fix(ci): repair docker build and consolidate CI/release workflows

The pnpm-fetch layer added in #6296 broke the release build: pnpm 11.10.0
applies patchedDependencies during `pnpm fetch`, before node_modules exists,
crashing with ENOENT. Install directly from the full context with the store
cache mounted instead.

Also audit and consolidate the workflows:
- standardize action majors (cache@v6, upload-artifact@v7, github-script@v9)
- provision Node from mise.toml via jdx/mise-action; drop .nvmrc
- rename deployment-docker-image.yml -> deployment-release.yml, reuse the
  shared setup action, and scope GITHUB_TOKEN permissions per job
- extract the duplicated beta/weekly release logic into a reusable
  deployment-release-pr.yml called by thin triggers

.dockerignore

@@ -6,7 +6,14 @@ npm-debug.log
 README.md
 .next
 .turbo
+.pnpm-store
+**/.pnpm-store
+coverage
+**/coverage
+**/.docusaurus
+**/build
 .git
+.github
 dev
 .build
 e2e

.github/act/.gitignore

@@ -0,0 +1,2 @@
+.secrets
+!.secrets.example

.github/act/.secrets.example

@@ -0,0 +1,4 @@
+TURBO_API=
+TURBO_TEAM=
+TURBO_TOKEN=
+TURBO_REMOTE_CACHE_SIGNATURE_KEY=

.github/act/README.md

@@ -0,0 +1,36 @@
+# Running CI locally
+
+Install [Act](https://nektosact.com/installation/index.html) and ensure Docker is running, then use:
+
+```bash
+pnpm ci:act:fast
+pnpm ci:act:docker
+pnpm ci:act:all
+pnpm ci:act:cleanup
+```
+
+`fast` runs the quality gate. `docker` and `all` run the gate followed by the single container build, E2E suite, and memory regression test. `cleanup` validates the manual cleanup path without calling GitHub. The wrapper supports regular clones and Git worktrees, including non-default Docker contexts. Linux dependencies are kept in Docker volumes instead of overwriting host `node_modules`. The first run downloads the Act runner and Playwright browser dependencies.
+
+Remote caching is optional locally. Copy `.github/act/.secrets.example` to `.github/act/.secrets`, populate it with rotated credentials, and run with:
+
+```bash
+ACT_SECRET_FILE=.github/act/.secrets pnpm ci:act:all
+```
+
+Act never publishes or deletes GHCR images. The secret file is ignored by Git.
+
+## PR preview images
+
+Successful non-draft pull requests from this repository publish an amd64 image:
+
+```bash
+docker pull ghcr.io/homarr-labs/homarr-test:pr-<number>
+```
+
+The tag is replaced when the pull request is updated and deleted when it closes. Production Homarr images remain the supported multi-architecture releases. The `homarr-test` package must be configured as public in GHCR for unauthenticated testers.
+
+## Dokploy preview cache
+
+Keep `needs-demo` as the Dokploy preview label. Under the application's **Preview Build-time Secrets**, configure `TURBO_API`, `TURBO_TEAM`, `TURBO_TOKEN`, and `TURBO_REMOTE_CACHE_SIGNATURE_KEY`. Dokploy passes these to the Dockerfile as BuildKit secrets. Do not configure the token or signature key as Docker build arguments.
+
+Rotate any credentials that have appeared in chat, logs, or committed configuration before enabling the cache.

.github/pull_request_template.md

@@ -11,3 +11,11 @@
 - [ ] Commits follow the [conventional commits guideline](https://www.conventionalcommits.org/en/v1.0.0/)
 - [ ] No shorthand variable names are used (eg. `x`, `y`, `i` or any abbrevation)
 - [ ] Documentation is up to date. Create a pull request [here](https://github.com/homarr-labs/documentation/).
+- [ ] When using AI; No temp files are checked in, the code style follows the rest of the project
+
+**When contributing a new integration or widget:**
+
+- [ ] I confirmed manually that the integration or widget is working with a real system and performed basic smoke
+  tests (e.g. what happens if it is offline)
+- [ ] Optional but recommended: I confirm that I am willing to be added to the `CODEOWNERS` of this feature and will
+  provide support and maintain the integration (e.g. in case of breaking or failure)

.github/workflows/autofix.yml

@@ -0,0 +1,48 @@
+name: Auto-fix lint and format
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+    branches: ["*"]
+
+permissions:
+  contents: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  autofix:
+    name: Auto-fix
+    if: github.event.pull_request.head.repo.id == github.repository_id
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          ref: ${{ github.head_ref }}
+          persist-credentials: false
+
+      - name: Setup
+        uses: ./tooling/github/setup
+
+      - name: Get changed files
+        id: changed
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: |
+          git diff --name-only --diff-filter=ACMR "origin/${BASE_REF}...HEAD" -- '*.ts' '*.tsx' '*.js' '*.jsx' > /tmp/changed-files
+          echo "count=$(wc -l < /tmp/changed-files | tr -d '[:space:]')" >> $GITHUB_OUTPUT
+
+      - name: Auto-fix lint + format
+        if: steps.changed.outputs.count != '0'
+        run: |
+          xargs -r -a /tmp/changed-files pnpm exec oxlint --fix || true
+          xargs -r -a /tmp/changed-files pnpm exec oxfmt --write
+
+      - name: Commit fixes
+        uses: stefanzweifel/git-auto-commit-action@v7
+        with:
+          commit_message: "style: auto-fix lint and format"

.github/workflows/ci.yml

@@ -0,0 +1,347 @@
+name: CI
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    branches: ["*"]
+  pull_request_target:
+    types: [closed]
+    branches: ["*"]
+  push:
+    branches: [main, dev, beta, next]
+  merge_group:
+  workflow_dispatch:
+    inputs:
+      operation:
+        description: Operation to run
+        required: true
+        default: validate
+        type: choice
+        options:
+          - validate
+          - publish
+          - cleanup
+      pr_number:
+        description: PR number for publish or cleanup
+        required: false
+        type: number
+      ref:
+        description: Git ref to validate or publish
+        required: false
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || inputs.pr_number || github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+env:
+  FORCE_COLOR: 3
+  SKIP_ENV_VALIDATION: true
+  TURBO_TELEMETRY_DISABLED: 1
+  REGISTRY: ghcr.io
+  PREVIEW_IMAGE: ghcr.io/homarr-labs/homarr-test
+
+jobs:
+  fast-gate:
+    name: Fast gate
+    if: github.event_name != 'pull_request_target' && (github.event_name != 'workflow_dispatch' || inputs.operation != 'cleanup')
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      TURBO_API: ${{ secrets.TURBO_API }}
+      TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
+      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+      TURBO_REMOTE_CACHE_SIGNATURE_KEY: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
+      TURBO_SCM_BASE: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha || github.event.before || 'HEAD~1' }}
+      TURBO_SCM_HEAD: ${{ github.sha }}
+      TURBO_PLATFORM: linux/amd64
+    steps:
+      - uses: actions/checkout@v7
+        if: '!env.ACT'
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }}
+
+      - name: Validate manual inputs
+        if: github.event_name == 'workflow_dispatch' && inputs.operation == 'publish'
+        env:
+          PR_NUMBER: ${{ inputs.pr_number }}
+          BUILD_REF: ${{ inputs.ref }}
+        run: |
+          test -n "$PR_NUMBER" || { echo "pr_number is required for publish"; exit 1; }
+          test -n "$BUILD_REF" || { echo "ref is required for publish"; exit 1; }
+
+      - name: Setup
+        uses: ./tooling/github/setup
+
+      - name: Copy environment defaults
+        run: cp .env.example .env
+
+      - name: Check formatting in affected workspaces
+        run: pnpm turbo run format --affected --continue -- --check
+
+      - name: Lint, typecheck, and build affected workspaces
+        run: pnpm turbo run lint typecheck build --affected --continue=dependencies-successful
+
+      - name: Validate workspace configuration
+        run: pnpm lint:ws
+
+      - name: Run unit tests
+        run: pnpm test
+
+      - name: Report coverage
+        if: always() && !env.ACT
+        uses: davelosert/vitest-coverage-report-action@v2
+
+  container:
+    name: Container, E2E, and memory
+    needs: fast-gate
+    if: |
+      github.event_name == 'merge_group' ||
+      (github.event_name == 'pull_request' && github.event.pull_request.draft == false) ||
+      (github.event_name == 'workflow_dispatch' && (inputs.operation == 'validate' || inputs.operation == 'publish'))
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v7
+        if: '!env.ACT'
+        with:
+          persist-credentials: false
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }}
+
+      - name: Setup
+        uses: ./tooling/github/setup
+
+      - name: Set up Docker Buildx
+        if: '!env.ACT'
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build container once
+        if: '!env.ACT'
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          network: host
+          platforms: linux/amd64
+          load: true
+          push: false
+          tags: |
+            homarr-ci
+            homarr-e2e
+          labels: |
+            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.ref.name=pr-${{ github.event.pull_request.number || inputs.pr_number || 'none' }}
+          cache-from: type=gha,scope=homarr-linux-amd64
+          cache-to: type=gha,scope=homarr-linux-amd64,mode=max
+          secrets: |
+            TURBO_API=${{ secrets.TURBO_API }}
+            TURBO_TEAM=${{ secrets.TURBO_TEAM }}
+            TURBO_TOKEN=${{ secrets.TURBO_TOKEN }}
+            TURBO_REMOTE_CACHE_SIGNATURE_KEY=${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
+
+      - name: Build container once with Act
+        if: env.ACT
+        env:
+          TURBO_API: ${{ secrets.TURBO_API }}
+          TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
+          TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+          TURBO_REMOTE_CACHE_SIGNATURE_KEY: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
+        run: |
+          secret_args=()
+          for secret in TURBO_API TURBO_TEAM TURBO_TOKEN TURBO_REMOTE_CACHE_SIGNATURE_KEY; do
+            if [ -n "${!secret:-}" ]; then
+              secret_args+=(--secret "id=${secret},env=${secret}")
+            fi
+          done
+          DOCKER_BUILDKIT=1 docker build --platform linux/amd64 \
+            --tag homarr-ci --tag homarr-e2e "${secret_args[@]}" .
+
+      - name: Cache Playwright browsers
+        if: '!env.ACT'
+        id: playwright-cache
+        uses: actions/cache@v6
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
+
+      - name: Install Playwright Chromium
+        if: steps.playwright-cache.outputs.cache-hit != 'true' || env.ACT
+        run: pnpm exec playwright install --with-deps chromium
+
+      - name: Install Playwright system deps
+        if: steps.playwright-cache.outputs.cache-hit == 'true'
+        run: pnpm exec playwright install-deps chromium
+
+      - name: Run E2E tests
+        run: pnpm test:e2e
+
+      - name: Upload E2E artifacts
+        if: failure() && !env.ACT
+        uses: actions/upload-artifact@v7
+        with:
+          name: playwright-report
+          path: e2e/test-results/
+          retention-days: 7
+
+      - name: Run memory regression test
+        env:
+          CONTAINER_NAME: homarr-mem-${{ github.run_id }}-${{ github.run_attempt }}
+          SECRET_ENCRYPTION_KEY: 0000000000000000000000000000000000000000000000000000000000000000
+        run: |
+          docker run -d --name "$CONTAINER_NAME" -p 127.0.0.1::7575 \
+            -e NO_EXTERNAL_CONNECTION=true \
+            -e SECRET_ENCRYPTION_KEY="$SECRET_ENCRYPTION_KEY" \
+            homarr-ci
+          PORT=$(docker port "$CONTAINER_NAME" 7575/tcp | sed 's/.*://')
+          [[ "$PORT" =~ ^[0-9]+$ ]] || { echo "ERROR: invalid port mapping: '$PORT'"; exit 1; }
+          URL="http://127.0.0.1:${PORT}"
+
+          healthy=false
+          for i in $(seq 1 30); do
+            if curl -sf "$URL/api/health/ready" >/dev/null 2>&1; then
+              echo "Container healthy after $((i * 2))s"
+              healthy=true
+              break
+            fi
+            sleep 2
+          done
+
+          if [ "$healthy" != "true" ]; then
+            echo "ERROR: Container never became healthy"
+            docker logs "$CONTAINER_NAME" --tail 100
+            exit 1
+          fi
+
+          warmup_ok=0
+          for _ in $(seq 1 5); do
+            curl -sf "$URL/" >/dev/null 2>&1 && warmup_ok=$((warmup_ok + 1))
+            sleep 2
+          done
+          if [ "$warmup_ok" -eq 0 ]; then
+            echo "ERROR: All warmup requests failed"
+            docker logs "$CONTAINER_NAME" --tail 50
+            exit 1
+          fi
+
+          docker inspect -f '{{.State.Running}}' "$CONTAINER_NAME" | grep -qx true || {
+            echo "ERROR: Container died before memory measurement"
+            docker logs "$CONTAINER_NAME" --tail 100
+            exit 1
+          }
+
+          RAW_MEMORY=$(docker stats --no-stream --format '{{.MemUsage}}' "$CONTAINER_NAME" | sed 's| /.*||')
+          MEMORY_MB=$(echo "$RAW_MEMORY" | awk '
+            /GiB/ { gsub(/GiB/, ""); print $1 * 1024; next }
+            /MiB/ { gsub(/MiB/, ""); print $1; next }
+            /KiB/ { gsub(/KiB/, ""); print $1 / 1024; next }
+            { print $1 / 1048576 }
+          ')
+
+          echo "Memory usage: ${MEMORY_MB} MB (${RAW_MEMORY})"
+          [[ "$MEMORY_MB" =~ ^[0-9]+(\.[0-9]+)?$ ]] || {
+            echo "ERROR: non-numeric memory value: '$MEMORY_MB' (raw: '$RAW_MEMORY')"
+            docker logs "$CONTAINER_NAME" --tail 100
+            exit 1
+          }
+          if awk "BEGIN { exit !($MEMORY_MB < 50) }"; then
+            echo "ERROR: Memory suspiciously low (${MEMORY_MB} MB) — container may have crashed"
+            docker logs "$CONTAINER_NAME" --tail 100
+            exit 1
+          elif awk "BEGIN { exit !($MEMORY_MB > 700) }"; then
+            echo "ERROR: Memory usage ${MEMORY_MB} MB exceeds 700 MB"
+            docker logs "$CONTAINER_NAME" --tail 100
+            exit 1
+          fi
+
+      - name: Clean up memory test container
+        if: always()
+        env:
+          CONTAINER_NAME: homarr-mem-${{ github.run_id }}-${{ github.run_attempt }}
+        run: docker rm -f "$CONTAINER_NAME" >/dev/null 2>&1 || true
+
+      - name: Determine preview tag
+        id: preview
+        if: |
+          !env.ACT &&
+          (
+            (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) ||
+            (github.event_name == 'workflow_dispatch' && inputs.operation == 'publish')
+          )
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number || inputs.pr_number }}
+        run: echo "tag=pr-${PR_NUMBER}" >> "$GITHUB_OUTPUT"
+
+      - name: Log in to GHCR
+        if: steps.preview.outputs.tag != ''
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Push preview image
+        if: steps.preview.outputs.tag != ''
+        env:
+          PREVIEW_TAG: ${{ steps.preview.outputs.tag }}
+        run: |
+          docker tag homarr-ci "${PREVIEW_IMAGE}:${PREVIEW_TAG}"
+          docker push "${PREVIEW_IMAGE}:${PREVIEW_TAG}"
+
+      - name: Show Act publication result
+        if: env.ACT
+        run: echo "Act validated the publication path; external GHCR writes are disabled locally."
+
+  cleanup:
+    name: Clean up preview image
+    if: github.event_name == 'pull_request_target' || (github.event_name == 'workflow_dispatch' && inputs.operation == 'cleanup')
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      packages: write
+    env:
+      IMAGE_TAG: pr-${{ github.event.pull_request.number || inputs.pr_number }}
+    steps:
+      - name: Validate cleanup input
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          PR_NUMBER: ${{ inputs.pr_number }}
+        run: test -n "$PR_NUMBER" || { echo "pr_number is required for cleanup"; exit 1; }
+
+      - name: Delete GHCR package version
+        if: '!env.ACT'
+        uses: actions/github-script@v9
+        with:
+          script: |
+            const packageName = "homarr-test";
+            const org = context.repo.owner;
+            const tag = process.env.IMAGE_TAG;
+            const versions = await github.paginate(
+              github.rest.packages.getAllPackageVersionsForPackageOwnedByOrg,
+              { package_type: "container", package_name: packageName, org, per_page: 100 },
+            );
+            const target = versions.find((version) =>
+              version.metadata?.container?.tags?.includes(tag),
+            );
+            if (!target) {
+              core.info(`No package version found with tag "${tag}"`);
+              return;
+            }
+            await github.rest.packages.deletePackageVersionForOrg({
+              package_type: "container",
+              package_name: packageName,
+              org,
+              package_version_id: target.id,
+            });
+            core.info(`Deleted package version ${target.id} (${tag})`);
+
+      - name: Show Act cleanup result
+        if: env.ACT
+        run: echo "Act validated cleanup for ${IMAGE_TAG}; external GHCR writes are disabled locally."

.github/workflows/code-quality.yml

@@ -1,165 +0,0 @@
-name: "[Quality] Code Analysis"
-permissions:
-  contents: read
-
-on:
-  pull_request:
-    branches: ["*"]
-  push:
-    branches: ["main"]
-  merge_group:
-
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}"
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
-
-env:
-  FORCE_COLOR: 3
-  SKIP_ENV_VALIDATION: true
-  TURBO_API: ${{ secrets.TURBO_API }}
-  TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
-  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
-  TURBO_REMOTE_CACHE_SIGNATURE_KEY: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
-  TURBO_SCM_BASE: ${{ github.event.pull_request.base.sha || github.event.before || 'HEAD~1' }}
-  TURBO_SCM_HEAD: ${{ github.sha }}
-
-jobs:
-  lint-format-autofix:
-    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.id == github.repository_id
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-          ref: ${{ github.head_ref }}
-
-      - name: Setup
-        uses: ./tooling/github/setup
-
-      - name: Get changed files
-        id: changed
-        run: |
-          git diff --name-only --diff-filter=ACMR origin/${{ github.base_ref }}...HEAD -- '*.ts' '*.tsx' '*.js' '*.jsx' > /tmp/changed-files
-          echo "count=$(wc -l < /tmp/changed-files | tr -d '[:space:]')" >> $GITHUB_OUTPUT
-
-      - name: Auto-fix lint + format
-        if: steps.changed.outputs.count != '0'
-        run: |
-          xargs -r -a /tmp/changed-files pnpm exec oxlint --fix || true
-          xargs -r -a /tmp/changed-files pnpm exec oxfmt --write
-
-      - name: Commit fixes
-        uses: stefanzweifel/git-auto-commit-action@v7
-        with:
-          commit_message: "style: auto-fix lint and format"
-
-  lint:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-
-      - name: Setup
-        uses: ./tooling/github/setup
-
-      - name: Copy env
-        shell: bash
-        run: cp .env.example .env
-
-      - name: Lint
-        run: pnpm turbo lint --affected && pnpm lint:ws
-
-  format:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-
-      - name: Setup
-        uses: ./tooling/github/setup
-
-      - name: Format
-        run: pnpm turbo format --affected --continue
-
-  typecheck:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-
-      - name: Setup
-        uses: ./tooling/github/setup
-
-      - name: Typecheck
-        run: pnpm turbo typecheck --affected
-
-  test:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Setup
-        uses: ./tooling/github/setup
-
-      - name: Test
-        run: pnpm test
-
-      - name: "Report Coverage"
-        # Set if: always() to also generate the report if tests are failing
-        # Only works if you set `reportOnFailure: true` in your vite config as specified above
-        if: always()
-        uses: davelosert/vitest-coverage-report-action@v2
-
-  e2e:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v7
-      - name: Setup
-        uses: ./tooling/github/setup
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-      - name: Build docker image
-        id: build-docker-image
-        uses: docker/build-push-action@v7
-        with:
-          platforms: linux/amd64
-          context: .
-          push: false
-          load: true
-          tags: homarr-e2e
-          network: host
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-        env:
-          SKIP_ENV_VALIDATION: true
-      - name: Install playwright browsers
-        run: pnpm exec playwright install chromium
-      - name: Run E2E Tests
-        shell: bash
-        run: pnpm test:e2e
-
-  build:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-      - name: Setup
-        uses: ./tooling/github/setup
-      - name: Copy env
-        shell: bash
-        run: cp .env.example .env
-      - name: Build
-        run: pnpm turbo build --affected

.github/workflows/deployment-beta-release.yml

@@ -14,91 +14,18 @@ permissions:
   pull-requests: write
 
 jobs:
-  create-and-merge-pr:
-    runs-on: ubuntu-latest
-    timeout-minutes: 2
-    steps:
-      - name: Discord notification
-        if: ${{ github.event.inputs.send-notifications }}
-        env:
-          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
-        uses: Ilshidur/action-discord@0.4.0
-        with:
-          args: "Beta release has been triggered: [run ${{ github.run_number }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})"
-      - name: Checkout repository
-        uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-      - name: Get Next Version
-        id: semver
-        uses: ietf-tools/semver-action@v1
-        with:
-          token: ${{ github.token }}
-          branch: next
-      - name: Create pull request
-        id: create-pull-request
-        run: 'gh pr create --title "chore(release): release ${{ steps.semver.outputs.next }}-beta" --body "Detected change to be ``${{ steps.semver.outputs.bump }}``<br/>Bump version from ``${{ steps.semver.outputs.current }}`` to ``${{ steps.semver.outputs.next }}-beta``" --base beta --head next --label automerge'
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-      - name: Discord notification
-        if: ${{ github.event.inputs.send-notifications }}
-        env:
-          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
-        uses: Ilshidur/action-discord@0.4.0
-        with:
-          args: "Created a release PR ${{ steps.create-pull-request.outputs.url }} for version ${{ steps.semver.outputs.next }}-beta (new behaviour: ${{ steps.semver.outputs.bump }})"
-      - name: Obtain token
-        id: obtainApprovalToken
-        uses: actions/create-github-app-token@v3
-        with:
-          private-key: ${{ secrets.RENOVATE_APPROVE_PRIVATE_KEY }}
-          client-id: ${{ secrets.RENOVATE_APPROVE_APP_ID }}
-          permission-pull-requests: write
-      - name: Approve PR
-        env:
-          GITHUB_TOKEN: ${{ steps.obtainApprovalToken.outputs.token }}
-        run: |
-          gh pr review --approve --body "Automatically approved by GitHub Action"
-      - name: Obtain token
-        id: obtainMergeToken
-        uses: actions/create-github-app-token@v3
-        with:
-          private-key: ${{ secrets.RENOVATE_MERGE_PRIVATE_KEY }}
-          client-id: ${{ secrets.RENOVATE_MERGE_APP_ID }}
-          permission-contents: write # write to beta branch (due to merge)
-          permission-pull-requests: write # merge pull request
-      - id: automerge
-        if: ${{ steps.semver.outputs.bump != 'major' }}
-        name: automerge
-        uses: "pascalgn/automerge-action@v0.16.4"
-        env:
-          GITHUB_TOKEN: ${{ steps.obtainMergeToken.outputs.token }}
-          MERGE_METHOD: merge # we prefer merge commits for merging to beta
-          MERGE_COMMIT_MESSAGE: "chore(release): release ${{ steps.semver.outputs.next }}-beta"
-          MERGE_DELETE_BRANCH: false # never set to true!
-          PULL_REQUEST: "${{ steps.create-pull-request.outputs.pr_number }}"
-          MERGE_RETRIES: 20 # 20 retries * MERGE_RETRY_SLEEP until step fails
-          MERGE_RETRY_SLEEP: 10000 # 10 seconds * MERGE_RETRIES until step fails
-          MERGE_REQUIRED_APPROVALS: 0 # do not require approvals
-
-      - name: Merged Discord notification
-        if: ${{ steps.automerge.outputs.mergeResult == 'merged' && github.event.inputs.send-notifications }}
-        env:
-          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
-        uses: Ilshidur/action-discord@0.4.0
-        with:
-          args: "Merged PR ${{ steps.create-pull-request.outputs.url }} for release ${{ steps.semver.outputs.next }}-beta"
-      - name: Major Bump Discord notification
-        if: ${{ steps.semver.outputs.bump == 'major' && github.event.inputs.send-notifications }}
-        env:
-          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
-        uses: Ilshidur/action-discord@0.4.0
-        with:
-          args: "The release PR must be manually merged because the next version is a major version: ${{ steps.create-pull-request.outputs.url }} for release ${{ steps.semver.outputs.next }}-beta"
-      - name: Discord Fail Notification
-        if: failure() && github.event.inputs.send-notifications
-        env:
-          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
-        uses: Ilshidur/action-discord@0.4.0
-        with:
-          args: "The beta release workflow [run ${{ github.run_number }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) has failed"
+  release:
+    # Permissions must be set on the calling job: a reusable workflow receives
+    # the default GITHUB_TOKEN permissions unless the caller job grants them here.
+    permissions:
+      contents: write
+      pull-requests: write
+    uses: ./.github/workflows/deployment-release-pr.yml
+    secrets: inherit
+    with:
+      release-label: "Beta release"
+      version-suffix: "-beta"
+      semver-branch: next
+      head: next
+      base: beta
+      send-notifications: ${{ github.event.inputs.send-notifications == 'true' }}

.github/workflows/deployment-release-pr.yml

@@ -0,0 +1,155 @@
+name: "[Deployment] Release PR (reusable)"
+
+# Reusable workflow that opens a release PR from `head` into `base`, auto-approves
+# it and (for non-major bumps) merges it. Used by the beta and weekly release
+# workflows, which differ only in branch, version suffix and notification wording.
+
+on:
+  workflow_call:
+    inputs:
+      release-label:
+        description: 'Human label used in notifications, e.g. "Beta release"'
+        required: true
+        type: string
+      title-prefix:
+        description: 'Text inserted before "release" in the PR title/commit, e.g. "automatic "'
+        required: false
+        default: ""
+        type: string
+      version-suffix:
+        description: 'Suffix appended to the computed version, e.g. "-beta"'
+        required: false
+        default: ""
+        type: string
+      body-prefix:
+        description: "Extra HTML prepended to the PR body"
+        required: false
+        default: ""
+        type: string
+      semver-branch:
+        description: "Branch used to compute the next version"
+        required: true
+        type: string
+      head:
+        description: "PR head branch"
+        required: true
+        type: string
+      base:
+        description: "PR base branch"
+        required: true
+        type: string
+      send-notifications:
+        description: "Whether to send Discord notifications"
+        required: false
+        default: true
+        type: boolean
+
+jobs:
+  create-and-merge-pr:
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Discord notification
+        if: inputs.send-notifications
+        env:
+          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
+        uses: Ilshidur/action-discord@0.4.0
+        with:
+          args: "${{ inputs.release-label }} has been triggered: [run ${{ github.run_number }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})"
+
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Get Next Version
+        id: semver
+        uses: ietf-tools/semver-action@v1
+        with:
+          token: ${{ github.token }}
+          branch: ${{ inputs.semver-branch }}
+
+      - name: Create pull request
+        id: create-pull-request
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: "${{ steps.semver.outputs.next }}${{ inputs.version-suffix }}"
+        run: >-
+          gh pr create
+          --title "chore(release): ${{ inputs.title-prefix }}release ${VERSION}"
+          --body "${{ inputs.body-prefix }}Detected change to be \`${{ steps.semver.outputs.bump }}\`<br/>Bump version from \`${{ steps.semver.outputs.current }}\` to \`${VERSION}\`"
+          --base ${{ inputs.base }}
+          --head ${{ inputs.head }}
+          --label automerge
+
+      - name: Discord notification
+        if: inputs.send-notifications
+        env:
+          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
+        uses: Ilshidur/action-discord@0.4.0
+        with:
+          args: "Created a release PR ${{ steps.create-pull-request.outputs.url }} for version ${{ steps.semver.outputs.next }}${{ inputs.version-suffix }} (new behaviour: ${{ steps.semver.outputs.bump }})"
+
+      - name: Obtain token
+        id: obtainApprovalToken
+        uses: actions/create-github-app-token@v3
+        with:
+          private-key: ${{ secrets.RENOVATE_APPROVE_PRIVATE_KEY }}
+          client-id: ${{ secrets.RENOVATE_APPROVE_APP_ID }}
+          permission-pull-requests: write
+
+      - name: Approve PR
+        env:
+          GITHUB_TOKEN: ${{ steps.obtainApprovalToken.outputs.token }}
+        run: |
+          gh pr review --approve --body "Automatically approved by GitHub Action"
+
+      - name: Obtain token
+        id: obtainMergeToken
+        uses: actions/create-github-app-token@v3
+        with:
+          private-key: ${{ secrets.RENOVATE_MERGE_PRIVATE_KEY }}
+          client-id: ${{ secrets.RENOVATE_MERGE_APP_ID }}
+          permission-contents: write # write to the base branch (due to merge)
+          permission-pull-requests: write # merge pull request
+
+      - id: automerge
+        if: ${{ steps.semver.outputs.bump != 'major' }}
+        name: automerge
+        uses: "pascalgn/automerge-action@v0.16.4"
+        env:
+          GITHUB_TOKEN: ${{ steps.obtainMergeToken.outputs.token }}
+          MERGE_METHOD: merge # we prefer merge commits for release branches
+          MERGE_COMMIT_MESSAGE: "chore(release): ${{ inputs.title-prefix }}release ${{ steps.semver.outputs.next }}${{ inputs.version-suffix }}"
+          MERGE_DELETE_BRANCH: false # never set to true!
+          PULL_REQUEST: "${{ steps.create-pull-request.outputs.pr_number }}"
+          MERGE_RETRIES: 20 # 20 retries * MERGE_RETRY_SLEEP until step fails
+          MERGE_RETRY_SLEEP: 10000 # 10 seconds * MERGE_RETRIES until step fails
+          MERGE_REQUIRED_APPROVALS: 0 # do not require approvals
+
+      - name: Merged Discord notification
+        if: ${{ steps.automerge.outputs.mergeResult == 'merged' && inputs.send-notifications }}
+        env:
+          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
+        uses: Ilshidur/action-discord@0.4.0
+        with:
+          args: "Merged PR ${{ steps.create-pull-request.outputs.url }} for release ${{ steps.semver.outputs.next }}${{ inputs.version-suffix }}"
+
+      - name: Major Bump Discord notification
+        if: ${{ steps.semver.outputs.bump == 'major' && inputs.send-notifications }}
+        env:
+          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
+        uses: Ilshidur/action-discord@0.4.0
+        with:
+          args: "The release PR must be manually merged because the next version is a major version: ${{ steps.create-pull-request.outputs.url }} for release ${{ steps.semver.outputs.next }}${{ inputs.version-suffix }}"
+
+      - name: Discord Fail Notification
+        if: failure() && inputs.send-notifications
+        env:
+          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
+        uses: Ilshidur/action-discord@0.4.0
+        with:
+          args: "The ${{ inputs.release-label }} workflow [run ${{ github.run_number }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) has failed"

.github/workflows/deployment-release.yml

@@ -15,9 +15,9 @@ on:
         default: true
         description: Send notifications
 
+# Least-privilege default; each job widens only what it needs.
 permissions:
-  contents: write # Required to update package.json version
-  packages: write # Required for pushing to GHCR
+  contents: read
 
 env:
   SKIP_ENV_VALIDATION: true
@@ -34,6 +34,8 @@ jobs:
     name: Create tag and release
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    permissions:
+      contents: write # commit package.json/changelog, push tags, update dev/next
     env:
       SKIP_RELEASE: ${{ github.event_name == 'workflow_dispatch' || github.ref_name == 'dev' || github.ref_name == 'next' }}
     outputs:
@@ -61,19 +63,9 @@ jobs:
         if: env.SKIP_RELEASE == 'false'
         with:
           persist-credentials: false
-      - uses: pnpm/action-setup@v6
+      - name: Setup
         if: env.SKIP_RELEASE == 'false'
-      - uses: actions/setup-node@v6
-        if: env.SKIP_RELEASE == 'false'
-        with:
-          node-version: 24.18.0
-          package-manager-cache: false
-      - run: npm i -g pnpm
-        if: env.SKIP_RELEASE == 'false'
-      - name: Install dependencies
-        if: env.SKIP_RELEASE == 'false'
-        run: |
-          pnpm install
+        uses: ./tooling/github/setup
       - name: Run Semantic Release
         if: env.SKIP_RELEASE == 'false'
         env:
@@ -116,6 +108,9 @@ jobs:
     needs: release
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    permissions:
+      contents: read # checkout the repository
+      packages: write # push image by digest to GHCR
     outputs:
       digest: ${{ steps.build.outputs.digest }}
     steps:
@@ -148,6 +143,11 @@ jobs:
           platforms: linux/amd64
           labels: ${{ steps.meta.outputs.labels }}
           outputs: type=image,"name=${{ env.GHCR_REPO }}",push-by-digest=true,name-canonical=true,push=true
+          secrets: |
+            TURBO_API=${{ secrets.TURBO_API }}
+            TURBO_TEAM=${{ secrets.TURBO_TEAM }}
+            TURBO_TOKEN=${{ secrets.TURBO_TOKEN }}
+            TURBO_REMOTE_CACHE_SIGNATURE_KEY=${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
         env:
           SKIP_ENV_VALIDATION: true
   build-arm64:
@@ -155,6 +155,9 @@ jobs:
     needs: release
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 20
+    permissions:
+      contents: read # checkout the repository
+      packages: write # push image by digest to GHCR
     outputs:
       digest: ${{ steps.build.outputs.digest }}
     steps:
@@ -187,6 +190,11 @@ jobs:
           platforms: linux/arm64
           labels: ${{ steps.meta.outputs.labels }}
           outputs: type=image,"name=${{ env.GHCR_REPO }}",push-by-digest=true,name-canonical=true,push=true
+          secrets: |
+            TURBO_API=${{ secrets.TURBO_API }}
+            TURBO_TEAM=${{ secrets.TURBO_TEAM }}
+            TURBO_TOKEN=${{ secrets.TURBO_TOKEN }}
+            TURBO_REMOTE_CACHE_SIGNATURE_KEY=${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
         env:
           SKIP_ENV_VALIDATION: true
   extract-asset-amd64:
@@ -194,6 +202,8 @@ jobs:
     needs: [release, build-amd64]
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    permissions:
+      contents: write # upload build artifacts as release assets
     steps:
       - name: Extract amd64
         if: needs.release.outputs.skipped == 'false'
@@ -210,6 +220,8 @@ jobs:
     needs: [release, build-arm64]
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 5
+    permissions:
+      contents: write # upload build artifacts as release assets
     steps:
       - name: Extract arm64
         if: needs.release.outputs.skipped == 'false'
@@ -225,6 +237,9 @@ jobs:
     needs: [release, build-amd64, build-arm64, extract-asset-amd64, extract-asset-arm64]
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    permissions:
+      contents: write # mark GitHub release as published (undraft)
+      packages: write # create multi-arch image tags in GHCR
     env:
       NEXT_VERSION: ${{ needs.release.outputs.version }}
       DEPLOY_LATEST: ${{ github.ref_name == 'main' }}

.github/workflows/deployment-weekly-release.yml

@@ -17,91 +17,20 @@ permissions:
   pull-requests: write
 
 jobs:
-  create-and-merge-pr:
-    runs-on: ubuntu-latest
-    timeout-minutes: 2
-    steps:
-      - name: Discord notification
-        if: ${{ github.event.inputs.send-notifications }}
-        env:
-          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
-        uses: Ilshidur/action-discord@0.4.0
-        with:
-          args: "Automatic release has been triggered: [run ${{ github.run_number }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})"
-      - name: Checkout repository
-        uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-      - name: Get Next Version
-        id: semver
-        uses: ietf-tools/semver-action@v1
-        with:
-          token: ${{ github.token }}
-          branch: dev
-      - name: Create pull request
-        id: create-pull-request
-        run: 'gh pr create --title "chore(release): automatic release ${{ steps.semver.outputs.next }}" --body "**This is an automatic release**.<br/>Manual action may be required for major bumps.<br/>Detected change to be ``${{ steps.semver.outputs.bump }}``<br/>Bump version from ``${{ steps.semver.outputs.current }}`` to ``${{ steps.semver.outputs.next }}``" --base main --head dev --label automerge'
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-      - name: Discord notification
-        if: ${{ github.event.inputs.send-notifications }}
-        env:
-          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
-        uses: Ilshidur/action-discord@0.4.0
-        with:
-          args: "Created a release PR ${{ steps.create-pull-request.outputs.url }} for version ${{ steps.semver.outputs.next }} (new behaviour: ${{ steps.semver.outputs.bump }})"
-      - name: Obtain token
-        id: obtainApprovalToken
-        uses: actions/create-github-app-token@v3
-        with:
-          private-key: ${{ secrets.RENOVATE_APPROVE_PRIVATE_KEY }}
-          client-id: ${{ secrets.RENOVATE_APPROVE_APP_ID }}
-          permission-pull-requests: write
-      - name: Approve PR
-        env:
-          GITHUB_TOKEN: ${{ steps.obtainApprovalToken.outputs.token }}
-        run: |
-          gh pr review --approve --body "Automatically approved by GitHub Action"
-      - name: Obtain token
-        id: obtainMergeToken
-        uses: actions/create-github-app-token@v3
-        with:
-          private-key: ${{ secrets.RENOVATE_MERGE_PRIVATE_KEY }}
-          client-id: ${{ secrets.RENOVATE_MERGE_APP_ID }}
-          permission-contents: write # write to main branch (due to merge)
-          permission-pull-requests: write # merge pull request
-      - id: automerge
-        if: ${{ steps.semver.outputs.bump != 'major' }}
-        name: automerge
-        uses: "pascalgn/automerge-action@v0.16.4"
-        env:
-          GITHUB_TOKEN: ${{ steps.obtainMergeToken.outputs.token }}
-          MERGE_METHOD: merge # we prefer merge commits for merging to main
-          MERGE_COMMIT_MESSAGE: "chore(release): automatic release ${{ steps.semver.outputs.next }}"
-          MERGE_DELETE_BRANCH: false # never set to true!
-          PULL_REQUEST: "${{ steps.create-pull-request.outputs.pr_number }}"
-          MERGE_RETRIES: 20 # 20 retries * MERGE_RETRY_SLEEP until step fails
-          MERGE_RETRY_SLEEP: 10000 # 10 seconds * MERGE_RETRIES until step fails
-          MERGE_REQUIRED_APPROVALS: 0 # do not require approvals
-
-      - name: Merged Discord notification
-        if: ${{ steps.automerge.outputs.mergeResult == 'merged' && github.event.inputs.send-notifications }}
-        env:
-          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
-        uses: Ilshidur/action-discord@0.4.0
-        with:
-          args: "Merged PR ${{ steps.create-pull-request.outputs.url }} for release ${{ steps.semver.outputs.next }}"
-      - name: Major Bump Discord notification
-        if: ${{ steps.semver.outputs.bump == 'major' && github.event.inputs.send-notifications }}
-        env:
-          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
-        uses: Ilshidur/action-discord@0.4.0
-        with:
-          args: "The release PR must be manually merged because the next version is a major version: ${{ steps.create-pull-request.outputs.url }} for release ${{ steps.semver.outputs.next }}"
-      - name: Discord Fail Notification
-        if: failure() && github.event.inputs.send-notifications
-        env:
-          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
-        uses: Ilshidur/action-discord@0.4.0
-        with:
-          args: "The automatic release workflow [run ${{ github.run_number }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) has failed"
+  release:
+    # Permissions must be set on the calling job: a reusable workflow receives
+    # the default GITHUB_TOKEN permissions unless the caller job grants them here.
+    permissions:
+      contents: write
+      pull-requests: write
+    uses: ./.github/workflows/deployment-release-pr.yml
+    secrets: inherit
+    with:
+      release-label: "Automatic release"
+      title-prefix: "automatic "
+      body-prefix: "**This is an automatic release**.<br/>Manual action may be required for major bumps.<br/>"
+      semver-branch: dev
+      head: dev
+      base: main
+      # Scheduled runs have no inputs, so notifications stay off unless manually dispatched.
+      send-notifications: ${{ github.event.inputs.send-notifications == 'true' }}

.github/workflows/update-contributors.yml

@@ -15,9 +15,6 @@ jobs:
   update-contributors:
     runs-on: ubuntu-latest
     timeout-minutes: 2
-    strategy:
-      matrix:
-        node-version: [22]
     steps:
       - name: Obtain token
         id: obtainToken
@@ -33,13 +30,11 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ steps.obtainToken.outputs.token }}
 
-      - uses: pnpm/action-setup@v6
-      - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v6
-        with:
-          node-version: ${{ matrix.node-version }}
-          cache: "pnpm"
+      - name: Install Node with mise
+        uses: jdx/mise-action@v4
 
+      # This script only uses Node built-ins (fs/promises), so no dependency
+      # install is needed.
       - name: Run update script
         run: node ./scripts/update-contributors.mjs
 

.nvmrc

@@ -1 +0,0 @@
-24.18.0

Dockerfile

@@ -1,24 +1,33 @@
+# syntax=docker/dockerfile:1.25
+
 FROM node:24.18.0-alpine AS base
 
 FROM base AS builder
-RUN apk add --no-cache libc6-compat
-RUN apk update
-
-# Set working directory
 WORKDIR /app
-RUN apk add --no-cache libc6-compat curl bash
-RUN apk update
+RUN apk add --no-cache libc6-compat curl bash && apk update
+
+RUN corepack enable pnpm
+
+# NOTE: We intentionally do NOT use `pnpm fetch` here. pnpm 11.10.0 applies
+# `patchedDependencies` patches during the fetch phase, before packages are
+# unpacked into node_modules, which crashes with ENOENT (chdir into a
+# not-yet-existing node_modules path). Installing directly from the full
+# context with the store cache mounted keeps builds fast without that break.
 COPY . .
+RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store \
+    pnpm config set store-dir /pnpm/store && \
+    pnpm install --recursive --frozen-lockfile
 
-RUN corepack enable pnpm && pnpm install --recursive --frozen-lockfile
-
-# Copy static data as it is not part of the build
-COPY static-data ./static-data
 ARG SKIP_ENV_VALIDATION='true'
 ARG CI='true'
 ARG DISABLE_REDIS_LOGS='true'
+ARG TARGETPLATFORM
 
-RUN corepack enable pnpm && pnpm build
+RUN --mount=type=secret,id=TURBO_API,env=TURBO_API \
+    --mount=type=secret,id=TURBO_TEAM,env=TURBO_TEAM \
+    --mount=type=secret,id=TURBO_TOKEN,env=TURBO_TOKEN \
+    --mount=type=secret,id=TURBO_REMOTE_CACHE_SIGNATURE_KEY,env=TURBO_REMOTE_CACHE_SIGNATURE_KEY \
+    TURBO_PLATFORM="${TARGETPLATFORM:-linux/amd64}" pnpm build
 
 FROM base AS runner
 WORKDIR /app

apps/docs/docs/getting-started/installation/helm.md

@@ -2,9 +2,9 @@
 
 <img src="https://raw.githubusercontent.com/homarr-labs/charts/refs/heads/main/charts/homarr/icon.svg" align="right" width="92" alt="homarr logo">
 
-![Version: 8.21.0](https://img.shields.io/badge/Version-8.21.0-informational?style=flat)
+![Version: 8.22.0](https://img.shields.io/badge/Version-8.22.0-informational?style=flat)
 ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat)
-![AppVersion: v1.69.2](https://img.shields.io/badge/AppVersion-v1.69.2-informational?style=flat)
+![AppVersion: v1.70.0](https://img.shields.io/badge/AppVersion-v1.70.0-informational?style=flat)
 
 A Helm chart to deploy homarr for Kubernetes
 
@@ -429,7 +429,7 @@ All available values are listed on the [artifacthub](https://artifacthub.io/pack
 | httproute.rules[0].matches[0].path.value | string | `"/"` | Path value to match |
 | image.pullPolicy | string | `"IfNotPresent"` | Image pull policy |
 | image.repository | string | `"ghcr.io/homarr-labs/homarr"` | Image repository |
-| image.tag | string | `"v1.69.2"` | Overrides the image tag whose default is the chart appVersion |
+| image.tag | string | `"v1.70.0"` | Overrides the image tag whose default is the chart appVersion |
 | imagePullSecrets | list | `[]` | Secrets for Docker registry |
 | ingress.annotations | object | `{}` | Ingress annotations |
 | ingress.enabled | bool | `false` | Enable ingress |

apps/docs/docs/widgets/notebook/index.mdx

@@ -1,29 +1,25 @@
 ---
-title: 'Notebook'
-description: 'A simple notebook widget that supports markdown.'
+title: "Notebook"
+description: "A simple notebook widget that supports markdown."
 hide_title: true
 ---
 
-import { AddingWidget } from '@site/src/components/widgets/adding';
-import { WidgetConfig } from '@site/src/components/widgets/configuration';
-import { WidgetHeader } from '@site/src/components/widgets/header';
-import { notebookWidget } from '.';
+import { AddingWidget } from "@site/src/components/widgets/adding";
+import { WidgetConfig } from "@site/src/components/widgets/configuration";
+import { WidgetHeader } from "@site/src/components/widgets/header";
+import { notebookWidget } from ".";
 
+<WidgetHeader widget={notebookWidget} categories={["Notes"]} />
 
-<WidgetHeader
-  widget={notebookWidget}
-  categories={['Notes']}
-/>
-
-The notebook widget focuses on usability and is designed to be as simple as possible to bring a familiar editing experience to regular users. 
+The notebook widget focuses on usability and is designed to be as simple as possible to bring a familiar editing experience to regular users.
 It is based on Tiptap.dev and supports most of its features.
 
 ### Screenshots
 
-import editOff from './img/normal.png';
-import editOn from './img/edit.png';
+import editOff from "./img/normal.png";
+import editOn from "./img/edit.png";
 
-<div className='flex gap-1'>
+<div className="flex gap-1">
   <img src={editOff} alt="notebook edit-off" width={128 * 3} />
   <img src={editOn} alt="notebook edit-on" width={128 * 3} />
 </div>
@@ -33,24 +29,27 @@ import editOn from './img/edit.png';
 <AddingWidget />
 
 ### Configuration
+
 <WidgetConfig configuration={notebookWidget.configuration} />
 
 ### Editing
+
 When the permissions of the user allows it, you can enter the editing of the text by clicking the following button in the top right.
 
 ![](./img/notebook-enter-editing.webp)
 
-
 You can then decide to save your changes or cancel them to exit editing, using the buttons placed in the same location.
 
 ![](./img/notebook-exit-editing.webp)
 
 ### Notebook toolbar functions
-The notebook offers a variaty of functions to edit the text and more.
+
+The notebook offers a variety of functions to edit the text and more.
 
 ![](./img/notebook-toolbar.webp)
 
 #### Common text formatting
+
 | Function               | Description                                                         |
 | ---------------------- | ------------------------------------------------------------------- |
 | Bold                   | Makes the selected text bold                                        |
@@ -62,35 +61,51 @@ The notebook offers a variaty of functions to edit the text and more.
 | Clear formatting       | Erases any of the preceding function's effects on the selected text |
 
 #### Heading
+
 Choose a heading size for the line, making the text bigger. Working like titles and sub-titles.
 
-#### Text Alignement
-Select the alignement on the line. Left, center or right.
+#### Text Alignment
+
+Select the alignment on the line. Left, center or right.
+
+#### Text direction
+
+Set the current paragraph or heading to left-to-right or right-to-left. This is useful when writing right-to-left text while Homarr is using a left-to-right language, or vice versa.
 
 #### Misc functions
+
 ##### Blockquote
+
 Puts the current line in a quoting block.
 
 ##### Horizontal line
+
 Adds a line that goes from the far right to the far left as a separator.
 
 #### Lists
+
 ##### Bullet lists
+
 Simple list with a dot preceding each element.
 
 ##### Ordered lists
+
 List with numbers preceding each element.
 
 ##### Check lists
+
 List with a checkbox on each element.
 
 ##### Indentation changes
+
 ![](./img/notebook-toolbar-lists.webp)
 
 When you are currently in a list of any sort, the last 2 buttons will appear and will allow you to change the indentation of the current list item.
 
 #### Insert functions
+
 ##### Link controls
+
 The first buttons is to insert a link, or edit an existing link. The link will be applied on the selected text.
 
 Pasting a link directly into the text will automatically put the link anchor on it too.
@@ -102,16 +117,20 @@ The second button will remove the link while leaving the text intact.
 This is the modal for the link, The little button in the textbox can be clicked to make the link open in a new tab.
 
 ##### Image controls
+
 ![](./img/notebook-image-modal.webp)
 
 ##### Source
+
 You can use a normal link to an image or you can also use locally stored images.
 
 ##### Width
+
 The aspect ratio will always be respected, so only the width field is necessary.
 You can provide a value in a plain number or you can also use percents to have your image size dynamically change on different screens.
 
 #### Table
+
 This last control allows you to add a table, for which you can determine the number of columns and row before inserting it.
 
 ![](./img/notebook-table-modal.webp)
@@ -119,6 +138,7 @@ This last control allows you to add a table, for which you can determine the num
 Clicking that button while in a table will delete it.
 
 ##### Table controls
+
 ![](./img/notebook-toolbar-table.webp)
 
 While in a table, further controls will appear to help edit the table.
@@ -134,4 +154,4 @@ All the following ones are for editing the wize of the table:
 - Delete Column
 - Add row on top
 - Add row below
-- Delete Row
+- Delete Row

apps/docs/package.json

@@ -43,7 +43,7 @@
     "random-word-slugs": "^0.1.7",
     "react": "catalog:",
     "react-dom": "catalog:",
-    "swiper": "^14.0.1",
+    "swiper": "^14.0.2",
     "tailwindcss": "^4.3.2"
   },
   "devDependencies": {

apps/nextjs/src/app/[locale]/init/_steps/import/file-info-card.tsx

@@ -2,7 +2,7 @@ import { ActionIcon, Button, Group, Text } from "@mantine/core";
 import type { FileWithPath } from "@mantine/dropzone";
 import { IconPencil } from "@tabler/icons-react";
 
-import { humanFileSize } from "@homarr/common";
+import { formatBytes } from "@homarr/common";
 import { useScopedI18n } from "@homarr/translation/client";
 
 import { InitStepCard } from "../../_components/init-step-card";
@@ -22,7 +22,7 @@ export const FileInfoCard = ({ file, onRemove }: FileInfoCardProps) => {
             {file.name}
           </Text>
           <Text visibleFrom="md" c="gray.6" size="sm">
-            {humanFileSize(file.size)}
+            {formatBytes(file.size)}
           </Text>
         </Group>
         <Button

apps/nextjs/src/app/[locale]/manage/medias/page.tsx

@@ -18,7 +18,7 @@ import { z } from "zod/v4";
 import type { RouterOutputs } from "@homarr/api";
 import { api } from "@homarr/api/server";
 import { auth } from "@homarr/auth/next";
-import { humanFileSize } from "@homarr/common";
+import { formatBytes } from "@homarr/common";
 import type { inferSearchParamsFromSchema } from "@homarr/common/types";
 import { createLocalImageUrl } from "@homarr/icons/local";
 import { getI18n } from "@homarr/translation/server";
@@ -125,7 +125,7 @@ const Row = async ({ media }: RowProps) => {
         />
       </TableTd>
       <TableTd>{media.name}</TableTd>
-      <TableTd>{humanFileSize(media.size)}</TableTd>
+      <TableTd>{formatBytes(media.size)}</TableTd>
       <TableTd>
         {media.creator ? (
           <Group gap="sm">

apps/nextjs/src/app/[locale]/manage/tools/docker/docker-table.tsx

@@ -19,7 +19,7 @@ import { MantineReactTable } from "mantine-react-table";
 
 import type { RouterOutputs } from "@homarr/api";
 import { clientApi } from "@homarr/api/client";
-import { humanFileSize, useTimeAgo } from "@homarr/common";
+import { formatBytes, useTimeAgo } from "@homarr/common";
 import type { ContainerState } from "@homarr/docker";
 import { containerStateColorMap, cpuUsageColor, memoryUsageColor, safeValue } from "@homarr/docker/shared";
 import { useModalAction } from "@homarr/modals";
@@ -143,7 +143,7 @@ const createColumns = (t: TranslationFunction): MRT_ColumnDef<DockerContainer>[]
 
       return (
         <Text size="sm" c={memoryUsageColor(bytesUsage, row.original.state)}>
-          {humanFileSize(bytesUsage)}
+          {formatBytes(bytesUsage)}
         </Text>
       );
     },

package.json

@@ -6,6 +6,10 @@
     "build": "cross-env CI=true turbo build",
     "clean": "git clean -xdf node_modules",
     "clean:workspaces": "turbo clean",
+    "ci:act:all": "bash scripts/ci/act.sh all",
+    "ci:act:cleanup": "bash scripts/ci/act.sh cleanup",
+    "ci:act:docker": "bash scripts/ci/act.sh docker",
+    "ci:act:fast": "bash scripts/ci/act.sh fast",
     "cli": "pnpm with-env tsx packages/cli/index.ts",
     "db:migration:mysql:generate": "pnpm -F db migration:mysql:generate",
     "db:migration:mysql:run": "pnpm -F db migration:mysql:run",
@@ -33,6 +37,9 @@
     "typecheck": "turbo typecheck",
     "with-env": "dotenv -e .env --"
   },
+  "dependencies": {
+    "jsonpath-plus": "catalog:"
+  },
   "devDependencies": {
     "@playwright/test": "catalog:",
     "@semantic-release/changelog": "catalog:",
@@ -64,8 +71,5 @@
     "node": ">=24.18.0",
     "pnpm": ">=11.10.0"
   },
-  "packageManager": "pnpm@11.10.0",
-  "dependencies": {
-    "jsonpath-plus": "catalog:"
-  }
+  "packageManager": "pnpm@11.10.0"
 }

packages/common/src/number.ts

@@ -21,11 +21,17 @@ export const randomInt = (min: number, max: number) => {
 };
 
 /**
- *  Number of bytes to si format. (Division by 1024)
- *  Does not accept floats, size in bytes should be an integer.
- *  Will return "NaI" and logs a warning if a float is passed.
- *  Concat as parameters so it is not added if the returned value is "NaI" or "∞".
- *  Returns "∞" if the size is too large to be represented in the current format.
+ *  Number of bytes to a human-readable string using binary (KiB) suffixes.
+ *  Does not accept floats; size in bytes should be an integer.
+ *  Will return "NaI" and log a warning if a float is passed.
+ *  `concat` is appended after the unit so it is omitted when the returned
+ *  value is "NaI" or "∞". Returns "∞" if the size is too large to be
+ *  represented in the current format.
+ *
+ *  @deprecated Use `formatBytes` for single values, `formatBytesPair` for
+ *  paired "used / total" displays, and `formatByteRate` for byte-per-second
+ *  rates. This function is kept for backwards compatibility but should not
+ *  be used in new code.
  */
 export const humanFileSize = (size: number, concat = ""): string => {
   //64bit limit for Number stops at EiB
@@ -48,6 +54,99 @@ export const humanFileSize = (size: number, concat = ""): string => {
   return "∞";
 };
 
+const BINARY_UNITS = ["B", "KiB", "MiB", "GiB", "TiB", "PiB", "EiB"] as const;
+const DECIMAL_UNITS = ["B", "KB", "MB", "GB", "TB", "PB", "EB"] as const;
+
+export type ByteUnitSystem = "binary" | "decimal";
+
+export interface FormatBytesOptions {
+  /**
+   * Unit system to use. "binary" uses 1024 as the base and KiB/MiB/GiB/TiB suffixes,
+   * "decimal" uses 1000 as the base and KB/MB/GB/TB suffixes. Defaults to "binary".
+   */
+  unit?: ByteUnitSystem;
+}
+
+const pickUnitIndex = (bytes: number, base: number, lastIndex: number): number => {
+  if (!Number.isFinite(bytes) || bytes <= 0) return 0;
+  let index = 0;
+  let value = bytes;
+  while (value >= base && index < lastIndex) {
+    value /= base;
+    index++;
+  }
+  return index;
+};
+
+const sanitizeBytes = (bytes: number): number => (Number.isFinite(bytes) && bytes > 0 ? bytes : 0);
+
+const resolveUnitConfig = (options: FormatBytesOptions) => {
+  const { unit = "binary" } = options;
+  return {
+    units: unit === "binary" ? BINARY_UNITS : DECIMAL_UNITS,
+    base: unit === "binary" ? 1024 : 1000,
+  };
+};
+
+/**
+ * Format a byte value as a human-readable string with a unit suffix.
+ *
+ * Picks the largest unit that keeps the scaled value below the base. Use
+ * `formatBytesPair` when two related values (e.g. used and available) should
+ * share a common unit.
+ *
+ * @example
+ * formatBytes(0);                          // "0.0 B"
+ * formatBytes(1024);                       // "1.0 KiB"
+ * formatBytes(985828802560);               // "918.1 GiB"
+ * formatBytes(985828802560, { unit: "decimal" }); // "985.8 GB"
+ */
+export const formatBytes = (bytes: number, options: FormatBytesOptions = {}): string => {
+  const { units, base } = resolveUnitConfig(options);
+  const safe = sanitizeBytes(bytes);
+  const index = pickUnitIndex(safe, base, units.length - 1);
+  const scaled = safe / base ** index;
+  return `${scaled.toFixed(1)} ${units[index]}`;
+};
+
+/**
+ * Format two related byte values (typically `used` and `available`) with a
+ * shared unit. The unit is picked from the sum of the two values so the
+ * combined display stays consistent.
+ *
+ * @example
+ * formatBytesPair(985828802560, 2858736793190);
+ * // { used: "0.9 TiB", available: "2.6 TiB" }
+ */
+export const formatBytesPair = (
+  used: number,
+  available: number,
+  options: FormatBytesOptions = {},
+): { used: string; available: string } => {
+  const { units, base } = resolveUnitConfig(options);
+  const safeUsed = sanitizeBytes(used);
+  const safeAvailable = sanitizeBytes(available);
+  const index = pickUnitIndex(safeUsed + safeAvailable, base, units.length - 1);
+  const suffix = units[index];
+  return {
+    used: `${(safeUsed / base ** index).toFixed(1)} ${suffix}`,
+    available: `${(safeAvailable / base ** index).toFixed(1)} ${suffix}`,
+  };
+};
+
+/**
+ * Format a byte-per-second rate (e.g. network throughput) as a human-readable
+ * string with a `/s` suffix. The value is formatted with the same rules as
+ * `formatBytes` and a trailing `/s` is appended.
+ *
+ * @example
+ * formatByteRate(0);                          // "0.0 B/s"
+ * formatByteRate(1024);                       // "1.0 KiB/s"
+ * formatByteRate(985828802560, { unit: "decimal" }); // "985.8 GB/s"
+ */
+export const formatByteRate = (bytes: number, options: FormatBytesOptions = {}): string =>
+  `${formatBytes(bytes, options)}/s`;
+
 const IMPERIAL_MULTIPLIER = 1.609344;
 
 export const metricToImperial = (metricValue: number) => metricValue / IMPERIAL_MULTIPLIER;

packages/common/src/test/number.spec.ts

@@ -0,0 +1,90 @@
+import { describe, expect, it } from "vitest";
+
+import { formatByteRate, formatBytes, formatBytesPair } from "../number";
+
+describe("formatBytes", () => {
+  it("returns bytes for small values", () => {
+    expect(formatBytes(0)).toBe("0.0 B");
+    expect(formatBytes(1)).toBe("1.0 B");
+    expect(formatBytes(1023)).toBe("1023.0 B");
+  });
+
+  it("scales binary units correctly", () => {
+    expect(formatBytes(1024)).toBe("1.0 KiB");
+    expect(formatBytes(1024 ** 2)).toBe("1.0 MiB");
+    expect(formatBytes(1024 ** 3)).toBe("1.0 GiB");
+    expect(formatBytes(1024 ** 4)).toBe("1.0 TiB");
+  });
+
+  it("scales decimal units when requested", () => {
+    expect(formatBytes(1000, { unit: "decimal" })).toBe("1.0 KB");
+    expect(formatBytes(1000 ** 2, { unit: "decimal" })).toBe("1.0 MB");
+    expect(formatBytes(1000 ** 3, { unit: "decimal" })).toBe("1.0 GB");
+    expect(formatBytes(1000 ** 4, { unit: "decimal" })).toBe("1.0 TB");
+  });
+
+  it("formats a typical storage value with one decimal", () => {
+    expect(formatBytes(985828802560)).toBe("918.1 GiB");
+    expect(formatBytes(985828802560, { unit: "decimal" })).toBe("985.8 GB");
+  });
+
+  it("caps at the largest unit to avoid overflow", () => {
+    expect(formatBytes(Number.MAX_SAFE_INTEGER)).toMatch(/PiB$/);
+  });
+
+  it("returns the zero value for negative or non-finite input", () => {
+    expect(formatBytes(-1)).toBe("0.0 B");
+    expect(formatBytes(Number.NaN)).toBe("0.0 B");
+    expect(formatBytes(Number.POSITIVE_INFINITY)).toBe("0.0 B");
+  });
+});
+
+describe("formatBytesPair", () => {
+  it("picks the unit of the larger total and applies it to both values", () => {
+    const { used, available } = formatBytesPair(985828802560, 2858736793190);
+    expect(used).toBe("0.9 TiB");
+    expect(available).toBe("2.6 TiB");
+  });
+
+  it("uses a smaller unit when both values fit in it", () => {
+    const { used, available } = formatBytesPair(1024 * 1024 * 100, 1024 * 1024 * 200);
+    expect(used).toBe("100.0 MiB");
+    expect(available).toBe("200.0 MiB");
+  });
+
+  it("falls back to zero when both inputs are invalid", () => {
+    const { used, available } = formatBytesPair(Number.NaN, -1);
+    expect(used).toBe("0.0 B");
+    expect(available).toBe("0.0 B");
+  });
+
+  it("uses the same unit across both values when one is invalid", () => {
+    const { used, available } = formatBytesPair(Number.NaN, 1024 ** 4);
+    expect(used).toBe("0.0 TiB");
+    expect(available).toBe("1.0 TiB");
+  });
+
+  it("honours the decimal unit option", () => {
+    const { used, available } = formatBytesPair(500_000_000_000, 1_500_000_000_000, { unit: "decimal" });
+    expect(used).toBe("0.5 TB");
+    expect(available).toBe("1.5 TB");
+  });
+});
+
+describe("formatByteRate", () => {
+  it("appends a /s suffix to the formatted value", () => {
+    expect(formatByteRate(0)).toBe("0.0 B/s");
+    expect(formatByteRate(1024)).toBe("1.0 KiB/s");
+    expect(formatByteRate(1024 ** 3)).toBe("1.0 GiB/s");
+  });
+
+  it("honours the decimal unit option", () => {
+    expect(formatByteRate(1000, { unit: "decimal" })).toBe("1.0 KB/s");
+    expect(formatByteRate(1000 ** 2, { unit: "decimal" })).toBe("1.0 MB/s");
+  });
+
+  it("returns zero for invalid input", () => {
+    expect(formatByteRate(-1)).toBe("0.0 B/s");
+    expect(formatByteRate(Number.NaN)).toBe("0.0 B/s");
+  });
+});

packages/integrations/src/dashdot/dashdot-integration.ts

@@ -1,5 +1,3 @@
-import { humanFileSize } from "@homarr/common";
-
 import "@homarr/redis";
 
 import dayjs from "dayjs";
@@ -48,7 +46,7 @@ export class DashDotIntegration extends Integration implements ISystemHealthMoni
         .map((storage, index) => ({
           deviceName: `Storage ${index + 1}: (${storage.disks.map((disk) => disk.device).join(", ")})`,
           // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-          used: humanFileSize(storageLoad[index]!),
+          used: `${storageLoad[index]!}`,
           available: storageLoad[index] ? `${storage.size - storageLoad[index]}` : `${storage.size}`,
           percentage: storageLoad[index] ? (storageLoad[index] / storage.size) * 100 : 0,
         })),

packages/integrations/src/download-client/qbittorrent/qbittorrent-integration.ts

@@ -30,7 +30,7 @@ export class QBitTorrentIntegration extends Integration implements IDownloadClie
   public async getClientJobsAndStatusAsync(input: { limit: number }): Promise<DownloadClientJobsAndStatus> {
     const type = "torrent";
     const client = await this.getClientAsync();
-    const torrents = await client.listTorrents({ limit: input.limit });
+    const torrents = await client.listTorrents({ limit: input.limit, sort: "progress", reverse: false });
     const rates = torrents.reduce(
       ({ down, up }, { dlspeed, upspeed }) => ({ down: down + dlspeed, up: up + upspeed }),
       { down: 0, up: 0 },

packages/integrations/src/unraid/unraid-integration.ts

@@ -1,7 +1,6 @@
 import dayjs from "dayjs";
 import type { fetch as undiciFetch } from "undici/types/fetch";
 
-import { humanFileSize } from "@homarr/common";
 import { ResponseError } from "@homarr/common/server";
 import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 import { createLogger } from "@homarr/core/infrastructure/logs";
@@ -59,7 +58,7 @@ export class UnraidIntegration extends Integration implements ISystemHealthMonit
       cpuTemp: undefined, // Not implemented, see https://github.com/unraid/api/issues/1597
       fileSystem: systemInfo.array.disks.map((disk) => ({
         deviceName: disk.name,
-        used: humanFileSize(disk.fsUsed * 1024), // API is in KiB (kibibytes), convert to bytes
+        used: `${disk.fsUsed * 1024}`, // API is in KiB (kibibytes), convert to bytes
         available: `${(disk.size - disk.fsUsed) * 1024}`, // free space left on the disk, API is in KiB (kibibytes)
         percentage: (disk.fsUsed / disk.size) * 100, // The units are the same, therefore the actual unit is irrelevant
       })),

packages/translation/src/lang/en.json

@@ -1956,6 +1956,8 @@
         "clear": "Clear formatting",
         "heading": "Heading {level}",
         "align": "Align text: {position}",
+        "directionLtr": "Set text direction left to right",
+        "directionRtl": "Set text direction right to left",
         "blockquote": "Blockquote",
         "horizontalLine": "Horizontal line",
         "bulletList": "Bullet list",
@@ -5203,6 +5205,9 @@
     "title": "Containers",
     "table": {
       "updated": "Updated {when}",
+      "refresh": {
+        "lastUpdated": "Last refresh {when}"
+      },
       "search": "Seach {count} containers",
       "selected": "{selectCount} of {totalCount} containers selected",
       "footer": "Total {count} containers",

packages/widgets/src/archive-team-warrior/component.tsx

@@ -3,7 +3,7 @@
 import { Avatar, Badge, Card, Group, SimpleGrid, Stack, Text } from "@mantine/core";
 
 import { clientApi } from "@homarr/api/client";
-import { humanFileSize } from "@homarr/common";
+import { formatByteRate } from "@homarr/common";
 import { getIconUrl } from "@homarr/definitions";
 
 import type { WidgetComponentProps } from "../definition";
@@ -84,4 +84,4 @@ const Metric = ({ label, value }: { label: string; value: number | string }) =>
   </Stack>
 );
 
-const formatBandwidth = (value?: number) => humanFileSize(Math.round(value ?? 0), "/s");
+const formatBandwidth = (value?: number) => formatByteRate(Math.round(value ?? 0));

packages/widgets/src/docker/component.tsx

@@ -3,13 +3,13 @@
 import { useMemo } from "react";
 import { ActionIcon, Avatar, Badge, Center, Group, Stack, Text, Tooltip } from "@mantine/core";
 import type { IconProps } from "@tabler/icons-react";
-import { IconBrandDocker, IconPlayerPlay, IconPlayerStop, IconRotateClockwise } from "@tabler/icons-react";
+import { IconBrandDocker, IconPlayerPlay, IconPlayerStop, IconRefresh, IconRotateClockwise } from "@tabler/icons-react";
 import type { MRT_ColumnDef, MRT_VisibilityState } from "mantine-react-table";
 import { MantineReactTable } from "mantine-react-table";
 
 import type { RouterOutputs } from "@homarr/api";
 import { clientApi } from "@homarr/api/client";
-import { humanFileSize, useTimeAgo } from "@homarr/common";
+import { formatBytes, useTimeAgo } from "@homarr/common";
 import type { ContainerState } from "@homarr/docker";
 import { containerStateColorMap, cpuUsageColor, memoryUsageColor, safeValue } from "@homarr/docker/shared";
 import { showErrorNotification, showSuccessNotification } from "@homarr/notifications";
@@ -110,7 +110,7 @@ const createColumns = (
 
       return (
         <Text size="xs" c={memoryUsageColor(bytesUsage, row.original.state)}>
-          {humanFileSize(bytesUsage)}
+          {formatBytes(bytesUsage)}
         </Text>
       );
     },
@@ -184,7 +184,11 @@ export default function DockerWidget({ options, width, isEditMode }: WidgetCompo
   const t = useScopedI18n("docker");
   const isTiny = width <= 256;
 
-  const { data } = clientApi.docker.getContainers.useQuery(undefined, {
+  const {
+    data,
+    refetch,
+    isFetching,
+  } = clientApi.docker.getContainers.useQuery(undefined, {
     refetchInterval: 30_000,
   });
   const containers = data?.containers ?? [];
@@ -297,12 +301,23 @@ export default function DockerWidget({ options, width, isEditMode }: WidgetCompo
             </Text>
 
             <Text size="sm" style={{ whiteSpace: "nowrap" }}>
-              {t("table.totalMemory", { memory: humanFileSize(totals.memory) })}
+              {t("table.totalMemory", { memory: formatBytes(totals.memory) })}
             </Text>
 
-            <Text size="sm" style={{ whiteSpace: "nowrap" }}>
-              {t("table.updated", { when: relativeTime })}
-            </Text>
+            <Tooltip
+              label={t("table.refresh.lastUpdated", { when: relativeTime })}
+            >
+              <ActionIcon
+                size="sm"
+                variant="transparent"
+                c="var(--mantine-color-text)"
+                loading={isFetching}
+                onClick={() => void refetch()}
+                aria-label={t("table.refresh.lastUpdated", { when: relativeTime })}
+              >
+                <IconRefresh style={actionIconIconStyle} />
+              </ActionIcon>
+            </Tooltip>
           </Group>
         </Group>
       )}

packages/widgets/src/docker/index.ts

@@ -25,6 +25,7 @@ const columnTranslationKeyMap = {
 
 export const { definition, componentLoader } = createWidgetDefinition("dockerContainers", {
   icon: IconBrandDocker,
+  queryKey: [["docker", "getContainers"]],
   createOptions() {
     return optionsBuilder.from((factory) => ({
       columns: factory.multiSelect({

packages/widgets/src/downloads/component.tsx

@@ -43,7 +43,7 @@ import { MantineReactTable, useMantineReactTable } from "mantine-react-table";
 
 import { clientApi } from "@homarr/api/client";
 import { useIntegrationsWithInteractAccess } from "@homarr/auth/client";
-import { humanFileSize, useIntegrationConnected } from "@homarr/common";
+import { formatByteRate, formatBytes, useIntegrationConnected } from "@homarr/common";
 import { getIconUrl, getIntegrationKindsByCategory } from "@homarr/definitions";
 import type { ExtendedClientStatus, ExtendedDownloadClientItem } from "@homarr/integrations";
 import { useScopedI18n } from "@homarr/translation/client";
@@ -386,7 +386,7 @@ export default function DownloadClientsWidget({
         sortUndefined: "last",
         Cell: ({ cell }) => {
           const downSpeed = cell.getValue<ExtendedDownloadClientItem["downSpeed"]>();
-          return downSpeed ? <Text size="xs">{humanFileSize(downSpeed, "/s")}</Text> : null;
+          return downSpeed ? <Text size="xs">{formatByteRate(downSpeed)}</Text> : null;
         },
       },
       {
@@ -466,7 +466,7 @@ export default function DownloadClientsWidget({
         ...columnsDefBase({ key: "received", showHeader: true }),
         Cell: ({ cell }) => {
           const received = cell.getValue<ExtendedDownloadClientItem["received"]>();
-          return <Text size="xs">{humanFileSize(received)}</Text>;
+          return <Text size="xs">{formatBytes(received)}</Text>;
         },
       },
       {
@@ -474,14 +474,14 @@ export default function DownloadClientsWidget({
         sortUndefined: "last",
         Cell: ({ cell }) => {
           const sent = cell.getValue<ExtendedDownloadClientItem["sent"]>();
-          return sent && <Text size="xs">{humanFileSize(sent)}</Text>;
+          return sent && <Text size="xs">{formatBytes(sent)}</Text>;
         },
       },
       {
         ...columnsDefBase({ key: "size", showHeader: true }),
         Cell: ({ cell }) => {
           const size = cell.getValue<ExtendedDownloadClientItem["size"]>();
-          return <Text size="xs">{humanFileSize(size)}</Text>;
+          return <Text size="xs">{formatBytes(size)}</Text>;
         },
       },
       {
@@ -521,7 +521,7 @@ export default function DownloadClientsWidget({
         sortUndefined: "last",
         Cell: ({ cell }) => {
           const upSpeed = cell.getValue<ExtendedDownloadClientItem["upSpeed"]>();
-          return upSpeed && <Text size="xs">{humanFileSize(upSpeed, "/s")}</Text>;
+          return upSpeed && <Text size="xs">{formatByteRate(upSpeed)}</Text>;
         },
       },
     ],
@@ -669,21 +669,21 @@ const ItemInfoModal = ({ items, currentIndex, opened, onClose }: ItemInfoModalPr
           {item.type !== "miscellaneous" && (
             <NormalizedLine
               itemKey="upSpeed"
-              values={item.upSpeed === undefined ? undefined : humanFileSize(item.upSpeed, "/s")}
+              values={item.upSpeed === undefined ? undefined : formatByteRate(item.upSpeed)}
             />
           )}
 
           <NormalizedLine
             itemKey="downSpeed"
-            values={item.downSpeed === undefined ? undefined : humanFileSize(item.downSpeed, "/s")}
+            values={item.downSpeed === undefined ? undefined : formatByteRate(item.downSpeed)}
           />
 
           {item.type !== "miscellaneous" && (
-            <NormalizedLine itemKey="sent" values={item.sent === undefined ? undefined : humanFileSize(item.sent)} />
+            <NormalizedLine itemKey="sent" values={item.sent === undefined ? undefined : formatBytes(item.sent)} />
           )}
 
-          <NormalizedLine itemKey="received" values={humanFileSize(item.received)} />
-          <NormalizedLine itemKey="size" values={humanFileSize(item.size)} />
+          <NormalizedLine itemKey="received" values={formatBytes(item.received)} />
+          <NormalizedLine itemKey="size" values={formatBytes(item.size)} />
           <NormalizedLine
             itemKey="progress"
             values={new Intl.NumberFormat("en", {
@@ -744,10 +744,7 @@ const ClientsControl = ({ clients, filters, setFilters, availableStatuses }: Cli
     { paused: [] as string[], active: [] as string[] },
   );
   const someInteract = clients.some(({ interact }) => interact);
-  const totalSpeed = humanFileSize(
-    clients.reduce((count, { status }) => count + (status?.rates.down ?? 0), 0),
-    "/s",
-  );
+  const totalSpeed = formatByteRate(clients.reduce((count, { status }) => count + (status?.rates.down ?? 0), 0));
 
   const utils = clientApi.useUtils();
   const invalidateDownloads = { onSettled: () => void utils.widget.downloads.getJobsAndStatuses.invalidate() };
@@ -849,21 +846,21 @@ const ClientsControl = ({ clients, filters, setFilters, availableStatuses }: Cli
                           {client.status.rates.up !== undefined ? (
                             <Group display="flex" justify="center" c="green" w="100%" gap={5}>
                               <Text flex={1} ta="right">
-                                {`↑ ${humanFileSize(client.status.rates.up, "/s")}`}
+                                {`↑ ${formatByteRate(client.status.rates.up)}`}
                               </Text>
                               <Text>{"-"}</Text>
                               <Text flex={1} ta="left">
-                                {humanFileSize(client.status.totalUp ?? 0)}
+                                {formatBytes(client.status.totalUp ?? 0)}
                               </Text>
                             </Group>
                           ) : undefined}
                           <Group display="flex" justify="center" c="blue" w="100%" gap={5}>
                             <Text flex={1} ta="right">
-                              {`↓ ${humanFileSize(client.status.rates.down, "/s")}`}
+                              {`↓ ${formatByteRate(client.status.rates.down)}`}
                             </Text>
                             <Text>{"-"}</Text>
                             <Text flex={1} ta="left">
-                              {humanFileSize(Math.floor(client.status.totalDown ?? 0))}
+                              {formatBytes(Math.floor(client.status.totalDown ?? 0))}
                             </Text>
                           </Group>
                         </Stack>

packages/widgets/src/health-monitoring/cluster/resource-popover.tsx

@@ -16,7 +16,7 @@ import {
 import dayjs from "dayjs";
 import duration from "dayjs/plugin/duration";
 
-import { capitalize, humanFileSize } from "@homarr/common";
+import { capitalize, formatBytes, formatBytesPair } from "@homarr/common";
 import type { ComputeResource, Resource, StorageResource } from "@homarr/integrations/types";
 import { useScopedI18n } from "@homarr/translation/client";
 
@@ -93,16 +93,18 @@ const RightSection = ({ label, value }: RightSectionProps) => {
 
 const ComputeResourceDetails = ({ item }: { item: ComputeResource }) => {
   const t = useScopedI18n("widget.healthMonitoring.cluster.popover.detail");
+  const memory = formatBytesPair(item.memory.used, item.memory.total);
+  const storage = formatBytesPair(item.storage.used, item.storage.total);
   return (
     <List>
       <List.Item icon={<IconCpu size={16} />}>
         {t("cpu")} - {item.cpu.cores}
       </List.Item>
       <List.Item icon={<IconBrain size={16} />}>
-        {t("memory")} - {humanFileSize(item.memory.used)} / {humanFileSize(item.memory.total)}
+        {t("memory")} - {memory.used} / {memory.available}
       </List.Item>
       <List.Item icon={<IconDatabase size={16} />}>
-        {t("storage")} - {humanFileSize(item.storage.used)} / {humanFileSize(item.storage.total)}
+        {t("storage")} - {storage.used} / {storage.available}
       </List.Item>
       <List.Item icon={<IconClockHour3 size={16} />}>
         {t("uptime")} - {dayjs(dayjs().add(-item.uptime, "seconds")).fromNow(true)}
@@ -121,6 +123,7 @@ const ComputeResourceDetails = ({ item }: { item: ComputeResource }) => {
 const StorageResourceDetails = ({ item }: { item: StorageResource }) => {
   const t = useScopedI18n("widget.healthMonitoring.cluster.popover.detail");
   const storagePercent = item.total ? (item.used / item.total) * 100 : 0;
+  const storage = formatBytesPair(item.used, item.total);
   return (
     <Stack gap={0}>
       <Center>
@@ -133,7 +136,7 @@ const StorageResourceDetails = ({ item }: { item: StorageResource }) => {
         />
         <Group align="center" gap={0}>
           <Text>
-            {t("storage")} - {humanFileSize(item.used)} / {humanFileSize(item.total)}
+            {t("storage")} - {storage.used} / {storage.available}
           </Text>
         </Group>
       </Center>
@@ -152,11 +155,11 @@ const DiskStats = ({ item }: { item: ComputeResource }) => {
     <List.Item icon={<IconDatabase size={16} />}>
       <Group gap="sm">
         <Group gap={0}>
-          <Text>{humanFileSize(item.storage.write)}</Text>
+          <Text>{formatBytes(item.storage.write)}</Text>
           <IconArrowNarrowDown size={14} />
         </Group>
         <Group gap={0}>
-          <Text>{humanFileSize(item.storage.read)}</Text>
+          <Text>{formatBytes(item.storage.read)}</Text>
           <IconArrowNarrowUp size={14} />
         </Group>
       </Group>
@@ -172,11 +175,11 @@ const NetStats = ({ item }: { item: ComputeResource }) => {
     <List.Item icon={<IconNetwork size={16} />}>
       <Group gap="sm">
         <Group gap={0}>
-          <Text>{humanFileSize(item.network.in)}</Text>
+          <Text>{formatBytes(item.network.in)}</Text>
           <IconArrowNarrowDown size={14} />
         </Group>
         <Group gap={0}>
-          <Text>{humanFileSize(item.network.out)}</Text>
+          <Text>{formatBytes(item.network.out)}</Text>
           <IconArrowNarrowUp size={14} />
         </Group>
       </Group>

packages/widgets/src/health-monitoring/system-health.tsx

@@ -32,7 +32,7 @@ import duration from "dayjs/plugin/duration";
 
 import { clientApi } from "@homarr/api/client";
 import { useRequiredBoard } from "@homarr/boards/context";
-import { humanFileSize } from "@homarr/common";
+import { formatBytes } from "@homarr/common";
 import type { TranslationFunction } from "@homarr/translation";
 import { useI18n } from "@homarr/translation/client";
 
@@ -277,7 +277,7 @@ export const progressColor = (percentage: number) => {
 // them (e.g. Unraid, dashdot). Format the former and pass the latter through untouched.
 const formatFileSize = (value: string) => {
   const bytes = Number(value);
-  return Number.isFinite(bytes) ? humanFileSize(Math.round(bytes)) : value;
+  return Number.isFinite(bytes) ? formatBytes(Math.round(bytes)) : value;
 };
 
 interface FileSystem {

packages/widgets/src/immich/server-stats/component.tsx

@@ -5,7 +5,7 @@ import { Group, Stack, Text } from "@mantine/core";
 import { IconDatabase, IconPhoto, IconUsers, IconVideo } from "@tabler/icons-react";
 
 import { clientApi } from "@homarr/api/client";
-import { humanFileSize } from "@homarr/common";
+import { formatBytes } from "@homarr/common";
 import { useI18n } from "@homarr/translation/client";
 
 import { WidgetEmptyState } from "../../common/empty-state";
@@ -46,7 +46,7 @@ export default function ImmichServerStatsWidget({
         <StatItem
           icon={<IconDatabase size={20} />}
           label={t("widget.immich-serverStats.storage")}
-          value={humanFileSize(stats.totalLibraryUsageInBytes)}
+          value={formatBytes(stats.totalLibraryUsageInBytes)}
         />
       )}
     </Stack>

packages/widgets/src/media-transcoding/panels/queue.panel.tsx

@@ -14,7 +14,7 @@ import {
 } from "@mantine/core";
 import { IconHeartbeat, IconTransform } from "@tabler/icons-react";
 
-import { humanFileSize } from "@homarr/common";
+import { formatBytes } from "@homarr/common";
 import type { TdarrQueue } from "@homarr/integrations";
 import { useI18n } from "@homarr/translation/client";
 
@@ -72,7 +72,7 @@ export function QueuePanel(props: QueuePanelProps) {
                 </Group>
               </TableTd>
               <TableTd py={2}>
-                <Text size="xs">{humanFileSize(item.fileSize)}</Text>
+                <Text size="xs">{formatBytes(item.fileSize)}</Text>
               </TableTd>
             </TableTr>
           ))}

packages/widgets/src/media-transcoding/panels/statistics.panel.tsx

@@ -3,7 +3,7 @@ import { Card, Center, Group, RingProgress, ScrollArea, Stack, Text, Title, Tool
 import { IconDatabaseHeart, IconFileDescription, IconHeartbeat, IconTransform } from "@tabler/icons-react";
 
 import { useRequiredBoard } from "@homarr/boards/context";
-import { humanFileSize } from "@homarr/common";
+import { formatBytes } from "@homarr/common";
 import type { TdarrPieSegment, TdarrStatistics } from "@homarr/integrations";
 import { useI18n } from "@homarr/translation/client";
 import type { TablerIcon } from "@homarr/ui";
@@ -41,7 +41,7 @@ export function StatisticsPanel(props: StatisticsPanelProps) {
         <StatisticItem
           icon={IconDatabaseHeart}
           label={t("savedSpace")}
-          value={humanFileSize(Math.floor(allLibs.totalSavedSpace))}
+          value={formatBytes(Math.floor(allLibs.totalSavedSpace))}
         />
       </Group>
       <Group justify="center" wrap="wrap" grow>

packages/widgets/src/notebook/notebook.tsx

@@ -39,6 +39,8 @@ import {
   IconRowRemove,
   IconTableOff,
   IconTablePlus,
+  IconTextDirectionLtr,
+  IconTextDirectionRtl,
   IconX,
 } from "@tabler/icons-react";
 import { Color } from "@tiptap/extension-color";
@@ -66,6 +68,7 @@ import { useI18n, useScopedI18n } from "@homarr/translation/client";
 import type { TablerIcon } from "@homarr/ui";
 
 import type { WidgetComponentProps } from "../definition";
+import { NotebookTextDirection, setTextDirection } from "./text-direction";
 
 import "@mantine/tiptap/styles.css";
 import "./notebook.css";
@@ -171,6 +174,7 @@ export function Notebook({ options, setOptions, isEditMode, boardId, itemId }: W
         }),
         TaskList.configure({ itemTypeName: "taskItem" }),
         TextAlign.configure({ types: ["heading", "paragraph"] }),
+        NotebookTextDirection,
         TextStyle,
       ],
       shouldRerenderOnTransaction: true,
@@ -347,6 +351,22 @@ export function Notebook({ options, setOptions, isEditMode, boardId, itemId }: W
                 position: t("widget.notebook.align.right"),
               })}
             />
+            <RichTextEditor.Control
+              title={tControls("directionLtr")}
+              aria-label={tControls("directionLtr")}
+              active={editor?.isActive({ dir: "ltr" })}
+              onClick={() => editor && setTextDirection(editor, "ltr").run()}
+            >
+              <IconTextDirectionLtr {...controlIconProps} />
+            </RichTextEditor.Control>
+            <RichTextEditor.Control
+              title={tControls("directionRtl")}
+              aria-label={tControls("directionRtl")}
+              active={editor?.isActive({ dir: "rtl" })}
+              onClick={() => editor && setTextDirection(editor, "rtl").run()}
+            >
+              <IconTextDirectionRtl {...controlIconProps} />
+            </RichTextEditor.Control>
           </RichTextEditor.ControlsGroup>
 
           <RichTextEditor.ControlsGroup>

packages/widgets/src/notebook/text-direction.spec.ts

@@ -0,0 +1,34 @@
+import { Editor } from "@tiptap/react";
+import { StarterKit } from "@tiptap/starter-kit";
+import { describe, expect, it } from "vitest";
+
+import { NotebookTextDirection, setTextDirection } from "./text-direction";
+
+describe("notebook text direction", () => {
+  it("persists right-to-left direction in the notebook HTML", () => {
+    const editor = new Editor({
+      content: "<p>יש לי 16GB</p>",
+      extensions: [StarterKit, NotebookTextDirection],
+    });
+
+    setTextDirection(editor, "rtl").run();
+
+    expect(editor.getHTML()).toBe('<p dir="rtl">יש לי 16GB</p>');
+    editor.destroy();
+  });
+
+  it("reads and changes an existing direction attribute", () => {
+    const editor = new Editor({
+      content: '<h2 dir="rtl">Heading</h2>',
+      extensions: [StarterKit, NotebookTextDirection],
+    });
+
+    expect(editor.getHTML()).toBe('<h2 dir="rtl">Heading</h2>');
+
+    editor.commands.setTextSelection(1);
+    setTextDirection(editor, "ltr").run();
+
+    expect(editor.getHTML()).toContain('<h2 dir="ltr">Heading</h2>');
+    editor.destroy();
+  });
+});

packages/widgets/src/notebook/text-direction.ts

@@ -0,0 +1,28 @@
+import { Extension } from "@tiptap/react";
+import type { Editor } from "@tiptap/react";
+
+export type TextDirection = "ltr" | "rtl";
+
+export const NotebookTextDirection = Extension.create({
+  name: "notebookTextDirection",
+
+  addGlobalAttributes() {
+    return [
+      {
+        types: ["heading", "paragraph"],
+        attributes: {
+          dir: {
+            default: null,
+            parseHTML: (element) => element.getAttribute("dir"),
+            renderHTML: ({ dir }: { dir?: TextDirection }) => (dir ? { dir } : {}),
+          },
+        },
+      },
+    ];
+  },
+});
+
+export function setTextDirection(editor: Editor, direction: TextDirection) {
+  const nodeType = editor.isActive("heading") ? "heading" : "paragraph";
+  return editor.chain().focus().updateAttributes(nodeType, { dir: direction });
+}

packages/widgets/src/system-disks/component.tsx

@@ -5,7 +5,7 @@ import { Box, Card, Group, Stack, Tooltip, useMantineColorScheme } from "@mantin
 
 import { clientApi } from "@homarr/api/client";
 import { useRequiredBoard } from "@homarr/boards/context";
-import { humanFileSize } from "@homarr/common";
+import { formatBytesPair } from "@homarr/common";
 import { useI18n } from "@homarr/translation/client";
 
 import { WidgetEmptyState } from "../common/empty-state";
@@ -20,11 +20,13 @@ const getDisplayText = (item: { used: string; available: string; percentage: num
     case "percentage":
       return `${Math.round(item.percentage)}%`;
     case "absolute": {
+      const usedInBytes = Number(item.used);
       const availableInBytes = Number(item.available);
-      const availableText = Number.isFinite(availableInBytes)
-        ? humanFileSize(Math.round(availableInBytes))
-        : item.available;
-      return `${item.used} / ${availableText}`;
+      if (Number.isFinite(usedInBytes) && Number.isFinite(availableInBytes)) {
+        const { used, available } = formatBytesPair(usedInBytes, availableInBytes);
+        return `${used} / ${available}`;
+      }
+      return `${item.used} / ${item.available}`;
     }
     case "free":
       return `${Math.round(100 - item.percentage)}% free`;
@@ -130,16 +132,8 @@ export default function SystemResources({ integrationIds, options }: WidgetCompo
     throw new NoIntegrationDataError();
   }
 
-  const fileSystem = filterStorageVolumes(
-    rawFileSystem,
-    options.visibleStorageVolumes,
-    lastItem.integrationId,
-  );
-  const smart = filterStorageVolumes(
-    lastItem.healthInfo.smart,
-    options.visibleStorageVolumes,
-    lastItem.integrationId,
-  );
+  const fileSystem = filterStorageVolumes(rawFileSystem, options.visibleStorageVolumes, lastItem.integrationId);
+  const smart = filterStorageVolumes(lastItem.healthInfo.smart, options.visibleStorageVolumes, lastItem.integrationId);
 
   if (fileSystem.length === 0) return <WidgetEmptyState />;
 

packages/widgets/src/system-resources/chart/combined-network-traffic.tsx

@@ -1,7 +1,7 @@
 import { Box, Group, Paper, Stack, Text } from "@mantine/core";
 import { IconNetwork } from "@tabler/icons-react";
 
-import { humanFileSize } from "@homarr/common";
+import { formatByteRate } from "@homarr/common";
 import { useScopedI18n } from "@homarr/translation/client";
 
 import type { LabelDisplayModeOption } from "..";
@@ -47,7 +47,7 @@ export const CombinedNetworkTrafficChart = ({
                       {payloadData.value === undefined ? (
                         <>N/A</>
                       ) : (
-                        <>{humanFileSize(Math.round(Number(payloadData.value)))}/s</>
+                        formatByteRate(Math.round(Number(payloadData.value)))
                       )}
                     </Text>
                   </Group>

packages/widgets/src/system-resources/chart/memory-chart.tsx

@@ -1,7 +1,7 @@
 import { Paper, Text } from "@mantine/core";
 import { IconBrain } from "@tabler/icons-react";
 
-import { humanFileSize } from "@homarr/common";
+import { formatBytesPair } from "@homarr/common";
 import { useScopedI18n } from "@homarr/translation/client";
 
 import type { LabelDisplayModeOption } from "..";
@@ -41,11 +41,11 @@ export const SystemResourceMemoryChart = ({
       tooltipProps={{
         content: ({ payload }) => {
           const value = payload[0] ? Number(payload[0].value) : 0;
+          const memory = formatBytesPair(Math.round(value), totalCapacityInBytes);
           return (
             <Paper px={3} py={2} shadow="md">
               <Text c="dimmed" size="xs">
-                {humanFileSize(Math.round(value))} / {humanFileSize(totalCapacityInBytes)} (
-                {Math.round((value / totalCapacityInBytes) * 100)}%)
+                {memory.used} / {memory.available} ({Math.round((value / totalCapacityInBytes) * 100)}%)
               </Text>
             </Paper>
           );

packages/widgets/src/system-resources/chart/network-traffic.tsx

@@ -1,7 +1,7 @@
 import { Paper, Text } from "@mantine/core";
 import { IconArrowDown, IconArrowUp } from "@tabler/icons-react";
 
-import { humanFileSize } from "@homarr/common";
+import { formatByteRate } from "@homarr/common";
 import { useScopedI18n } from "@homarr/translation/client";
 
 import type { LabelDisplayModeOption } from "..";
@@ -32,7 +32,7 @@ export const NetworkTrafficChart = ({
       title={isUp ? t("up") : t("down")}
       icon={isUp ? IconArrowUp : IconArrowDown}
       yAxisProps={{ domain: [0, upperBound] }}
-      lastValue={`${humanFileSize(Math.round(max))}/s`}
+      lastValue={formatByteRate(Math.round(max))}
       chartType={hasShadow ? "area" : "line"}
       labelDisplayMode={labelDisplayMode}
       tooltipProps={{
@@ -41,7 +41,7 @@ export const NetworkTrafficChart = ({
           return (
             <Paper px={3} py={2} shadow="md">
               <Text c="dimmed" size="xs">
-                {humanFileSize(Math.round(value))}/s
+                {formatByteRate(Math.round(value))}
               </Text>
             </Paper>
           );

pnpm-workspace.yaml

@@ -53,28 +53,28 @@ catalog:
   "@testcontainers/mysql": ^12.0.4
   "@testcontainers/postgresql": ^12.0.4
   "@testcontainers/redis": ^12.0.4
-  "@tiptap/extension-color": 3.27.1
-  "@tiptap/extension-highlight": 3.27.1
-  "@tiptap/extension-image": 3.27.1
-  "@tiptap/extension-link": ^3.27.1
-  "@tiptap/extension-placeholder": ^3.27.1
-  "@tiptap/extension-table": 3.27.1
-  "@tiptap/extension-table-cell": 3.27.1
-  "@tiptap/extension-table-header": 3.27.1
-  "@tiptap/extension-table-row": 3.27.1
-  "@tiptap/extension-task-item": 3.27.1
-  "@tiptap/extension-task-list": 3.27.1
-  "@tiptap/extension-text-align": 3.27.1
-  "@tiptap/extension-text-style": 3.27.1
-  "@tiptap/extension-underline": 3.27.1
-  "@tiptap/react": ^3.27.1
-  "@tiptap/starter-kit": ^3.27.1
+  "@tiptap/extension-color": 3.27.3
+  "@tiptap/extension-highlight": 3.27.3
+  "@tiptap/extension-image": 3.27.3
+  "@tiptap/extension-link": ^3.27.3
+  "@tiptap/extension-placeholder": ^3.27.3
+  "@tiptap/extension-table": 3.27.3
+  "@tiptap/extension-table-cell": 3.27.3
+  "@tiptap/extension-table-header": 3.27.3
+  "@tiptap/extension-table-row": 3.27.3
+  "@tiptap/extension-task-item": 3.27.3
+  "@tiptap/extension-task-list": 3.27.3
+  "@tiptap/extension-text-align": 3.27.3
+  "@tiptap/extension-text-style": 3.27.3
+  "@tiptap/extension-underline": 3.27.3
+  "@tiptap/react": ^3.27.3
+  "@tiptap/starter-kit": ^3.27.3
   "@trpc/client": ^11.18.0
   "@trpc/next": ^11.18.0
   "@trpc/react-query": ^11.18.0
   "@trpc/server": ^11.18.0
   "@trpc/tanstack-react-query": ^11.18.0
-  "@turbo/gen": ^2.10.2
+  "@turbo/gen": ^2.10.4
   "@types/adm-zip": 0.5.8
   "@types/bcrypt": 6.0.0
   "@types/better-sqlite3": 7.6.13
@@ -83,17 +83,17 @@ catalog:
   "@types/crypto-js": ^4.2.2
   "@types/css-modules": ^1.0.5
   "@types/dockerode": ^4.0.1
-  "@types/node": ^24.13.2
+  "@types/node": ^24.13.3
   "@types/node-unifi": ^2.5.1
   "@types/pg": ^8.20.0
   "@types/prismjs": ^1.26.6
   "@types/react": 19.2.17
   "@types/react-dom": 19.2.3
-  "@scalar/api-reference-react": ^0.9.51
+  "@scalar/api-reference-react": ^0.9.54
   "@types/video.js": ^7.3.58
   "@types/ws": ^8.18.1
   "@types/xml2js": ^0.4.14
-  posthog-js: ^1.396.4
+  posthog-js: ^1.398.2
   posthog-node: ^5.39.2
   "@vitejs/plugin-react": ^6.0.3
   "@vitest/coverage-v8": ^4.1.9
@@ -151,7 +151,7 @@ catalog:
   next-intl: 4.13.1
   node-loader: ^2.1.0
   octokit: ^5.0.5
-  oxfmt: ^0.57.0
+  oxfmt: ^0.58.0
   oxlint: ^1.72.0
   pg: ^8.22.0
   postcss-preset-mantine: ^1.18.0
@@ -176,7 +176,7 @@ catalog:
   trpc-to-openapi: ^3.3.0
   tsdav: ^2.3.0
   tsx: 4.20.4
-  turbo: ^2.10.2
+  turbo: ^2.10.4
   typescript: ^6.0.3
   vite: ^8.1.2
   undici: 7.28.0
@@ -218,7 +218,7 @@ overrides:
   "brace-expansion@>=1.0.0 <=1.1.11": ">=5.0.7"
   "esbuild@<=0.24.2": ">=0.28.1"
   "form-data@>=4.0.0 <4.0.4": ">=4.0.6"
-  "hono@<4.6.5": ">=4.12.27"
+  "hono@<4.6.5": ">=4.12.28"
   "linkifyjs@<4.3.2": ">=4.3.3"
   "nanoid@>=4.0.0 <5.0.9": ">=5.1.16"
   "prismjs@<1.30.0": ">=1.30.0"

scripts/ci/act.sh

@@ -0,0 +1,97 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+mode="${1:-all}"
+case "$mode" in
+  fast) job="fast-gate" ;;
+  docker) job="container" ;;
+  all) job="" ;;
+  cleanup) job="cleanup" ;;
+  *)
+    echo "Usage: $0 {fast|docker|all|cleanup}" >&2
+    exit 2
+    ;;
+esac
+
+command -v act >/dev/null 2>&1 || {
+  echo "act is required: https://nektosact.com/installation/index.html" >&2
+  exit 1
+}
+
+docker info >/dev/null 2>&1 || {
+  echo "Docker is not running" >&2
+  exit 1
+}
+
+if [[ -z "${DOCKER_HOST:-}" ]]; then
+  DOCKER_HOST=$(docker context inspect --format '{{.Endpoints.docker.Host}}' 2>/dev/null || true)
+  export DOCKER_HOST
+fi
+
+head_sha=$(git rev-parse HEAD)
+base_sha=$(git rev-parse HEAD~1 2>/dev/null || echo "$head_sha")
+head_ref=$(git branch --show-current)
+head_ref=${head_ref:-act-local}
+event_file=$(mktemp "${TMPDIR:-/tmp}/homarr-act-event.XXXXXX")
+trap 'rm -f "$event_file"' EXIT
+
+json_escape() { printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g; s/\t/\\t/g'; }
+
+if [[ "$mode" == "cleanup" ]]; then
+  event_name="workflow_dispatch"
+  cat >"$event_file" <<EOF
+{
+  "inputs": { "operation": "cleanup", "pr_number": "1", "ref": "" },
+  "repository": { "full_name": "homarr-labs/homarr" }
+}
+EOF
+else
+  event_name="pull_request"
+  safe_ref=$(json_escape "$head_ref")
+  cat >"$event_file" <<EOF
+{
+  "action": "synchronize",
+  "number": 1,
+  "repository": { "full_name": "homarr-labs/homarr" },
+  "pull_request": {
+    "number": 1,
+    "draft": false,
+    "base": { "sha": "$base_sha", "ref": "dev" },
+    "head": {
+      "sha": "$head_sha",
+      "ref": "$safe_ref",
+      "repo": { "full_name": "homarr-labs/homarr" }
+    }
+  }
+}
+EOF
+fi
+
+runner_image="${ACT_RUNNER_IMAGE:-catthehacker/ubuntu:act-latest}"
+args=(
+  "$event_name"
+  --workflows .github/workflows/ci.yml
+  --eventpath "$event_file"
+  --platform "ubuntu-latest=$runner_image"
+  --container-architecture linux/amd64
+  --bind
+)
+
+if [[ -n "$job" ]]; then
+  args+=(--job "$job")
+fi
+
+git_common_dir=$(cd "$(git rev-parse --git-common-dir)" && pwd)
+container_options="--volume homarr-act-node-modules:$PWD/node_modules --volume homarr-act-pnpm-store:$PWD/.pnpm-store"
+case "$git_common_dir" in
+  "$PWD" | "$PWD"/*) ;;
+  *) container_options="$container_options --volume $git_common_dir:$git_common_dir:ro" ;;
+esac
+args+=(--container-options "$container_options")
+
+if [[ -n "${ACT_SECRET_FILE:-}" ]]; then
+  args+=(--secret-file "$ACT_SECRET_FILE")
+fi
+
+exec act "${args[@]}"

tooling/github/setup/action.yml

@@ -4,11 +4,26 @@ description: "Common setup steps for Actions"
 runs:
   using: composite
   steps:
-    - uses: pnpm/action-setup@v6
-    - uses: actions/setup-node@v6
-      with:
-        node-version: 24.18.0
-        cache: "pnpm"
+    # Node (and any other tools) are provisioned from mise.toml, the single
+    # source of truth for tool versions.
+    - name: Install tools with mise
+      uses: jdx/mise-action@v4
 
-    - shell: bash
+    - name: Install pnpm
+      uses: pnpm/action-setup@v6
+
+    - name: Locate pnpm store
+      shell: bash
+      run: echo "PNPM_STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_ENV"
+
+    - name: Cache pnpm store
+      uses: actions/cache@v6
+      with:
+        path: ${{ env.PNPM_STORE_PATH }}
+        key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
+        restore-keys: |
+          pnpm-store-${{ runner.os }}-
+
+    - name: Install dependencies
+      shell: bash
       run: pnpm install --frozen-lockfile

turbo.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://turborepo.org/schema.json",
-  "remoteCache": { "signature": false },
+  "remoteCache": { "signature": true },
   "globalEnv": ["CI", "NODE_ENV", "SKIP_ENV_VALIDATION"],
   "ui": "stream",
   "futureFlags": {
@@ -13,6 +13,7 @@
     },
     "build": {
       "dependsOn": ["^build"],
+      "env": ["TURBO_PLATFORM"],
       "inputs": [
         "$TURBO_DEFAULT$",
         "!**/*.test.ts",