style: auto-fix lint and format

The v1.69.0 caching refactor replaced Redis pub/sub push with a global
30s client-side refetchInterval. This caused fast-refresh widgets like
health-monitoring (Dashdot, 5s) to only update every 30s.

Adds refetchIntervalSeconds field to WidgetDefinition. Each widget
declares its own refresh rate alongside its other config. The TRPC
provider iterates all widget definitions and calls setQueryDefaults
with the widget's queryKey (or auto-derived from widget kind).

Widgets whose kind doesn't match their tRPC path set queryKey
explicitly (e.g. dnsHoleSummary -> widget.dnsHole, systemResources ->
widget.healthMonitoring). Beszel already does this for cache sharing.

Removed inline refetchInterval from docker widget component since it's
now on the definition.

Fixes #6268

.dockerignore

@@ -6,7 +6,14 @@ npm-debug.log
 README.md
 .next
 .turbo
+.pnpm-store
+**/.pnpm-store
+coverage
+**/coverage
+**/.docusaurus
+**/build
 .git
+.github
 dev
 .build
 e2e

.github/act/.gitignore

@@ -0,0 +1,2 @@
+.secrets
+!.secrets.example

.github/act/.secrets.example

@@ -0,0 +1,4 @@
+TURBO_API=
+TURBO_TEAM=
+TURBO_TOKEN=
+TURBO_REMOTE_CACHE_SIGNATURE_KEY=

.github/act/README.md

@@ -0,0 +1,36 @@
+# Running CI locally
+
+Install [Act](https://nektosact.com/installation/index.html) and ensure Docker is running, then use:
+
+```bash
+pnpm ci:act:fast
+pnpm ci:act:docker
+pnpm ci:act:all
+pnpm ci:act:cleanup
+```
+
+`fast` runs the quality gate. `docker` and `all` run the gate followed by the single container build, E2E suite, and memory regression test. `cleanup` validates the manual cleanup path without calling GitHub. The wrapper supports regular clones and Git worktrees, including non-default Docker contexts. Linux dependencies are kept in Docker volumes instead of overwriting host `node_modules`. The first run downloads the Act runner and Playwright browser dependencies.
+
+Remote caching is optional locally. Copy `.github/act/.secrets.example` to `.github/act/.secrets`, populate it with rotated credentials, and run with:
+
+```bash
+ACT_SECRET_FILE=.github/act/.secrets pnpm ci:act:all
+```
+
+Act never publishes or deletes GHCR images. The secret file is ignored by Git.
+
+## PR preview images
+
+Successful non-draft pull requests from this repository publish an amd64 image:
+
+```bash
+docker pull ghcr.io/homarr-labs/homarr-test:pr-<number>
+```
+
+The tag is replaced when the pull request is updated and deleted when it closes. Production Homarr images remain the supported multi-architecture releases. The `homarr-test` package must be configured as public in GHCR for unauthenticated testers.
+
+## Dokploy preview cache
+
+Keep `needs-demo` as the Dokploy preview label. Under the application's **Preview Build-time Secrets**, configure `TURBO_API`, `TURBO_TEAM`, `TURBO_TOKEN`, and `TURBO_REMOTE_CACHE_SIGNATURE_KEY`. Dokploy passes these to the Dockerfile as BuildKit secrets. Do not configure the token or signature key as Docker build arguments.
+
+Rotate any credentials that have appeared in chat, logs, or committed configuration before enabling the cache.

.github/workflows/autofix.yml

@@ -0,0 +1,48 @@
+name: Auto-fix lint and format
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+    branches: ["*"]
+
+permissions:
+  contents: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  autofix:
+    name: Auto-fix
+    if: github.event.pull_request.head.repo.id == github.repository_id
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          ref: ${{ github.head_ref }}
+          persist-credentials: false
+
+      - name: Setup
+        uses: ./tooling/github/setup
+
+      - name: Get changed files
+        id: changed
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: |
+          git diff --name-only --diff-filter=ACMR "origin/${BASE_REF}...HEAD" -- '*.ts' '*.tsx' '*.js' '*.jsx' > /tmp/changed-files
+          echo "count=$(wc -l < /tmp/changed-files | tr -d '[:space:]')" >> $GITHUB_OUTPUT
+
+      - name: Auto-fix lint + format
+        if: steps.changed.outputs.count != '0'
+        run: |
+          xargs -r -a /tmp/changed-files pnpm exec oxlint --fix || true
+          xargs -r -a /tmp/changed-files pnpm exec oxfmt --write
+
+      - name: Commit fixes
+        uses: stefanzweifel/git-auto-commit-action@v7
+        with:
+          commit_message: "style: auto-fix lint and format"

.github/workflows/ci.yml

@@ -0,0 +1,347 @@
+name: CI
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    branches: ["*"]
+  pull_request_target:
+    types: [closed]
+    branches: ["*"]
+  push:
+    branches: [main, dev, beta, next]
+  merge_group:
+  workflow_dispatch:
+    inputs:
+      operation:
+        description: Operation to run
+        required: true
+        default: validate
+        type: choice
+        options:
+          - validate
+          - publish
+          - cleanup
+      pr_number:
+        description: PR number for publish or cleanup
+        required: false
+        type: number
+      ref:
+        description: Git ref to validate or publish
+        required: false
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || inputs.pr_number || github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+env:
+  FORCE_COLOR: 3
+  SKIP_ENV_VALIDATION: true
+  TURBO_TELEMETRY_DISABLED: 1
+  REGISTRY: ghcr.io
+  PREVIEW_IMAGE: ghcr.io/homarr-labs/homarr-test
+
+jobs:
+  fast-gate:
+    name: Fast gate
+    if: github.event_name != 'pull_request_target' && (github.event_name != 'workflow_dispatch' || inputs.operation != 'cleanup')
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      TURBO_API: ${{ secrets.TURBO_API }}
+      TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
+      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+      TURBO_REMOTE_CACHE_SIGNATURE_KEY: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
+      TURBO_SCM_BASE: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha || github.event.before || 'HEAD~1' }}
+      TURBO_SCM_HEAD: ${{ github.sha }}
+      TURBO_PLATFORM: linux/amd64
+    steps:
+      - uses: actions/checkout@v7
+        if: '!env.ACT'
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }}
+
+      - name: Validate manual inputs
+        if: github.event_name == 'workflow_dispatch' && inputs.operation == 'publish'
+        env:
+          PR_NUMBER: ${{ inputs.pr_number }}
+          BUILD_REF: ${{ inputs.ref }}
+        run: |
+          test -n "$PR_NUMBER" || { echo "pr_number is required for publish"; exit 1; }
+          test -n "$BUILD_REF" || { echo "ref is required for publish"; exit 1; }
+
+      - name: Setup
+        uses: ./tooling/github/setup
+
+      - name: Copy environment defaults
+        run: cp .env.example .env
+
+      - name: Check formatting in affected workspaces
+        run: pnpm turbo run format --affected --continue -- --check
+
+      - name: Lint, typecheck, and build affected workspaces
+        run: pnpm turbo run lint typecheck build --affected --continue=dependencies-successful
+
+      - name: Validate workspace configuration
+        run: pnpm lint:ws
+
+      - name: Run unit tests
+        run: pnpm test
+
+      - name: Report coverage
+        if: always() && !env.ACT
+        uses: davelosert/vitest-coverage-report-action@v2
+
+  container:
+    name: Container, E2E, and memory
+    needs: fast-gate
+    if: |
+      github.event_name == 'merge_group' ||
+      (github.event_name == 'pull_request' && github.event.pull_request.draft == false) ||
+      (github.event_name == 'workflow_dispatch' && (inputs.operation == 'validate' || inputs.operation == 'publish'))
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v7
+        if: '!env.ACT'
+        with:
+          persist-credentials: false
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }}
+
+      - name: Setup
+        uses: ./tooling/github/setup
+
+      - name: Set up Docker Buildx
+        if: '!env.ACT'
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build container once
+        if: '!env.ACT'
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          network: host
+          platforms: linux/amd64
+          load: true
+          push: false
+          tags: |
+            homarr-ci
+            homarr-e2e
+          labels: |
+            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.ref.name=pr-${{ github.event.pull_request.number || inputs.pr_number || 'none' }}
+          cache-from: type=gha,scope=homarr-linux-amd64
+          cache-to: type=gha,scope=homarr-linux-amd64,mode=max
+          secrets: |
+            TURBO_API=${{ secrets.TURBO_API }}
+            TURBO_TEAM=${{ secrets.TURBO_TEAM }}
+            TURBO_TOKEN=${{ secrets.TURBO_TOKEN }}
+            TURBO_REMOTE_CACHE_SIGNATURE_KEY=${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
+
+      - name: Build container once with Act
+        if: env.ACT
+        env:
+          TURBO_API: ${{ secrets.TURBO_API }}
+          TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
+          TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+          TURBO_REMOTE_CACHE_SIGNATURE_KEY: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
+        run: |
+          secret_args=()
+          for secret in TURBO_API TURBO_TEAM TURBO_TOKEN TURBO_REMOTE_CACHE_SIGNATURE_KEY; do
+            if [ -n "${!secret:-}" ]; then
+              secret_args+=(--secret "id=${secret},env=${secret}")
+            fi
+          done
+          DOCKER_BUILDKIT=1 docker build --platform linux/amd64 \
+            --tag homarr-ci --tag homarr-e2e "${secret_args[@]}" .
+
+      - name: Cache Playwright browsers
+        if: '!env.ACT'
+        id: playwright-cache
+        uses: actions/cache@v6
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
+
+      - name: Install Playwright Chromium
+        if: steps.playwright-cache.outputs.cache-hit != 'true' || env.ACT
+        run: pnpm exec playwright install --with-deps chromium
+
+      - name: Install Playwright system deps
+        if: steps.playwright-cache.outputs.cache-hit == 'true'
+        run: pnpm exec playwright install-deps chromium
+
+      - name: Run E2E tests
+        run: pnpm test:e2e
+
+      - name: Upload E2E artifacts
+        if: failure() && !env.ACT
+        uses: actions/upload-artifact@v7
+        with:
+          name: playwright-report
+          path: e2e/test-results/
+          retention-days: 7
+
+      - name: Run memory regression test
+        env:
+          CONTAINER_NAME: homarr-mem-${{ github.run_id }}-${{ github.run_attempt }}
+          SECRET_ENCRYPTION_KEY: 0000000000000000000000000000000000000000000000000000000000000000
+        run: |
+          docker run -d --name "$CONTAINER_NAME" -p 127.0.0.1::7575 \
+            -e NO_EXTERNAL_CONNECTION=true \
+            -e SECRET_ENCRYPTION_KEY="$SECRET_ENCRYPTION_KEY" \
+            homarr-ci
+          PORT=$(docker port "$CONTAINER_NAME" 7575/tcp | sed 's/.*://')
+          [[ "$PORT" =~ ^[0-9]+$ ]] || { echo "ERROR: invalid port mapping: '$PORT'"; exit 1; }
+          URL="http://127.0.0.1:${PORT}"
+
+          healthy=false
+          for i in $(seq 1 30); do
+            if curl -sf "$URL/api/health/ready" >/dev/null 2>&1; then
+              echo "Container healthy after $((i * 2))s"
+              healthy=true
+              break
+            fi
+            sleep 2
+          done
+
+          if [ "$healthy" != "true" ]; then
+            echo "ERROR: Container never became healthy"
+            docker logs "$CONTAINER_NAME" --tail 100
+            exit 1
+          fi
+
+          warmup_ok=0
+          for _ in $(seq 1 5); do
+            curl -sf "$URL/" >/dev/null 2>&1 && warmup_ok=$((warmup_ok + 1))
+            sleep 2
+          done
+          if [ "$warmup_ok" -eq 0 ]; then
+            echo "ERROR: All warmup requests failed"
+            docker logs "$CONTAINER_NAME" --tail 50
+            exit 1
+          fi
+
+          docker inspect -f '{{.State.Running}}' "$CONTAINER_NAME" | grep -qx true || {
+            echo "ERROR: Container died before memory measurement"
+            docker logs "$CONTAINER_NAME" --tail 100
+            exit 1
+          }
+
+          RAW_MEMORY=$(docker stats --no-stream --format '{{.MemUsage}}' "$CONTAINER_NAME" | sed 's| /.*||')
+          MEMORY_MB=$(echo "$RAW_MEMORY" | awk '
+            /GiB/ { gsub(/GiB/, ""); print $1 * 1024; next }
+            /MiB/ { gsub(/MiB/, ""); print $1; next }
+            /KiB/ { gsub(/KiB/, ""); print $1 / 1024; next }
+            { print $1 / 1048576 }
+          ')
+
+          echo "Memory usage: ${MEMORY_MB} MB (${RAW_MEMORY})"
+          [[ "$MEMORY_MB" =~ ^[0-9]+(\.[0-9]+)?$ ]] || {
+            echo "ERROR: non-numeric memory value: '$MEMORY_MB' (raw: '$RAW_MEMORY')"
+            docker logs "$CONTAINER_NAME" --tail 100
+            exit 1
+          }
+          if awk "BEGIN { exit !($MEMORY_MB < 50) }"; then
+            echo "ERROR: Memory suspiciously low (${MEMORY_MB} MB) — container may have crashed"
+            docker logs "$CONTAINER_NAME" --tail 100
+            exit 1
+          elif awk "BEGIN { exit !($MEMORY_MB > 700) }"; then
+            echo "ERROR: Memory usage ${MEMORY_MB} MB exceeds 700 MB"
+            docker logs "$CONTAINER_NAME" --tail 100
+            exit 1
+          fi
+
+      - name: Clean up memory test container
+        if: always()
+        env:
+          CONTAINER_NAME: homarr-mem-${{ github.run_id }}-${{ github.run_attempt }}
+        run: docker rm -f "$CONTAINER_NAME" >/dev/null 2>&1 || true
+
+      - name: Determine preview tag
+        id: preview
+        if: |
+          !env.ACT &&
+          (
+            (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) ||
+            (github.event_name == 'workflow_dispatch' && inputs.operation == 'publish')
+          )
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number || inputs.pr_number }}
+        run: echo "tag=pr-${PR_NUMBER}" >> "$GITHUB_OUTPUT"
+
+      - name: Log in to GHCR
+        if: steps.preview.outputs.tag != ''
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Push preview image
+        if: steps.preview.outputs.tag != ''
+        env:
+          PREVIEW_TAG: ${{ steps.preview.outputs.tag }}
+        run: |
+          docker tag homarr-ci "${PREVIEW_IMAGE}:${PREVIEW_TAG}"
+          docker push "${PREVIEW_IMAGE}:${PREVIEW_TAG}"
+
+      - name: Show Act publication result
+        if: env.ACT
+        run: echo "Act validated the publication path; external GHCR writes are disabled locally."
+
+  cleanup:
+    name: Clean up preview image
+    if: github.event_name == 'pull_request_target' || (github.event_name == 'workflow_dispatch' && inputs.operation == 'cleanup')
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      packages: write
+    env:
+      IMAGE_TAG: pr-${{ github.event.pull_request.number || inputs.pr_number }}
+    steps:
+      - name: Validate cleanup input
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          PR_NUMBER: ${{ inputs.pr_number }}
+        run: test -n "$PR_NUMBER" || { echo "pr_number is required for cleanup"; exit 1; }
+
+      - name: Delete GHCR package version
+        if: '!env.ACT'
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const packageName = "homarr-test";
+            const org = context.repo.owner;
+            const tag = process.env.IMAGE_TAG;
+            const versions = await github.paginate(
+              github.rest.packages.getAllPackageVersionsForPackageOwnedByOrg,
+              { package_type: "container", package_name: packageName, org, per_page: 100 },
+            );
+            const target = versions.find((version) =>
+              version.metadata?.container?.tags?.includes(tag),
+            );
+            if (!target) {
+              core.info(`No package version found with tag "${tag}"`);
+              return;
+            }
+            await github.rest.packages.deletePackageVersionForOrg({
+              package_type: "container",
+              package_name: packageName,
+              org,
+              package_version_id: target.id,
+            });
+            core.info(`Deleted package version ${target.id} (${tag})`);
+
+      - name: Show Act cleanup result
+        if: env.ACT
+        run: echo "Act validated cleanup for ${IMAGE_TAG}; external GHCR writes are disabled locally."

.github/workflows/code-quality.yml

@@ -1,165 +0,0 @@
-name: "[Quality] Code Analysis"
-permissions:
-  contents: read
-
-on:
-  pull_request:
-    branches: ["*"]
-  push:
-    branches: ["main"]
-  merge_group:
-
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}"
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
-
-env:
-  FORCE_COLOR: 3
-  SKIP_ENV_VALIDATION: true
-  TURBO_API: ${{ secrets.TURBO_API }}
-  TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
-  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
-  TURBO_REMOTE_CACHE_SIGNATURE_KEY: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
-  TURBO_SCM_BASE: ${{ github.event.pull_request.base.sha || github.event.before || 'HEAD~1' }}
-  TURBO_SCM_HEAD: ${{ github.sha }}
-
-jobs:
-  lint-format-autofix:
-    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.id == github.repository_id
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-          ref: ${{ github.head_ref }}
-
-      - name: Setup
-        uses: ./tooling/github/setup
-
-      - name: Get changed files
-        id: changed
-        run: |
-          git diff --name-only --diff-filter=ACMR origin/${{ github.base_ref }}...HEAD -- '*.ts' '*.tsx' '*.js' '*.jsx' > /tmp/changed-files
-          echo "count=$(wc -l < /tmp/changed-files | tr -d '[:space:]')" >> $GITHUB_OUTPUT
-
-      - name: Auto-fix lint + format
-        if: steps.changed.outputs.count != '0'
-        run: |
-          xargs -r -a /tmp/changed-files pnpm exec oxlint --fix || true
-          xargs -r -a /tmp/changed-files pnpm exec oxfmt --write
-
-      - name: Commit fixes
-        uses: stefanzweifel/git-auto-commit-action@v7
-        with:
-          commit_message: "style: auto-fix lint and format"
-
-  lint:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-
-      - name: Setup
-        uses: ./tooling/github/setup
-
-      - name: Copy env
-        shell: bash
-        run: cp .env.example .env
-
-      - name: Lint
-        run: pnpm turbo lint --affected && pnpm lint:ws
-
-  format:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-
-      - name: Setup
-        uses: ./tooling/github/setup
-
-      - name: Format
-        run: pnpm turbo format --affected --continue
-
-  typecheck:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-
-      - name: Setup
-        uses: ./tooling/github/setup
-
-      - name: Typecheck
-        run: pnpm turbo typecheck --affected
-
-  test:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Setup
-        uses: ./tooling/github/setup
-
-      - name: Test
-        run: pnpm test
-
-      - name: "Report Coverage"
-        # Set if: always() to also generate the report if tests are failing
-        # Only works if you set `reportOnFailure: true` in your vite config as specified above
-        if: always()
-        uses: davelosert/vitest-coverage-report-action@v2
-
-  e2e:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v7
-      - name: Setup
-        uses: ./tooling/github/setup
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-      - name: Build docker image
-        id: build-docker-image
-        uses: docker/build-push-action@v7
-        with:
-          platforms: linux/amd64
-          context: .
-          push: false
-          load: true
-          tags: homarr-e2e
-          network: host
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-        env:
-          SKIP_ENV_VALIDATION: true
-      - name: Install playwright browsers
-        run: pnpm exec playwright install chromium
-      - name: Run E2E Tests
-        shell: bash
-        run: pnpm test:e2e
-
-  build:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-      - name: Setup
-        uses: ./tooling/github/setup
-      - name: Copy env
-        shell: bash
-        run: cp .env.example .env
-      - name: Build
-        run: pnpm turbo build --affected

.github/workflows/deployment-docker-image.yml

@@ -148,6 +148,11 @@ jobs:
           platforms: linux/amd64
           labels: ${{ steps.meta.outputs.labels }}
           outputs: type=image,"name=${{ env.GHCR_REPO }}",push-by-digest=true,name-canonical=true,push=true
+          secrets: |
+            TURBO_API=${{ secrets.TURBO_API }}
+            TURBO_TEAM=${{ secrets.TURBO_TEAM }}
+            TURBO_TOKEN=${{ secrets.TURBO_TOKEN }}
+            TURBO_REMOTE_CACHE_SIGNATURE_KEY=${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
         env:
           SKIP_ENV_VALIDATION: true
   build-arm64:
@@ -187,6 +192,11 @@ jobs:
           platforms: linux/arm64
           labels: ${{ steps.meta.outputs.labels }}
           outputs: type=image,"name=${{ env.GHCR_REPO }}",push-by-digest=true,name-canonical=true,push=true
+          secrets: |
+            TURBO_API=${{ secrets.TURBO_API }}
+            TURBO_TEAM=${{ secrets.TURBO_TEAM }}
+            TURBO_TOKEN=${{ secrets.TURBO_TOKEN }}
+            TURBO_REMOTE_CACHE_SIGNATURE_KEY=${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
         env:
           SKIP_ENV_VALIDATION: true
   extract-asset-amd64:

Dockerfile

@@ -1,24 +1,43 @@
+# syntax=docker/dockerfile:1.25
+
 FROM node:24.18.0-alpine AS base
 
 FROM base AS builder
-RUN apk add --no-cache libc6-compat
-RUN apk update
-
-# Set working directory
 WORKDIR /app
-RUN apk add --no-cache libc6-compat curl bash
+RUN apk add --no-cache libc6-compat curl bash && apk update
-RUN apk update
+
+RUN corepack enable pnpm
+COPY pnpm-lock.yaml pnpm-workspace.yaml package.json ./
+COPY patches ./patches
+# Workaround for pnpm/pnpm#5268: pnpm fetch crashes when patchedDependencies
+# are configured with nodeLinker: hoisted. The applyPatchToDir function tries
+# to chdir into node_modules/<pkg> which doesn't exist during fetch (only the
+# content-addressable store is populated). By temporarily switching to the
+# isolated linker, patches apply inside the virtual store (node_modules/.pnpm/...)
+# which IS created by pnpm fetch. The original hoisted linker is restored
+# before the install step so the final node_modules layout stays flat.
+RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store \
+    pnpm config set store-dir /pnpm/store && \
+    sed -i 's/nodeLinker: hoisted/nodeLinker: isolated/' pnpm-workspace.yaml && \
+    pnpm fetch && \
+    sed -i 's/nodeLinker: isolated/nodeLinker: hoisted/' pnpm-workspace.yaml
+
 COPY . .
+# Follow the pnpm fetch pattern from https://pnpm.io/cli/fetch
+# --frozen-lockfile is omitted as recommended by the pnpm fetch docs
+RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store \
+    pnpm install --recursive
 
-RUN corepack enable pnpm && pnpm install --recursive --frozen-lockfile
-
-# Copy static data as it is not part of the build
-COPY static-data ./static-data
 ARG SKIP_ENV_VALIDATION='true'
 ARG CI='true'
 ARG DISABLE_REDIS_LOGS='true'
+ARG TARGETPLATFORM
 
-RUN corepack enable pnpm && pnpm build
+RUN --mount=type=secret,id=TURBO_API,env=TURBO_API \
+    --mount=type=secret,id=TURBO_TEAM,env=TURBO_TEAM \
+    --mount=type=secret,id=TURBO_TOKEN,env=TURBO_TOKEN \
+    --mount=type=secret,id=TURBO_REMOTE_CACHE_SIGNATURE_KEY,env=TURBO_REMOTE_CACHE_SIGNATURE_KEY \
+    TURBO_PLATFORM="${TARGETPLATFORM:-linux/amd64}" pnpm build
 
 FROM base AS runner
 WORKDIR /app

apps/nextjs/src/app/[locale]/_client-providers/trpc.tsx

@@ -2,6 +2,7 @@
 
 import type { PropsWithChildren } from "react";
 import { useState } from "react";
+import type { QueryKey } from "@tanstack/react-query";
 import { QueryClient } from "@tanstack/react-query";
 import { ReactQueryDevtools } from "@tanstack/react-query-devtools";
 import { ReactQueryStreamedHydration } from "@tanstack/react-query-next-experimental";
@@ -33,6 +34,7 @@ import {
 import { createHeadersCallbackForSource, getTrpcUrl } from "@homarr/api/shared";
 import { env } from "@homarr/common/env";
 import { showWarningNotification } from "@homarr/notifications";
+import { widgetImports } from "@homarr/widgets";
 
 import { createWidgetQueryPersister } from "./query-cache-persister";
 
@@ -90,6 +92,12 @@ export function TRPCReactProvider(props: PropsWithChildren) {
       },
     });
     client.setQueryDefaults([["widget"]], { refetchInterval: queryCacheDefaultRefetchIntervalMs });
+    for (const { definition } of Object.values(widgetImports)) {
+      const def = definition as { refetchIntervalSeconds?: number; queryKey?: QueryKey; kind: string };
+      if (!def.refetchIntervalSeconds) continue;
+      const key = def.queryKey ?? [["widget", def.kind]];
+      client.setQueryDefaults(key, { refetchInterval: def.refetchIntervalSeconds * 1000 });
+    }
     return client;
   });
 

package.json

@@ -6,6 +6,10 @@
     "build": "cross-env CI=true turbo build",
     "clean": "git clean -xdf node_modules",
     "clean:workspaces": "turbo clean",
+    "ci:act:all": "bash scripts/ci/act.sh all",
+    "ci:act:cleanup": "bash scripts/ci/act.sh cleanup",
+    "ci:act:docker": "bash scripts/ci/act.sh docker",
+    "ci:act:fast": "bash scripts/ci/act.sh fast",
     "cli": "pnpm with-env tsx packages/cli/index.ts",
     "db:migration:mysql:generate": "pnpm -F db migration:mysql:generate",
     "db:migration:mysql:run": "pnpm -F db migration:mysql:run",
@@ -33,6 +37,9 @@
     "typecheck": "turbo typecheck",
     "with-env": "dotenv -e .env --"
   },
+  "dependencies": {
+    "jsonpath-plus": "catalog:"
+  },
   "devDependencies": {
     "@playwright/test": "catalog:",
     "@semantic-release/changelog": "catalog:",
@@ -64,8 +71,5 @@
     "node": ">=24.18.0",
     "pnpm": ">=11.10.0"
   },
-  "packageManager": "pnpm@11.10.0",
+  "packageManager": "pnpm@11.10.0"
-  "dependencies": {
-    "jsonpath-plus": "catalog:"
-  }
 }

packages/widgets/src/anchor-note/index.ts

@@ -5,6 +5,8 @@ import { optionsBuilder } from "../options";
 
 export const { definition, componentLoader } = createWidgetDefinition("anchorNote", {
   icon: IconNotes,
+  queryKey: [["widget", "anchorNotes"]],
+  refetchIntervalSeconds: 15,
   supportedIntegrations: ["anchor"],
   createOptions() {
     return optionsBuilder.from((factory) => ({

packages/widgets/src/archive-team-warrior/index.ts

@@ -5,6 +5,7 @@ import { optionsBuilder } from "../options";
 
 export const { definition, componentLoader } = createWidgetDefinition("archiveTeamWarrior", {
   icon: IconArchive,
+  refetchIntervalSeconds: 300,
   createOptions() {
     return optionsBuilder.from((factory) => ({
       showBroadcastMessage: factory.switch({

packages/widgets/src/audio-stats/index.ts

@@ -14,6 +14,7 @@ const hideUnlessAudiobookshelf = {
 
 export const { definition, componentLoader } = createWidgetDefinition("audioStats", {
   icon: IconHeadphones,
+  refetchIntervalSeconds: 600,
   supportedIntegrations: ["navidrome", "audiobookshelf"],
   integrationsRequired: true,
   maxIntegrations: 1,

packages/widgets/src/calendar/index.ts

@@ -9,6 +9,7 @@ import { optionsBuilder } from "../options";
 
 export const { definition, componentLoader } = createWidgetDefinition("calendar", {
   icon: IconCalendar,
+  refetchIntervalSeconds: 60,
   createOptions() {
     return optionsBuilder.from((factory) => ({
       releaseType: factory.multiSelect({

packages/widgets/src/coolify/index.ts

@@ -5,6 +5,7 @@ import { optionsBuilder } from "../options";
 
 export const { definition, componentLoader } = createWidgetDefinition("coolify", {
   icon: IconCloud,
+  refetchIntervalSeconds: 30,
   createOptions() {
     return optionsBuilder.from((factory) => ({
       showServers: factory.switch({

packages/widgets/src/definition.ts

@@ -70,6 +70,7 @@ export const createWidgetDefinition = <TKind extends WidgetKind, TDefinition ext
 export interface WidgetDefinition {
   icon: TablerIcon;
   queryKey?: QueryKey;
+  refetchIntervalSeconds?: number;
   supportedIntegrations?: IntegrationKind[];
   integrationsRequired?: boolean;
   maxIntegrations?: number;

packages/widgets/src/dns-hole/controls/index.ts

@@ -9,6 +9,8 @@ export const widgetKind = "dnsHoleControls";
 
 export const { definition, componentLoader } = createWidgetDefinition(widgetKind, {
   icon: IconDeviceGamepad,
+  queryKey: [["widget", "dnsHole"]],
+  refetchIntervalSeconds: 5,
   createOptions() {
     return optionsBuilder.from((factory) => ({
       showToggleAllButtons: factory.switch({

packages/widgets/src/dns-hole/summary/index.ts

@@ -9,6 +9,8 @@ export const widgetKind = "dnsHoleSummary";
 
 export const { definition, componentLoader } = createWidgetDefinition(widgetKind, {
   icon: IconAd,
+  queryKey: [["widget", "dnsHole"]],
+  refetchIntervalSeconds: 5,
   createOptions() {
     return optionsBuilder.from((factory) => ({
       usePiHoleColors: factory.switch({

packages/widgets/src/docker/component.tsx

@@ -184,13 +184,7 @@ export default function DockerWidget({ options, width, isEditMode }: WidgetCompo
   const t = useScopedI18n("docker");
   const isTiny = width <= 256;
 
-  const {
+  const { data, refetch, isFetching } = clientApi.docker.getContainers.useQuery(undefined, {});
-    data,
-    refetch,
-    isFetching,
-  } = clientApi.docker.getContainers.useQuery(undefined, {
-    refetchInterval: 30_000,
-  });
   const containers = data?.containers ?? [];
   const timestamp = useMemo(() => data?.timestamp ?? new Date(), [data?.timestamp]);
   const relativeTime = useTimeAgo(timestamp);
@@ -304,9 +298,7 @@ export default function DockerWidget({ options, width, isEditMode }: WidgetCompo
               {t("table.totalMemory", { memory: formatBytes(totals.memory) })}
             </Text>
 
-            <Tooltip
+            <Tooltip label={t("table.refresh.lastUpdated", { when: relativeTime })}>
-              label={t("table.refresh.lastUpdated", { when: relativeTime })}
-            >
               <ActionIcon
                 size="sm"
                 variant="transparent"

packages/widgets/src/docker/index.ts

@@ -26,6 +26,7 @@ const columnTranslationKeyMap = {
 export const { definition, componentLoader } = createWidgetDefinition("dockerContainers", {
   icon: IconBrandDocker,
   queryKey: [["docker", "getContainers"]],
+  refetchIntervalSeconds: 20,
   createOptions() {
     return optionsBuilder.from((factory) => ({
       columns: factory.multiSelect({

packages/widgets/src/downloads/index.ts

@@ -33,6 +33,7 @@ const columnsSort = columnsList.filter((column) =>
 
 export const { definition, componentLoader } = createWidgetDefinition("downloads", {
   icon: IconDownload,
+  refetchIntervalSeconds: 5,
   createOptions() {
     return optionsBuilder.from(
       (factory) => ({

packages/widgets/src/firewall/index.ts

@@ -7,6 +7,7 @@ import { optionsBuilder } from "../options";
 
 export const { definition, componentLoader } = createWidgetDefinition("firewall", {
   icon: IconWall,
+  refetchIntervalSeconds: 5,
   createOptions() {
     return optionsBuilder.from(() => ({}));
   },

packages/widgets/src/health-monitoring/index.ts

@@ -8,6 +8,7 @@ import { createStorageVolumeMultiSelectOptions } from "../storage-volume-options
 
 export const { definition, componentLoader } = createWidgetDefinition("healthMonitoring", {
   icon: IconHeartRateMonitor,
+  refetchIntervalSeconds: 5,
   createOptions() {
     return optionsBuilder.from(
       (factory) => ({

packages/widgets/src/immich/album-carousel/index.ts

@@ -8,6 +8,8 @@ import { optionsBuilder } from "../../options";
 
 export const { definition, componentLoader } = createWidgetDefinition("immich-albumCarousel", {
   icon: IconPhoto,
+  queryKey: [["widget", "immich"]],
+  refetchIntervalSeconds: 900,
   supportedIntegrations: ["immich"],
   integrationsRequired: true,
   createOptions() {

packages/widgets/src/immich/server-stats/index.ts

@@ -5,6 +5,8 @@ import { optionsBuilder } from "../../options";
 
 export const { definition, componentLoader } = createWidgetDefinition("immich-serverStats", {
   icon: IconGraphFilled,
+  queryKey: [["widget", "immich"]],
+  refetchIntervalSeconds: 900,
   supportedIntegrations: ["immich"],
   integrationsRequired: true,
   createOptions() {

packages/widgets/src/indexer-manager/index.ts

@@ -7,6 +7,7 @@ import { optionsBuilder } from "../options";
 
 export const { definition, componentLoader } = createWidgetDefinition("indexerManager", {
   icon: IconReportSearch,
+  refetchIntervalSeconds: 300,
   createOptions() {
     return optionsBuilder.from((factory) => ({
       openIndexerSiteInNewTab: factory.switch({

packages/widgets/src/media-releases/index.ts

@@ -5,6 +5,8 @@ import { optionsBuilder } from "../options";
 
 export const { definition, componentLoader } = createWidgetDefinition("mediaReleases", {
   icon: IconTicket,
+  queryKey: [["widget", "mediaRelease"]],
+  refetchIntervalSeconds: 300,
   createOptions() {
     return optionsBuilder.from((factory) => ({
       layout: factory.select({

packages/widgets/src/media-requests/list/index.ts

@@ -8,6 +8,8 @@ import { optionsBuilder } from "../../options";
 
 export const { componentLoader, definition } = createWidgetDefinition("mediaRequests-requestList", {
   icon: IconZoomQuestion,
+  queryKey: [["widget", "mediaRequests"]],
+  refetchIntervalSeconds: 60,
   createOptions() {
     return optionsBuilder.from((factory) => ({
       linksTargetNewTab: factory.switch({

packages/widgets/src/media-requests/stats/index.ts

@@ -7,6 +7,8 @@ import { createWidgetDefinition } from "../../definition";
 
 export const { componentLoader, definition } = createWidgetDefinition("mediaRequests-requestStats", {
   icon: IconChartBar,
+  queryKey: [["widget", "mediaRequests"]],
+  refetchIntervalSeconds: 60,
   createOptions() {
     return {};
   },

packages/widgets/src/media-server/index.ts

@@ -7,6 +7,7 @@ import { optionsBuilder } from "../options";
 
 export const { componentLoader, definition } = createWidgetDefinition("mediaServer", {
   icon: IconVideo,
+  refetchIntervalSeconds: 5,
   createOptions() {
     return optionsBuilder.from((factory) => ({
       showOnlyPlaying: factory.switch({ defaultValue: true, withDescription: true }),

packages/widgets/src/media-transcoding/index.ts

@@ -11,6 +11,7 @@ export const views = ["workers", "queue", "statistics"] as const;
 
 export const { componentLoader, definition } = createWidgetDefinition("mediaTranscoding", {
   icon: IconTransform,
+  refetchIntervalSeconds: 300,
   createOptions() {
     return optionsBuilder.from((factory) => ({
       defaultView: factory.select({

packages/widgets/src/minecraft/server-status/index.ts

@@ -6,6 +6,7 @@ import { optionsBuilder } from "../../options";
 
 export const { componentLoader, definition } = createWidgetDefinition("minecraftServerStatus", {
   icon: IconBrandMinecraft,
+  refetchIntervalSeconds: 300,
   createOptions() {
     return optionsBuilder.from((factory) => ({
       title: factory.text({ defaultValue: "" }),

packages/widgets/src/network-controller/network-status/index.ts

@@ -7,6 +7,8 @@ import { optionsBuilder } from "../../options";
 
 export const { definition, componentLoader } = createWidgetDefinition("networkControllerStatus", {
   icon: IconTopologyFull,
+  queryKey: [["widget", "networkController"]],
+  refetchIntervalSeconds: 300,
   createOptions() {
     return optionsBuilder.from((factory) => ({
       content: factory.select({

packages/widgets/src/network-controller/summary/index.ts

@@ -7,6 +7,7 @@ import { optionsBuilder } from "../../options";
 
 export const { definition, componentLoader } = createWidgetDefinition("networkControllerSummary", {
   icon: IconTopologyFull,
+  refetchIntervalSeconds: 300,
   createOptions() {
     return optionsBuilder.from(() => ({}));
   },

packages/widgets/src/notifications/index.ts

@@ -7,6 +7,7 @@ import { optionsBuilder } from "../options";
 
 export const { componentLoader, definition } = createWidgetDefinition("notifications", {
   icon: IconMessage,
+  refetchIntervalSeconds: 300,
   createOptions() {
     return optionsBuilder.from((factory) => ({
       hideLogos: factory.switch({ defaultValue: false }),

packages/widgets/src/paperless-ngx/index.ts

@@ -5,6 +5,7 @@ import { optionsBuilder } from "../options";
 
 export const { definition, componentLoader } = createWidgetDefinition("paperlessNgx", {
   icon: IconFileText,
+  refetchIntervalSeconds: 900,
   supportedIntegrations: ["paperlessNgx"],
   integrationsRequired: true,
   createOptions() {

packages/widgets/src/releases/index.ts

@@ -14,6 +14,7 @@ const relativeDateSchema = z
 
 export const { definition, componentLoader } = createWidgetDefinition("releases", {
   icon: IconRocket,
+  refetchIntervalSeconds: 300,
   createOptions() {
     return optionsBuilder.from((factory) => ({
       newReleaseWithin: factory.text({

packages/widgets/src/rssFeed/index.ts

@@ -12,6 +12,7 @@ import { optionsBuilder } from "../options";
  */
 export const { definition, componentLoader } = createWidgetDefinition("rssFeed", {
   icon: IconRss,
+  refetchIntervalSeconds: 300,
   createOptions() {
     return optionsBuilder.from((factory) => ({
       feedUrls: factory.multiText({

packages/widgets/src/smart-home/entity-state/index.ts

@@ -7,6 +7,8 @@ import { optionsBuilder } from "../../options";
 
 export const { definition, componentLoader } = createWidgetDefinition("smartHome-entityState", {
   icon: IconBinaryTree,
+  queryKey: [["widget", "smartHome"]],
+  refetchIntervalSeconds: 60,
   createOptions() {
     return optionsBuilder.from((factory) => ({
       entityId: factory.text({

packages/widgets/src/speedtest-tracker/index.ts

@@ -5,6 +5,7 @@ import { optionsBuilder } from "../options";
 
 export const { definition, componentLoader } = createWidgetDefinition("speedtestTracker", {
   icon: IconSpeedboat,
+  refetchIntervalSeconds: 600,
   createOptions() {
     return optionsBuilder.from(
       (factory) => ({

packages/widgets/src/stocks/index.ts

@@ -13,6 +13,7 @@ const timeIntervalOptions = stockPriceTimeFrames.interval;
 
 export const { definition, componentLoader } = createWidgetDefinition("stockPrice", {
   icon: IconBuildingBank,
+  refetchIntervalSeconds: 300,
   createOptions() {
     return optionsBuilder.from((factory) => ({
       stock: factory.text({

packages/widgets/src/system-disks/index.ts

@@ -6,6 +6,8 @@ import { createStorageVolumeMultiSelectOptions } from "../storage-volume-options
 
 export const { definition, componentLoader } = createWidgetDefinition("systemDisks", {
   icon: IconServer2,
+  queryKey: [["widget", "healthMonitoring"]],
+  refetchIntervalSeconds: 5,
   supportedIntegrations: ["dashDot", "openmediavault", "truenas", "unraid", "synology"],
   createOptions() {
     return optionsBuilder.from(

packages/widgets/src/system-resources/index.ts

@@ -14,6 +14,8 @@ const labelDisplayModeOptions = {
 
 export const { definition, componentLoader } = createWidgetDefinition("systemResources", {
   icon: IconGraphFilled,
+  queryKey: [["widget", "healthMonitoring"]],
+  refetchIntervalSeconds: 5,
   supportedIntegrations: ["dashDot", "openmediavault", "truenas", "unraid", "glances", "synology"],
   createOptions() {
     return optionsBuilder.from((factory) => ({

packages/widgets/src/timetable/index.ts

@@ -8,6 +8,7 @@ import { optionsBuilder } from "../options";
 
 export const { componentLoader, definition } = createWidgetDefinition("timetable", {
   icon: IconBusStop,
+  refetchIntervalSeconds: 60,
   createOptions() {
     return optionsBuilder.from((factory) => ({
       baseUrl: factory.text({

packages/widgets/src/tracearr/index.ts

@@ -5,6 +5,7 @@ import { optionsBuilder } from "../options";
 
 export const { definition, componentLoader } = createWidgetDefinition("tracearr", {
   icon: IconActivityHeartbeat,
+  refetchIntervalSeconds: 5,
   createOptions() {
     return optionsBuilder.from((factory) => ({
       showStreams: factory.switch({

packages/widgets/src/umami/index.ts

@@ -8,6 +8,7 @@ export const timeFrameValues = ["today", "24h", "7d", "30d", "month", "lastMonth
 
 export const { definition, componentLoader } = createWidgetDefinition("umami", {
   icon: IconChartBar,
+  refetchIntervalSeconds: 300,
   supportedIntegrations: ["umami"],
   createOptions() {
     return optionsBuilder.from(

packages/widgets/src/ups/index.ts

@@ -7,6 +7,7 @@ import { optionsBuilder } from "../options";
 
 export const { definition, componentLoader } = createWidgetDefinition("ups", {
   icon: IconBatteryCharging,
+  refetchIntervalSeconds: 60,
   createOptions() {
     return optionsBuilder.from((factory) => ({
       showBattery: factory.switch({

packages/widgets/src/uptime-kuma/index.ts

@@ -5,6 +5,7 @@ import { optionsBuilder } from "../options";
 
 export const { definition, componentLoader } = createWidgetDefinition("uptimeKuma", {
   icon: IconHeartbeat,
+  refetchIntervalSeconds: 60,
   createOptions() {
     return optionsBuilder.from((factory) => ({
       showAverageUptime: factory.switch({

packages/widgets/src/vpn/index.ts

@@ -7,6 +7,7 @@ import { optionsBuilder } from "../options";
 
 export const { componentLoader, definition } = createWidgetDefinition("vpn", {
   icon: IconShieldLock,
+  refetchIntervalSeconds: 300,
   createOptions() {
     return optionsBuilder.from(() => ({}));
   },

packages/widgets/src/weather/index.ts

@@ -7,6 +7,7 @@ import { optionsBuilder } from "../options";
 
 export const { definition, componentLoader } = createWidgetDefinition("weather", {
   icon: IconCloud,
+  refetchIntervalSeconds: 60,
   createOptions() {
     return optionsBuilder.from(
       (factory) => ({

pnpm-workspace.yaml

@@ -18,7 +18,7 @@ catalog:
   "@gitbeaker/rest": ^43.8.0
   "@homarr/gridstack": ^1.12.0
   "@homarr/node-unifi": ^2.6.0
-  "@immich/sdk": ^3.0.1
+  "@immich/sdk": ^3.0.2
   "@jellyfin/sdk": ^0.13.0
   "@kubernetes/client-node": ^1.4.0
   "@modelcontextprotocol/sdk": 1.29.0
@@ -93,11 +93,11 @@ catalog:
   "@types/video.js": ^7.3.58
   "@types/ws": ^8.18.1
   "@types/xml2js": ^0.4.14
-  posthog-js: ^1.398.2
+  posthog-js: ^1.399.0
-  posthog-node: ^5.39.2
+  posthog-node: ^5.40.0
   "@vitejs/plugin-react": ^6.0.3
-  "@vitest/coverage-v8": ^4.1.9
+  "@vitest/coverage-v8": ^4.1.10
-  "@vitest/ui": ^4.1.9
+  "@vitest/ui": ^4.1.10
   "@xterm/addon-canvas": ^0.7.0
   "@xterm/addon-fit": 0.11.0
   "@xterm/xterm": ^6.0.0
@@ -139,20 +139,20 @@ catalog:
   jsonpath-plus: ^10.4.0
   ldapts: 8.1.8
   lodash.clonedeep: ^4.5.0
-  lucide-react: ^1.23.0
+  lucide-react: ^1.24.0
   "mantine-contextmenu": ^9.3.1
   mantine-datatable: ^9.3.1
   mantine-react-table: npm:mantine-react-table-open@9.0.3
   mcp-handler: ^1.1.0
   maria2: ^0.4.1
-  mysql2: 3.22.5
+  mysql2: 3.22.6
   next: 16.2.10
   next-auth: 5.0.0-beta.31
   next-intl: 4.13.1
   node-loader: ^2.1.0
   octokit: ^5.0.5
   oxfmt: ^0.58.0
-  oxlint: ^1.72.0
+  oxlint: ^1.73.0
   pg: ^8.22.0
   postcss-preset-mantine: ^1.18.0
   prismjs: ^1.30.0
@@ -177,13 +177,13 @@ catalog:
   tsdav: ^2.3.0
   tsx: 4.20.4
   turbo: ^2.10.4
-  typescript: ^6.0.3
+  typescript: "npm:@typescript/typescript6@^6.0.2"
-  vite: ^8.1.2
+  vite: ^8.1.4
   undici: 7.28.0
   use-deep-compare-effect: ^1.8.1
   video.js: ^8.23.9
   vite-tsconfig-paths: ^6.1.1
-  vitest: ^4.1.9
+  vitest: ^4.1.10
   winston: 3.19.0
   ws: ^8.21.0
   xml2js: ^0.6.2
@@ -229,7 +229,7 @@ overrides:
   "tar-fs@>=3.0.0 <3.0.9": ">=3.1.3"
   "tar-fs@>=2.0.0 <2.1.3": ">=3.1.3"
   "tmp@<=0.2.3": ">=0.2.7"
-  "vite@>=5.0.0 <=5.4.18": ">=8.1.3"
+  "vite@>=5.0.0 <=5.4.18": ">=8.1.4"
 patchedDependencies:
   "@types/node-unifi": "patches/@types__node-unifi.patch"
   "trpc-to-openapi": "patches/trpc-to-openapi.patch"

scripts/ci/act.sh

@@ -0,0 +1,97 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+mode="${1:-all}"
+case "$mode" in
+  fast) job="fast-gate" ;;
+  docker) job="container" ;;
+  all) job="" ;;
+  cleanup) job="cleanup" ;;
+  *)
+    echo "Usage: $0 {fast|docker|all|cleanup}" >&2
+    exit 2
+    ;;
+esac
+
+command -v act >/dev/null 2>&1 || {
+  echo "act is required: https://nektosact.com/installation/index.html" >&2
+  exit 1
+}
+
+docker info >/dev/null 2>&1 || {
+  echo "Docker is not running" >&2
+  exit 1
+}
+
+if [[ -z "${DOCKER_HOST:-}" ]]; then
+  DOCKER_HOST=$(docker context inspect --format '{{.Endpoints.docker.Host}}' 2>/dev/null || true)
+  export DOCKER_HOST
+fi
+
+head_sha=$(git rev-parse HEAD)
+base_sha=$(git rev-parse HEAD~1 2>/dev/null || echo "$head_sha")
+head_ref=$(git branch --show-current)
+head_ref=${head_ref:-act-local}
+event_file=$(mktemp "${TMPDIR:-/tmp}/homarr-act-event.XXXXXX")
+trap 'rm -f "$event_file"' EXIT
+
+json_escape() { printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g; s/\t/\\t/g'; }
+
+if [[ "$mode" == "cleanup" ]]; then
+  event_name="workflow_dispatch"
+  cat >"$event_file" <<EOF
+{
+  "inputs": { "operation": "cleanup", "pr_number": "1", "ref": "" },
+  "repository": { "full_name": "homarr-labs/homarr" }
+}
+EOF
+else
+  event_name="pull_request"
+  safe_ref=$(json_escape "$head_ref")
+  cat >"$event_file" <<EOF
+{
+  "action": "synchronize",
+  "number": 1,
+  "repository": { "full_name": "homarr-labs/homarr" },
+  "pull_request": {
+    "number": 1,
+    "draft": false,
+    "base": { "sha": "$base_sha", "ref": "dev" },
+    "head": {
+      "sha": "$head_sha",
+      "ref": "$safe_ref",
+      "repo": { "full_name": "homarr-labs/homarr" }
+    }
+  }
+}
+EOF
+fi
+
+runner_image="${ACT_RUNNER_IMAGE:-catthehacker/ubuntu:act-latest}"
+args=(
+  "$event_name"
+  --workflows .github/workflows/ci.yml
+  --eventpath "$event_file"
+  --platform "ubuntu-latest=$runner_image"
+  --container-architecture linux/amd64
+  --bind
+)
+
+if [[ -n "$job" ]]; then
+  args+=(--job "$job")
+fi
+
+git_common_dir=$(cd "$(git rev-parse --git-common-dir)" && pwd)
+container_options="--volume homarr-act-node-modules:$PWD/node_modules --volume homarr-act-pnpm-store:$PWD/.pnpm-store"
+case "$git_common_dir" in
+  "$PWD" | "$PWD"/*) ;;
+  *) container_options="$container_options --volume $git_common_dir:$git_common_dir:ro" ;;
+esac
+args+=(--container-options "$container_options")
+
+if [[ -n "${ACT_SECRET_FILE:-}" ]]; then
+  args+=(--secret-file "$ACT_SECRET_FILE")
+fi
+
+exec act "${args[@]}"

turbo.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://turborepo.org/schema.json",
-  "remoteCache": { "signature": false },
+  "remoteCache": { "signature": true },
   "globalEnv": ["CI", "NODE_ENV", "SKIP_ENV_VALIDATION"],
   "ui": "stream",
   "futureFlags": {
@@ -13,6 +13,7 @@
     },
     "build": {
       "dependsOn": ["^build"],
+      "env": ["TURBO_PLATFORM"],
       "inputs": [
         "$TURBO_DEFAULT$",
         "!**/*.test.ts",