
+        - stable-e2e
+
+  docker-stable-tag-amd64:
+    image: *kaniko_image
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "tag"'
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "manual" && CI_COMMIT_BRANCH == "stable" && CI_COMMIT_TAG != ""'
+    settings:
+      <<: *docker_variables
+      tags:
+        - <<: *amd64_tags
+        - ${CI_COMMIT_TAG}-amd64
+
+  docker-stable-arm64:
+    image: *kaniko_image
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "manual" && CI_COMMIT_BRANCH == "stable" && CI_COMMIT_TAG == ""'
+    settings:
+      <<: *docker_variables
+      tags: &arm64_tags
+        - latest-arm64
+        - stable-arm64
+        - ${CI_COMMIT_SHA:0:8}-arm64
+
+  docker-stable-tag-arm64:
+    image: *kaniko_image
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "tag"'
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "manual" && CI_COMMIT_BRANCH == "stable" && CI_COMMIT_TAG != ""'
+    settings:
+      <<: *docker_variables
+      tags:
+        - <<: *arm64_tags
+        - ${CI_COMMIT_TAG}-arm64
+
+  docker-stable-armv7:
+    image: *kaniko_image
+    when:
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "manual" && CI_COMMIT_BRANCH == "stable" && CI_COMMIT_TAG == ""'
+    settings:
+      <<: *armv7_docker_variables
+      tags: &armv7_tags
+        - latest-armv7
+        - stable-armv7
+        - ${CI_COMMIT_SHA:0:8}-armv7
+
+  docker-stable-tag-armv7:
+    image: *kaniko_image
+    when:
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "tag"'
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "manual" && CI_COMMIT_BRANCH == "stable" && CI_COMMIT_TAG != ""'
+    settings:
+      <<: *armv7_docker_variables
+      tags:
+        - <<: *armv7_tags
+        - ${CI_COMMIT_TAG}-armv7

.woodpecker/lint.yaml

@@ -0,0 +1,78 @@
+when:
+  - event: pull_request
+    path: [ "**/*.ex", "**/*.eex", "**/*.exs", "mix.lock", ".woodpecker/**" ]
+    evaluate: 'CI_COMMIT_SOURCE_BRANCH != "weblate"'
+  - event: push
+    branch: ${CI_REPO_DEFAULT_BRANCH}
+    path: [ "**/*.ex", "**/*.eex", "**/*.exs", "mix.lock", ".woodpecker/**" ]
+
+labels:
+  platform: linux/amd64
+
+variables:
+  script_file_entrypoint: &script_file_entrypoint
+    - /bin/sh
+    - -c
+    - 'printf "%s" "$CI_SCRIPT" | base64 -d > /tmp/ci-script.sh && /bin/sh -xe /tmp/ci-script.sh'
+
+steps:
+  mix-format:
+    image: &elixir-image
+      docker.io/elixir:1.15-alpine
+    entrypoint: *script_file_entrypoint
+    failure: ignore
+    commands:
+      - |
+        if ! mix format --check-formatted; then
+          touch fail.stamp
+          exit 1
+        fi
+
+  credo:
+    image: *elixir-image
+    entrypoint: *script_file_entrypoint
+    failure: ignore
+    environment:
+      MIX_ENV: test
+    commands:
+      - apk add --no-cache build-base cmake exiftool ffmpeg file-dev git openssl
+      - adduser -D -h /home/testuser testuser
+      - mkdir -p /home/testuser/.mix /home/testuser/.hex
+      - chown -R testuser:testuser . /home/testuser
+      - su testuser -c "HOME=/home/testuser mix local.hex --force"
+      - su testuser -c "HOME=/home/testuser mix local.rebar --force"
+      - su testuser -c "HOME=/home/testuser mix deps.get"
+      - |
+        if ! su testuser -c "HOME=/home/testuser mix analyze"; then
+          touch fail.stamp
+          exit 1
+        fi
+
+  # cycles:
+  #   image: *elixir-image
+  #   failure: ignore
+  #   commands:
+  #     - apk add --no-cache build-base cmake exiftool ffmpeg file-dev git openssl
+  #     - adduser -D -h /home/testuser testuser
+  #     - mkdir -p /home/testuser/.mix /home/testuser/.hex
+  #     - chown -R testuser:testuser . /home/testuser
+  #     - su testuser -c "HOME=/home/testuser mix local.hex --force"
+  #     - su testuser -c "HOME=/home/testuser mix local.rebar --force"
+  #     - su testuser -c "HOME=/home/testuser mix compile"
+  #     - |
+  #       if ! su testuser -c "HOME=/home/testuser mix xref graph --format cycles --label compile | awk '{print $0} END{exit ($0 != \"No cycles found\")}'"; then
+  #       touch fail.stamp
+  #       exit 1
+  #       fi
+
+  ensure-status:
+    image: *elixir-image
+    entrypoint: *script_file_entrypoint
+    commands: |
+      if test -f fail.stamp; then
+        echo "One or more previous steps fails. Failing workflow..."
+        exit 1
+      else
+        echo "All steps passed"
+        exit 0
+      fi

.woodpecker/otp-musl.yaml

@@ -0,0 +1,292 @@
+when:
+  - event: push
+    branch: ${CI_REPO_DEFAULT_BRANCH}
+    path: [ "**/*.ex", "**/*.eex", "**/*.exs", "mix.lock", ".woodpecker/**" ]
+  - event: tag
+  - event: manual
+    branch: ${CI_REPO_DEFAULT_BRANCH}
+  - event: manual
+    branch: stable
+
+matrix:
+  platform:
+    - linux/amd64
+    - linux/arm
+    - linux/arm64
+
+# This is needed for the when clauses below.
+# When the platform clause is fixed, this might not be needed anymore
+labels:
+  platform: ${platform}
+
+variables:
+  script_file_entrypoint: &script_file_entrypoint
+    - /bin/sh
+    - -c
+    - 'printf "%s" "$CI_SCRIPT" | base64 -d > /tmp/ci-script.sh && /bin/sh -xe /tmp/ci-script.sh'
+  build_cmds: &build_cmds
+    - apk add git build-base cmake file-dev openssl vips-dev zip
+    - echo "import Config" > config/prod.secret.exs
+    - mix local.hex --force
+    - mix local.rebar --force
+    - mix deps.get --only prod
+    - mkdir release
+    - export PLEROMA_BUILD_BRANCH=${CI_COMMIT_BRANCH}
+    - mix release --path release
+  build_image_amd64: &build_image_amd64 docker.io/hexpm/elixir-amd64:1.17.3-erlang-27.3.4.2-alpine-3.22.1
+  build_image_arm: &build_image_arm docker.io/arm32v7/elixir:1.17.3-alpine
+  build_image_arm64: &build_image_arm64 docker.io/hexpm/elixir-arm64:1.17.3-erlang-27.3.4.2-alpine-3.22.1
+  artifacts_uploader_image: &artifacts_uploader_image docker.io/woodpeckercommunity/plugin-gitea-package:0.5.0
+  artifacts_uploader_settings: &artifacts_uploader_settings
+    user:
+      from_secret: pleroma-ci-user
+    password:
+      from_secret: pleroma-ci-password
+    owner: 'pleroma'
+  env: &env
+    MIX_ENV: prod
+    VIX_COMPILATION_MODE: PLATFORM_PROVIDED_LIBVIPS
+
+steps:
+  otp-develop-amd64-musl:
+    image: *build_image_amd64
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+    environment: *env
+    commands: &amd64_build
+      - <<: *build_cmds
+      - zip -9rq ${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-amd64-musl.zip release
+
+  otp-stable-amd64-musl:
+    image: *build_image_amd64
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "manual" && CI_COMMIT_BRANCH == "stable"'
+    environment: *env
+    commands: *amd64_build
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  otp-stable-tag-amd64-musl:
+    image: *build_image_amd64
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "tag"'
+    environment: *env
+    commands:
+      - <<: *build_cmds
+      - zip -9rq stable-${CI_COMMIT_SHA:0:8}-amd64-musl.zip release
+
+  otp-develop-arm-musl:
+    image: *build_image_arm
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/arm" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+    environment: *env
+    commands: &arm_build
+      - <<: *build_cmds
+      - zip -9rq ${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm-musl.zip release
+
+  otp-stable-arm-musl:
+    image: *build_image_arm
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "manual" && CI_COMMIT_BRANCH == "stable"'
+    environment: *env
+    commands: *arm_build
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  otp-stable-tag-arm-musl:
+    image: *build_image_arm
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "tag"'
+    environment: *env
+    commands:
+      - <<: *build_cmds
+      - zip -9rq stable-${CI_COMMIT_SHA:0:8}-arm-musl.zip release
+
+  otp-develop-arm64-musl:
+    image: *build_image_arm64
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+    environment: *env
+    commands: &arm64_build
+      - <<: *build_cmds
+      - zip -9rq ${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm64-musl.zip release
+
+  otp-stable-arm64-musl:
+    image: *build_image_arm64
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "manual" && CI_COMMIT_BRANCH == "stable"'
+    environment: *env
+    commands: *arm64_build
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  otp-stable-tag-arm64-musl:
+    image: *build_image_arm64
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "tag"'
+    environment: *env
+    commands:
+      - <<: *build_cmds
+      - zip -9rq stable-${CI_COMMIT_SHA:0:8}-arm64-musl.zip release
+
+  upload-artifacts-amd64-musl:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "push" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "manual"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-${CI_COMMIT_BRANCH}-amd64-musl
+      package_version: ${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-amd64-musl
+      file_source: ./${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-amd64-musl.zip
+      file_name: pleroma-${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-amd64-musl.zip
+      update: 'true'
+
+  upload-latest-amd64-musl:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "push" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "manual"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-${CI_COMMIT_BRANCH}-amd64-musl
+      package_version: latest
+      file_source: ./${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-amd64-musl.zip
+      file_name: pleroma.zip
+      update: 'true'
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  upload-artifacts-tag-amd64-musl:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "tag"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-stable-amd64-musl
+      package_version: stable-${CI_COMMIT_SHA:0:8}-amd64-musl
+      file_source: ./stable-${CI_COMMIT_SHA:0:8}-amd64-musl.zip
+      file_name: pleroma-stable-${CI_COMMIT_SHA:0:8}-amd64-musl.zip
+      update: 'true'
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  upload-latest-tag-amd64-musl:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "tag"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-stable-amd64-musl
+      package_version: latest
+      file_source: ./stable-${CI_COMMIT_SHA:0:8}-amd64-musl.zip
+      file_name: pleroma.zip
+      update: 'true'
+
+  upload-artifacts-arm-musl:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "push" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "manual"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-${CI_COMMIT_BRANCH}-arm-musl
+      package_version: ${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm-musl
+      file_source: ./${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm-musl.zip
+      file_name: pleroma-${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm-musl.zip
+      update: 'true'
+
+  upload-latest-arm-musl:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "push" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "manual"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-${CI_COMMIT_BRANCH}-arm-musl
+      package_version: latest
+      file_source: ./${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm-musl.zip
+      file_name: pleroma.zip
+      update: 'true'
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  upload-artifacts-tag-arm-musl:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "tag"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-stable-arm-musl
+      package_version: stable-${CI_COMMIT_SHA:0:8}-arm-musl
+      file_source: ./stable-${CI_COMMIT_SHA:0:8}-arm-musl.zip
+      file_name: pleroma-stable-${CI_COMMIT_SHA:0:8}-arm-musl.zip
+      update: 'true'
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  upload-latest-tag-arm-musl:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "tag"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-stable-arm-musl
+      package_version: latest
+      file_source: ./stable-${CI_COMMIT_SHA:0:8}-arm-musl.zip
+      file_name: pleroma.zip
+      update: 'true'
+
+  upload-artifacts-arm64-musl:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "push" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "manual"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-${CI_COMMIT_BRANCH}-arm64-musl
+      package_version: ${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm64-musl
+      file_source: ./${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm64-musl.zip
+      file_name: pleroma-${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm64-musl.zip
+      update: 'true'
+
+  upload-latest-arm64-musl:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "push" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "manual"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-${CI_COMMIT_BRANCH}-arm64-musl
+      package_version: latest
+      file_source: ./${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm64-musl.zip
+      file_name: pleroma.zip
+      update: 'true'
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  upload-artifacts-tag-arm64-musl:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "tag"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-stable-arm64-musl
+      package_version: stable-${CI_COMMIT_SHA:0:8}-arm64-musl
+      file_source: ./stable-${CI_COMMIT_SHA:0:8}-arm64-musl.zip
+      file_name: pleroma-stable-${CI_COMMIT_SHA:0:8}-arm64-musl.zip
+      update: 'true'
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  upload-latest-tag-arm64-musl:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "tag"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-stable-arm64-musl
+      package_version: latest
+      file_source: ./stable-${CI_COMMIT_SHA:0:8}-arm64-musl.zip
+      file_name: pleroma.zip
+      update: 'true'

.woodpecker/otp.yaml

@@ -0,0 +1,293 @@
+when:
+  - event: push
+    branch: ${CI_REPO_DEFAULT_BRANCH}
+    path: [ "**/*.ex", "**/*.eex", "**/*.exs", "mix.lock", ".woodpecker/**" ]
+  - event: tag
+  - event: manual
+    branch: ${CI_REPO_DEFAULT_BRANCH}
+  - event: manual
+    branch: stable
+
+matrix:
+  platform:
+    - linux/amd64
+    - linux/arm
+    - linux/arm64
+
+# This is needed for the when clauses below.
+# When the platform clause is fixed, this might not be needed anymore
+labels:
+  platform: ${platform}
+
+variables:
+  script_file_entrypoint: &script_file_entrypoint
+    - /bin/sh
+    - -c
+    - 'printf "%s" "$CI_SCRIPT" | base64 -d > /tmp/ci-script.sh && /bin/sh -xe /tmp/ci-script.sh'
+  build_cmds: &build_cmds
+    - apt-get update && apt-get install -y cmake libmagic-dev libvips-dev erlang-dev git build-essential zip
+    - echo "import Config" > config/prod.secret.exs
+    - mix local.hex --force
+    - mix local.rebar --force
+    - mix deps.get --only prod
+    - mkdir release
+    - export PLEROMA_BUILD_BRANCH=${CI_COMMIT_BRANCH}
+    - mix release --path release
+  build_image_amd64: &build_image_amd64 docker.io/hexpm/elixir-amd64:1.17.3-erlang-27.3.4.2-ubuntu-noble-20250716
+  build_image_arm: &build_image_arm docker.io/arm32v7/elixir:1.17.3
+  build_image_arm64: &build_image_arm64 docker.io/hexpm/elixir-arm64:1.17.3-erlang-27.3.4.2-ubuntu-noble-20250716
+  artifacts_uploader_image: &artifacts_uploader_image docker.io/woodpeckercommunity/plugin-gitea-package:0.5.0
+  artifacts_uploader_settings: &artifacts_uploader_settings
+    user:
+      from_secret: pleroma-ci-user
+    password:
+      from_secret: pleroma-ci-password
+    owner: 'pleroma'
+  env: &env
+    MIX_ENV: prod
+    VIX_COMPILATION_MODE: PLATFORM_PROVIDED_LIBVIPS
+    DEBIAN_FRONTEND: noninteractive
+
+steps:
+  otp-develop-amd64:
+    image: *build_image_amd64
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+    environment: *env
+    commands: &amd64_build
+      - <<: *build_cmds
+      - zip -9rq ${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-amd64.zip release
+
+  otp-stable-amd64:
+    image: *build_image_amd64
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "manual" && CI_COMMIT_BRANCH == "stable"'
+    environment: *env
+    commands: *amd64_build
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  otp-stable-tag-amd64:
+    image: *build_image_amd64
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "tag"'
+    environment: *env
+    commands:
+      - <<: *build_cmds
+      - zip -9rq stable-${CI_COMMIT_SHA:0:8}-amd64.zip release
+
+  otp-develop-arm:
+    image: *build_image_arm
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/arm" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+    environment: *env
+    commands: &arm_build
+      - <<: *build_cmds
+      - zip -9rq ${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm.zip release
+
+  otp-stable-arm:
+    image: *build_image_arm
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "manual" && CI_COMMIT_BRANCH == "stable"'
+    environment: *env
+    commands: *arm_build
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  otp-stable-tag-arm:
+    image: *build_image_arm
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "tag"'
+    environment: *env
+    commands:
+      - <<: *build_cmds
+      - zip -9rq stable-${CI_COMMIT_SHA:0:8}-arm.zip release
+
+  otp-develop-arm64:
+    image: *build_image_arm64
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+    environment: *env
+    commands: &arm64_build
+      - <<: *build_cmds
+      - zip -9rq ${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm64.zip release
+
+  otp-stable-arm64:
+    image: *build_image_arm64
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "manual" && CI_COMMIT_BRANCH == "stable"'
+    environment: *env
+    commands: *arm64_build
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  otp-stable-tag-arm64:
+    image: *build_image_arm64
+    entrypoint: *script_file_entrypoint
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "tag"'
+    environment: *env
+    commands:
+      - <<: *build_cmds
+      - zip -9rq stable-${CI_COMMIT_SHA:0:8}-arm64.zip release
+
+  upload-artifacts-amd64:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "push" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "manual"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-${CI_COMMIT_BRANCH}-amd64
+      package_version: ${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-amd64
+      file_source: ./${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-amd64.zip
+      file_name: pleroma-${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-amd64.zip
+      update: 'true'
+
+  upload-latest-amd64:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "push" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "manual"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-${CI_COMMIT_BRANCH}-amd64
+      package_version: latest
+      file_source: ./${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-amd64.zip
+      file_name: pleroma.zip
+      update: 'true'
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  upload-artifacts-tag-amd64:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "tag"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-stable-amd64
+      package_version: stable-${CI_COMMIT_SHA:0:8}-amd64
+      file_source: ./stable-${CI_COMMIT_SHA:0:8}-amd64.zip
+      file_name: pleroma-stable-${CI_COMMIT_SHA:0:8}-amd64.zip
+      update: 'true'
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  upload-latest-tag-amd64:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/amd64" && CI_PIPELINE_EVENT == "tag"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-stable-amd64
+      package_version: latest
+      file_source: ./stable-${CI_COMMIT_SHA:0:8}-amd64.zip
+      file_name: pleroma.zip
+      update: 'true'
+
+  upload-artifacts-arm:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "push" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "manual"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-${CI_COMMIT_BRANCH}-arm
+      package_version: ${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm
+      file_source: ./${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm.zip
+      file_name: pleroma-${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm.zip
+      update: 'true'
+
+  upload-latest-arm:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "push" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "manual"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-${CI_COMMIT_BRANCH}-arm
+      package_version: latest
+      file_source: ./${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm.zip
+      file_name: pleroma.zip
+      update: 'true'
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  upload-artifacts-tag-arm:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "tag"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-stable-arm
+      package_version: stable-${CI_COMMIT_SHA:0:8}-arm
+      file_source: ./stable-${CI_COMMIT_SHA:0:8}-arm.zip
+      file_name: pleroma-stable-${CI_COMMIT_SHA:0:8}-arm.zip
+      update: 'true'
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  upload-latest-tag-arm:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/arm" && CI_PIPELINE_EVENT == "tag"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-stable-arm
+      package_version: latest
+      file_source: ./stable-${CI_COMMIT_SHA:0:8}-arm.zip
+      file_name: pleroma.zip
+      update: 'true'
+
+  upload-artifacts-arm64:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "push" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "manual"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-${CI_COMMIT_BRANCH}-arm64
+      package_version: ${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm64
+      file_source: ./${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm64.zip
+      file_name: pleroma-${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm64.zip
+      update: 'true'
+
+  upload-latest-arm64:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "push" && CI_COMMIT_BRANCH == "${CI_REPO_DEFAULT_BRANCH}"'
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "manual"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-${CI_COMMIT_BRANCH}-arm64
+      package_version: latest
+      file_source: ./${CI_COMMIT_BRANCH}-${CI_COMMIT_SHA:0:8}-arm64.zip
+      file_name: pleroma.zip
+      update: 'true'
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  upload-artifacts-tag-arm64:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "tag"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-stable-arm64
+      package_version: stable-${CI_COMMIT_SHA:0:8}-arm64
+      file_source: ./stable-${CI_COMMIT_SHA:0:8}-arm64.zip
+      file_name: pleroma-stable-${CI_COMMIT_SHA:0:8}-arm64.zip
+      update: 'true'
+
+  # Tag events don't have CI_COMMIT_BRANCH set, hardcode stable
+  upload-latest-tag-arm64:
+    image: *artifacts_uploader_image
+    when:
+      - evaluate: 'platform == "linux/arm64" && CI_PIPELINE_EVENT == "tag"'
+    settings:
+      <<: *artifacts_uploader_settings
+      package_name: pleroma-otp-stable-arm64
+      package_version: latest
+      file_source: ./stable-${CI_COMMIT_SHA:0:8}-arm64.zip
+      file_name: pleroma.zip
+      update: 'true'

.woodpecker/unit-testing-elixir-1.15.yaml

@@ -0,0 +1,46 @@
+when:
+  - event: pull_request
+    path: [ "**/*.ex", "**/*.eex", "**/*.exs", "mix.lock", ".woodpecker/**" ]
+    evaluate: 'CI_COMMIT_SOURCE_BRANCH != "weblate"'
+  - event: push
+    branch: ${CI_REPO_DEFAULT_BRANCH}
+    path: [ "**/*.ex", "**/*.eex", "**/*.exs", "mix.lock", ".woodpecker/**" ]
+
+depends_on:
+  - lint
+
+labels:
+  platform: linux/amd64
+
+variables:
+  script_file_entrypoint: &script_file_entrypoint
+    - /bin/sh
+    - -c
+    - 'printf "%s" "$CI_SCRIPT" | base64 -d > /tmp/ci-script.sh && /bin/sh -xe /tmp/ci-script.sh'
+
+steps:
+  unit-testing-elixir-1.15:
+    image: elixir:1.15-alpine
+    entrypoint: *script_file_entrypoint
+    environment:
+      MIX_ENV: test
+      VIX_COMPILATION_MODE: PLATFORM_PROVIDED_LIBVIPS
+      DB_HOST: postgres
+      DB_PORT: 5432
+    commands:
+      - apk add --no-cache build-base cmake exiftool ffmpeg vips-dev file-dev git openssl
+      - adduser -D -h /home/testuser testuser
+      - mkdir -p /home/testuser/.mix /home/testuser/.hex
+      - chown -R testuser:testuser . /home/testuser
+      - su testuser -c "HOME=/home/testuser mix local.hex --force"
+      - su testuser -c "HOME=/home/testuser mix local.rebar --force"
+      - su testuser -c "HOME=/home/testuser mix deps.get"
+      - su testuser -c "HOME=/home/testuser mix pleroma.test_runner --preload-modules"
+
+services:
+  postgres:
+    image: postgres:13-alpine
+    environment:
+      POSTGRES_DB: pleroma_test
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: postgres

.woodpecker/unit-testing-elixir-1.19.yaml

@@ -0,0 +1,46 @@
+when:
+  - event: pull_request
+    path: [ "**/*.ex", "**/*.eex", "**/*.exs", "mix.lock", ".woodpecker/**" ]
+    evaluate: 'CI_COMMIT_SOURCE_BRANCH != "weblate"'
+  - event: push
+    branch: ${CI_REPO_DEFAULT_BRANCH}
+    path: [ "**/*.ex", "**/*.eex", "**/*.exs", "mix.lock", ".woodpecker/**" ]
+
+depends_on:
+  - lint
+
+labels:
+  platform: linux/amd64
+
+variables:
+  script_file_entrypoint: &script_file_entrypoint
+    - /bin/sh
+    - -c
+    - 'printf "%s" "$CI_SCRIPT" | base64 -d > /tmp/ci-script.sh && /bin/sh -xe /tmp/ci-script.sh'
+
+steps:
+  unit-testing-elixir-1.19:
+    image: elixir:1.19-otp-28-alpine
+    entrypoint: *script_file_entrypoint
+    environment:
+      MIX_ENV: test
+      VIX_COMPILATION_MODE: PLATFORM_PROVIDED_LIBVIPS
+      DB_HOST: postgres
+      DB_PORT: 5432
+    commands:
+      - apk add --no-cache build-base cmake exiftool ffmpeg vips-dev file-dev git openssl
+      - adduser -D -h /home/testuser testuser
+      - mkdir -p /home/testuser/.mix /home/testuser/.hex
+      - chown -R testuser:testuser . /home/testuser
+      - su testuser -c "HOME=/home/testuser mix local.hex --force"
+      - su testuser -c "HOME=/home/testuser mix local.rebar --force"
+      - su testuser -c "HOME=/home/testuser mix deps.get"
+      - su testuser -c "HOME=/home/testuser mix pleroma.test_runner --preload-modules"
+
+services:
+  postgres:
+    image: postgres:13-alpine
+    environment:
+      POSTGRES_DB: pleroma_test
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: postgres

Dockerfile

@@ -1,9 +1,12 @@
+# https://hub.docker.com/r/hexpm/elixir/tags
 ARG ELIXIR_IMG=hexpm/elixir
-ARG ELIXIR_VER=1.13.4
+ARG ELIXIR_VER=1.17.3
-ARG ERLANG_VER=24.3.4.15
+ARG ERLANG_VER=27.3.4.14
-ARG ALPINE_VER=3.17.5
+ARG ALPINE_VER=3.23.5
+ARG ELIXIR_TAG=${ELIXIR_VER}-erlang-${ERLANG_VER}-alpine-${ALPINE_VER}
+ARG ALPINE_IMG=alpine
 
-FROM ${ELIXIR_IMG}:${ELIXIR_VER}-erlang-${ERLANG_VER}-alpine-${ALPINE_VER} as build
+FROM ${ELIXIR_IMG}:${ELIXIR_TAG} AS build
 
 COPY . .
 
@@ -14,11 +17,12 @@ RUN apk add git gcc g++ musl-dev make cmake file-dev vips-dev &&\
 	echo "import Config" > config/prod.secret.exs &&\
 	mix local.hex --force &&\
 	mix local.rebar --force &&\
+  mix deps.clean --all &&\
 	mix deps.get --only prod &&\
 	mkdir release &&\
 	mix release --path release
 
-FROM alpine:${ALPINE_VER}
+FROM ${ALPINE_IMG}:${ALPINE_VER}
 
 ARG BUILD_DATE
 ARG VCS_REF

Dockerfile-e2e

@@ -0,0 +1,61 @@
+# https://hub.docker.com/r/hexpm/elixir/tags
+ARG ELIXIR_IMG=docker.io/hexpm/elixir
+ARG ALPINE_IMG=docker.io/alpine
+ARG ELIXIR_VER=1.18.4
+ARG ERLANG_VER=27.3.4.11
+ARG ALPINE_VER=3.23.4
+
+FROM ${ELIXIR_IMG}:${ELIXIR_VER}-erlang-${ERLANG_VER}-alpine-${ALPINE_VER} AS build
+
+COPY . .
+
+ENV MIX_ENV=prod
+ENV VIX_COMPILATION_MODE=PLATFORM_PROVIDED_LIBVIPS
+
+RUN apk add git gcc g++ musl-dev make cmake file-dev vips-dev &&\
+	echo "import Config" > config/prod.secret.exs &&\
+	mix local.hex --force &&\
+	mix local.rebar --force &&\
+	mix deps.clean --all &&\
+	mix deps.get --only prod &&\
+	mkdir release &&\
+	mix release --path release
+
+FROM ${ALPINE_IMG}:${ALPINE_VER}
+
+ARG BUILD_DATE
+ARG VCS_REF
+
+LABEL maintainer="ops@pleroma.social" \
+    org.opencontainers.image.title="pleroma" \
+    org.opencontainers.image.description="Pleroma FE E2E test image" \
+    org.opencontainers.image.authors="ops@pleroma.social" \
+    org.opencontainers.image.vendor="pleroma.social" \
+    org.opencontainers.image.documentation="https://git.pleroma.social/pleroma/pleroma" \
+    org.opencontainers.image.licenses="AGPL-3.0" \
+    org.opencontainers.image.url="https://pleroma.social" \
+    org.opencontainers.image.revision=$VCS_REF \
+    org.opencontainers.image.created=$BUILD_DATE
+
+ARG HOME=/opt/pleroma
+ARG DATA=/var/lib/pleroma
+
+RUN apk update &&\
+	apk add exiftool ffmpeg vips libmagic ncurses postgresql-client &&\
+	adduser --system --shell /bin/false --home ${HOME} pleroma &&\
+	mkdir -p ${DATA}/uploads &&\
+	mkdir -p ${DATA}/static &&\
+	chown -R pleroma ${DATA} &&\
+	mkdir -p /etc/pleroma &&\
+	chown -R pleroma /etc/pleroma
+
+USER pleroma
+
+COPY --from=build --chown=pleroma:0 /release ${HOME}
+
+COPY --chown=pleroma --chmod=640 ./config/docker.exs /etc/pleroma/config.exs
+COPY ./docker-entrypoint-e2e.sh ${HOME}
+
+EXPOSE 4000
+
+ENTRYPOINT ["/opt/pleroma/docker-entrypoint-e2e.sh"]

README.md

@@ -1,4 +1,4 @@
-<img src="https://git.pleroma.social/pleroma/pleroma/uploads/8cec84f5a084d887339f57deeb8a293e/pleroma-banner-vector-nopad-notext.svg" width="300px" />
+<img src="https://git.pleroma.social/attachments/06a95f5a-7cac-42ad-8b1d-1483f1739f38" width="300px" />
 
 ## About 
 
@@ -19,8 +19,6 @@ If you are running Linux (glibc or musl) on x86/arm, the recommended way to inst
 If your platform is not supported, or you just want to be able to edit the source code easily, you may install Pleroma from source.
 
 - [Alpine Linux](https://docs-develop.pleroma.social/backend/installation/alpine_linux_en/)
-- [Arch Linux](https://docs-develop.pleroma.social/backend/installation/arch_linux_en/)
-- [CentOS 7](https://docs-develop.pleroma.social/backend/installation/centos7_en/)
 - [Debian-based](https://docs-develop.pleroma.social/backend/installation/debian_based_en/)
 - [Debian-based (jp)](https://docs-develop.pleroma.social/backend/installation/debian_based_jp/)
 - [FreeBSD](https://docs-develop.pleroma.social/backend/installation/freebsd_en/)

changelog.d/3900.change

@@ -1 +0,0 @@
-Update to Phoenix 1.7

changelog.d/3904.security

@@ -1 +0,0 @@
-HTTP Security: By default, don't allow unsafe-eval. The setting needs to be changed to allow Flash emulation.

changelog.d/3987.fix

@@ -1 +0,0 @@
-Remove checking ImageMagick's commands for Pleroma.Upload.Filter.AnalyzeMetadata

changelog.d/account-favourites-order.fix

@@ -0,0 +1 @@
+Fixed `/api/v1/pleroma/accounts/:id/favourites` ordering and pagination to use the favourite date.

changelog.d/account-rendering-auth-check.fix

@@ -1 +0,0 @@
-Fix authentication check on account rendering when bio is defined

changelog.d/activitypub-bot-rfc9421-fallback.fix

@@ -0,0 +1 @@
+Reject unsupported or ambiguous inbox signatures instead of queueing a doomed failed-signature retry, allowing clients to fall back to legacy HTTP Signatures.

changelog.d/add-ipfs-upload.add

@@ -1 +0,0 @@
-Uploader: Add support for uploading attachments using IPFS

changelog.d/add-nsfw-mrf.add

@@ -1 +0,0 @@
-Add NSFW-detecting MRF

changelog.d/add-outbox.fix

@@ -1 +0,0 @@
-ap userview: add outbox field.

changelog.d/add-rbl-mrf.add

@@ -1 +0,0 @@
-Add DNSRBL MRF

changelog.d/akkoma-prune-options.add

@@ -1 +0,0 @@
-Add options to the mix prune_objects task

changelog.d/anonymous-exception-else.fix

@@ -1 +0,0 @@
-Fix #strip_report_status_data

changelog.d/anti-mentionspam-mrf.add

@@ -1 +0,0 @@
-Add Anti-mention Spam MRF backported from Rebased

changelog.d/auth-fetch-exception.add

@@ -1 +0,0 @@
-HTTPSignaturePlug: Add :authorized_fetch_mode_exceptions configuration

changelog.d/authorize-interaction.add

@@ -1 +0,0 @@
-Support /authorize-interaction route used by Mastodon

changelog.d/authorized-fetch-rejections.add

@@ -1 +0,0 @@
-Add an option to reject certain domains when authorized fetch is enabled.

changelog.d/backups-follows.add

@@ -1 +0,0 @@
-Include following/followers in backups

changelog.d/bad_inbox_request.change

@@ -1 +0,0 @@
-Invalid activities delivered to the inbox will be rejected with a 400 Bad Request

changelog.d/bandit.change

@@ -1 +0,0 @@
-Support Bandit as an alternative to Cowboy for the HTTP server. 

changelog.d/blurhash.change

@@ -1 +0,0 @@
-Replace eblurhash with rinpatch_blurhash. This also removes a dependency on ImageMagick.

changelog.d/bookmark-folders.add

@@ -1 +0,0 @@
-Allow to group bookmarks in folders

changelog.d/bugfix-ccworks.fix

@@ -1 +0,0 @@
-Fix federation with Convergence AP Bridge

changelog.d/bump-elixir.change

@@ -1 +0,0 @@
-Elixir 1.13 is the minimum required version.

changelog.d/captcha-package.fix

@@ -0,0 +1 @@
+Switch native captcha to the published pleroma_captcha Hex package.

changelog.d/card-endpoint.remove

@@ -1 +0,0 @@
-Mastodon API: Remove deprecated GET /api/v1/statuses/:id/card endpoint https://github.com/mastodon/mastodon/pull/11213

changelog.d/card-image-description.add

@@ -1 +0,0 @@
-Include image description in status media cards

changelog.d/chat-attachment-empty-array.fix

@@ -1 +0,0 @@
-ChatMessage: Tolerate attachment field set to an empty array

changelog.d/config-stat-symlink.fix

@@ -1 +0,0 @@
-- Config: Check the permissions of the linked file instead of the symlink

changelog.d/content-length.fix

@@ -1 +0,0 @@
-MediaProxy was setting the content-length header which is not permitted by RFC9112§6.2 when we are chunking the reply as it conflicts with the existence of the transfer-encoding header.

changelog.d/context-cleanup.skip

@@ -0,0 +1 @@
+litepub-0.1.jsonld cleanup

changelog.d/deprecations.skip

@@ -1 +0,0 @@
-

changelog.d/digest_emails.fix

@@ -1 +0,0 @@
-Fix the processing of email digest jobs.

changelog.d/disabling-chats.change

@@ -0,0 +1 @@
+Allow disabling Chats feature

changelog.d/docker-baseimage-ssl.fix

@@ -0,0 +1 @@
+Dockerfile: update base images to fix problems with SSL handshakes

changelog.d/docs-max-elixir-erlang.change

@@ -1 +0,0 @@
-- Document maximum supported version of Erlang & Elixir

changelog.d/elixir-1-19.add

@@ -0,0 +1 @@
+Implemented ConfigDB configuration blacklist and accompanying Mix task

changelog.d/elixir-1-19.fix

@@ -0,0 +1 @@
+Fixed Elixir 1.19 warnings

changelog.d/emoji-download-paginate.fix

@@ -1 +0,0 @@
-When downloading remote emojis packs, account for pagination

changelog.d/emoji-use-v1.fix

@@ -1 +0,0 @@
-Make remote emoji packs API use specifically the V1 URL. Akkoma does not understand it without V1, and it works either way with normal pleroma, so no reason to not do this

changelog.d/familiar-followers.add

@@ -1 +0,0 @@
-Implement `/api/v1/accounts/familiar_followers`

changelog.d/favicon.add

@@ -1 +0,0 @@
-Add support for configuring favicon, embed favicon and PWA manifest in server-generated meta

changelog.d/featured-collection-page.fix

@@ -0,0 +1 @@
+Support fetching featured collection items from the first collection page

changelog.d/federation_status-access.change

@@ -1 +0,0 @@
-- Make `/api/v1/pleroma/federation_status` publicly available

changelog.d/federator-modules.remove

@@ -1 +0,0 @@
-Removed support for multiple federator modules as we only support ActivityPub

changelog.d/fedidev-federation-compat.add

@@ -0,0 +1 @@
+Accept more real-world ActivityPub object shapes collected by fedidev.fun

changelog.d/fep-2c59.add

@@ -1 +0,0 @@
-Implement FEP-2c59, add "webfinger" to user actor

changelog.d/ffmpeg-limiter.add

@@ -1 +0,0 @@
-Framegrabs with ffmpeg will execute with a 5 second timeout and cache the URLs of failures with a TTL of 15 minutes to prevent excessive retries.

changelog.d/finch_redirects.fix

@@ -1 +0,0 @@
-Following HTTP Redirects when the HTTP Adapter is Finch

changelog.d/fix-preferred-frontend.fix

@@ -0,0 +1 @@
+Fix preferred frontend not working due to InstanceStatic plug prematurely returning HTTP 404

changelog.d/fix-webfinger-spoofing.security

@@ -1 +0,0 @@
-Fix webfinger spoofing.

changelog.d/force-mention-mrf.add

@@ -1 +0,0 @@
-Add ForceMention MRF

changelog.d/framegrabs.fix

@@ -1 +0,0 @@
-Video framegrabs were not working correctly after the change to use Exile to execute ffmpeg

changelog.d/frontend-management.add

@@ -1 +0,0 @@
-[docs] add frontends management documentation

changelog.d/group-actor.add

@@ -1 +0,0 @@
-Implement group actors

changelog.d/grouped-notifications-api.add

@@ -0,0 +1 @@
+Add Mastodon-compatible grouped notifications API endpoints under `/api/v2/notifications` for newly-created notifications

changelog.d/gun-pool-rework.fix

@@ -0,0 +1 @@
+Fixed Gun HTTP/1 concurrency, forwarding and authenticated proxy handling, tunnel requests, and streamed connection cleanup. Updated Gun and Cowlib for HTTP client security fixes.

changelog.d/gun_pool.fix

@@ -1 +0,0 @@
-Fix logic error in Gun connection pooling which prevented retries even when the worker was launched with retry = true