Merge origin/main into stable-main-13.13.0

Author: metamaskbot

.github/CODEOWNERS

@@ -13,7 +13,7 @@
 # audit these changes on their own, and leave their analysis in a comment.
 # These codeowners will review this analysis, and review the policy changes in
 # further detail if warranted.
-lavamoat/                            @MetaMask/extension-devs @MetaMask/policy-reviewers @MetaMask/supply-chain
+lavamoat/                            @MetaMask/policy-reviewers
 
 # The offscreen.ts script file that is included in the offscreen document html
 # file is responsible, at present, for loading the snaps execution environment
@@ -142,6 +142,7 @@ app/scripts/lib/transaction/util.*
 ui/pages/confirmations                                                              @MetaMask/confirmations
 ui/components/multichain/pages/send                                                 @MetaMask/confirmations
 ui/pages/confirmations/components/confirm/footer                                    @MetaMask/confirmations @MetaMask/web3auth
+ui/pages/confirmations/components/confirm/info/shield-subscription-approve          @MetaMask/confirmations @MetaMask/web3auth
 ui/pages/confirmations/hooks/alerts/useShieldCoverageAlert.test.ts                  @MetaMask/confirmations @MetaMask/web3auth
 ui/pages/confirmations/hooks/alerts/useShieldCoverageAlert.ts                       @MetaMask/confirmations @MetaMask/web3auth
 ui/pages/confirmations/hooks/alerts/transactions/ShieldCoverageAlertMessage.tsx     @MetaMask/confirmations @MetaMask/web3auth

.github/scripts/check-template-and-add-labels.ts

@@ -409,7 +409,19 @@ async function userBelongsToMetaMaskOrg(
 // This function checks if the PR description has a changelog entry
 function hasChangelogEntry(body: string): boolean {
   // Remove HTML comments (including multiline)
-  const uncommentedBody = body.replace(/<!--[\s\S]*?-->/g, "");
+  let uncommentedBody = body;
+  let prevBody;
+  let iterationCount = 0;
+  const MAX_ITERATIONS = 100;
+  do {
+    prevBody = uncommentedBody;
+    uncommentedBody = uncommentedBody.replace(/<!--[\s\S]*?-->/g, "");
+    iterationCount++;
+    if (iterationCount >= MAX_ITERATIONS) {
+      console.warn(`Reached maximum HTML comment removal iterations (${MAX_ITERATIONS}). Input may be malformed or malicious.`);
+      break;
+    }
+  } while (uncommentedBody !== prevBody);
 
   // Split body into lines
   const lines = uncommentedBody.split(/\r?\n/);

.github/workflows/create-release-pr.yml

@@ -76,20 +76,21 @@ jobs:
   create-release-pr:
     needs: [resolve-bases, resolve-previous-ref]
     name: Create Release Pull Request using Github Tools
-    uses: MetaMask/github-tools/.github/workflows/create-release-pr.yml@6a04e4d0c8c25680a7543cfcd2e2fb7125b6759c
-    with:
-      platform: extension
-      checkout-base-branch: ${{ needs.resolve-bases.outputs.checkout_base }}
-      release-pr-base-branch: ${{ needs.resolve-bases.outputs.release_base }}
-      semver-version: ${{ inputs.semver-version }}
-      previous-version-ref: ${{ needs.resolve-previous-ref.outputs.previous_ref }}
-      github-tools-version: 6a04e4d0c8c25680a7543cfcd2e2fb7125b6759c
-    secrets:
-      # This token needs write permissions to metamask-extension & read permissions to metamask-planning
-      # If called from auto-create-release-pr use the PR_TOKEN passed in as an input, if called manually use github secret token values
-      # (this is due to github limitations on fetching secrets from called workflows).
-      github-token: ${{ github.event_name == 'workflow_dispatch' && secrets.PR_TOKEN || secrets.github-token }}
-      google-application-creds-base64: ${{ github.event_name == 'workflow_dispatch' && secrets.GCP_RLS_SHEET_ACCOUNT_BASE64 || secrets.google-application-creds-base64 }}
+    runs-on: ubuntu-latest
     permissions:
       contents: write
       pull-requests: write
+    steps:
+      - name: Create Release PR
+        uses: MetaMask/github-tools/.github/actions/[email protected]
+        with:
+          platform: extension
+          checkout-base-branch: ${{ needs.resolve-bases.outputs.checkout_base }}
+          release-pr-base-branch: ${{ needs.resolve-bases.outputs.release_base }}
+          semver-version: ${{ inputs.semver-version }}
+          previous-version-ref: ${{ needs.resolve-previous-ref.outputs.previous_ref }}
+          # This token needs write permissions to metamask-extension & read permissions to metamask-planning
+          # If called from auto-create-release-pr use the PR_TOKEN passed in as an input, if called manually use github secret token values
+          # (this is due to github limitations on fetching secrets from called workflows).
+          github-token: ${{ github.event_name == 'workflow_dispatch' && secrets.PR_TOKEN || secrets.github-token }}
+          google-application-creds-base64: ${{ github.event_name == 'workflow_dispatch' && secrets.GCP_RLS_SHEET_ACCOUNT_BASE64 || secrets.google-application-creds-base64 }}

.github/workflows/merge-stable-sync-pr.yml

@@ -0,0 +1,25 @@
+name: Merge Stable Sync PR
+
+on:
+  # Trigger the workflow when a comment is created on an issue or pull request
+  issue_comment:
+    types: [created]
+
+jobs:
+  merge-pr:
+    # Only run if the comment is on a PR and the comment body matches exactly "Merge my PR"
+    if: >-
+      github.event.issue.pull_request &&
+      github.event.comment.body == 'Merge my PR' &&
+      (
+        github.event.comment.author_association == 'MEMBER' ||
+        github.event.comment.author_association == 'OWNER'
+      )
+    uses: MetaMask/github-tools/.github/workflows/merge-approved-pr.yml@7c0ab4db1e9c1d5673fe7958e8959f1842edbebd
+    with:
+      pr-number: ${{ github.event.issue.number }}
+      # Merge PRs from stable-main-X.Y.Z into main
+      required-base-branch: 'main'
+      head-branch-pattern: '^stable-main-[0-9]+\.[0-9]+\.[0-9]+$'
+    secrets:
+      github-token: ${{ secrets.METAMASK_EXTENSION_BRANCH_SYNC_TOKEN }}

.github/workflows/merge-version-bump-pr.yml

@@ -0,0 +1,25 @@
+name: Merge Version Bump PR
+
+on:
+  # Trigger the workflow when a comment is created on an issue or pull request
+  issue_comment:
+    types: [created]
+
+jobs:
+  merge-pr:
+    # Only run if the comment is on a PR and the comment body matches exactly "Merge my PR"
+    if: >-
+      github.event.issue.pull_request &&
+      github.event.comment.body == 'Merge my PR' &&
+      (
+        github.event.comment.author_association == 'MEMBER' ||
+        github.event.comment.author_association == 'OWNER'
+      )
+    uses: MetaMask/github-tools/.github/workflows/merge-approved-pr.yml@7c0ab4db1e9c1d5673fe7958e8959f1842edbebd
+    with:
+      pr-number: ${{ github.event.issue.number }}
+      # Merge PRs from version-bump/X.Y.Z into main
+      required-base-branch: 'main'
+      head-branch-pattern: '^version-bump/[0-9]+\.[0-9]+\.[0-9]+$'
+    secrets:
+      github-token: ${{ secrets.METAMASK_EXTENSION_BRANCH_SYNC_TOKEN }}

.github/workflows/run-e2e.yml

@@ -74,7 +74,7 @@ jobs:
       RUN_ID: ${{ github.run_id }}
       PR_NUMBER: ${{ github.event.pull_request.number || '' }}
       TEST_SUITE_NAME: ${{ inputs.test-suite-name }}
-      IS_SIDEPANEL: false
+      IS_SIDEPANEL: true
     steps:
       - name: Checkout and setup environment
         uses: MetaMask/action-checkout-and-setup@v1

.github/workflows/update-release-changelog.yml

@@ -42,15 +42,17 @@ jobs:
     name: Update changelog
     needs: validate-branch
     if: needs.validate-branch.outputs.is-valid-release == 'true'
+    runs-on: ubuntu-latest
     permissions:
       contents: write
       pull-requests: write
-    uses: MetaMask/github-tools/.github/workflows/update-release-changelog.yml@36dc168896c1b496f35fc880ee8a3625b4b837ba
-    with:
-      release-branch: ${{ github.ref_name }}
-      repository-url: ${{ github.server_url }}/${{ github.repository }}
-      platform: extension
-      github-tools-version: 36dc168896c1b496f35fc880ee8a3625b4b837ba
-      previous-version-ref: null
-    secrets:
-      github-token: ${{ secrets.PR_TOKEN }}
+    steps:
+      - name: Update Release Changelog
+        uses: MetaMask/github-tools/.github/actions/[email protected]
+        with:
+          release-branch: ${{ github.ref_name }}
+          repository-url: ${{ github.server_url }}/${{ github.repository }}
+          platform: extension
+          previous-version-ref: 'null'
+          github-tools-version: v1.1.2
+          github-token: ${{ secrets.PR_TOKEN }}