[7.x] Reintroduce mixed pipe shorthand modifier error

.claude/skills/changelog/SKILL.md

@@ -8,23 +8,46 @@ Generate a changelog entry for the CHANGELOG.md file by following these steps:
 
 ## 1. Get commits since last tag
 
-Run `git --no-pager log $(git describe --tags --abbrev=0)..HEAD --oneline --no-decorate --first-parent --no-merges`) to get the list of commits.
+First, fetch tags from origin — they sit off-branch (see note below) so they don't come down with a normal `git pull`/`git fetch` on the branch:
+
+```
+git fetch origin --tags
+```
+
+Then run the following to get the list of commits:
+
+```
+git --no-pager log $(git merge-base $(git tag --list 'v*' --sort=-v:refname | head -n1) HEAD)..HEAD --oneline --no-decorate --no-merges
+```
+
+Note: The release workflow tags a separate "Build assets" commit that is *not* an ancestor of the branch, so the tag itself never lands on `6.x`. That means `git describe --tags` walks back to a stale tag. Instead, take the newest tag and use its `git merge-base` with `HEAD`, which resolves to the release commit that *is* on the branch.
+
+5.x commits are merged into 6.x as-is (not squashed), so this plain `--no-merges` log already walks both the 6.x mainline and every commit brought in via a 5.x merge, in true chronological order — it only excludes the merge commits themselves (multi-parent, no real change of their own).
 
 ## 2. Process each commit
 
 For each commit:
 - Extract the PR number from the commit message (e.g., `(#13331)`)
-- Remove the commit SHA and `[6.x]` prefix from the message
+- Remove the commit SHA and `[6.x]`/`[5.x]` prefix from the message
 - Fetch the PR author from GitHub using a sequential loop — do NOT use parallel background jobs (`&`) as they interleave stdout unpredictably. Use: `for pr in <numbers>; do echo -n "PR $pr: "; gh pr view $pr --json author --jq '.author.login'; done`
 
 ## 3. Skip certain commits
 
 Skip commits that are:
 - Test fixture updates (e.g., "Update composer test fixtures")
 - CI/workflow changes (e.g., "Only run lint workflow...")
+- Test-only fixes with no user-facing effect (e.g., "Fix failing Guzzle tests" — check the PR body; if it says the bug only affected tests, skip it)
+- Internal release/workflow-only PRs (e.g., "Update Release Workflow")
+- Commits with no PR number, or whose message is itself a merge bookkeeping commit (e.g., "Merge 5.x (#NUM)", "Merge branch '5.x' into...")
 
 Do not skip dependency bumps from dependabot.
 
+For `[5.x]`-prefixed commits, also skip/dedupe:
+- Changes already superseded by a bigger PR in this release. Read the PR bodies — if a larger 6.x PR's description explicitly covers what the smaller 5.x fix addressed (e.g., a big OAuth rework that says it removes email-based matching supersedes a smaller "Fix OAuth" email-trust patch), skip the smaller one and note it in the summary (step 10).
+- Changes that no longer apply to 6.x because 6.x already handled it independently (e.g., a 5.x "Drop support for Laravel 10/11" PR when 6.x already dropped those versions).
+
+When in doubt about whether a `[5.x]`-prefixed commit is user-facing, lean toward including it — security/authorization hardening fixes (auth checks, method-resolution guarding, validation hardening) belong in the changelog even without a lot of detail in the title, matching how they're written up in the 5.x changelog (e.g. "Harden remote URL validation", "Fix token path traversal").
+
 ## 4. Categorize commits
 
 - **What's new**: Commits that add new features (title contains "Add" or introduces new functionality). An "improvement" is not to be considered new. 
@@ -37,7 +60,7 @@ Format: `- Description [#NUMBER](https://github.com/statamic/cms/issues/NUMBER)
 ## 6. Order entries
 
 - Reverse the list so earliest commits come first (git log shows newest first)
-- Within each category, maintain chronological order
+- Within each category, maintain chronological order — this already interleaves 5.x-origin commits correctly since step 1's log is in true merge order
 - Translation PRs get moved to the bottom of the list
 - Dependabot PRs get moved to the bottom, after translations
 

.gitattributes

@@ -1,14 +1,24 @@
 * text=auto
 *.php eol=lf
+
+/resources/dist/**/* linguist-generated=true
+/resources/dist-dev/**/* linguist-generated=true
+/resources/dist-frontend/**/* linguist-generated=true
+/resources/dist-package/**/* linguist-generated=true
+
 /.github export-ignore
+/resources/js export-ignore
+/resources/css export-ignore
+/packages export-ignore
 /tests export-ignore
 .babelrc export-ignore
 .gitattributes export-ignore
 .gitignore export-ignore
 .travis.yml export-ignore
 CONTRIBUTING.md export-ignore
 jest.config.js export-ignore
+phpstan.dist.neon export-ignore
 phpunit.bat export-ignore
-phpunit.xml.dist export-ignore
+phpunit.dist.xml export-ignore
 SECURITY.md export-ignore
 translator export-ignore

.github/CODEOWNERS

@@ -0,0 +1,8 @@
+/composer.json @statamic/security
+/src/helpers.php @statamic/security
+/src/namespaced_helpers.php @statamic/security
+/src/View/Blade/helpers.php @statamic/security
+
+/.github/CODEOWNERS @statamic/security
+/.github/workflows/tripwire.yml @statamic/security
+/scripts/check-autoload-files.sh @statamic/security

.github/PULL_REQUEST_TEMPLATE.md

@@ -4,12 +4,14 @@ Please take 30 seconds to read the following so we can be as efficient as possib
 
 1️⃣ Is this your first PR? If so, please read our [contribution guide](https://statamic.dev/contribution-guide) first.
 
-2️⃣ Please make sure to create a new branch for your PR.
+2️⃣ Did you use AI tools to create this PR? If so, please review changes carefully to make sure they meet our code standards. We all know how AI can behave sometimes. This helps to make the review easier for us. Reviewing PRs can be a lot of work.
 
-3️⃣ Typically you should target the branch of the most current release, e.g. `6.x`, unless your PR includes a breaking change, in which case you should target the `master` branch for the next major release.
+3️⃣ Please make sure to create a new branch for your PR.
 
-4️⃣ We _really_ appreciate it if your PR includes tests. This makes it much easier for us to review, merge, and release. A PR with tests is usually reviewed and merged 5x-10x faster.
+4️⃣ Typically you should target the branch of the most current release, e.g. `6.x`, unless your PR includes a breaking change, in which case you should target the `master` branch for the next major release.
 
-5️⃣ If your PR introduce a new feature, adds to an existing one, or changes current behavior, please **open an issue for it in the [statamic/docs](https://github.com/statamic/docs/issues) repo referencing your PR**. A simple "Goes along with statamic/cms#9000" is enough. Otherwise it's really easy to forget and no will ever become aware of your ✨ sparkling ✨ invention if it's not documented.
+5️⃣ We _really_ appreciate it if your PR includes tests. This makes it much easier for us to review, merge, and release. A PR with tests is usually reviewed and merged 5x-10x faster.
 
-6️⃣ Remove this placeholder text and replace it with a description of what this PR is doing.
+6️⃣ If your PR introduce a new feature, adds to an existing one, or changes current behavior, please **open an issue for it in the [statamic/docs](https://github.com/statamic/docs/issues) repo referencing your PR**. A simple "Goes along with statamic/cms#9000" is enough. Otherwise it's really easy to forget and no will ever become aware of your ✨ sparkling ✨ invention if it's not documented.
+
+7️⃣ Remove this placeholder text and replace it with a description of what this PR is doing.

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    cooldown:
+      default-days: 7

.github/workflows/code-style-lint.yml

@@ -3,25 +3,38 @@ name: Lint code style issues
 on:
   pull_request:
 
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
-  lint-code-styling:
+  lint-code-styling: # zizmor: ignore[anonymous-definition]
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Get changed files
         id: changed-files
-        uses: tj-actions/changed-files@v46
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
         with:
           files: |
             **.php
 
       - name: Check PHP code style issues
         if: steps.changed-files.outputs.any_modified == 'true'
-        uses: aglipanci/laravel-pint-action@v2
+        uses: aglipanci/laravel-pint-action@36de00d5f5a8a4e12d443e01671daa12a18f4c79 # 2.6
         with:
           testMode: true
           verboseMode: true
           pintVersion: 1.16.0
+
+      - name: Check Statamic\trans imports
+        run: bash scripts/check-trans-import.sh

.github/workflows/phpstan.yml

@@ -0,0 +1,53 @@
+name: PHPStan
+
+on:
+  pull_request:
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  phpstan:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Get changed files
+        id: changed-files
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
+        with:
+          files: |
+            src/**
+            composer.json
+            phpstan.dist.neon
+            .phpstan/**
+            .github/workflows/phpstan.yml
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        if: steps.changed-files.outputs.any_modified == 'true'
+        with:
+          php-version: 8.5
+          coverage: none
+
+      - name: Install dependencies
+        uses: nick-invision/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
+        if: steps.changed-files.outputs.any_modified == 'true'
+        with:
+          timeout_minutes: 5
+          max_attempts: 5
+          command: composer update --prefer-stable --prefer-dist --no-interaction
+
+      - name: Run PHPStan
+        if: steps.changed-files.outputs.any_modified == 'true'
+        run: vendor/bin/phpstan analyse --memory-limit=2G

.github/workflows/pr-title.yml

@@ -4,60 +4,13 @@ on:
   pull_request:
     types: [opened, edited, synchronize, reopened]
 
-jobs:
-  pr-title:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Validate PR title matches target branch
-        env:
-          PR_TITLE: ${{ github.event.pull_request.title }}
-          BASE_BRANCH: ${{ github.event.pull_request.base.ref }}
-          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
-        run: |
-          # Validates PR title against target branch
-          # Returns error message if invalid, empty string if valid
-          validate_pr_title() {
-            local target_branch="$1"
-            local pr_title="$2"
-            local default_branch="$3"
-
-            # Check if target branch is a version branch (e.g., 5.x, 4.x)
-            if [[ $target_branch =~ ^([0-9]+)\.x$ ]]; then
-              local version="${BASH_REMATCH[1]}"
-              if [[ ! $pr_title =~ ^\[$version\.x\][[:space:]] ]]; then
-                echo "PR targeting '$target_branch' must have title starting with '[$version.x] '"
-                return
-              fi
-
-            # Check if target branch is master (next major version)
-            elif [[ $target_branch == "master" ]]; then
-              local current_version="${default_branch//\.x/}"
-              local next_version=$((current_version + 1))
-              if [[ ! $pr_title =~ ^\[$next_version\.x\][[:space:]] ]]; then
-                echo "PR targeting 'master' must have title starting with '[$next_version.x] '"
-                return
-              fi
-
-            # For other branches, just enforce that there's a version prefix
-            else
-              if [[ ! $pr_title =~ ^\[[0-9]+\.x\][[:space:]] ]]; then
-                echo "PR title must start with a version prefix like '[5.x] '"
-                return
-              fi
-            fi
+permissions: {}
 
-            echo ""
-          }
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
-          echo "PR Title: $PR_TITLE"
-          echo "Base Branch: $BASE_BRANCH"
-          echo "Default Branch: $DEFAULT_BRANCH"
-
-          ERROR=$(validate_pr_title "$BASE_BRANCH" "$PR_TITLE" "$DEFAULT_BRANCH")
-
-          if [[ -n $ERROR ]]; then
-            echo $ERROR
-            exit 1
-          fi
-
-          echo "PR title validation passed"
+jobs:
+  pr-title:
+    uses: statamic/.github/.github/workflows/pr-title.yml@bebe92309b4276e45ebc0d0c65854fb2ecf786ba
+    permissions: {}

.github/workflows/pull-requests.yml

@@ -1,75 +1,18 @@
 name: Pull Requests
 
-# Credit: https://github.com/github/docs/blob/main/.github/workflows/notify-when-maintainers-cannot-edit.yaml
-#         https://github.com/laravel/.github/blob/main/.github/workflows/pull-requests.yml
-
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
     types:
       - opened
 
-permissions:
-  pull-requests: write
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
 
 jobs:
   uneditable:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/github-script@v7
-        with:
-          script: |
-            const repo = context.repo.repo;
-
-            const query = `
-              query($number: Int!) {
-                repository(owner: "statamic", name: "${repo}") {
-                  pullRequest(number: $number) {
-                    headRepositoryOwner {
-                      login
-                    }
-                    maintainerCanModify
-                    state
-                  }
-                }
-              }
-            `;
-
-            const pullNumber = context.issue.number;
-            const variables = { number: pullNumber };
-
-            try {
-              console.log(`Check for maintainer edit access ...`);
-              const result = await github.graphql(query, variables);
-              console.log(JSON.stringify(result, null, 2));
-              const pullRequest = result.repository.pullRequest;
-
-              if (pullRequest.headRepositoryOwner.login === 'statamic') {
-                console.log('PR owned by statamic');
-                return;
-              }
-
-              if (pullRequest.state !== 'OPEN') {
-                 console.log('PR has already been closed or merged');
-                 return;
-              }
-
-              if (!pullRequest.maintainerCanModify) {
-                console.log('PR not owned by statamic and does not have maintainer edits enabled');
-
-                await github.rest.issues.createComment({
-                  issue_number: pullNumber,
-                  owner: 'statamic',
-                  repo,
-                  body: "Thanks for submitting a PR!\n\nIn order to review and merge PRs most efficiently, we require that all PRs grant maintainer edit access before we review them. For information on how to do this, [see the relevant GitHub documentation](https://docs.github.com/en/github/collaborating-with-pull-requests/working-with-forks/allowing-changes-to-a-pull-request-branch-created-from-a-fork). Additionally, GitHub doesn't allow maintainer permissions from organization accounts. Please resubmit this PR from a personal GitHub account with maintainer permissions enabled."
-                });
-
-                await github.rest.pulls.update({
-                  pull_number: pullNumber,
-                  owner: 'statamic',
-                  repo,
-                  state: 'closed'
-                });
-              }
-            } catch(e) {
-              console.log(e);
-            }
+    uses: statamic/.github/.github/workflows/pull-requests.yml@bebe92309b4276e45ebc0d0c65854fb2ecf786ba
+    permissions:
+      pull-requests: write # post comment and close PRs that don't allow maintainer edits