chore: bump dorny/paths-filter from 3.0.3 to 4.0.1

Bumps [dorny/paths-filter](https://github.com/dorny/paths-filter) from 3.0.3 to 4.0.1.
- [Release notes](https://github.com/dorny/paths-filter/releases)
- [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md)
- [Commits](d1c1ffe024...fbd0ab8f3e)

---
updated-dependencies:
- dependency-name: dorny/paths-filter
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/publish.yaml

@@ -70,11 +70,6 @@ jobs:
           token: ${{ secrets.HOMEBREW_GITHUB_API_TOKEN }}
           ref: "master"
 
-      - name: Configure git
-        run: |
-          git config --global user.name cdrci
-          git config --global user.email opensource@coder.com
-
       - name: Fetch and reset master
         run: |
           git remote add upstream https://github.com/coder/code-server-aur.git
@@ -82,6 +77,11 @@ jobs:
           git reset --hard upstream/master
           git push --force
 
+      - name: Configure git
+        run: |
+          git config --global user.name cdrci
+          git config --global user.email opensource@coder.com
+
       - name: Validate package
         uses: heyhusen/archlinux-package-action@c9f94059ccbebe8710d31d582f33ef4e84fe575c # v3.0.0
         with:
@@ -136,32 +136,3 @@ jobs:
           out-file-path: "release-packages"
 
       - run: npm run publish:docker
-
-  repo:
-    runs-on: ubuntu-latest
-    env:
-      GH_TOKEN: ${{ secrets.HOMEBREW_GITHUB_API_TOKEN }}
-      TAG: ${{ inputs.version || github.ref_name }}
-    needs: docker
-
-    steps:
-      - name: Set version to tag without leading v
-        run: |
-          echo "VERSION=${TAG#v}" >> $GITHUB_ENV
-
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-
-      - run: ./ci/build/update-repo.sh
-
-      - name: Open PR
-        run: |
-          git config --global user.name cdrci
-          git config --global user.email opensource@coder.com
-          git checkout -b "helm/$VERSION"
-          git add .
-          git commit -m "Update to $VERSION"
-          git push -u origin "$(git branch --show)"
-          gh pr create \
-            --repo coder/code-server \
-            --body-file .cache/checklist \
-            --title "Update to $VERSION"

.github/workflows/release.yaml

@@ -6,11 +6,6 @@ on:
       version:
         type: string
         required: true
-  pull_request_target:
-    types:
-      - closed
-    branches:
-      - "update/**"
 
 permissions:
   contents: write # For creating releases.
@@ -26,7 +21,6 @@ jobs:
   package-linux:
     name: ${{ format('linux-{0}', matrix.vscode_arch) }}
     runs-on: ubuntu-22.04
-    if: github.event_name == 'workflow_dispatch' || github.event.pull_request.merged == true
 
     strategy:
       matrix:
@@ -45,7 +39,7 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       ELECTRON_SKIP_BINARY_DOWNLOAD: 1
       PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
-      TAG: ${{ inputs.version || github.event.pull_request.head.ref || github.ref_name }}
+      TAG: ${{ inputs.version || github.ref_name }}
       # Set release package name.
       ARCH: ${{ matrix.package_arch }}
       # Cross-compile target.
@@ -70,10 +64,9 @@ jobs:
           curl -sSfL https://github.com/goreleaser/nfpm/releases/download/v2.3.1/nfpm_2.3.1_`uname -s`_`uname -m`.tar.gz | tar -C ~/.local/bin -zxv nfpm
           echo "$HOME/.local/bin" >> $GITHUB_PATH
 
-      - name: Strip update/ and v from tag
+      - name: Set version to tag without leading v
         run: |
-          version=${TAG#update/}
+          echo "VERSION=${TAG#v}" >> $GITHUB_ENV
-          echo "VERSION=${version#v}" >> $GITHUB_ENV
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
@@ -106,18 +99,12 @@ jobs:
         if: ${{ matrix.vscode_arch == 'x64' }}
       - run: tar -czf package.tar.gz release
         if: ${{ matrix.vscode_arch == 'x64' }}
-      - run: |
-          sed "/^## Unreleased/,/^## / ! d" CHANGELOG.md | head -n -2 | tail -n +3 > .cache/release-notes
-        if: ${{ matrix.vscode_arch == 'x64' }}
       - uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
         if: ${{ matrix.vscode_arch == 'x64' }}
         with:
           draft: true
           discussion_category_name: "📣 Announcements"
           files: package.tar.gz
-          tag_name: v${{ env.VERSION }}
-          name: v${{ env.VERSION }}
-          body: .cache/release-notes
 
       # Platform-specific release.
       - run: KEEP_MODULES=1 npm run release
@@ -127,13 +114,10 @@ jobs:
           draft: true
           discussion_category_name: "📣 Announcements"
           files: ./release-packages/*
-          tag_name: v${{ env.VERSION }}
-          name: v${{ env.VERSION }}
 
   package-macos:
     name: ${{ matrix.vscode_target }}
     runs-on: ${{ matrix.os }}
-    if: github.event_name == 'workflow_dispatch' || github.event.pull_request_merged == true
     strategy:
       matrix:
         include:
@@ -160,10 +144,9 @@ jobs:
           curl -sSfL https://github.com/goreleaser/nfpm/releases/download/v2.3.1/nfpm_2.3.1_`uname -s`_`uname -m`.tar.gz | tar -C ~/.local/bin -zxv nfpm
           echo "$HOME/.local/bin" >> $GITHUB_PATH
 
-      - name: Strip update/ and v from tag
+      - name: Set version to tag without leading v
         run: |
-          version=${TAG#update/}
+          echo "VERSION=${TAG#v}" >> $GITHUB_ENV
-          echo "VERSION=${version#v}" >> $GITHUB_ENV
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
@@ -189,5 +172,3 @@ jobs:
           draft: true
           discussion_category_name: "📣 Announcements"
           files: ./release-packages/*
-          tag_name: v${{ env.VERSION }}
-          name: v${{ env.VERSION }}

.github/workflows/update.yaml

@@ -1,72 +0,0 @@
-name: Update code-server
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        type: string
-        required: true
-  schedule:
-    - cron: "0 16,21 * * *"
-
-jobs:
-  update:
-    runs-on: ubuntu-latest
-    env:
-      TAG: ${{ inputs.version }}
-      GH_TOKEN: ${{ secrets.HOMEBREW_GITHUB_API_TOKEN }}
-
-    steps:
-      - name: Fetch latest tag
-        if: env.TAG == ''
-        run: |
-          tag=$(curl -fsSLI -o /dev/null -w "%{url_effective}" https://github.com/microsoft/vscode/releases/latest)
-          tag="${tag#https://github.com/microsoft/vscode/releases/tag/}"
-          echo "TAG=$tag" >> $GITHUB_ENV
-
-      - name: Remove leading v from tag
-        run: |
-          echo "VERSION=${TAG#v}" >> $GITHUB_ENV
-
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-        with:
-          submodules: true
-
-      - name: Check current version
-        id: check
-        run: |
-          commit="$(git -C lib/vscode rev-parse HEAD)"
-          if [[ $(git -C lib/vscode ls-remote --tags | grep "$commit") == */"$VERSION" ]] ; then
-            echo "$VERSION update has already been merged into $(git rev-parse --abbrev-ref HEAD)"
-            echo done=true >> $GITHUB_OUTPUT
-          elif git ls-remote --exit-code --heads origin "update/$VERSION" ; then
-            echo "There is already a PR for updating to $VERSION"
-            echo done=true >> $GITHUB_OUTPUT
-          else
-            echo "$VERSION update has not started yet"
-            echo done=false >> $GITHUB_OUTPUT
-          fi
-
-      - uses: awalsh128/cache-apt-pkgs-action@2c09a5e66da6c8016428a2172bd76e5e4f14bb17 # latest
-        if: steps.check.outputs.done == 'false'
-        with:
-          packages: quilt
-          version: 1.0
-
-      - run: ./ci/build/update-vscode.sh
-        if: steps.check.outputs.done == 'false'
-
-      - name: Open PR
-        if: steps.check.outputs.done == 'false'
-        run: |
-          git config --global user.name cdrci
-          git config --global user.email opensource@coder.com
-          git checkout -b "update/$VERSION"
-          git add .
-          git commit -m "Update VS Code to $VERSION"
-          git push -u origin "$(git branch --show)"
-          gh pr create \
-            --repo coder/code-server \
-            --title "Update VS Code to $VERSION" \
-            --body-file .cache/checklist \
-            --draft

.gitignore

@@ -11,7 +11,6 @@ node_modules
 .home
 coverage
 **/.DS_Store
-*.bak
 
 # Code packages itself here.
 /lib/vscode-reh-web-*

CHANGELOG.md

@@ -22,14 +22,6 @@ Code v99.99.999
 
 ## Unreleased
 
-## [4.119.0](https://github.com/coder/code-server/releases/tag/v4.119.0) - 2026-05-07
-
-Code v1.119.0
-
-### Changed
-
-- Update to Code 1.119.0
-
 ## [4.118.0](https://github.com/coder/code-server/releases/tag/v4.118.0) - 2026-05-06
 
 Code v1.118.0

ci/build/update-repo.sh

@@ -1,46 +0,0 @@
-#!/usr/bin/env bash
-
-set -Eeuo pipefail
-
-function update_helm() {
-  local current
-  current=$(yq .version ci/helm-chart/Chart.yaml)
-  local next
-  next=$(semver "$current" -i minor)
-  echo "Bumping version from $current to $next..."
-  sed -i.bak "s/^version: $current\$/version: $next/" ci/helm-chart/Chart.yaml
-
-  echo "Setting app version and image to $version..."
-  sed -i.bak "s/^appVersion: .\+\$/appVersion: $version/" ci/helm-chart/Chart.yaml
-  sed -i.bak "s/^  tag: .\+\$/  tag: '$version'/" ci/helm-chart/values.yaml
-}
-
-function update_changelog() {
-  local date
-  date=$(printf '%(%Y-%m-%d)T\n' -1)
-  local link="https://github.com/coder/code-server/releases/tag/v$version"
-  sed -i.bak "s|## Unreleased|## Unreleased\n\n## [$version]($link) - $date|" CHANGELOG.md
-}
-
-function main() {
-  cd "$(dirname "${0}")/../.."
-
-  source ./ci/lib.sh
-
-  local version=${VERSION:-$(git describe --tags)}
-  version="${version#v}"
-
-  declare -a steps
-
-  steps+=(
-    "Update Helm chart" "update_helm"
-    "Update changelog" "update_changelog"
-  )
-
-  run-steps "${steps[@]}"
-
-  # This step is always manual.
-  echo "- [ ] https://github.com/coder/code-server-aur/pulls" >> .cache/checklist
-}
-
-main "$@"

ci/build/update-vscode.sh

@@ -2,13 +2,13 @@
 
 set -Eeuo pipefail
 
-function unapply_patches() {
+function remove_patches() {
   local -i exit_code=0
-  quiet quilt pop -af || exit_code=$?
+  quilt pop -af || exit_code=$?
   case $exit_code in
-    # Sucessfully unapplied.
+    # Sucessfully removed.
     0) ;;
-    # No more patches to unapply.
+    # No more patches to remove.
     2) ;;
     # Some error.
     *) return $exit_code ;;
@@ -17,18 +17,19 @@ function unapply_patches() {
 
 function update_vscode() {
   pushd lib/vscode
-  if ! git checkout 2>&1 "$target_vscode_version" ; then
+  if ! git checkout "$VERSION" ; then
-    echo "$target_vscode_version does not exist locally, fetching..."
+    echo "$VERSION does not exist locally, fetching..."
     git fetch --all --prune
-    git checkout "$target_vscode_version"
+    git checkout "$VERSION"
   fi
   popd
 }
 
 function refresh_patches() {
   local -i exit_code=0
-  while quiet quilt push ; ! (( exit_code=$? )) ; do
+  while quilt push ; ! (( exit_code=$? )) ; do
     quilt refresh
+    echo # Extra new line for separation.
   done
   case $exit_code in
     # No more patches to apply.
@@ -41,8 +42,8 @@ function refresh_patches() {
 function update_node() {
   local node_version
   node_version=$(cat .node-version)
-  if [[ $node_version == "$target_node_version" ]] ; then
+  if [[ $node_version == $target_node_version ]] ; then
-    echo "Already set to $target_node_version"
+    echo "$node_version already matches $target_node_version"
   else
     echo "Updating from $node_version to $target_node_version..."
     echo "$target_node_version" > .node-version
@@ -51,37 +52,26 @@ function update_node() {
 
 function get-webview-script-hash() {
   local html
-  html=$(<"$1")
+  html=$(<$1)
   local start_tag='<script async type="module">'
   local end_tag="</script>"
-  html=${html##*"$start_tag"}
+  html=${html##*$start_tag}
-  html=${html%%"$end_tag"*}
+  html=${html%%$end_tag*}
   echo -n "$html" | openssl sha256 -binary | openssl base64
 }
 
 function update_csp() {
-  local current
+  local -i exit_code=0
-  current=$(quilt top 2>/dev/null || echo "")
+  # Move back to the webview patch so it can be refreshed.
-  local patch_action=""
+  quilt pop webview || exit_code=$?
-  echo "Currently at ${current:-base}"
+  case $exit_code in
-  if [[ $current != */webview.diff ]] ; then
+    # Successfully moved.
-    echo "Moving to patches/webview.diff..."
+    0) ;;
-    local -i exit_code=0
+    # Already at the patch.
-    if quilt applied 2>/dev/null | grep --quiet webview.diff ; then
+    2) ;;
-      quiet quilt pop webview || exit_code=$?
+    # Some error.
-      patch_action=pop
+    *) return $exit_code ;;
-    else
+  esac
-      quiet quilt push webview || exit_code=$?
-      patch_action=push
-    fi
-    case $exit_code in
-      # Successfully moved.
-      0) ;;
-      # Some error.
-      *) return $exit_code ;;
-    esac
-  fi
-
   local file=lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index.html
   local hash
   hash=$(get-webview-script-hash "$file")
@@ -89,24 +79,43 @@ function update_csp() {
   # Use octothorpe as a delimiter since the hash may contain a slash.
   sed -i.bak "s#script-src 'sha256-[^']\+'#script-src 'sha256-$hash'#" "$file"
   quilt refresh
+  # Get patched back up.
+  quilt push -a
+}
 
-  if [[ $patch_action != "" ]] ; then
+function run() {
-    echo "Moving back to ${current:-base}..."
+  local -i failed=0
-    case $patch_action in
+  rm -f .cache/checklist
-      pop) quiet quilt push "$current" ;;
+  while (( $# )) ; do
-      push) quiet quilt pop "${current:--a}" ;;
+    local name=$1 ; shift
-    esac
+    local fn=$1 ; shift
+    # Only run if an earlier step has not failed.
+    if [[ $failed == 0 ]] ; then
+      echo "[+] $name..."
+      if $fn ; then
+        echo "- [X] $name" >> .cache/checklist
+      else
+        ((failed++))
+      fi
+    fi
+    # For all failed steps, write out an empty checkbox.
+    if [[ $failed != 0 ]] ; then
+      echo "- [ ] $name" >> .cache/checklist
+    fi
+  done
+  if [[ $failed != 0 ]] ; then
+    return 1
   fi
 }
 
 function add_changelog() {
   local file=CHANGELOG.md
-  if grep --quiet "Code $target_vscode_version" "$file" ; then
+  if grep "Code $VERSION" "$file" ; then
-    echo "Changelog for $target_vscode_version already exists"
+    echo "Changelog for $VERSION already exists"
   else
     # TODO: This is not exactly robust.  In particular, it needs to handle if
     # there is already a "changed" section.
-    sed -i.bak "s/## Unreleased/## Unreleased\n\nCode v$target_vscode_version\n\n### Changed\n\n- Update to Code $target_vscode_version/" "$file"
+    sed -i.bak "s/## Unreleased/## Unreleased\n\nCode v$VERSION\n\n### Changed\n\n- Update to Code $VERSION/" "$file"
   fi
 }
 
@@ -119,33 +128,21 @@ function main() {
   target_node_version=$(grep target lib/vscode/remote/.npmrc | awk -F= '{print $2}' | tr -d '"')
 
   declare -a steps
-
+  # Removing patches only needs to be done locally; in CI we start from a fresh
-  # If version is not set, assume we are already at the target version and the
+  # clone each time.
-  # user is just trying to resolve conflics.
+  if [[ ! ${CI-} ]] ; then
-  local target_vscode_version
+    steps+=("Remove patches" "remove_patches")
-  if [[ ${VERSION-} ]] ; then
-    # Removing patches only needs to be done locally; in CI we start from a
-    # fresh clone each time.
-    if [[ ! ${CI-} ]] ; then
-      steps+=("Unapplying patches" "unapply_patches")
-    fi
-    target_vscode_version="${VERSION#v}"
-    steps+=(
-      "Update VS Code to $target_vscode_version" "update_vscode"
-      "Refresh VS Code patches" "refresh_patches"
-    )
-  else
-    target_vscode_version="$(git -C lib/vscode describe --tags --exact-match)"
-    echo "Detected VS Code version $target_vscode_version"
   fi
 
   steps+=(
+    "Update VS Code to $VERSION" "update_vscode"
+    "Refresh VS Code patches" "refresh_patches"
     "Set Node version to $target_node_version" "update_node"
     "Update CSP webview hash" "update_csp"
     "Add changelog note" "add_changelog"
   )
 
-  run-steps "${steps[@]}"
+  run "${steps[@]}"
 
   # This step is always manual.
   echo "- [ ] Verify changelog" >> .cache/checklist

ci/lib.sh

@@ -78,42 +78,6 @@ nodeArch() {
   echo "$cpu"
 }
 
-run-steps() {
-  local -i failed=0
-  rm -f .cache/checklist
-  while (( $# )) ; do
-    local name=$1 ; shift
-    local fn=$1 ; shift
-    # Only run if an earlier step has not failed.
-    if [[ $failed == 0 ]] ; then
-      echo "$name..."
-      if $fn | indent ; then
-        echo "- [X] $name" >> .cache/checklist
-      else
-        ((failed++))
-      fi
-    fi
-    # For all failed steps, write out an empty checkbox.
-    if [[ $failed != 0 ]] ; then
-      echo "- [ ] $name" >> .cache/checklist
-    fi
-  done
-  if [[ $failed != 0 ]] ; then
-    return 1
-  fi
-}
-
-quiet() {
-  "$@" >/dev/null
-}
-
-indent() {
-  local count=2
-  local space
-  space=$(printf "%${count}s")
-  sed "s/^/$space| /g"
-}
-
 # See gulpfile.reh.ts for available targets.
 if [[ ! ${VSCODE_TARGET-} ]]; then
   VSCODE_TARGET="$(nodeOS)-$(nodeArch)"

docs/CONTRIBUTING.md

@@ -93,20 +93,17 @@ commits first if you are doing this).
 
 ### Version updates to Code
 
-PRs will be automatically created with updates to VS Code. If a patch cannot be
+1. Remove any patches with `quilt pop -a`.
-automatically resolved, it will be necessary to clone the branch, resolve the
+2. Update the `lib/vscode` submodule to the desired upstream version branch.
-conflicts manually, and finish the update. To do this:
+   1. `cd lib/vscode && git checkout release/1.66 && cd ../..`
-
+   2. `git add lib && git commit -m "chore: update to Code <version>"`
-1. Apply as many patches as possible `quilt push -a`.
+3. Apply the patches one at a time (`quilt push`). If the application succeeds
-2. Once you hit a conflict, force apply with `quilt push -f`, manually add back
+   but the lines changed, update the patch with `quilt refresh`. If there are
-   the rejected code, then run `quilt refresh`.
+   conflicts, then force apply with `quilt push -f`, manually add back the
-3. Once all patches have been resolved, run `./ci/build/update.sh` to finish the
+   rejected code, then run `quilt refresh`.
-   update process.
+4. From the code-server **project root**, run `npm install`.
-4. Commit all changes, push them up to the branch, and update the checklist in
+5. Check the Node.js version that's used by Electron (which is shipped with VS
-   the PR description.
+   Code. If necessary, update our version of Node.js to match.
-
-Once the PR is ready, manually verify that the unreleased changelog section
-contains all the changes going into this version before merging.
 
 ### Patching Code