Sync from upstream

.gitattributes

@@ -2,6 +2,7 @@
 
 *.hs linguist-detectable=false
 
-/examples/* linguist-documentation
+/web/** linguist-documentation
+/examples/** linguist-documentation
 
 **/package-lock.json linguist-generated=true

.github/actions/fetch-nightly-cli/action.yaml

@@ -0,0 +1,59 @@
+name: Fetch nightly CLI
+description: From an outside repo, fetch the latest nightly CLI build from Wasp's CI runs.
+
+inputs:
+  branch:
+    description: The branch to fetch the nightly build from. Defaults to 'main'.
+    required: false
+    default: main
+  token:
+    description: GitHub token to authenticate the request.
+    required: false
+    default: ${{ github.token }}
+  output-dir:
+    description: Directory to download the CLI build into. Defaults to the current directory.
+    required: false
+    default: "."
+
+runs:
+  using: composite
+
+  steps:
+    - name: Get latest successful run ID
+      id: get_run_id
+      shell: bash
+      run: |
+        run_id=$(
+          gh run list \
+            --workflow "$WORKFLOW_NAME" \
+            --branch "$BRANCH" \
+            --status success \
+            --limit 1 \
+            --json databaseId \
+            --jq '.[0].databaseId'
+        )
+        echo "run_id=$run_id" >> $GITHUB_OUTPUT
+      env:
+        GH_REPO: wasp-lang/wasp
+        GH_TOKEN: ${{ inputs.token }}
+        BRANCH: ${{ inputs.branch }}
+        WORKFLOW_NAME:
+          # This name must be in sync with the name used in:
+          # /.github/workflows/ci.yaml
+          "CI"
+
+    - name: Download artifact
+      shell: bash
+      run: |
+        gh run download "$RUN_ID" \
+          --name "$ARTIFACT_NAME" \
+          --dir "$OUTPUT_DIR"
+      env:
+        GH_REPO: wasp-lang/wasp
+        GH_TOKEN: ${{ inputs.token }}
+        RUN_ID: ${{ steps.get_run_id.outputs.run_id }}
+        OUTPUT_DIR: ${{ inputs.output-dir }}
+        ARTIFACT_NAME:
+          # This is the name of the artifact (not the file), which must be in sync with:
+          # /.github/workflows/ci-waspc-build.yaml
+          "wasp-cli-${{ runner.os == 'Linux' && 'linux' || 'macos' }}-${{ runner.arch == 'ARM64' && 'aarch64' || 'x86_64' }}"

.github/actions/setup-haskell/action.yaml

@@ -9,13 +9,13 @@ inputs:
     description: |
       The version of GHC to install.
     required: false
-    default: "8.10.7"
+    default: "9.0.2"
 
   cabal-version:
     description: |
       The version of Cabal to install.
     required: false
-    default: "latest"
+    default: "3.10.2.0"
 
   cabal-project-dir:
     description: |

.github/pull_request_template.md

@@ -25,6 +25,16 @@ If you did a **bug fix**, make sure you satisfy the following:
 If you're unable to add a regression test, please explain why.
 This likely indicates that our current testing setup needs improvement.
 
+### Test Coverage
+
+Please ensure your changes are adequately tested:
+
+1. [ ] **My changes are covered by tests** (unit, integration, or e2e tests as appropriate).
+
+If you're unable to add tests or if coverage is partial, please explain why below:
+
+<!-- Provide explanation here if tests are missing or incomplete -->
+
 ### Update example apps if needed
 
 If you did code changes and **added a new feature**, make sure you satisfy the following:

.github/workflows/automation-algolia-restart-crawler.yaml

@@ -0,0 +1,53 @@
+name: "Automation - Restart Algolia crawler"
+
+# Based on https://github.com/wasp-lang/wasp/tree/main/web#deployment.
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - deploy-web
+
+concurrency:
+  group: "automation-algolia-restart-crawler"
+  cancel-in-progress: true
+
+jobs:
+  restart-crawler:
+    name: Restart Algolia Crawler
+    runs-on: ubuntu-latest
+    steps:
+      - name: Wait for Wasp web to finish deploying
+        env:
+          CLOUDFLARE_ACCOUNT_ID: 75c37602a6b75c790961219411cb1b92
+          CLOUDFLARE_PROJECT_NAME: wasp-docs
+        run: |
+          while true; do
+            response=$(curl -s "https://api.cloudflare.com/client/v4/accounts/$CLOUDFLARE_ACCOUNT_ID/pages/projects/$CLOUDFLARE_PROJECT_NAME/deployments?per_page=1&page=1&env=production" \
+              -H "Authorization: Bearer ${{ secrets.CLOUDFLARE_READ_PAGES_API_TOKEN }}" \
+              -H "Content-Type: application/json")
+
+            latest_name=$(echo "$response" | jq -r '.result[0].latest_stage.name')
+            latest_status=$(echo "$response" | jq -r '.result[0].latest_stage.status')
+
+            echo "Latest stage: $latest_name, status: $latest_status"
+
+            if [[ "$latest_status" == "active" ]]; then
+              echo "Deployment is still active, waiting 5 seconds..."
+              sleep 5
+              continue
+            elif [[ "$latest_name" == "deploy" && "$latest_status" == "success" ]]; then
+              echo "Deployment succeeded!"
+              break
+            else
+              echo "Deployment failed or in unexpected state: stage=$latest_name, status=$latest_status"
+              exit 1
+            fi
+          done
+
+      - name: Restart Algolia crawler
+        run: |
+          # Based on Algolia API: https://www.algolia.com/doc/rest-api/crawler/#tag/actions/operation/startReindex
+          curl -X POST \
+            --user "${{ secrets.ALGOLIA_CRAWLER_USER_ID }}:${{ secrets.ALGOLIA_CRAWLER_API_KEY }}" \
+            -H "Content-Type: application/json" \
+            "https://crawler.algolia.com/api/1/crawlers/${{ secrets.ALGOLIA_CRAWLER_ID }}/reindex"

.github/workflows/automation-cache-evict.yaml

@@ -0,0 +1,31 @@
+name: "Automation - Evict caches"
+
+# Caches for merged PRs stay around until we bump against our cache limit.
+# They are also not shareable between branches. Therefore, once a PR is
+# merged, the cache for that branch is immediately not needed anymore, and we
+# can remove it. If we remove these caches, we can save space and be more sure
+# that the remaining caches are actually useful, and not at danger of being
+# evicted.
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+
+concurrency:
+  group: "automation-cache-evict"
+  cancel-in-progress: true
+
+jobs:
+  evict-cache:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Evict caches
+        shell: bash
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: node ./scripts/cache-evict.mjs

.github/workflows/automation-cache-warm.yaml

@@ -0,0 +1,16 @@
+name: "Automation - Warm caches"
+
+on:
+  workflow_dispatch:
+  schedule:
+    # GitHub evicts unused caches after 7 days, so we run this every 6 days
+    - cron: "0 0 */6 * *"
+
+concurrency:
+  group: "automation-cache-warm"
+  cancel-in-progress: false
+
+jobs:
+  warm-cache-ci:
+    uses: ./.github/workflows/ci.yaml
+    secrets: inherit

.github/workflows/automation-merge-release-to-main.yaml

@@ -0,0 +1,56 @@
+name: "Automation - Merge release to main"
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - release
+
+env:
+  SOURCE_BRANCH: release
+  TARGET_BRANCH: main
+
+  USERNAME: ${{ github.actor }}
+
+  PR_TITLE: "Merge `release` into `main`"
+  PR_BODY: |
+    Automated PR to merge changes from `release` branch back into `main`.
+
+    > [!IMPORTANT]
+    > You should **NOT** "Rebase and merge" or "Squash and merge" this PR, so we avoid conflicts in the future.
+
+jobs:
+  create-pr:
+    name: Create Pull Request
+    runs-on: ubuntu-latest
+
+    steps:
+      - run: |
+          existing_pr_number=$(
+            gh pr list \
+              --head "$SOURCE_BRANCH" \
+              --base "$TARGET_BRANCH" \
+              --json number \
+              --jq '.[0].number // empty'
+          )
+
+          if [ -n "$existing_pr_number" ]; then
+            gh pr comment "$existing_pr_number" \
+              --body "Ping @${USERNAME}"
+
+            gh pr edit "$existing_pr_number" \
+              --add-assignee "$USERNAME" \
+              --add-reviewer "$USERNAME"
+          else
+            gh pr create \
+              --assignee "$USERNAME" \
+              --reviewer "$USERNAME" \
+              --head "$SOURCE_BRANCH" \
+              --base "$TARGET_BRANCH" \
+              --title "$PR_TITLE" \
+              --body "$PR_BODY"
+          fi
+        env:
+          # Env for the `gh` CLI tool
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}

.github/workflows/automation-pr-label-external.yaml

@@ -0,0 +1,50 @@
+name: "Automation - Label external PRs"
+
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+
+env:
+  internal_team_name: "eng"
+  external_label_name: "external"
+
+jobs:
+  label-external-pr:
+    name: Label external PRs
+
+    runs-on: ubuntu-latest
+
+    permissions:
+      pull-requests: write
+
+    steps:
+      # We're dealing with untrusted input, so we pass inputs as environment
+      # variables instead of interpolation, following GitHub's advice:
+      # https://docs.github.com/en/actions/reference/security/secure-use#use-an-intermediate-environment-variable
+
+      - name: Check if PR is internal
+        id: check_pr
+        run: |
+          pr_is_internal=$(
+            gh api "/orgs/$GITHUB_ORG/teams/$TEAM_NAME/members" |
+              jq --arg author "$AUTHOR_LOGIN" 'map(.login) | contains([$author])'
+          )
+
+          # Output is a JSON boolean
+          echo "pr_is_internal=$pr_is_internal" >>"$GITHUB_OUTPUT"
+
+        env:
+          AUTHOR_LOGIN: ${{ github.event.sender.login }}
+          GITHUB_ORG: ${{ github.repository_owner }}
+          TEAM_NAME: ${{ env.internal_team_name }}
+          GH_TOKEN: ${{ secrets.WASP_LANG_READ_MEMBERS }}
+
+      - name: Label external PR
+        if: steps.check_pr.outputs.pr_is_internal == 'false'
+        run: gh pr edit "$PR_NUMBER" --add-label "$LABEL_NAME"
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          LABEL_NAME: ${{ env.external_label_name }}
+          GH_TOKEN: ${{ github.token }}