chore: sync release-v5.1

* fork/release-v5.1: (125 commits)
  fix(account): harden PAYG debt recovery (labring#7103)
  fix(account): replay final debt namespace cleanup (labring#7102)
  chore(frontend): remove invite provider from release v5.1 (labring#7092)
  chore(frontend): remove cronjob references from configuration files (… (labring#7088)
  chore(aiproxy): remove aiproxy provider references from configuration… (labring#7087)
  fix(frontend): remove cloudserver from release builds (labring#7085)
  fix(desktop): honor guide feature flag (labring#7084)
  fix(account-webhook): block Start OpsRequest in debt-limit0 namespaces (labring#7077)
  fix(objectstorage): tighten public read bucket policy (labring#7076)
  fix(account): use dns-safe workspace debt notice names (labring#7075)
  Revert "chore(cloud): remove migrated and unused projects (labring#7072)" (labring#7074)
  chore(cloud): remove migrated and unused projects (labring#7072)
  fix(frontend): harden release-v5.1 Helm deployments (labring#7062)
  fix(applaunchpad): restart workloads only when needed (labring#7064)
  fix(account): advance workspace debt cleanup status (labring#7061)
  fix(applaunchpad): clear stale image pull secrets (labring#7059)
  fix(costcenter): show complete quota resources (labring#7041)
  fix(desktop): disable workspace quota bridge (labring#7051)
  fix(license): parse Kubernetes resource quantities (labring#7050)
  feat(desktop): show workspace resources in header (labring#7046)
  ...

# Conflicts:
#	.github/workflows/frontends.yml
#	.tagpr.json
#	CHANGELOG/CHANGELOG-5.1.2-rc4.md
#	CHANGELOG/CHANGELOG-latest.md
#	CHANGELOG/CHANGELOG.md
#	frontend/Dockerfile
#	frontend/README.md
#	frontend/desktop/prisma/providers/postgresql/global/migrations/migration_lock.toml
#	frontend/package.json
#	frontend/pnpm-lock.yaml

Author: cuisongliu

.github/copilot-instructions.md

@@ -21,7 +21,7 @@ sudo apt-get update && sudo apt-get install -y pkg-config libdevmapper-dev libbt
 ### Repository Structure
 - **`/lifecycle`**: Main sealos CLI and core binaries (sealos, sealctl, lvscare, image-cri-shim) 
 - **`/controllers`**: Multiple Kubernetes controllers with individual Go modules and Makefiles
-- **`/frontend`**: Next.js workspace with pnpm, 23 sub-projects (desktop, providers)
+- **`/frontend`**: Next.js workspace with pnpm, 17 workspace projects (root, desktop, packages, providers)
 - **`/service`**: Backend Go services with individual modules  
 - **`/webhooks`**: Kubernetes admission webhooks
 - **`/docs`**: Documentation and guides
@@ -211,4 +211,4 @@ Sealos uses Go 1.18+ workspace feature. When adding new modules:
 go work use -r .  # Update workspace from root directory
 ```
 
-This maintains the multi-module workspace structure across lifecycle, controllers, services, and webhooks.
+This maintains the multi-module workspace structure across lifecycle, controllers, services, and webhooks.

.github/scripts/install.sh

@@ -37,7 +37,7 @@ check_file_exits() {
 check_file_exits /usr/bin/sealos
 
 pushd "$(mktemp -d)" >/dev/null || exit
-  until curl -sLo "sealos.tar.gz"  "https://github.com/labring/sealos/releases/download/v5.1.0-beta3/sealos_5.1.0-beta3_linux_amd64.tar.gz"; do sleep 3; done
+  until curl -sLo "sealos.tar.gz"  "https://github.com/labring/sealos/releases/download/v5.1.2-rc5/sealos_5.1.2-rc5_linux_amd64.tar.gz"; do sleep 3; done
   tar -zxf sealos.tar.gz sealos &&  chmod +x sealos && mv sealos /usr/bin
   rm -rf sealos.tar.gz
   sealos version

.github/workflows/ci.yml

@@ -17,6 +17,7 @@ on:
       - "docs/**"
       - "**/*.md"
       - "**/*.yaml"
+      - "**/*.yml"
       - "CHANGELOG/**"
       - "controllers/**"
       - "service/**"
@@ -29,6 +30,7 @@ on:
       - "CHANGELOG/**"
       - "**/*.md"
       - "**/*.yaml"
+      - "**/*.yml"
       - "CHANGELOG/**"
       - "controllers/**"
       - "service/**"

.github/workflows/frontends.yml

@@ -68,8 +68,8 @@ jobs:
     outputs:
       modules: ${{ steps.set-matrix.outputs.modules }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: dorny/paths-filter@v3
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
         id: filter
         with:
           filters: |
@@ -82,12 +82,8 @@ jobs:
               - 'frontend/tsconfig*.json'
               - '.github/workflows/frontend.yml'
               - '.github/workflows/frontends.yml'
-            aiproxy:
-              - 'frontend/providers/aiproxy/**'
             license:
               - 'frontend/providers/license/**'
-            cronjob:
-              - 'frontend/providers/cronjob/**'
             template:
               - 'frontend/providers/template/**'
             applaunchpad:
@@ -106,18 +102,30 @@ jobs:
               - 'frontend/desktop/**'
       - name: Generate build matrix
         id: set-matrix
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          FILTER_APPLAUNCHPAD: ${{ steps.filter.outputs.applaunchpad }}
+          FILTER_COSTCENTER: ${{ steps.filter.outputs.costcenter }}
+          FILTER_DBPROVIDER: ${{ steps.filter.outputs.dbprovider }}
+          FILTER_DESKTOP: ${{ steps.filter.outputs.desktop }}
+          FILTER_KUBEPANEL: ${{ steps.filter.outputs.kubepanel }}
+          FILTER_LICENSE: ${{ steps.filter.outputs.license }}
+          FILTER_OBJECTSTORAGE: ${{ steps.filter.outputs.objectstorage }}
+          FILTER_PACKAGES: ${{ steps.filter.outputs.packages }}
+          FILTER_ROOT_CONFIG: ${{ steps.filter.outputs.root-config }}
+          FILTER_TEMPLATE: ${{ steps.filter.outputs.template }}
+          FILTER_TERMINAL: ${{ steps.filter.outputs.terminal }}
+          FORCE_ALL: ${{ inputs.force_all }}
         run: |
           modules=()
 
           # Check if we need to build all modules
-          if [[ "${{ steps.filter.outputs.packages }}" == "true" || \
-                "${{ steps.filter.outputs.root-config }}" == "true" || \
-                "${{ inputs.force_all }}" == "true" || \
-                "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+          if [[ "${FILTER_PACKAGES}" == "true" || \
+                "${FILTER_ROOT_CONFIG}" == "true" || \
+                "${FORCE_ALL}" == "true" || \
+                "${EVENT_NAME}" == "workflow_dispatch" ]]; then
             modules=(
-              "providers/aiproxy"
               "providers/license"
-              "providers/cronjob"
               "providers/template"
               "providers/applaunchpad"
               "providers/terminal"
@@ -129,17 +137,15 @@ jobs:
             )
           else
             # Only build changed modules
-            [[ "${{ steps.filter.outputs.aiproxy }}" == "true" ]] && modules+=("providers/aiproxy")
-            [[ "${{ steps.filter.outputs.license }}" == "true" ]] && modules+=("providers/license")
-            [[ "${{ steps.filter.outputs.cronjob }}" == "true" ]] && modules+=("providers/cronjob")
-            [[ "${{ steps.filter.outputs.template }}" == "true" ]] && modules+=("providers/template")
-            [[ "${{ steps.filter.outputs.applaunchpad }}" == "true" ]] && modules+=("providers/applaunchpad")
-            [[ "${{ steps.filter.outputs.terminal }}" == "true" ]] && modules+=("providers/terminal")
-            [[ "${{ steps.filter.outputs.dbprovider }}" == "true" ]] && modules+=("providers/dbprovider")
-            [[ "${{ steps.filter.outputs.costcenter }}" == "true" ]] && modules+=("providers/costcenter")
-            [[ "${{ steps.filter.outputs.objectstorage }}" == "true" ]] && modules+=("providers/objectstorage")
-            [[ "${{ steps.filter.outputs.kubepanel }}" == "true" ]] && modules+=("providers/kubepanel")
-            [[ "${{ steps.filter.outputs.desktop }}" == "true" ]] && modules+=("desktop")
+            [[ "${FILTER_LICENSE}" == "true" ]] && modules+=("providers/license")
+            [[ "${FILTER_TEMPLATE}" == "true" ]] && modules+=("providers/template")
+            [[ "${FILTER_APPLAUNCHPAD}" == "true" ]] && modules+=("providers/applaunchpad")
+            [[ "${FILTER_TERMINAL}" == "true" ]] && modules+=("providers/terminal")
+            [[ "${FILTER_DBPROVIDER}" == "true" ]] && modules+=("providers/dbprovider")
+            [[ "${FILTER_COSTCENTER}" == "true" ]] && modules+=("providers/costcenter")
+            [[ "${FILTER_OBJECTSTORAGE}" == "true" ]] && modules+=("providers/objectstorage")
+            [[ "${FILTER_KUBEPANEL}" == "true" ]] && modules+=("providers/kubepanel")
+            [[ "${FILTER_DESKTOP}" == "true" ]] && modules+=("desktop")
           fi
 
           # Convert to JSON array (compact format for GitHub Actions)
@@ -151,9 +157,56 @@ jobs:
           echo "modules=$json_modules" >> $GITHUB_OUTPUT
           echo "Building modules: $json_modules"
 
-  image-build:
+  helm-validate:
     needs: detect-changes
     if: needs.detect-changes.outputs.modules != '[]'
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        module: ${{ fromJSON(needs.detect-changes.outputs.modules) }}
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
+      - name: Validate Helm charts
+        shell: bash
+        env:
+          MODULE: ${{ matrix.module }}
+        run: |
+          chart_root="frontend/${MODULE}/deploy/charts"
+          if [[ ! -d "${chart_root}" ]]; then
+            echo "No Helm chart found for ${MODULE}; skipping"
+            exit 0
+          fi
+
+          found=false
+          while IFS= read -r -d '' chart_file; do
+            found=true
+            chart_dir=$(dirname "${chart_file}")
+            chart_name=$(basename "${chart_dir}")
+            user_values=$(find "${chart_dir}" -maxdepth 1 -type f -name '*-values.yaml' -print -quit)
+
+            helm lint "${chart_dir}"
+            helm template "${chart_name}" "${chart_dir}" \
+              --namespace "${chart_name}" >/dev/null
+
+            if [[ -n "${user_values}" ]]; then
+              helm lint "${chart_dir}" --values "${user_values}"
+              helm template "${chart_name}" "${chart_dir}" \
+                --namespace "${chart_name}" \
+                --values "${user_values}" >/dev/null
+            fi
+          done < <(find "${chart_root}" -mindepth 2 -maxdepth 2 -name Chart.yaml -print0)
+
+          if [[ "${found}" == "false" ]]; then
+            echo "No Helm chart found for ${MODULE}; skipping"
+          fi
+
+  image-build:
+    needs:
+      - detect-changes
+      - helm-validate
+    if: needs.detect-changes.outputs.modules != '[]'
     uses: ./.github/workflows/frontend.yml
     permissions:
       contents: read

.github/workflows/service-build.yml

@@ -299,6 +299,9 @@ jobs:
             if [[ -f charts/${MODULE_NAME}/values.yaml ]]; then
               sed -i -E "s;(${OLD_DOCKER_REPO}|${GHCR_DOCKER_REPO}):[^[:space:]\"']*;${NEW_DOCKER_IMAGE};" charts/${MODULE_NAME}/values.yaml
             fi
+            if [[ -f charts/${MODULE_NAME}-service/values.yaml ]]; then
+              sed -i -E "s;(${OLD_DOCKER_REPO}|${GHCR_DOCKER_REPO}):[^[:space:]\"']*;${NEW_DOCKER_IMAGE};" charts/${MODULE_NAME}-service/values.yaml
+            fi
             sudo rm -rf registry
             echo "Building ${TAG}-amd64"
             sudo sealos build -t "${TAG}-amd64" --platform linux/amd64 -f Kubefile

.gitignore

@@ -23,7 +23,9 @@ pkg/registry/save/testdata/registry
 deploy/cloud/tars
 .vscode/
 /lifecycle/tools/
+.workflow/
+**/.impeccable/
 
 **.env*
 !scripts/cloud/sealos.env
-**/helloagents/**
+**/helloagents/**

.tagpr.json

@@ -1,6 +1,6 @@
 {
     "name": "sealos",
-    "version": "v5.1.2-rc4",
-    "command": "bash scripts/changelog.sh v5.1.2-rc4 v5.1.1",
+    "version": "v5.1.2-rc5",
+    "command": "bash scripts/changelog.sh v5.1.2-rc5 v5.1.1",
     "pre-version": "v5.1.1"
 }

CHANGELOG/CHANGELOG-5.1.2-rc4.md

@@ -2,10 +2,11 @@
 # Welcome to the v5.1.2-rc4 release of Sealos!🎉🎉!
 
 <a name="v5.1.2-rc4"></a>
-## [v5.1.2-rc4](https://github.com/labring/sealos/compare/v5.1.2-rc3...v5.1.2-rc4) (2026-03-08)
+## [v5.1.2-rc4](https://github.com/labring/sealos/compare/v5.1.2-rc3...v5.1.2-rc4) (2026-03-09)
 
 ### Bug Fixes
 
+* **desktop:** close correct window by using component pid ([#6782](https://github.com/labring/sealos/issues/6782))
 * **devbox:** nfs max value bug ([#6778](https://github.com/labring/sealos/issues/6778))
 * **devbox:** upload file bug ([#6776](https://github.com/labring/sealos/issues/6776))
 * **dependencies:** replace gcc-aarch64-linux-gnu with binutils-aarch6… ([#6772](https://github.com/labring/sealos/issues/6772))

CHANGELOG/CHANGELOG-5.1.2-rc5.md

@@ -0,0 +1,42 @@
+
+# Welcome to the v5.1.2-rc5 release of Sealos!🎉🎉!
+
+<a name="v5.1.2-rc5"></a>
+## [v5.1.2-rc5](https://github.com/labring/sealos/compare/v5.1.2-rc4...v5.1.2-rc5) (2026-03-26)
+
+### Bug Fixes
+
+* **lifecycle:** fallback registry sync for oci media type ([#6842](https://github.com/labring/sealos/issues/6842))
+* **account:** helm install name ([#6844](https://github.com/labring/sealos/issues/6844))
+* **deploy:** change command to execute install script instead of kube… ([#6839](https://github.com/labring/sealos/issues/6839))
+* **account-service:** add ingress resource adoption and create instal… ([#6833](https://github.com/labring/sealos/issues/6833))
+* **user:** Fix the concurrent creation restriction exception for user controller ([#6829](https://github.com/labring/sealos/issues/6829))
+* **account-webhook:** remove cache ([#6828](https://github.com/labring/sealos/issues/6828))
+* **applaunchpad:** fix command text overflow in app detail advanced info ([#6825](https://github.com/labring/sealos/issues/6825))
+* **devbox:** some little bug ([#6823](https://github.com/labring/sealos/issues/6823))
+* **devbox:** some quota bug ([#6820](https://github.com/labring/sealos/issues/6820))
+* **template:** [backport] pvc not get deleted in the new deletion flow ([#6821](https://github.com/labring/sealos/issues/6821))
+* **applaunchpad:** floor storage maxValue ([#6813](https://github.com/labring/sealos/issues/6813))
+* **desktop:** i18n login form validation messages ([#6812](https://github.com/labring/sealos/issues/6812))
+* **lifecycle:** clear stale registry auth when saving public images ([#6810](https://github.com/labring/sealos/issues/6810))
+* **account:** skip the validate webhook for admin account ([#6806](https://github.com/labring/sealos/issues/6806))
+* **user-controller:** update namespace condition to exclude 'ns-admin' ([#6800](https://github.com/labring/sealos/issues/6800))
+* **devbox:** date picker cause bug ([#6798](https://github.com/labring/sealos/issues/6798))
+* **license:** license limit prompt translation ([#6797](https://github.com/labring/sealos/issues/6797))
+* **devbox:** refresh bug and nfs mount path bug ([#6793](https://github.com/labring/sealos/issues/6793))
+
+### New Features
+
+* **desktop:** support auto-register and auto-init in password auth API ([#6840](https://github.com/labring/sealos/issues/6840))
+* **template:** add NodePort two-phase deploy API ([#6824](https://github.com/labring/sealos/issues/6824))
+* **applaunchpad:** add network storage (networkStoreList) support ([#6811](https://github.com/labring/sealos/issues/6811))
+* **desktop:** [backport] support overriding icon size style in app cr ([#6817](https://github.com/labring/sealos/issues/6817))
+* **lifecycle:** sealos registry support image filter and --all flags to image save ([#6805](https://github.com/labring/sealos/issues/6805))
+* **desktop:** validate kubeconfig on desktop load ([#6791](https://github.com/labring/sealos/issues/6791))
+* **desktop:** add PKCE (S256) support for OAuth2 authentication ([#6790](https://github.com/labring/sealos/issues/6790))
+
+See [the CHANGELOG](https://github.com/labring/sealos/blob/main/CHANGELOG/CHANGELOG.md) for more details.
+
+Your patronage towards Sealos is greatly appreciated 🎉🎉.
+
+If you encounter any problems during its usage, please create an issue in the [GitHub repository](https://github.com/labring/sealos), we're committed to resolving your problem as soon as possible.