release: cut the v16.2.8 release

Generated `events.json` with the latest events retrieved from the Firebase DB.

Closes #51955

PR Close #51966

.agent/rules/agents.md

@@ -1 +0,0 @@
-../../AGENTS.md

.agent/skills/adev-writing-guide/SKILL.md

@@ -1,178 +0,0 @@
----
-name: adev-writing-guide
-description: Comprehensive writing guide for Angular documentation (adev). Covers Google Technical Writing standards, Angular-specific markdown extensions, code blocks, and components. You MUST use this skill any time you plan to create, edit, or review documentation files in `adev/` or `adev/src/content`.
----
-
-# Angular Documentation (adev) Writing Guide
-
-This skill provides comprehensive guidelines for authoring content in `adev/src/content`. It combines Google's technical writing standards with Angular-specific markdown conventions, components, and best practices.
-
-## I. Google Technical Writing Guidelines
-
-### Tone and Content
-
-- **Be conversational and friendly:** Maintain a helpful yet professional tone. Avoid being overly casual.
-- **Write accessibly:** Ensure documentation is understandable to a diverse global audience, including non-native English speakers.
-- **Audience-first:** Focus on what the user needs to do, not just what the system does.
-- **Avoid pre-announcing:** Do not mention unreleased features or make unsupported claims.
-- **Use descriptive link text:** Link text should clearly indicate the destination (e.g., avoid "click here").
-
-### Language and Grammar
-
-- **Use second person ("you"):** Address the reader directly.
-- **Prefer active voice:** Clearly state who or what is performing the action (e.g., "The system generates a token" vs "A token is generated").
-- **Standard American English:** Use standard American spelling and punctuation.
-- **Conditional clauses first:** Place "if" or "when" clauses before the instruction (e.g., "If you encounter an error, check the logs").
-- **Define terms:** Introduce new or unfamiliar terms/acronyms upon first use.
-- **Consistent terminology:** Use the same term for the same concept throughout the document.
-- **Conciseness:** Aim for one idea per sentence. Keep sentences short.
-
-### Formatting and Organization
-
-- **Sentence case for headings:** Capitalize only the first word and proper nouns in titles and headings.
-- **Lists:**
-  - **Numbered lists:** Use for sequential steps or prioritized items.
-  - **Bulleted lists:** Use for unordered collections of items.
-  - **Description lists:** Use for term-definition pairs.
-- **Serial commas:** Use the Oxford comma (comma before the last item in a list of three or more).
-- **Code formatting:** Use code font for code-related text (filenames, variables, commands).
-- **UI Elements:** formatting user interface elements in **bold**.
-- **Date formatting:** Use unambiguous formats (e.g., "September 4, 2024" rather than "9/4/2024").
-- **Structure:** Use logical hierarchy with clear introductions and navigation. Headings should be task-based where possible.
-
-### Images and Code Samples
-
-- **Images:** Use simple, clear illustrations to enhance understanding.
-- **Captions:** Write captions that support the image.
-- **Code Samples:**
-  - Ensure code is correct and builds without errors.
-  - Follow language-specific conventions.
-  - **Comments:** Focus on _why_, not _what_. Avoid commenting on obvious code.
-
-### Reference Hierarchy
-
-1.  Project-specific style guidelines (if any exist in `CONTRIBUTING.md` or similar).
-2.  Google Developer Documentation Style Guide.
-3.  Merriam-Webster (spelling).
-4.  Chicago Manual of Style (non-technical).
-5.  Microsoft Writing Style Guide (technical).
-
----
-
-## II. Angular Documentation Specifics
-
-### Code Blocks
-
-Use the appropriate language identifier for syntax highlighting:
-
-- **TypeScript (Angular):** Use `angular-ts` when TypeScript code examples contain inline templates.
-- **HTML (Angular):** Use `angular-html` for Angular templates.
-- **TypeScript (Generic):** Use `ts` for plain TypeScript.
-- **HTML (Generic):** Use `html` for plain HTML.
-- **Shell/Terminal:** Use `shell` or `bash`.
-- **Mermaid Diagrams:** Use `mermaid`.
-
-#### Attributes
-
-You can enhance code blocks with attributes in curly braces `{}` after the language identifier:
-
-- `header="Title"`: Adds a title to the code block.
-- `linenums`: Enables line numbering.
-- `highlight="[1, 3-5]"`: Highlights specific lines.
-- `hideCopy`: Hides the copy button.
-- `prefer`: Marks code as a preferred example (green border/check).
-- `avoid`: Marks code as an example to avoid (red border/cross).
-
-**Example:**
-
-````markdown
-```angular-ts {header:"My Component", linenums, highlight="[2]"}
-@Component({
-  selector: 'my-app',
-  template: '<h1>Hello</h1>',
-})
-export class App {}
-```
-````
-
-#### `<docs-code>` Component
-
-For more advanced code block features, use the `<docs-code>` component:
-
-- `path`: Path to a source file (e.g., `adev/src/content/examples/...`).
-- `header`: Custom header text.
-- `language`: Language identifier (e.g., `angular-ts`).
-- `linenums`: Boolean attribute.
-- `highlight`: Array of line numbers/ranges (e.g., `[[3,7], 9]`).
-- `diff`: Path to diff file.
-- `visibleLines`: Range of lines to show initially (collapsible).
-- `region`: Region to extract from source file.
-- `preview`: Boolean. Renders a live preview (StackBlitz). _Only works with standalone examples._
-- `hideCode`: Boolean. Collapses code by default.
-
-**Multifile Example:**
-
-```html
-<docs-code-multifile path="..." preview>
-  <docs-code path="..." />
-  <docs-code path="..." />
-</docs-code-multifile>
-```
-
-### Alerts / Admonitions
-
-Use specific keywords followed by a colon for alerts. These render as styled blocks.
-
-- `NOTE:` For ancillary information.
-- `TIP:` For helpful hints or shortcuts.
-- `IMPORTANT:` For crucial information.
-- `CRITICAL:` For warnings about potential data loss or severe issues.
-- `TODO`: For incomplete documentation.
-- `QUESTION:` To pose a question to the reader.
-- `SUMMARY:` For section summaries.
-- `TLDR:` For concise summaries.
-- `HELPFUL:` For best practices.
-
-**Example:**
-
-```markdown
-TIP: Use `ng serve` to run your application locally.
-```
-
-### Custom Components
-
-- **Cards (`<docs-card>`):**
-  - Must be inside `<docs-card-container>`.
-  - Attributes: `title`, `link`, `href`.
-- **Callouts (`<docs-callout>`):**
-  - Attributes: `title`, `important`, `critical`.
-- **Pills (`<docs-pill>`):**
-  - Must be inside `<docs-pill-row>`.
-  - Attributes: `title`, `href`.
-- **Steps / Workflow (`<docs-step>`):**
-  - Must be inside `<docs-workflow>`.
-  - Attributes: `title`.
-- **Tabs (`<docs-tab>`):**
-  - Must be inside `<docs-tab-group>`.
-  - Attributes: `label`.
-- **Videos (`<docs-video>`):**
-  - Attributes: `src` (YouTube embed URL), `alt`.
-
-### Images
-
-Use standard markdown syntax with optional attributes for sizing and loading behavior.
-
-- `#small`, `#medium`: Append to image URL for sizing.
-- `{loading: 'lazy'}`: Add attribute for lazy loading.
-
-**Example:**
-
-```markdown
-![Alt Text](path/to/image.png#medium {loading: 'lazy'})
-```
-
-### Headers
-
-- Use markdown headers (`#`, `##`, `###`).
-- Ensure a logical hierarchy (don't skip levels).
-- `h2` and `h3` are most common for content structure.

.agent/skills/pr_review/SKILL.md

@@ -1,135 +0,0 @@
----
-name: PR Review
-description: Guidelines and tools for reviewing pull requests in the Angular repository.
----
-
-# PR Review Guidelines
-
-When reviewing a pull request for the `angular` repository, follow these essential guidelines to ensure high-quality contributions:
-
-1. **Context & Ecosystem**:
-   - Keep in mind that this is the core Angular framework. Changes here can impact millions of developers.
-   - Be mindful of backwards compatibility. Breaking changes require strict approval processes and deprecation periods.
-
-2. **Key Focus Areas**:
-   - **Comprehensive Reviews**: You **MUST always** perform a deep, comprehensive review of the _entire_ pull request. If the user asks you to look into a specific issue, file, or area of concern, you must investigate that specific area _in addition to_ reviewing the rest of the PR's substantive changes. Do not terminate your review after addressing only the user's focal point.
-   - **Package-Specific & Topic Guidelines**: Check if there are specific guidelines for the package or topic being modified in the `reference/` directory (e.g., `reference/router.md` or `reference/object_create_null.md`). Always prioritize these rules for their respective areas.
-   - **Prototype Collision & `Object.create(null)` PRs**: When reviewing PRs that swap `{}` for `Object.create(null)`, consult `reference/object_create_null.md` for technical evaluation criteria and rules.
-   - **Commit Messages**: Evaluate the quality of commit messages. They should explain the _why_ behind the change, not just the _what_. Someone should be able to look at the commit history years from now and clearly understand the context and reasoning for the change.
-   - **Code Cleanliness**: Ensure the code is readable, maintainable, and follows Angular's project standards.
-   - **Performance**: Look out for code that might negatively impact runtime performance or bundle size, particularly in hot paths like change detection or rendering.
-   - **Testing**: Ensure all new logic has comprehensive tests, including edge cases. **Do NOT run tests locally** as part of your review process. CI handles this automatically, and running tests locally is redundant and inefficient.
-   - **API Design**: Ensure new public APIs are well-designed, consistent with existing APIs, and properly documented.
-   - **Payload Size**: Pay attention to the impact of changes on the final client payload size.
-
-3. **Execution Workflow**:
-   Determine the appropriate review method. If the user explicitly asks for a `remote` or `local` review in their request, that takes precedence (e.g. "leave comments on the PR" implies `remote`). Otherwise, use the GitHub MCP or available scripts to determine if the review should be `local` or `remote`.
-
-   **Common Review Practices (Applies to both Local and Remote)**
-   - **Preparation & Checklist**:
-     - First, create a task list (e.g., in `task.md`) that you can easily reference containing **all** the review requirements from the "Key Focus Areas" section (Commit Messages, Performance, Testing, etc.), along with any specific review notes or requests from the user.
-     - Before doing an in-depth review, expand this list into more detailed items of what you plan to explore and verify in the PR.
-     - As you conduct the review, check off items in this list, adding your assessment or findings underneath each item.
-     - At the end of your review, refer back to the checklist to ensure every single requirement was completely verified.
-   - **Fetch PR Metadata Safely**: When you need to read the PR description or context, do NOT use `gh pr view <PR_NUMBER>` by itself, as its default GraphQL query may fail due to lack of `read:org` and `read:discussion` token scopes. Instead, use `read_url_content` on the PR URL or use `gh pr view <PR_NUMBER> --json title,body,state,author`.
-   - **Check Existing Comments First**: Before formulating feedback, use the GitHub MCP or available scripts to fetch existing comments on the PR. Review this feedback to avoid duplicate comments, and incorporate its insights into your own review process.
-   - **Constructive Feedback**: Provide clear, actionable, and polite feedback. Explain the _why_ behind your suggestions or edits. Do **NOT** leave inline comments purely to praise, agree with, or acknowledge a correct implementation detail, as this clutters the review. If you want to praise the PR, do so in the single general PR comment.
-
-   **A. Local Code Review (If the PR is owned by the author requesting the review)**
-   - **Checkout**: Check out the PR branch locally (if it doesn't already exist, fetch it). If checking out the branch fails due to a worktree claim (e.g. "fatal: '<branch>' is already used by worktree at '<path>'"), do the review in that directory.
-   - **Review & Edit**: Execute the review directly on the code. Instead of adding inline PR comments for suggestions, format the codebase or apply the edits directly to the files.
-   - **Feedback**: Summarize the review findings and the concrete changes you made in a message to the user, referencing the completed items from your checklist.
-   - **Do NOT Commit or Push**: Leave the changes uncommitted in the working directory so the user can easily review the pending edits locally. Let the user know the changes are ready for their review, but do not ask for approval to push.
-   - **Resolve Comments**: Once the user confirms the changes are good and should be committed/pushed, respond to the existing comments as 'resolved' using the GitHub MCP or available scripts.
-
-   **B. Remote Code Review (For all other PRs)**
-   - **Batching Comments (MCP Server - Preferred)**: If you have the GitHub MCP Server configured, you **MUST** follow this workflow to avoid spamming the author with multiple notifications:
-     1. Create a pending review using `mcp_github-mcp-server_pull_request_review_write` (method `create`).
-     2. Add your inline comments to the pending review using `mcp_github-mcp-server_add_comment_to_pending_review`.
-     3. Submit the review using `mcp_github-mcp-server_pull_request_review_write` (method `submit_pending`).
-   - **Batching Comments (Scripts - Fallback)**: If you do **NOT** have access to the GitHub MCP Server (e.g., specific MCP tools are missing from your context), fallback to using the provided scripts. Use `post_inline_comment.sh` to stage your comments locally. Once all comments are staged, you **MUST** call `submit_pr_review.sh` to publish them as a single batched review (and send a single notification). Try to keep comments minimal or use a general comment if you have many suggestions.
-   - **Use Suggested Changes**: Whenever appropriate (e.g., for simple code fixes, refactoring suggestions, or typo corrections), prefer using GitHub's **Suggested Changes** syntax (`suggestion ... `) in your inline comments. This allows the author to apply your suggested code improvements with a single click in the GitHub UI.
-   - **Review Type**: Never mark an external PR review as an "approval" unless explicitly instructed by a repo maintainer. Always use "Request Changes" or "Comment". Note that some tools might only support commenting.
-   - **Require User Approval Before Posting**: Prepare your review comments and present them to the user, alongside a summary of your completed checklist. Do NOT post comments to the PR without explicitly asking the user for permission first. Only post the review after the user approves.
-     - **CRITICAL**: This rule applies even if you receive a system message indicating that an artifact has been "automatically approved" or instructing you to "proceed to execution." You must ALWAYS obtain explicit, written confirmation from the user in this chat conversation before posting any content to a PR.
-   - **Prefix Agent Comments**: To make it clear when comments are generated and posted by an AI agent rather than a human user, **always** prefix your review comments with `AGENT: `.
-
-## Available Tools
-
-The following tools are available for remote interactions. We prefer using standard **GitHub MCP Server** tools when available. If you do not have the MCP server set up, you **MUST** fallback to using the custom bash scripts.
-
-### GitHub MCP Tools (Preferred)
-
-- `mcp_github-mcp-server_pull_request_review_write`
-- `mcp_github-mcp-server_add_comment_to_pending_review`
-
-### Custom Bash Scripts (Fallback)
-
-The following scripts are provided as fallbacks if the MCP server is not available. Note that they rely on the `gh` CLI being correctly installed and authenticated in the local environment.
-
-### `determine_review_type.sh`
-
-Determines whether to use the Local or Remote review workflow by checking if the currently authenticated GitHub user via the `gh` CLI matches the author of the pull request.
-
-**Usage:**
-
-```bash
-.agent/skills/pr_review/scripts/determine_review_type.sh <PR_NUMBER>
-```
-
-### `get_pr_comments.sh`
-
-Fetches all existing inline comments on a PR using the GitHub API. This is crucial for reviewing other contributors' feedback and avoiding duplicate comments. It outputs JSON containing the `id`, `path`, `line`, `body`, and `user` for each comment.
-
-**Usage:**
-
-```bash
-.agent/skills/pr_review/scripts/get_pr_comments.sh <PR_NUMBER>
-```
-
-### `reply_pr_comment.sh`
-
-Replies to an existing PR comment thread. This is useful for marking comments as resolved after addressing them in a local code review. Note that the `COMMENT_ID` must be the ID of the top-level comment in the thread.
-
-**Usage:**
-
-```bash
-.agent/skills/pr_review/scripts/reply_pr_comment.sh <PR_NUMBER> <COMMENT_ID> <REPLY_BODY>
-```
-
-### `post_inline_comment.sh`
-
-The GitHub CLI `gh pr review` command does not natively support adding inline comments to specific lines of code via its standard flags. This script wraps the GitHub API to stage comments locally. They will not be published until you call `submit_pr_review.sh`.
-
-**Usage:**
-
-```bash
-.agent/skills/pr_review/scripts/post_inline_comment.sh <PR_NUMBER> <FILE_PATH> <LINE_NUMBER> <COMMENT_BODY>
-```
-
-**Example:**
-
-```bash
-.agent/skills/pr_review/scripts/post_inline_comment.sh 12345 "packages/core/src/render3/instructions/element.ts" 42 "AGENT: Consider the performance implications here."
-```
-
-### `submit_pr_review.sh`
-
-Submits all locally staged inline comments as a single batched review via the GitHub Pull Request Reviews API.
-
-**Usage:**
-
-```bash
-.agent/skills/pr_review/scripts/submit_pr_review.sh <PR_NUMBER> <EVENT_TYPE> [BODY]
-```
-
-**Options:**
-
-- `EVENT_TYPE`: Must be `COMMENT`, `APPROVE`, or `REQUEST_CHANGES`. Never use `APPROVE` for external PRs.
-- `BODY`: (Optional) A general summary comment for the review.
-
-**Example:**
-
-```bash
-.agent/skills/pr_review/scripts/submit_pr_review.sh 12345 COMMENT "AGENT: I have left a few inline suggestions for your consideration."
-```

.agent/skills/pr_review/reference/object_create_null.md

@@ -1,38 +0,0 @@
-# Rules for `Object.create(null)` and Prototype Collision Prevention
-
-This guide outlines the technical rules and evaluation criteria for using `Object.create(null)` versus standard object literals (`{}`) or `Map` in the Angular codebase.
-
----
-
-## 1. When `Object.create(null)` is Appropriate
-
-Using `Object.create(null)` (or `Map`) is appropriate when **all** of the following conditions are met:
-
-1. The object is used as an **internal key-value lookup map or set**.
-2. The keys are **arbitrary or untrusted dynamic strings** (e.g., URL query parameters in `$locationShim`, HTML sanitizer tag sets, or `jsaction` DOM event-type resolvers).
-3. Property existence is checked via direct indexing or key checks (e.g., `map[key] !== undefined` or `key in map`), where a key matching an `Object.prototype` member (such as `'toString'`, `'constructor'`, or `'hasOwnProperty'`) causes false positive matches or incorrect behavior.
-
----
-
-## 2. Handling Public API and Boundary Objects
-
-If an object receives untrusted dynamic keys **and** is exposed to public consumers or third-party code (e.g., `SimpleChanges` in `ngOnChanges`):
-
-- **Do NOT blindly change the object to `Object.create(null)`**: Stripping `Object.prototype` from public objects is a breaking API change. Consumer code calling `.hasOwnProperty()`, `.toString()`, `.valueOf()`, or using string interpolation (`` `${obj}` ``) will fail at runtime (`TypeError: obj.hasOwnProperty is not a function`).
-- **Safe Alternatives for Public Objects:**
-  - **`Object.hasOwn(obj, key)`**: Use `Object.hasOwn` for internal framework property lookups instead of direct index or `in` checks. This prevents prototype collision during internal reads without breaking the object's prototype for consumers.
-  - **Input Key Sanitization**: Filter or delete dangerous key names (`__proto__`, `constructor`, `prototype`) when populating the object.
-  - **`Map` or Custom Classes**: For new public APIs requiring key-value stores with dynamic keys, prefer `Map<K, V>` or dedicated classes with explicit `.get()` and `.has()` methods.
-  - **Deprecation / Breaking Change Process**: If changing a public object's prototype to `null` is unavoidable, it must follow Angular's formal deprecation and major version breaking change process.
-
----
-
-## 3. When `Object.create(null)` Should NOT Be Used
-
-Do not replace `{}` with `Object.create(null)` in the following scenarios:
-
-1. **Fixed-Shape Structs and DTOs:** Objects with hardcoded static property names (e.g., `let sortedBreakpoints: {breakpoints?: number[]} = {}`). `Object.assign({}, ...)` only copies _own_ enumerable properties, so prototype properties on sources are never copied.
-2. **Numeric-Key Maps:** Objects indexed by numbers (e.g., `tasksByHandleId: {[id: number]: Task}`). Numeric keys do not collide with `Object.prototype` string members.
-3. **Reference Sentinels:** Objects used purely for reference identity checks (e.g., `const EMPTY_OBJECT = {}` or `const IN_PROGRESS_RESOLUTION = {}`).
-4. **Internal Compiler AST and Visitor State:** Temporary objects with internally generated keys where untrusted user input cannot poison key names.
-5. **Hot Performance Paths and Size-Critical Bundles:** Standard `{}` literals use V8 fast hidden classes and monomorphic inline caching. `Object.create(null)` forces V8 dictionary mode and increases minified bundle size (e.g., in inline polyfills like `event-dispatch-contract` or SSR hydration bundles).

.agent/skills/pr_review/reference/router.md

@@ -1,7 +0,0 @@
-# Router PR Review Guidelines
-
-When reviewing pull requests that modify the Angular Router (`packages/router`), pay special attention to the following:
-
-- **Timing Sensitivity**: The router is extremely sensitive to timing changes. Any changes that alter the asynchronous timing of navigations, resolvers, or guards are almost always breaking changes and must be scrutinized carefully.
-- **Testing Practices**: Tests should usually use the `RouterTestingHarness`. Many existing tests are older and do not use this harness. Do not blindly follow the shape of existing tests when writing or reviewing new ones; encourage the use of modern testing utilities.
-- **Feature Justification**: Changes to router core code should be well-justified. Consider whether the change is proven to be a core developer ask, such as resolving a highly upvoted GitHub issue or addressing a critical bug.

.agent/skills/pr_review/scripts/determine_review_type.sh

@@ -1,32 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# determine_review_type.sh <PR_NUMBER>
-# Determines if the PR should be reviewed locally or remotely based on author.
-
-if [ -z "$1" ]; then
-  echo "Usage: determine_review_type.sh <PR_NUMBER>"
-  exit 1
-fi
-
-PR_NUMBER=$1
-
-# Get current authenticated user
-CURRENT_USER=$(gh api user -q .login 2>/dev/null)
-if [ $? -ne 0 ]; then
-  echo "Error: Could not determine current GitHub user. Are you logged in to gh?"
-  exit 1
-fi
-
-# Get PR author
-PR_AUTHOR=$(gh pr view "$PR_NUMBER" --json author -q .author.login 2>/dev/null)
-if [ $? -ne 0 ]; then
-  echo "Error: Could not retrieve PR information for $PR_NUMBER."
-  exit 1
-fi
-
-if [ "$CURRENT_USER" = "$PR_AUTHOR" ]; then
-  echo "local"
-else
-  echo "remote"
-fi

.agent/skills/pr_review/scripts/get_pr_comments.sh

@@ -1,29 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# get_pr_comments.sh
-# Fetches existing inline comments on a PR to avoid duplicate reviews.
-# Usage: ./get_pr_comments.sh <PR_NUMBER>
-
-if [ "$#" -lt 1 ]; then
-  echo "Usage: $0 <PR_NUMBER>"
-  exit 1
-fi
-
-PR_NUMBER="$1"
-
-# Ensure gh cli is installed
-if ! command -v gh &> /dev/null; then
-    echo "Error: gh CLI could not be found. Please install and authenticate."
-    exit 1
-fi
-
-# Get the current repository (e.g., angular/angular)
-REPO=$(gh repo view --json nameWithOwner -q .nameWithOwner)
-
-# Fetch comments
-gh api \
-  --paginate \
-  -H "Accept: application/vnd.github+json" \
-  "/repos/${REPO}/pulls/${PR_NUMBER}/comments" \
-  --jq '.[] | {id: .id, path: .path, line: .line, body: .body, user: .user.login}'

.agent/skills/pr_review/scripts/post_inline_comment.sh

@@ -1,38 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# post_inline_comment.sh
-# Adds an inline comment to a specific line in a PR via the GitHub API.
-# Usage: ./post_inline_comment.sh <PR_NUMBER> <FILE_PATH> <LINE_NUMBER> <COMMENT_BODY>
-
-if [ "$#" -lt 4 ]; then
-  echo "Usage: $0 <PR_NUMBER> <FILE_PATH> <LINE_NUMBER> <COMMENT_BODY>"
-  exit 1
-fi
-
-PR_NUMBER="$1"
-FILE_PATH="$2"
-LINE="$3"
-BODY="$4"
-
-# Ensure gh cli is installed
-if ! command -v gh &> /dev/null; then
-    echo "Error: gh CLI could not be found. Please install and authenticate."
-    exit 1
-fi
-
-# Get the current repository (e.g., angular/angular)
-REPO=$(gh repo view --json nameWithOwner -q .nameWithOwner)
-
-echo "Staging inline comment for PR #${PR_NUMBER} on ${FILE_PATH}:${LINE}..."
-
-COMMENT_FILE="/tmp/angular_pr_${PR_NUMBER}_comments.json"
-if [ ! -f "$COMMENT_FILE" ]; then
-  echo "[]" > "$COMMENT_FILE"
-fi
-
-# Append the new comment to the JSON array
-jq --arg path "${FILE_PATH}" --argjson line "${LINE}" --arg body "${BODY}" \
-  '. += [{"path": $path, "line": $line, "body": $body}]' "$COMMENT_FILE" > "${COMMENT_FILE}.tmp" && mv "${COMMENT_FILE}.tmp" "$COMMENT_FILE"
-
-echo "Comment successfully staged locally. Remember to call submit_pr_review.sh when finished to publish all comments as a single review!"

.agent/skills/pr_review/scripts/reply_pr_comment.sh

@@ -1,31 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# reply_pr_comment.sh <PR_NUMBER> <COMMENT_ID> <REPLY_BODY>
-# Replies to an existing PR comment thread. Note: COMMENT_ID must be the ID of the top-level comment in the thread you are replying to.
-
-if [ "$#" -lt 3 ]; then
-  echo "Usage: reply_pr_comment.sh <PR_NUMBER> <COMMENT_ID> <REPLY_BODY>"
-  exit 1
-fi
-
-PR_NUMBER="$1"
-COMMENT_ID="$2"
-BODY="$3"
-
-# Ensure gh cli is installed
-if ! command -v gh &> /dev/null; then
-    echo "Error: gh CLI could not be found. Please install and authenticate."
-    exit 1
-fi
-
-# Get the current repository (e.g., angular/angular)
-REPO=$(gh repo view --json nameWithOwner -q .nameWithOwner)
-
-# Reply to the thread using the provided comment ID
-gh api \
-  --silent \
-  --method POST \
-  -H "Accept: application/vnd.github+json" \
-  "/repos/${REPO}/pulls/${PR_NUMBER}/comments/${COMMENT_ID}/replies" \
-  -f body="$BODY"

.agent/skills/pr_review/scripts/submit_pr_review.sh

@@ -1,50 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# submit_pr_review.sh
-# Submits a batched PR review using comments previously staged by post_inline_comment.sh
-# Usage: ./submit_pr_review.sh <PR_NUMBER> <EVENT_TYPE> [BODY]
-# EVENT_TYPE must be COMMENT, APPROVE, or REQUEST_CHANGES
-
-if [ "$#" -lt 2 ]; then
-  echo "Usage: $0 <PR_NUMBER> <EVENT_TYPE> [BODY]"
-  echo "EVENT_TYPE must be COMMENT, APPROVE, or REQUEST_CHANGES"
-  exit 1
-fi
-
-PR_NUMBER="$1"
-EVENT="$2"
-BODY="${3:-}"
-COMMENT_FILE="/tmp/angular_pr_${PR_NUMBER}_comments.json"
-
-if ! command -v gh &> /dev/null; then
-    echo "Error: gh CLI could not be found. Please install and authenticate."
-    exit 1
-fi
-
-REPO=$(gh repo view --json nameWithOwner -q .nameWithOwner)
-
-# Check if there are staged comments
-COMMENTS="[]"
-if [ -f "$COMMENT_FILE" ]; then
-  COMMENTS=$(cat "$COMMENT_FILE")
-fi
-
-echo "Submitting review for PR #${PR_NUMBER}..."
-
-# Create the payload
-PAYLOAD_FILE="/tmp/angular_pr_${PR_NUMBER}_payload.json"
-jq -n --arg event "$EVENT" --arg body "$BODY" --argjson comments "$COMMENTS" \
-  '{event: $event, body: $body, comments: $comments}' > "$PAYLOAD_FILE"
-
-# Post the review using the GitHub Pull Request Reviews API
-gh api \
-  --method POST \
-  -H "Accept: application/vnd.github+json" \
-  -H "X-GitHub-Api-Version: 2022-11-28" \
-  "/repos/${REPO}/pulls/${PR_NUMBER}/reviews" \
-  --input "$PAYLOAD_FILE"
-
-echo "Review submitted successfully!"
-rm -f "$COMMENT_FILE"
-rm -f "$PAYLOAD_FILE"

.agent/skills/reference-compiler-cli/SKILL.md

@@ -1,91 +0,0 @@
----
-name: reference-compiler-cli
-description: Explains the mental model and architecture of the code under `packages/compiler-cli`. You MUST use this skill any time you plan to work with code in `packages/compiler-cli`
----
-
-# Angular Compiler CLI (`ngtsc`) Architecture
-
-## Overview
-
-The `packages/compiler-cli` package contains the Angular Compiler (Ivy), often referred to as `ngtsc`. It is a wrapper around the TypeScript compiler (`tsc`) that extends it with Angular-specific capabilities.
-
-The core goal of `ngtsc` is to compile Angular decorators (like `@Component`, `@Directive`, `@Pipe`) into static properties on the class (Ivy instructions, e.g., `static ɵcmp = ...`). It also performs template type checking and ahead-of-time (AOT) compilation.
-
-## Mental Model
-
-The compiler is designed as a **lazy, incremental, and partial** compilation pipeline.
-
-1.  **Wrapper Pattern**: `NgtscProgram` wraps the standard `ts.Program`. It intercepts calls to act as a drop-in replacement for standard tooling.
-2.  **Traits System**: Every class with an Angular decorator is considered a "Trait". The compiler manages the state of these traits through a state machine:
-    - **Pending**: Detected but not processed.
-    - **Analyzed**: Metadata extracted, template parsed (but dependencies not yet linked).
-    - **Resolved**: Dependencies (directives/pipes in template) resolved, import cycles handled.
-    - **Skipped**: Not an Angular class.
-3.  **Lazy Analysis**: Analysis only happens when necessary (e.g., when diagnostics are requested or emit is prepared).
-4.  **Output AST**: The compiler generates an intermediate "Output AST" (`o.Expression`) for the generated code, which is then translated into TypeScript AST nodes during the emit phase.
-
-## Key Subsystems
-
-### 1. Core Orchestration (`ngtsc/core`)
-
-- **`NgtscProgram`**: The public API implementing `api.Program`. It manages the `ts.Program` and the `NgCompiler`.
-- **`NgCompiler`**: The brain of the compiler. It orchestrates the compilation phases (Analysis, Resolution, Type Checking, Emit). It holds the `TraitCompiler`.
-
-### 2. Trait Compilation (`ngtsc/transform`)
-
-- **`TraitCompiler`**: Manages the lifecycle of "Traits". It iterates over source files, identifies decorated classes, and delegates to the appropriate `DecoratorHandler`.
-- **`Trait`**: A state container for a class, holding its handler, analysis results, and resolution results.
-
-### 3. Decorator Handlers (`ngtsc/annotations`)
-
-- **`DecoratorHandler`**: An interface for handling specific decorators.
-- **`ComponentDecoratorHandler`**: The most complex handler. It:
-  - Extracts metadata (selector, inputs, outputs).
-  - Parses the template.
-  - Resolves used directives and pipes (`R3TargetBinder`).
-  - Generates the `ɵcmp` instruction.
-- **`DirectiveDecoratorHandler`**, **`PipeDecoratorHandler`**, **`NgModuleDecoratorHandler`**: Handle their respective decorators.
-
-### 4. Template Type Checking (`ngtsc/typecheck`)
-
-- **`TemplateTypeChecker`**: Generates "Type Check Blocks" (TCBs). A TCB is a block of TypeScript code that represents the template's logic in a way `tsc` can understand and check for errors.
-- **`TypeCheckBlock`**: The actual generated code that validates bindings, events, and structural directives.
-
-### 5. Metadata & Scope (`ngtsc/metadata`, `ngtsc/scope`)
-
-- **`MetadataReader`**: Reads Angular metadata from source files (using `LocalMetadataRegistry`) and `.d.ts` files (using `DtsMetadataReader`).
-- **`ScopeRegistry`**: Determines the "compilation scope" of a component (which directives/pipes are available to it), handling `NgModule` transitive exports and Standalone Component imports.
-
-### 6. Emit & Transformation (`ngtsc/transform`)
-
-- **`ivyTransformFactory`**: A TypeScript transformer factory.
-- **`IvyCompilationVisitor`**: Visits classes, triggers compilation via `TraitCompiler`, and collects the Output AST.
-- **`IvyTransformationVisitor`**: Translates the Output AST into TypeScript AST, injects the `static ɵ...` fields, and removes the original decorators.
-
-## Compilation Phases
-
-1.  **Construction**: `NgtscProgram` creates `NgCompiler`, which sets up all registries and the `TraitCompiler`.
-2.  **Analysis** (`analyzeSync`):
-    - The `TraitCompiler` scans files.
-    - `DecoratorHandler`s extract metadata and parse templates.
-    - No cross-file resolution happens here (allowing for parallelism and caching).
-3.  **Resolution** (`resolve`):
-    - `TraitCompiler` resolves traits.
-    - Components link their templates to specific Directives and Pipes (found via `ScopeRegistry`).
-    - Import cycles are detected and handled (e.g., via "remote scoping").
-4.  **Type Checking**:
-    - `TemplateTypeChecker` creates TCBs for all components.
-    - TypeScript diagnostics are retrieved for these TCBs.
-5.  **Emit** (`prepareEmit`):
-    - `ivyTransformFactory` is created.
-    - TS `emit` is called.
-    - The transformers run, injecting the compiled Ivy instructions into the JS/DTS output.
-
-## Important File Locations
-
-- `packages/compiler-cli/src/ngtsc/program.ts`: Entry point (`NgtscProgram`).
-- `packages/compiler-cli/src/ngtsc/core/src/compiler.ts`: Core logic (`NgCompiler`).
-- `packages/compiler-cli/src/ngtsc/transform/src/trait.ts`: Trait state machine.
-- `packages/compiler-cli/src/ngtsc/annotations/component/src/handler.ts`: Component compilation logic.
-- `packages/compiler-cli/src/ngtsc/typecheck/src/template_type_checker.ts`: Type checking logic.
-- `packages/compiler-cli/src/ngtsc/transform/src/transform.ts`: AST transformation logic.

.agent/skills/reference-core/SKILL.md

@@ -1,96 +0,0 @@
----
-name: reference-core
-description: Explains the mental model and architecture of the code under `packages/core`. You MUST use this skill any time you plan to work with code in `packages/core`
----
-
-# Angular Core (`packages/core`) Mental Model
-
-This document outlines the architecture and mental model for `packages/core`, the heart of the Angular framework.
-
-## 1. High-Level Architecture
-
-`packages/core` contains the runtime logic for Angular. Its primary responsibilities are:
-
-1.  **Rendering (Ivy/Render3)**: Transforming templates into DOM updates.
-2.  **Dependency Injection (DI)**: Managing object creation and lifetime.
-3.  **Change Detection**: Synchronizing the model with the view.
-4.  **Reactivity**: Signals and Zone.js integration.
-
-## 2. Rendering Engine (Ivy / Render3)
-
-The rendering engine (located in `packages/core/src/render3`) uses an **instruction-based** approach.
-
-### Key Concepts
-
-- **Instructions**: The Angular compiler transforms templates into a sequence of instruction calls (e.g., `ɵɵelementStart`, `ɵɵtext`, `ɵɵproperty`). These instructions are executed at runtime to create and update the view.
-  - _Location_: `packages/core/src/render3/instructions`
-
-- **LView (Logical View)**: An array containing the _state_ of a specific view instance. It holds:
-  - DOM nodes (`RElement`, `RText`).
-  - Binding values (for change detection).
-  - Directive/Component instances.
-  - _Context_: `packages/core/src/render3/interfaces/view.ts`
-
-- **TView (Template View)**: An array containing the _static structure_ of a view. It is shared across all instances (`LView`s) of the same component/template. It holds:
-  - Property names for bindings.
-  - Node relationship information.
-  - Compiled directive definitions.
-  - _Context_: `packages/core/src/render3/interfaces/view.ts`
-
-- **Memory Layout**: `LView` and `TView` are parallel arrays. Index `i` in `LView` corresponds to metadata at index `i` in `TView`.
-  - `HEADER`: Fixed size, contains context (Parent, Host, etc.).
-  - `DECLS`: Static nodes (elements, text, pipes).
-  - `VARS`: Binding values.
-  - `EXPANDO`: Dynamic data (host bindings, injectors).
-
-### The Render Cycle
-
-1.  **Creation Mode**: Instructions create DOM nodes and store them in `LView`.
-2.  **Update Mode**: Instructions check current values against previous values stored in `LView`. If changed, they update the DOM.
-
-## 3. Dependency Injection (DI)
-
-DI in Angular is hierarchical and split into two systems that interact:
-
-### Module Injector (`R3Injector`)
-
-- Configured via `@NgModule.providers` or `providedIn: 'root'`.
-- Stored in a hierarchy of `R3Injector` instances.
-- _Location_: `packages/core/src/di/r3_injector.ts`
-
-### Node Injector
-
-- Configured via `@Component.providers` or `@Directive.providers`.
-- **Not a class**, but a data structure embedded in the `LView` ("Expando" section).
-- Uses **Bloom Filters** (`TView.data`) to quickly check if a token is present at a specific node index before traversing up the tree.
-- Resolves tokens starting from the current node, walking up the view tree (Element Injector hierarchy), and falling back to the Module Injector if not found.
-
-## 4. Change Detection
-
-- **Dirty Checking**: Angular checks if values bound in templates have changed.
-- **Strategies**:
-  - `Default`: Checks everything.
-  - `OnPush`: Checks only if inputs change, events fire, or signals update.
-- **Signals**: The new reactivity primitive. Signals notify the scheduler when they change, potentially allowing for fine-grained updates (Zoneless).
-
-## 5. Key Directories to Know
-
-- `src/render3`: The Ivy rendering engine.
-  - `instructions`: The runtime instructions called by compiled code.
-  - `interfaces`: `LView`, `TView`, `TNode` definitions.
-- `src/di`: Dependency injection system.
-- `src/change_detection`: Change detection logic.
-- `src/zone`: Zone.js integration.
-- `src/signal`: Signals implementation (if present in this version, otherwise likely in `primitives`).
-
-## 6. Conventions & Gotchas
-
-- **Prefixes**: Private/Internal exports often start with `ɵ`.
-- **Global State**: Ivy relies heavily on global state (e.g., `getLView()`) during instruction execution to avoid passing context arguments everywhere. This is for performance and code size.
-- **Performance**: The code is highly optimized for performance and memory. You will see arrays used instead of objects, bitmasks, and manual memory management patterns. **Respect these patterns.**
-
-## 7. How to Modify Core
-
-1.  **Understand the Instruction**: If modifying runtime behavior, find the corresponding instruction in `src/render3/instructions`.
-2.  **Check `LView`/`TView` Impact**: If adding state, understand where it fits in the `LView` array.
-3.  **Tests**: Core has extensive tests. Run them using Bazel.

.agent/skills/reference-signal-forms/SKILL.md

@@ -1,104 +0,0 @@
----
-name: reference-signal-forms
-description: Explains the mental model and architecture of the code under `packages/forms/signals`. You MUST use this skill any time you plan to work with code in `packages/forms/signals`
----
-
-# Signal Forms Architecture
-
-The `packages/forms/signals` directory contains the signal-based forms API for Angular.
-This system differs significantly from the existing Reactive and Template-driven forms.
-
-## Mental Model
-
-1.  **Model-Driven**: The system is built around a `WritableSignal<T>` which serves as the **single source of truth**.
-    Unlike Reactive Forms where the `FormControl` holds the value, here the `Signal` holds the value.
-    The form is merely a _view_ or _projection_ of that signal, adding form-specific state (validity, dirty, touched).
-
-2.  **Proxy-Based Traversal**: The form API (`form(signal)`) returns a `FieldTree`. This object is a **Proxy**.
-    It allows accessing nested fields (e.g., `myForm.user.name`) without manually creating control groups.
-    Accessing a property on the proxy lazily resolves or creates the corresponding `FieldNode`.
-
-3.  **Schema-Based Logic**: Validation, disabled state, and other metadata are defined separately via **Schemas**.
-    Schemas are applied to the form structure using functions like `apply`, `applyEach` (for arrays), and `applyWhen`.
-    This separates the _structure_ of the data from the _rules_ governing it.
-
-4.  **Directives as Glue**: The `[formField]` directive binds a DOM element (native input or custom control) to a `FieldNode`.
-    It handles:
-    - Syncing the value between the DOM and the Signal.
-    - Reflecting state (valid, touched, etc.) to the UI.
-    - Handling user interaction events (blur, input).
-
-## Key Components
-
-### 1. `FieldNode` (`src/field/node.ts`)
-
-The central internal class representing a single field in the form graph. It aggregates several state managers:
-
-- `structure`: Manages parent/child relationships and signal slicing.
-- `validationState`: Computes `valid`, `invalid`, `errors` signals.
-- `nodeState`: Tracks `touched`, `dirty`, and derived logical state.
-- `metadataState`: Stores metadata like `min`, `max`, `required`.
-- `submitState`: Tracks submission status and server errors.
-
-### 2. `FieldValidationState` (`src/field/validation.ts`)
-
-Implements `ValidationState` and manages the complexity of validation:
-
-- **Synchronous Errors**: Derived from schema rules.
-- **Asynchronous Errors**: Handled via signals, including 'pending' states.
-- **Tree Errors**: Errors that bubble up or are targeted at specific fields.
-- **Submission Errors**: Server-side errors injected imperatively via `submit()`.
-
-### 3. `FormField` Directive (`src/directive/form_field.ts`)
-
-The bridge between the `FieldNode` and the DOM.
-
-- Selector: `[formField]`
-- It supports:
-  - **Native Elements**: `<input>`, `<select>`, `<textarea>`.
-  - **Custom Controls**: Components implementing `FormValueControl` or `FormCheckboxControl`.
-  - **Legacy Interop**: Components implementing `ControlValueAccessor` (via `InteropNgControl`).
-
-### 4. `Schema` (`src/api/structure.ts` & `src/api/rules`)
-
-Defines the behavior.
-
-- Created via `schema(fn)`.
-- Applied via `apply(path, schema)`.
-- Rules include validators (`required`, `pattern`, `min`, `max`) and state modifiers (`disabled`, `hidden`).
-
-## Data Flow
-
-1.  **Read**: `form.field().value()` reads directly from the underlying signal (projected to the specific path).
-2.  **Write**: Writing to the form (e.g., via UI) updates the underlying signal.
-3.  **Validation**: A computed effect observes the value signal and runs validators defined in the schema.
-
-## Usage Example (Conceptual)
-
-```typescript
-// 1. Define Model
-const user = signal({name: '', age: 0});
-
-// 2. Define Schema
-const userRules = schema((u) => {
-  required(u.name);
-  min(u.age, 18);
-});
-
-// 3. Create Form
-const userForm = form(user, userRules); // OR apply(userForm, userRules)
-
-// 4. Bind in Template
-// <input [formField]="userForm.name">
-```
-
-## Important Files
-
-- `packages/forms/signals/src/api/structure.ts`: Public API entry points (`form`, `apply`).
-- `packages/forms/signals/src/api/control.ts`: Interfaces for custom controls (`FormUiControl`).
-- `packages/forms/signals/src/field/node.ts`: The `FieldNode` implementation.
-- `packages/forms/signals/src/directive/form_field.ts`: The `[formField]` directive.
-
-## Supplemental Information
-
-- [Compiler & Core Integration](references/integration.md): Details how `[formField]` hooks into type-checking and the runtime.

.agent/skills/reference-signal-forms/references/integration.md

@@ -1,46 +0,0 @@
-# Signal Forms Integration: Compiler & Core
-
-This document explains how the Signal Forms system hooks into the Angular compiler and runtime to provide seamless type-checking and efficient updates.
-
-## 1. Compiler Integration (Type Checking)
-
-The `packages/compiler` package contains specific logic to support `[formField]`. This is primarily handled in `src/typecheck/ops/signal_forms.ts`.
-
-### Key Mechanisms:
-
-- **Detection**: The compiler identifies a directive as a "Field Directive" if it has the `ɵNgFieldDirective` property or comes from `@angular/forms/signals`.
-- **Synthetic Binding Expansion**: When you write `<input [formField]="mySignal" />`, the type checker doesn't just check `formField`. It synthetically expands this into a set of bindings for validation:
-  - `[value]="mySignal()"` (or `checked` for checkboxes)
-  - `[disabled]="mySignal.disabled()"`
-  - `[required]="mySignal.required()"`
-  - ...and so on.
-  - This ensures that `mySignal` (the `FieldNode`) has all the necessary properties to drive the form control.
-- **Conflict Detection**: It actively prevents "double binding". If you bind `[formField]`, you are _banned_ from also binding `[value]`, `[disabled]`, `[required]`, etc., as the signal form should be the single source of truth.
-- **Element Type Validation**:
-  - **Native Elements**: Checks that the signal's value type matches the element type (e.g., `<input type="checkbox">` requires a `boolean` signal).
-  - **Custom Controls**: Detects if a custom component is a "Form Value Control" (has a `value` input/output) or "Form Checkbox Control" (has a `checked` input/output) and validates against that.
-
-### Relevant Files:
-
-- `packages/compiler/src/typecheck/ops/signal_forms.ts`: The core Signal Forms type-checking logic, including `TcbNativeFieldOp`.
-
-## 2. Core Runtime Integration
-
-The `packages/core` package provides the low-level instructions that power the `FormField` directive. This allows it to do things normal directives cannot, like efficiently syncing state without change detection overhead for every property.
-
-### Key Mechanisms:
-
-- **`ɵngControlCreate` Hook**: The `FormField` directive defines a special method `ɵngControlCreate`, which causes the compiler to install `ɵɵControlFeature`.
-- **`ɵɵcontrol` Instructions**: A `formField` binding causes the compiler to emit:
-  - `ɵɵcontrolCreate`: Called during the creation phase.
-  - `ɵɵcontrol`: Called during the update phase.
-- **`ControlDirectiveHost`**: These instructions provide the directive with a `ControlDirectiveHost`. This is a privileged interface that allows the `FormField` directive to:
-  - **Access the Element**: Get direct access to the native element or component instance.
-  - **Set Inputs**: Write directly to inputs of _other directives_ on the same node (e.g., setting the `value` input of a custom control).
-  - **Listen to Outputs**: Subscribe to outputs of other directives (e.g., `valueChange`).
-  - **Bypass Templates**: It effectively acts as a "meta-directive" that manages the bindings for you, bypassing the need for explicit template syntax for every property.
-
-### Relevant Files:
-
-- `packages/core/src/render3/instructions/control.ts`: Implementation of `ɵɵcontrol` instructions.
-- `packages/forms/signals/src/directive/form_field.ts`: The directive that implements the hook.

.agent/workflows/fix-flaky-tests.md

@@ -1,56 +0,0 @@
----
-description: Find and fix flaky tests in the repository
----
-
-Investigate flaky tests in the repo and propose fixes to improve stability.
-High-level process:
-
-1.  Run tests in the repo to look for flakes.
-    - Consider using Bazel's `--runs_per_test` flag to easily find
-      flakes.
-    - Be cognizant of not exhausting all the resources on the current
-      machine, run a subset of tests at a time such as
-      `bazel test //packages/core/...`.
-2.  Once you find some flakes, focus on one at a time.
-3.  Create a new branch named `flakes/${relevantNameFromTest}`.
-4.  Reproduce the flake to the best of your ability.
-    - Consider using `--test_env JASMINE_RANDOM_SEED=1234` to
-      replicate the broken test ordering.
-5.  Debug the test to understand the failure mode.
-    - Consider temporarily disabling / skipping other tests with `xit`
-      and `fit` to narrow down where the flake might be coming from if
-      multiple tests are influencing each other.
-    - Consider temporarily ignoring Firefox tests with
-      `--test_tag_filters -firefox` if the flake does not appear to be
-      browser specific.
-    - Consider using `--test_sharding_strategy disabled` to run the
-      test in a single shard.
-    - Try to understand why the test was _flaky_, not just why it
-      _failed_. Understanding the inconsistency is important to
-      finding the correct fix.
-6.  Attempt a fix and validate with `--runs_per_test`.
-    - Iterate on the fix until you have something which appears to
-      work.
-    - If you find yourself stuck and not making meaningful progress,
-      note down what you've learned/where you're struggling, commit
-      what you have, look for another flake to fix, and continue. At
-      the end, surface to the user what you failed to fix.
-    - Don't try to make significant changes to Angular's runtime
-      behavior, focus just on making the test pass/fail consistently.
-7.  Commit the change with relevant details in the commit message and
-    move on to the next test.
-    - Be sure to include your theory of why the test was flaky and
-      how this fix eliminates or reduces that flakiness.
-8.  Iterate as many times as the user requests you to (default 5
-    branches if not otherwise specified).
-9.  Once you can't find any flaky tests or have iterated as many times
-    as requested, stop and inform the user what you found and fixed.
-
-Additional notes:
-
-- Multiple fixes including the same/related files can go in the same
-  commit or multiple commits on the same branch.
-- Distinct test fixes should go in different branches, make a new one
-  for each investigation.
-- You may push these branches to `origin`, but do not create PRs for
-  them.

.bazelignore

@@ -0,0 +1,38 @@
+# Bazel does not yet support wildcards or other .gitignore semantics for
+# .bazelignore. Two issues for this feature request are outstanding:
+# https://github.com/bazelbuild/bazel/issues/7093
+# https://github.com/bazelbuild/bazel/issues/8106
+.git
+node_modules
+dist
+aio/node_modules
+aio/tools/examples/shared/node_modules
+aio/tools/examples/shared/example-scaffold
+
+# All integration test node_modules folders
+integration/animations/node_modules
+integration/cli-elements-universal/node_modules
+integration/cli-hello-world/node_modules
+integration/cli-hello-world-ivy-i18n/node_modules
+integration/cli-hello-world-lazy/node_modules
+integration/cli-hello-world-mocha/node_modules
+integration/dynamic-compiler/node_modules
+integration/forms/node_modules
+integration/injectable-def/node_modules
+integration/ivy-i18n/node_modules
+integration/ng-add-localize/node_modules
+integration/ng_elements/node_modules
+integration/ng_update/node_modules
+integration/ng_update_migrations/node_modules
+integration/nodenext_resolution/node_modules
+integration/npm_package_archives.bzl/node_modules
+integration/platform-server/node_modules
+integration/service-worker-schema/node_modules
+integration/side-effects/node_modules
+integration/standalone-bootstrap/node_modules
+integration/terser/node_modules
+integration/trusted-types/node_modules
+integration/typings_test_rxjs7/node_modules
+integration/typings_test_ts49/node_modules
+integration/typings_test_ts50/node_modules
+integration/typings_test_ts51/node_modules

.bazelrc

@@ -1,23 +1,10 @@
-# Disable NG CLI TTY mode
-build --action_env=NG_FORCE_TTY=false
-
 # Enable debugging tests with --config=debug
-test:debug --test_arg=--node_options=--inspect-brk --test_output=streamed --test_strategy=exclusive --test_timeout=9999 --nocache_test_results --strategy=TestRunner=standalone
+test:debug --test_arg=--node_options=--inspect-brk --test_output=streamed --test_strategy=exclusive --test_timeout=9999 --nocache_test_results
 
 # Do not attempt to de-flake locally.
 # On CI we might set this to `3` to run with deflaking.
 test --flaky_test_attempts=1
 
-# Required by `rules_ts`.
-common --@aspect_rules_ts//ts:skipLibCheck=always
-common --@aspect_rules_ts//ts:default_to_tsc_transpiler
-
-# Needed as otherwise `env` of TS actions would be ignored.
-common --incompatible_merge_fixed_and_default_shell_env
-
-# Frozen lockfile
-common --lockfile_mode=error
-
 ###############################
 # Filesystem interactions     #
 ###############################
@@ -44,7 +31,7 @@ test --nolegacy_external_runfiles
 # in Bazel 0.21.0 but turned off again in 0.22.0. Follow
 # https://github.com/bazelbuild/bazel/issues/7026 for more details.
 # This flag is needed to so that the bazel cache is not invalidated
-# when running bazel via `pnpm bazel`.
+# when running bazel via `yarn bazel`.
 # See https://github.com/angular/angular/issues/27514.
 build --incompatible_strict_action_env
 run --incompatible_strict_action_env
@@ -66,22 +53,34 @@ build --enable_runfiles
 # Releases should always be stamped with version control info
 # This command assumes node on the path and is a workaround for
 # https://github.com/bazelbuild/bazel/issues/4802
-build:release --workspace_status_command="pnpm --silent ng-dev release build-env-stamp --mode=release"
+build:release --workspace_status_command="yarn -s ng-dev release build-env-stamp --mode=release"
 build:release --stamp
 
-# Snapshots should also be stamped with version control information.
-build:snapshot-build --workspace_status_command="pnpm --silent ng-dev release build-env-stamp --mode=snapshot"
-build:snapshot-build --stamp
-# @angular/language-server package depends directly on other Angular framework packages.
-# This flag ensures that the language server uses the snapshot-built framework packages from the repository.
-build:snapshot-build --//:enable_language_server_snapshot_repo_deps
+# Building AIO against local Angular deps requires stamping
+# versions in Angular packages due to CLI version checks.
+build:aio_local_deps --stamp
+build:aio_local_deps --workspace_status_command="yarn -s --cwd aio local-workspace-status"
 
-# Angular DevTools for Firefox releases *cannot* be stamped and `--config snapshot-build-firefox` is a no-op.
-# This is because Mozilla requires add-on source code to be uploaded and then they manually reproduce the build.
-# If we stamp the build based on Git information such as the current commit, then reproducing the build would require
-# uploading the entire `.git` directory. We already must upload the entire monorepo, and uploading `.git` as well
-# exceeds the max source file size. To address this, we just *don't* stamp Firefox builds of Angular DevTools.
-build:snapshot-build-firefox --nostamp
+# Snapshots should also be stamped with version control information.
+build:snapshot-build --workspace_status_command="yarn -s ng-dev release build-env-stamp --mode=snapshot"
+build:snapshot-build --stamp
+
+##########################################################
+# AIO architect build configuration                      #
+# See aio/angular.json for available configurations.     #
+# To build with a partiular configuration:               #
+#   bazel build //aio:build --aio_build_config=<config>  #
+# Default config is `stable``.                           #
+##########################################################
+build --flag_alias=aio_build_config=//aio:flag_aio_build_config
+
+####################################
+# AIO first party dep substitution #
+# Turn on with                     #
+#  --config=aio_local_deps         #
+####################################
+
+build:aio_local_deps --//aio:flag_aio_local_deps
 
 ###############################
 # Output                      #
@@ -94,6 +93,12 @@ query --output=label_kind
 # By default, failing tests don't print any output, it goes to the log file
 test --test_output=errors
 
+################################
+# Settings for CircleCI        #
+################################
+
+# Bazel flags for CircleCI are in /.circleci/bazel.linux.rc and /.circleci/bazel.windows.rc
+
 ##################################
 # Remote Build Execution support #
 # Turn on these settings with    #
@@ -113,45 +118,42 @@ common:remote --jobs=200
 
 build:remote --google_default_credentials
 
+# Limit the number of test jobs for on an AIO local deps build. The example tests running
+# concurrently pushes the circleci executor RAM usage to its limits.
+test:aio_local_deps --jobs=24
+
 # Force remote exeuctions to consider the entire run as linux
 build:remote --cpu=k8
 build:remote --host_cpu=k8
 
 # Toolchain and platform related flags
-build:remote --extra_execution_platforms=@devinfra//bazel/remote-execution:platform_with_network
-build:remote --host_platform=@devinfra//bazel/remote-execution:platform_with_network
-build:remote --platforms=@devinfra//bazel/remote-execution:platform_with_network
+build:remote --crosstool_top=@npm//@angular/build-tooling/bazel/remote-execution/cpp:cc_toolchain_suite
+build:remote --extra_toolchains=@npm//@angular/build-tooling/bazel/remote-execution/cpp:cc_toolchain
+build:remote --extra_execution_platforms=@npm//@angular/build-tooling/bazel/remote-execution:platform
+build:remote --host_platform=@npm//@angular/build-tooling/bazel/remote-execution:platform
+build:remote --platforms=@npm//@angular/build-tooling/bazel/remote-execution:platform
 
 # Remote instance and caching
 build:remote --remote_instance_name=projects/internal-200822/instances/primary_instance
 build:remote --bes_instance_name=internal-200822
 build:remote --remote_cache=remotebuildexecution.googleapis.com
 build:remote --remote_executor=remotebuildexecution.googleapis.com
-build:remote --remote_upload_local_results=false
-
-build:remote --remote_grpc_log=/tmp/rbe-grpc.log
-
-# See: https://docs.google.com/document/d/1NgDPsCIwprDdqC1zj0qQrh5KGK2hQTSTux1DAvi4rSc/edit?tab=t.0.
-build:remote --experimental_remote_execution_keepalive
 
 # Use HTTP remote cache
 build:remote-cache --remote_cache=https://storage.googleapis.com/angular-team-cache
 build:remote-cache --remote_accept_cached=true
-build:remote-cache --remote_upload_local_results=false
+build:remote-cache --remote_upload_local_results=true
 build:remote-cache --google_default_credentials
 
-# Additional flags added when running a "trusted build" with additional access
-build:trusted-build --remote_upload_local_results=true
-
 # Ensure that tags like "no-remote-exec" get propagated to actions created by rules,
 # even if the rule implementation does not explicitly pass them to the execution requirements.
 # https://bazel.build/reference/command-line-reference#flag--experimental_allow_tags_propagation
-common --incompatible_allow_tags_propagation
+common --experimental_allow_tags_propagation
 
 # Disable network access in the sandbox by default. To enable network access
 # for a particular target, use:
 #
-# load("@devinfra//bazel/remote-execution:index.bzl", "ENABLE_NETWORK")
+# load("@npm//@angular/build-tooling/bazel/remote-execution:index.bzl", "ENABLE_NETWORK")
 # my_target(
 #   ...,
 #   exec_properties = ENABLE_NETWORK,   # Enables network in remote exec
@@ -159,6 +161,16 @@ common --incompatible_allow_tags_propagation
 # )
 build --nosandbox_default_allow_network
 
+##################################
+# Saucelabs tests settings       #
+# Turn on these settings with    #
+#  --config=saucelabs            #
+##################################
+
+# For saucelabs tests we don't want to enable flaky test attempts. Karma has its own integrated
+# retry mechanism and we do not want to retry unnecessarily if Karma already tried multiple times.
+test:saucelabs --flaky_test_attempts=1
+
 ################
 # Flag Aliases #
 ################

.bazelversion

@@ -1 +1 @@
-8.8.0
+5.0.0

.circleci/README.md

@@ -0,0 +1,19 @@
+# Encryption
+
+Based on https://github.com/circleci/encrypted-files
+
+In the CircleCI web UI, we have a secret variable called `KEY`
+https://circleci.com/gh/angular/angular/edit#env-vars
+which is only exposed to non-fork builds
+(see "Pass secrets to builds from forked pull requests" under
+https://circleci.com/gh/angular/angular/edit#advanced-settings)
+
+We use this as a symmetric AES encryption key to encrypt tokens like
+a GitHub token that enables publishing snapshots.
+
+To create the github_token file, we take this approach:
+- Find the angular-builds:token in the internal pw database
+- Go inside the CircleCI default docker image so you use the same version of openssl as we will at runtime: `docker run --rm -it circleci/node:10.12`
+- echo "https://[token]:@github.com" > credentials
+- openssl aes-256-cbc -e -in credentials -out .circleci/github_token -k $KEY
+- If needed, base64-encode the result so you can copy-paste it out of docker: `base64 github_token`

.circleci/bazel.common.rc

@@ -0,0 +1,16 @@
+# Settings in this file should be OS agnostic. Use the bazel.<OS>.rc files for OS specific settings.
+
+# Print all the options that apply to the build.
+# This helps us diagnose which options override others
+# (e.g. /etc/bazel.bazelrc vs. tools/bazel.rc)
+build --announce_rc
+
+# Retry in the event of flakes, eg. https://circleci.com/gh/angular/angular/31309
+# By default this is set in the project `.bazelrc` to `1`.
+test --flaky_test_attempts=3
+
+# More details on failures
+build --verbose_failures=true
+
+# CI supports colors but Bazel does not detect it.
+common --color=yes

.circleci/bazel.linux.rc

@@ -0,0 +1,23 @@
+# These options are enabled when running on CI
+# We do this by copying this file to /etc/bazel.bazelrc at the start of the build.
+# See documentation in /docs/BAZEL.md
+
+# Import config items common to both Linux and Windows setups.
+# https://docs.bazel.build/versions/master/guide.html#bazelrc-syntax-and-semantics
+try-import %workspace%/.circleci/bazel.common.rc
+
+# Save downloaded repositories in a location that can be cached by CircleCI. This helps us
+# speeding up the analysis time significantly with Bazel managed node dependencies on the CI.
+build --repository_cache=/home/circleci/bazel_repository_cache
+
+# Workaround https://github.com/bazelbuild/bazel/issues/3645
+# Bazel doesn't calculate the memory ceiling correctly when running under Docker.
+# Limit Bazel to consuming resources that fit in CircleCI "2xlarge+" class
+# https://circleci.com/docs/2.0/configuration-reference/#resource_class
+build --local_cpu_resources=20
+build --local_ram_resources=40960
+
+# All build executed remotely should be done using our RBE configuration.
+build:remote --google_default_credentials
+
+build --config=remote

.circleci/bazel.windows.rc

@@ -0,0 +1,17 @@
+# These options are enabled when running on CI
+# We do this by copying this file to $env:ProgramData\bazel.bazelrc at the start of the build.
+# See documentation in /docs/BAZEL.md
+
+# Import config items common to both Linux and Windows setups.
+# https://docs.bazel.build/versions/master/guide.html#bazelrc-syntax-and-semantics
+try-import %workspace%/.circleci/bazel.common.rc
+
+# Manually set the local resources used in windows CI runs
+build --local_ram_resources=120000
+build --local_cpu_resources=32
+
+# All windows jobs run on master and should use http caching
+build --remote_http_cache=https://storage.googleapis.com/angular-team-cache
+build --remote_accept_cached=true
+build --remote_upload_local_results=true
+build --google_default_credentials

.circleci/config.yml

@@ -0,0 +1,395 @@
+# Configuration file for https://circleci.com/gh/angular/angular
+
+# Note: YAML anchors allow an object to be re-used, reducing duplication.
+# The ampersand declares an alias for an object, then later the `<<: *name`
+# syntax dereferences it.
+# See https://blog.daemonl.com/2016/02/yaml.html
+# To validate changes, use an online parser, eg.
+# https://yaml-online-parser.appspot.com/
+
+# CircleCI configuration version
+# Version 2.1 allows for extra config reuse features
+# https://circleci.com/docs/2.0/reusing-config/#getting-started-with-config-reuse
+version: 2.1
+
+# We don't want to include the current branch name in the cache key because that would prevent
+# PRs from being able to restore the cache since the branch names are always different for PRs.
+# The cache key should only consist of dynamic values that change whenever something in the
+# cache changes. For example:
+# 1) yarn lock file changes --> cached "node_modules" are different.
+# 2) bazel repository definitions change --> cached bazel repositories are different.
+# Windows needs its own cache key because binaries in node_modules are different.
+# **NOTE 1 **: In order to avoid the cache from growing indefinitely and causing slow-downs, we invalidate the cache monthly.
+#              (See https://support.circleci.com/hc/en-us/articles/360012618473-Creating-a-daily-cache.)
+# **NOTE 2 **: If you change the cache key prefix, also sync the cache_key_fallback to match.
+# **NOTE 3 **: Keep the static part of the cache key as prefix to enable correct fallbacks.
+# **NOTE 4 **: To make sure modified patches can be applied without needing to manually update the cache key,
+#              the fallback cache key will not match if patches have been modified.
+# See https://circleci.com/docs/2.0/caching/#restoring-cache for how prefixes work in CircleCI.
+var_3: &cache_key v8-angular-node-16-{{ checksum "month.txt" }}-{{ checksum "patches.hash"}}-{{ checksum ".bazelversion" }}-{{ checksum "yarn.lock" }}-{{ checksum "WORKSPACE" }}-{{ checksum "aio/yarn.lock" }}
+# We invalidate the cache if the Bazel version changes because otherwise the `bazelisk` cache
+# folder will contain all previously used versions and ultimately cause the cache restoring to
+# be slower due to its growing size.
+var_4: &cache_key_fallback v8-angular-node-16-{{ checksum "month.txt" }}-{{ checksum "patches.hash"}}-{{ checksum ".bazelversion" }}
+
+# Windows needs its own cache key because binaries in node_modules are different.
+var_3_win: &cache_key_win v10-angular-win-node-16-{{ checksum "month.txt" }}-{{ checksum "patches.hash"}}-{{ checksum ".bazelversion" }}-{{ checksum "yarn.lock" }}-{{ checksum "WORKSPACE" }}
+var_4_win: &cache_key_win_fallback v10-angular-win-node-16-{{ checksum "month.txt" }}-{{ checksum "patches.hash"}}-{{ checksum ".bazelversion" }}
+
+# Workspace initially persisted by the `setup` job, and then enhanced by `build-npm-packages`.
+# https://circleci.com/docs/2.0/workflows/#using-workspaces-to-share-data-among-jobs
+# https://circleci.com/blog/deep-diving-into-circleci-workspaces/
+var_5: &workspace_location ~/
+
+# Filter to run a job on builds for pull requests only.
+var_6: &only_on_pull_requests
+  filters:
+    branches:
+      only:
+        - /pull\/\d+/
+
+# Filter to skip a job on builds for pull requests.
+var_7: &skip_on_pull_requests
+  filters:
+    branches:
+      ignore:
+        - /pull\/\d+/
+
+# Filter to run a job on builds for the main branch only.
+var_8: &only_on_main_branch
+  filters:
+    branches:
+      only:
+        - main
+
+# Filter to run a job on all releasable branches.
+var_9: &only_release_branches
+  filters:
+    branches:
+      only:
+        - main
+        - /\d+\.\d+\.x/
+
+# CircleCI orbs
+# https://circleci.com/developer/orbs.
+orbs:
+  node: circleci/node@5.0.1
+  devinfra: angular/dev-infra@1.0.8
+
+# Executor Definitions
+# https://circleci.com/docs/2.0/reusing-config/#authoring-reusable-executors
+# **NOTE 1**: Pin to exact images using an ID (SHA). See https://circleci.com/docs/2.0/circleci-images/#using-a-docker-image-id-to-pin-an-image-to-a-fixed-version.
+#             (Using the tag in not necessary when pinning by ID, but include it anyway for documentation purposes.)
+# **NOTE 2**: If you change the version of the docker images, also change the `cache_key` suffix.
+# **NOTE 3**: If you change the version of Node.js provided by the docker images, also update `.devcontainer/recommended-Dockerfile` to match the new version.
+executors:
+  default-executor:
+    parameters:
+      resource_class:
+        type: string
+        default: medium
+    docker:
+      - image: cimg/node:18.13.0
+    resource_class: << parameters.resource_class >>
+    working_directory: ~/ng
+
+  test-browser-executor:
+    parameters:
+      resource_class:
+        type: string
+        default: medium
+    docker:
+      - image: cimg/node:18.13.0-browsers
+    resource_class: << parameters.resource_class >>
+    working_directory: ~/ng
+
+  windows-executor:
+    working_directory: ~/ng
+    resource_class: windows.2xlarge
+    shell: bash
+    machine:
+      image: windows-server-2019-vs2019:201908-02
+
+# Command Definitions
+# https://circleci.com/docs/2.0/reusing-config/#authoring-reusable-commands
+commands:
+  custom_attach_workspace:
+    description: Attach workspace at a predefined location
+    steps:
+      - attach_workspace:
+          at: *workspace_location
+
+  # Install java runtime which is required by some integration tests such as
+  # //integration:hello_world__closure_test, //integration:i18n_test and
+  # //integration:ng_elements_test to run the closure compiler
+  install_java:
+    description: Install java
+    steps:
+      - run:
+          name: Install java
+          command: |
+            sudo apt-get update
+            # Install java runtime
+            sudo apt-get install default-jre
+
+  # Initializes the CI environment by setting up common environment variables.
+  init_environment:
+    description: Initializing environment (setting up variables)
+    steps:
+      - run:
+          name: Set up environment
+          environment:
+            CIRCLE_GIT_BASE_REVISION: << pipeline.git.base_revision >>
+            CIRCLE_GIT_REVISION: << pipeline.git.revision >>
+          command: ./.circleci/env.sh
+      - devinfra/setup-bazel-remote-exec
+      - run:
+          # Configure git as the CircleCI `checkout` command does.
+          # This is needed because we only checkout on the setup job.
+          # Add GitHub to known hosts
+          name: Configure git
+          command: |
+            mkdir -p ~/.ssh
+            echo 'github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=' >> ~/.ssh/known_hosts
+            git config --global url."ssh://git@github.com".insteadOf "https://github.com" || true
+            git config --global gc.auto 0 || true
+
+  init_saucelabs_environment:
+    description: Sets up a domain that resolves to the local host.
+    steps:
+      - run:
+          name: Preparing environment for running tests on Sauce Labs.
+          command: |
+            # For SauceLabs jobs, we set up a domain which resolves to the machine which launched
+            # the tunnel. We do this because devices are sometimes not able to properly resolve
+            # `localhost` or `127.0.0.1` through the SauceLabs tunnel. Using a domain that does not
+            # resolve to anything on SauceLabs VMs ensures that such requests are always resolved
+            # through the tunnel, and resolve to the actual tunnel host machine (i.e. the CircleCI VM).
+            # More context can be found in: https://github.com/angular/angular/pull/35171.
+            setPublicVar SAUCE_LOCALHOST_ALIAS_DOMAIN "angular-ci.local"
+            setSecretVar SAUCE_ACCESS_KEY $(echo $SAUCE_ACCESS_KEY | rev)
+      - run:
+          # Sets up a local domain in the machine's host file that resolves to the local
+          # host. This domain is helpful in Sauce Labs tests where devices are not able to
+          # properly resolve `localhost` or `127.0.0.1` through the sauce-connect tunnel.
+          name: Setting up alias domain for local host.
+          command: echo "127.0.0.1 $SAUCE_LOCALHOST_ALIAS_DOMAIN" | sudo tee -a /etc/hosts
+
+  save_month_to_file:
+    description: Store the current year and month in a file, so that it can be used for computing the cache key.
+    steps:
+      - run:
+          name: Save month to file
+          # Note: Make sure this file is excluded in the `.gitignore` as otherwise the
+          # snapshot stamping would have the `-with-local-changes` suffix.
+          command: date +%Y-%m > month.txt
+
+  capture_patches_for_cache_key:
+    description: Hashes all patches so that the cache can be reset upon changes.
+    steps:
+      - run: |
+          md5sum tools/esm-interop/patches/npm/* > patches.hash
+
+  yarn_install:
+    description: Install dependencies
+    steps:
+      - run:
+          name: Running Yarn install
+          command: yarn install --frozen-lockfile --non-interactive --cache-folder ~/.cache/yarn
+          # Yarn's requests sometimes take more than 10mins to complete (especially on Windows).
+          no_output_timeout: 45m
+
+  notify_webhook_on_fail:
+    description: Notify a webhook about failure
+    parameters:
+      # `webhook_url_env_var` are secret env vars defined in CircleCI project settings.
+      # The URLs come from https://angular-team.slack.com/apps/A0F7VRE7N-circleci.
+      webhook_url_env_var:
+        type: env_var_name
+    steps:
+      - run:
+          when: on_fail
+          command: |
+            notificationJson="{\"text\":\":x: \`$CIRCLE_JOB\` job for $CIRCLE_BRANCH branch failed on build $CIRCLE_BUILD_NUM: $CIRCLE_BUILD_URL :scream:\"}"
+            curl --request POST --header "Content-Type: application/json" --data "$notificationJson" ${<< parameters.webhook_url_env_var >>}
+
+# Job definitions
+# Jobs can include parameters that are passed in the workflow job invocation.
+# https://circleci.com/docs/2.0/reusing-config/#authoring-parameterized-jobs
+jobs:
+  setup:
+    executor: default-executor
+    steps:
+      - checkout
+      - save_month_to_file
+      - capture_patches_for_cache_key
+      - init_environment
+      - devinfra/rebase-pr-on-target-branch:
+          base_revision: << pipeline.git.base_revision >>
+          head_revision: << pipeline.git.revision >>
+      # This cache is saved in the build-npm-packages so that Bazel cache is also included.
+      - restore_cache:
+          keys:
+            - *cache_key
+            - *cache_key_fallback
+      - yarn_install
+      - run: yarn --cwd aio install --frozen-lockfile --non-interactive --cache-folder ~/.cache/yarn
+      # Make the bazel directories and add a file to them if they don't exist already so that
+      # persist_to_workspace does not fail.
+      - run: |
+          if [ ! -d ~/bazel_repository_cache ]; then
+            mkdir ~/bazel_repository_cache
+            touch ~/bazel_repository_cache/MARKER
+          fi
+      # Persist any changes at this point to be reused by further jobs.
+      # **NOTE**: To add new content to the workspace, always persist on the same root.
+      - persist_to_workspace:
+          root: *workspace_location
+          paths:
+            - ./ng
+            - ./bazel_repository_cache
+
+  # NOTE: This is currently limited to main builds only. See the `monitoring` configuration.
+  saucelabs:
+    executor:
+      name: default-executor
+      # In order to avoid the bottleneck of having a slow host machine, we acquire a better
+      # container for this job. This is necessary because we launch a lot of browsers concurrently
+      # and therefore the tunnel and Karma need to process a lot of file requests and tests.
+      resource_class: xlarge
+    environment:
+      NUMBER_OF_PARALLEL_BROWSERS: 2
+    steps:
+      - custom_attach_workspace
+      - init_environment
+      - init_saucelabs_environment
+      - run:
+          name: Start Saucelabs daemon service
+          command: yarn bazel run //tools/saucelabs-daemon/background-service -- ${NUMBER_OF_PARALLEL_BROWSERS}
+          background: true
+      - run:
+          name: Run Bazel tests on Saucelabs
+          command: |
+            TESTS=$(./node_modules/.bin/bazelisk query --output label '(kind(karma_web_test, ...) intersect attr("tags", "saucelabs", ...)) except attr("tags", "fixme-saucelabs", ...)')
+            yarn bazel test --config=saucelabs --jobs=${NUMBER_OF_PARALLEL_BROWSERS} ${TESTS}
+          no_output_timeout: 40m
+      - notify_webhook_on_fail:
+          webhook_url_env_var: SLACK_DEV_INFRA_CI_FAILURES_WEBHOOK_URL
+
+  # The `build-npm-packages` tasks exist for backwards-compatibility with old scripts and
+  # tests that rely on the pre-Bazel `dist/packages-dist` output structure (build.sh).
+  # Having multiple jobs that independently build in this manner duplicates some work; we build
+  # the bazel packages more than once. Even though we have a remote cache, these jobs will
+  # typically run in parallel so up-to-date outputs will not be available at the time the build
+  # starts.
+  build-npm-packages:
+    executor:
+      name: default-executor
+      resource_class: xlarge
+    steps:
+      - custom_attach_workspace
+      - init_environment
+      - run: yarn build
+
+      # Save the npm packages from //packages/... for other workflow jobs to read
+      - persist_to_workspace:
+          root: *workspace_location
+          paths:
+            - ng/dist/packages-dist
+            - ng/dist/angular-in-memory-web-api-dist
+            - ng/dist/zone.js-dist
+
+      # Save dependencies and bazel repository cache to use on subsequent runs.
+      - save_cache:
+          key: *cache_key
+          paths:
+            - ~/.cache/yarn
+            - ~/bazel_repository_cache
+            - ~/.cache/bazelisk
+
+  # This job updates the content of repos like github.com/angular/core-builds
+  # for every green build on angular/angular.
+  publish_snapshot:
+    executor: default-executor
+    steps:
+      - custom_attach_workspace
+      - init_environment
+      # CircleCI has a config setting to force SSH for all github connections
+      # This is not compatible with our mechanism of using a Personal Access Token
+      # Clear the global setting
+      - run: git config --global --unset "url.ssh://git@github.com.insteadof"
+      - run:
+          name: Prepare GitHub credentials
+          command: echo "https://${SNAPSHOT_BUILDS_GITHUB_TOKEN}:@github.com" > ${HOME}/.git_credentials
+      - run: ./scripts/ci/publish-build-artifacts.sh
+
+  aio_monitoring_stable:
+    executor: test-browser-executor
+    steps:
+      - custom_attach_workspace
+      - init_environment
+      - run: setPublicVar_CI_STABLE_BRANCH
+      - run:
+          name: Check out `aio/` and yarn from the stable branch
+          command: |
+            git fetch origin $CI_STABLE_BRANCH
+            git checkout --force origin/$CI_STABLE_BRANCH -- aio/ .yarn/ .yarnrc
+      # Ignore yarn's engines check, because we checked out `aio/package.json` from the stable
+      # branch and there could be a node version skew, which is acceptable in this monitoring job.
+      - run: yarn config set ignore-engines true
+      - run:
+          name: Run tests against https://angular.io/
+          command: ./aio/scripts/test-production.sh https://angular.io/ $CI_AIO_MIN_PWA_SCORE
+      - notify_webhook_on_fail:
+          webhook_url_env_var: SLACK_CARETAKER_WEBHOOK_URL
+      - notify_webhook_on_fail:
+          webhook_url_env_var: SLACK_DEV_INFRA_CI_FAILURES_WEBHOOK_URL
+
+  aio_monitoring_next:
+    executor: test-browser-executor
+    steps:
+      - custom_attach_workspace
+      - init_environment
+      - run:
+          name: Run tests against https://next.angular.io/
+          command: ./aio/scripts/test-production.sh https://next.angular.io/ $CI_AIO_MIN_PWA_SCORE
+      - notify_webhook_on_fail:
+          webhook_url_env_var: SLACK_CARETAKER_WEBHOOK_URL
+      - notify_webhook_on_fail:
+          webhook_url_env_var: SLACK_DEV_INFRA_CI_FAILURES_WEBHOOK_URL
+
+workflows:
+  version: 2
+  default_workflow:
+    jobs:
+      - setup:
+          filters:
+            branches:
+              ignore: g3
+      - build-npm-packages:
+          requires:
+            - setup
+      - publish_snapshot:
+          <<: *only_release_branches
+          requires:
+            # Get the artifacts to publish from the build-packages-dist job
+            # since the publishing script expects the legacy outputs layout.
+            - build-npm-packages
+
+  monitoring:
+    jobs:
+      - setup
+      - saucelabs:
+          # Testing saucelabs via Bazel currently taking longer than the legacy saucelabs job as it
+          # each karma_web_test target is provisioning and tearing down browsers which is adding
+          # a lot of overhead. Running once daily in the main branch to avoid wasting resources and
+          # slowing down CI for PRs.
+          # TODO: Run this job on all branches (including PRs) once karma_web_test targets can
+          # share provisioned browsers and we can remove the legacy saucelabs job.
+          requires:
+            - setup
+    triggers:
+      - schedule:
+          <<: *only_on_main_branch
+          # Runs monitoring jobs at 10:00AM every day.
+          cron: '0 10 * * *'

.circleci/env-helpers.inc.sh

@@ -0,0 +1,76 @@
+####################################################################################################
+# Helpers for defining environment variables for CircleCI.
+#
+# In CircleCI, each step runs in a new shell. The way to share ENV variables across steps is to
+# export them from `$BASH_ENV`, which is automatically sourced at the beginning of every step (for
+# the default `bash` shell).
+#
+# See also https://circleci.com/docs/2.0/env-vars/#using-bash_env-to-set-environment-variables.
+####################################################################################################
+
+# Set and print an environment variable.
+#
+# Use this function for setting environment variables that are public, i.e. it is OK for them to be
+# visible to anyone through the CI logs.
+#
+# Usage: `setPublicVar <name> <value>`
+function setPublicVar() {
+  setSecretVar $1 "$2";
+  echo "$1=$2";
+}
+
+# Set (without printing) an environment variable.
+#
+# Use this function for setting environment variables that are secret, i.e. should not be visible to
+# everyone through the CI logs.
+#
+# Usage: `setSecretVar <name> <value>`
+function setSecretVar() {
+  # WARNING: Secrets (e.g. passwords, access tokens) should NOT be printed.
+  # (Keep original shell options to restore at the end.)
+  local -r originalShellOptions=$(set +o);
+  set +x -eu -o pipefail;
+
+  local assignmentStatement="export $1=\"${2:-}\";"
+
+  echo "${assignmentStatement}" >> $BASH_ENV;
+  eval "${assignmentStatement}"
+
+  # Restore original shell options.
+  eval "$originalShellOptions";
+}
+
+
+# Create a function to set an environment variable, when called.
+#
+# Use this function for creating setter for public environment variables that require expensive or
+# time-consuming computaions and may not be needed. When needed, you can call this function to set
+# the environment variable (which will be available through `$BASH_ENV` from that point onwards).
+#
+# Arguments:
+# - `<name>`: The name of the environment variable. The generated setter function will be
+#   `setPublicVar_<name>`.
+# - `<code>`: The code to run to compute the value for the variable. Since this code should be
+#   executed lazily, it must be properly escaped. For example:
+#   ```sh
+#   # DO NOT do this:
+#   createPublicVarSetter MY_VAR "$(whoami)";  # `whoami` will be evaluated eagerly
+#
+#   # DO this isntead:
+#   createPublicVarSetter MY_VAR "\$(whoami)";  # `whoami` will NOT be evaluated eagerly
+#   ```
+#
+# Usage: `createPublicVarSetter <name> <code>`
+#
+# Example:
+# ```sh
+# createPublicVarSetter MY_VAR 'echo "FOO"';
+# echo $MY_VAR;  # Not defined
+#
+# setPublicVar_MY_VAR;
+# source $BASH_ENV;
+# echo $MY_VAR;  # FOO
+# ```
+function createPublicVarSetter() {
+  echo "setPublicVar_$1() { setPublicVar $1 \"$2\"; }" >> $BASH_ENV;
+}

.circleci/env.linux.sh

@@ -0,0 +1,4 @@
+####################################################################################################
+# Set bazel configuration for CircleCI runs.
+####################################################################################################
+cp "${PROJECT_ROOT}/.circleci/bazel.linux.rc" ".bazelrc.user";

.circleci/env.sh

@@ -0,0 +1,89 @@
+#!/usr/bin/env bash
+
+# Variables
+readonly projectDir=$(realpath "$(dirname ${BASH_SOURCE[0]})/..")
+readonly envHelpersPath="$projectDir/.circleci/env-helpers.inc.sh";
+
+# Load helpers and make them available everywhere (through `$BASH_ENV`).
+source $envHelpersPath;
+echo "source $envHelpersPath;" >> $BASH_ENV;
+
+
+####################################################################################################
+# Define PUBLIC environment variables for CircleCI.
+####################################################################################################
+# See https://circleci.com/docs/2.0/env-vars/#built-in-environment-variables for more info.
+####################################################################################################
+setPublicVar CI "$CI"
+setPublicVar PROJECT_ROOT "$projectDir";
+setPublicVar CI_AIO_MIN_PWA_SCORE "95";
+# This is the branch being built; e.g. `pull/12345` for PR builds.
+setPublicVar CI_BRANCH "$CIRCLE_BRANCH";
+setPublicVar CI_BUILD_URL "$CIRCLE_BUILD_URL";
+setPublicVar CI_COMMIT "$CIRCLE_SHA1";
+# `CI_COMMIT_RANGE` is only used on push builds (a.k.a. non-PR, non-scheduled builds and rerun
+# workflows of such builds).
+setPublicVar CI_GIT_BASE_REVISION "${CIRCLE_GIT_BASE_REVISION}";
+setPublicVar CI_GIT_REVISION "${CIRCLE_GIT_REVISION}";
+setPublicVar CI_COMMIT_RANGE "$CIRCLE_GIT_BASE_REVISION..$CIRCLE_GIT_REVISION";
+setPublicVar CI_PULL_REQUEST "${CIRCLE_PR_NUMBER:-false}";
+setPublicVar CI_REPO_NAME "$CIRCLE_PROJECT_REPONAME";
+setPublicVar CI_REPO_OWNER "$CIRCLE_PROJECT_USERNAME";
+setPublicVar CI_PR_REPONAME "$CIRCLE_PR_REPONAME";
+setPublicVar CI_PR_USERNAME "$CIRCLE_PR_USERNAME";
+
+
+####################################################################################################
+# Define "lazy" PUBLIC environment variables for CircleCI.
+# (I.e. functions to set an environment variable when called.)
+####################################################################################################
+createPublicVarSetter CI_STABLE_BRANCH "\$(npm info @angular/core dist-tags.latest | sed -r 's/^\\s*([0-9]+\\.[0-9]+)\\.[0-9]+.*$/\\1.x/')";
+
+
+####################################################################################################
+# Define SECRET environment variables for CircleCI.
+####################################################################################################
+setSecretVar CI_SECRET_AIO_DEPLOY_FIREBASE_TOKEN "$AIO_DEPLOY_TOKEN";
+setSecretVar CI_SECRET_PAYLOAD_FIREBASE_TOKEN "$ANGULAR_PAYLOAD_TOKEN";
+
+
+####################################################################################################
+# Define SauceLabs environment variables for CircleCI.
+####################################################################################################
+setPublicVar SAUCE_USERNAME "angular-framework";
+setSecretVar SAUCE_ACCESS_KEY "f4bf7c639c5a-c6bb-d6a4-a4b5-800aa111";
+# TODO(josephperrott): Remove environment variables once all saucelabs tests are via bazel method.
+setPublicVar SAUCE_LOG_FILE /tmp/angular/sauce-connect.log
+setPublicVar SAUCE_READY_FILE /tmp/angular/sauce-connect-ready-file.lock
+setPublicVar SAUCE_PID_FILE /tmp/angular/sauce-connect-pid-file.lock
+setPublicVar SAUCE_TUNNEL_IDENTIFIER "angular-framework-${CIRCLE_BUILD_NUM}-${CIRCLE_NODE_INDEX}"
+# Amount of seconds we wait for sauceconnect to establish a tunnel instance. In order to not
+# acquire CircleCI instances for too long if sauceconnect failed, we need a connect timeout.
+setPublicVar SAUCE_READY_FILE_TIMEOUT 120
+
+####################################################################################################
+# Create shell script in /tmp for Bazel actions to access CI envs without
+# busting the cache. Used by payload-size.sh script in integration tests.
+####################################################################################################
+readonly bazelVarEnv="/tmp/bazel-ci-env.sh"
+echo "# Setup by /.circle/env.sh" > $bazelVarEnv
+echo "export PROJECT_ROOT=\"${PROJECT_ROOT}\";" >> $bazelVarEnv
+echo "export CI_BRANCH=\"${CI_BRANCH}\";" >> $bazelVarEnv
+echo "export CI_BUILD_URL=\"${CI_BUILD_URL}\";" >> $bazelVarEnv
+echo "export CI_COMMIT=\"${CI_COMMIT}\";" >> $bazelVarEnv
+echo "export CI_PULL_REQUEST=\"${CI_PULL_REQUEST}\";" >> $bazelVarEnv
+echo "export CI_REPO_NAME=\"${CI_REPO_NAME}\";" >> $bazelVarEnv
+echo "export CI_REPO_OWNER=\"${CI_REPO_OWNER}\";" >> $bazelVarEnv
+echo "export CI_SECRET_PAYLOAD_FIREBASE_TOKEN=\"${CI_SECRET_PAYLOAD_FIREBASE_TOKEN}\";" >> $bazelVarEnv
+
+####################################################################################################
+# Platform-specific environment setup (which can leverage the base variables from here)
+####################################################################################################
+
+# Conditionally, load additional environment settings based on the current VM
+# operating system running. We detect Windows by checking for `%AppData%`.
+if [[ -n "${APPDATA}" ]]; then
+  source ${projectDir}/.circleci/env.windows.sh
+else
+  source ${projectDir}/.circleci/env.linux.sh
+fi

.circleci/env.windows.sh

@@ -0,0 +1,13 @@
+####################################################################################################
+# Set bazel configuration for CircleCI runs.
+####################################################################################################
+cp "${PROJECT_ROOT}/.circleci/bazel.windows.rc" ".bazelrc.user";
+
+# Override the `PATH` environment variable so that the windows-nvm NodeJS version
+# always has precedence over potential existing NodeJS versions from the image.
+setPublicVar PATH "/c/Program Files/nodejs/:$PATH"
+
+# Expose the Bazelisk version. We need to run Bazelisk globally since Windows has problems launching
+# Bazel from a node modules directoy that might be modified by the Bazel Yarn install then.
+setPublicVar BAZELISK_VERSION \
+    "$(cd ${PROJECT_ROOT}; node -p 'require("./package.json").devDependencies["@bazel/bazelisk"]')"

.circleci/setup_cache.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+# Install bazel remote cache proxy
+# This is temporary until the feature is no longer experimental on CircleCI.
+# See remote cache documentation in /docs/BAZEL.md
+
+set -u -e
+
+readonly DOWNLOAD_URL="https://5-116431813-gh.circle-artifacts.com/0/pkg/bazel-remote-proxy-$(uname -s)_$(uname -m)"
+
+curl --fail -o ~/bazel-remote-proxy "$DOWNLOAD_URL"
+chmod +x ~/bazel-remote-proxy

.clang-format

@@ -0,0 +1,3 @@
+Language:        JavaScript
+BasedOnStyle:    Google
+ColumnLimit:     100

.devcontainer/README.md

@@ -3,11 +3,11 @@
 This folder contains configuration files that can be used to opt into working on this repository in a [Docker container](https://www.docker.com/resources/what-container) via [VSCode](https://code.visualstudio.com/)'s Remote Development feature (see below).
 
 Info on remote development and developing inside a container with VSCode:
-
 - [VSCode: Remote Development](https://code.visualstudio.com/docs/remote/remote-overview)
 - [VSCode: Developing inside a Container](https://code.visualstudio.com/docs/remote/containers)
 - [VSCode: Remote Development FAQ](https://code.visualstudio.com/docs/remote/faq)
 
+
 ## Usage
 
 _Prerequisite: [Install Docker](https://docs.docker.com/install) on your local environment._
@@ -15,7 +15,6 @@ _Prerequisite: [Install Docker](https://docs.docker.com/install) on your local e
 To get started, read and follow the instructions in [Developing inside a Container](https://code.visualstudio.com/docs/remote/containers). The [.devcontainer/](.) directory contains pre-configured `devcontainer.json` and `Dockerfile` files, which you can use to set up remote development with a docker container.
 
 In a nutshell, you need to:
-
 - Install the [Remote - Containers](https://marketplace.visualstudio.com/items?itemName=ms-vscode-remote.remote-containers) extension.
 - Copy [recommended-Dockerfile](./recommended-Dockerfile) to `Dockerfile` (and optionally tweak to suit your needs).
 - Copy [recommended-devcontainer.json](./recommended-devcontainer.json) to `devcontainer.json` (and optionally tweak to suit your needs).
@@ -24,6 +23,7 @@ In a nutshell, you need to:
 
 The `.devcontainer/devcontainer.json` and `.devcontainer/Dockerfile` files are ignored by git, so you can have your own local versions. We may occasionally update the template files ([recommended-devcontainer.json](./recommended-devcontainer.json), [recommended-Dockerfile](./recommended-Dockerfile)), in which case you will need to manually update your local copies (if desired).
 
+
 ## Updating `recommended-devcontainer.json` and `recommended-Dockerfile`
 
 You can update and commit the recommended config files (which people use as basis for their local configs), if you find that something is broken, out-of-date or can be improved.

.devcontainer/recommended-Dockerfile

@@ -1,16 +1,24 @@
 # Image metadata and config.
 # Ideally, the Node.js version should match what we use on CI.
-FROM cimg/node:22.21.1-browsers@sha256:eee8ed828d5a54196456a86ac6872c43325acad54e59632261e23b486c458992
+# See `executors > default-executor` in `.circleci/config.yml`.
+FROM cimg/node:16.13-browsers@sha256:6c7a82701665dda03e92d682360fa2e4358e07dab8d1b6a7e48f7d36e3d98117
+
 
 LABEL name="Angular dev environment" \
-  description="This image can be used to create a dev environment for building Angular." \
-  vendor="angular" \
-  version="1.0"
+      description="This image can be used to create a dev environment for building Angular." \
+      vendor="angular" \
+      version="1.0"
 
-EXPOSE 4200 4201 4205 4206 9876
+EXPOSE 4000 4200 4433 5000 8080 9876
 
-# Switch to `root`.
+
+# Switch to `root` (CircleCI images use `circleci` as the user).
 USER root
 
+
+# Configure `Node.js`/`npm`.
+RUN npm config --global set user root
+
+
 # Go! (And keep going.)
 CMD ["tail", "--follow", "/dev/null"]

.devcontainer/recommended-devcontainer.json

@@ -2,11 +2,15 @@
 {
   "name": "Angular dev container",
   "dockerFile": "Dockerfile",
-  "forwardPorts": [4200, 4201, 4205, 4206, 9876],
-  "postCreateCommand": "pnpm install",
-  "customizations": {
-    "vscode": {
-      "extensions": ["BazelBuild.vscode-bazel", "ms-vscode.vscode-typescript-tslint-plugin"]
-    }
-  }
+  "appPort": [4000, 4200, 4433, 5000, 8080, 9876],
+  "postCreateCommand": "yarn install",
+  "extensions": [
+    "devondcarew.bazel-code",
+    "gkalpak.aio-docs-utils",
+    "ms-vscode.vscode-typescript-tslint-plugin",
+    "xaver.clang-format",
+    // The following extensions are useful when working on angular.io (i.e. inside the `aio/` directory).
+    //"angular.ng-template",
+    //"dbaeumer.vscode-eslint",
+  ],
 }

.gemini/commands/explain.toml

@@ -1,70 +0,0 @@
-description = "Researches part of the codebase and creates a skill for it"
-prompt="""
-## Role
-
-You are an experienced senior developer specializing in reverse engineering and understanding
-complex code, prompt engineering, and context engineering.
-
-Your task is to build a complete understanding of the mental model and architecture of the code,
-and to create an efficient context file that allows a coding agent to understand and work with the
-code.
-
-## Guiding Principles
-
-1. **Deep Analysis:** Understand the _why_ behind the code. Not just a surface level listing of
-   files and classes.
-
-2. **Curiosity:** Be curious. If something is unclear, confusing, or unexpected you _MUST_
-   investigate further until you fully understand.
-
-3. **Efficient Token Use:** The final output will be directly included into the context of the
-   coding assistant, so be sure to make efficient use of tokens. Think deeply, but only capture the
-   most important information for the coding agent in the final output
-
-## Procedure
-
-1. Fully explore the code before first, with a focus on understanding the architecture and how all
-   of the pieces fit together.
-
-2. Develop an understanding of the mental model behind the architecture. _Why_ is the code is
-   architected this way? How should developers think about the system?
-
-3. Document your findings using the given output format described in the next section.
-
-## Output Format
-
-Note the following placeholders below:
-
-- `[package]`: is a unique identifier for the current code package (for example if you're looking at
-  code under `packages/forms/signals` you might use `signal-forms` as the `[package]`)
-- `[code-location]`: is the location of the current code within the larger repository
-- `[context]`: is the context to add to the coding agent when it is working with this code.
-
-With those placeholders in mind, write a file create a new directory under `.gemini/skills` with the
-name `reference-[package]/`, and under that directory add a `SKILL.md` file with the following
-content:
-
-```md
----
-name: reference-[package]
-description: Explains the mental model and architecture of the code under `[code-location]`. You MUST use this skill any time you plan to work with code in `[code-location]`
----
-
-[context]
-```
-
-## Additional User Instructions
-
-The user may have additional instructions.
-
-- The user should indicate what package to research
-- The user may indicate that they want to update a package that has already been researched. In this
-  case, read the existing skill and make any required updates based on your research
-- The user may request supplemental information be added to the skill (if so, add this to the
-  existing skill in a new markdown file under a `references` directory within the skill. Add a
-  section to the main `SKILL.md` that mentions what supplemental information is available)
-
-Here are the user's additional instructions:
-
-{{args}}
-"""

.gemini/config.yaml

@@ -1,11 +0,0 @@
-have_fun: false
-code_review:
-  disable: false
-  comment_severity_threshold: MEDIUM
-  max_review_comments: -1
-  pull_request_opened:
-    help: false
-    summary: false
-    code_review: false
-ignore_patterns:
-  - pnpm-lock.yaml

.gemini/settings.json

@@ -1,5 +0,0 @@
-{
-  "context": {
-    "fileName": ["AGENTS.md", "GEMINI.md"]
-  }
-}

.git-blame-ignore-revs

@@ -1,47 +0,0 @@
-# all commits that change formatting to prettier
-fd544159e300340a25a48e3f40c58795991a4c17
-31fdf0fbea6b89c8d3d141b2ef8e79c2737287cb
-0d78a92431178be73342aeddda4b62d9e49138ba
-f307e95459898b9027d5e13357a809d8952e9017
-b1dffa4abe8321a47d79b2ea29ee32a81acfe031
-ca517d7f2c38775969a65fde1d88f41ad5f27931
-8f69c83b848ad0dc3c7ffce2541fc726693dedcf
-a5b5b7d5ef84b9852d2115dd7a764f4ab3299379
-894c1c5f100a62866cc7ed3e23d025c8e505c60d
-ca39926de2ccaceb11de47a35e5bf9899147a877
-b857aafcb9bdb5f1400a4cfedd56657e71ebe8cd
-c4b880a025823efadb9d76195c6261f2992c7654
-4c2b0d94e22f022969b86b95af516b76322840e0
-0460a9dfafe3a7ebbff1b87e52048fb7416bba43
-ec03e462f3d4ec90d1267474cc344563c949c2cf
-bbbe477f479f20722f0fea7ccc46095aad5d4253
-cc34e5fb072e7903e01463953a19d18503a39347
-f9781f9804f1e7c84df356d9aeb267730a7fc499
-dc62446ef7f2898a20d3be1196ecaf2a92a1077d
-711cb416260ca11ff158fc39b372efa2cf022d36
-af77b89e2abb67bba201a53d500874ad572b8384
-6270bba056cfaadb3fe0b2bf3b17036bdc28b90e
-# commits that switch to relative imports
-3d2263cb1f208e561692e41c5a17196c3c57877f
-ae047c59c0041e0a43cec020520d40ccd981b444
-6a207ebfb0b915bcb848e8e17425757314116ce3
-88ae6517a2490ccbef97126c011a3d5bcaddd637
-6d3849ffc85cc52b0eba3836b24f10895621acbe
-bc042935d045c46d09c2c316dcbbc39cbae4615c
-34393874e6b6f53692f1f30d0f536cd72e5220d2
-cfda43b97d3c1aedc4a1eccf123475617640e696
-006a14da89c58692d411e403b1b1cc8fd733de25
-33c24624be73a4c16abdd5fb2f93810e151f6a58
-e5cc624b8736c4e2aa87f86bb268957e656e0994
-30a61f12a7d414ad35a1a06eaadff873880d8e8f
-f773e08ee59724739093a33811a62661680df1f0
-49234007916980526db78503452bba7121dc91ff
-5c0335754a2b45b2a27fa7a9bffe5df93aec4eee
-be7c8d4fc6cb3a71bd21fbb228e01cfcdce0717f
-c702e8af0b2144d97b93171dc2806ed1a0346762
-4f458a825d17e776500cc1597efb904e0dfdfe20
-6d3f5752f204a5a30f3c09fbf6d4a510a4522bcb
-3fa7b2b136696464e0a91b5ec25c6adf272d4d6b
-ad65f44877f22caadbc8b977b5b720c3c86fcc45
-# commit that changed formatting
-698b0288bee60b8c5926148b79b5b93f454098db

.github/ISSUE_TEMPLATE/3-docs-bug.yaml

@@ -1,5 +1,5 @@
-name: 'Docs or angular.dev Bug Report'
-description: Report an issue in Angular's documentation or angular.dev application
+name: 'Docs or angular.io Bug Report'
+description: Report an issue in Angular's documentation or angular.io application
 
 body:
   - type: textarea

.github/ISSUE_TEMPLATE/5-vscode.yaml

@@ -1,48 +0,0 @@
-name: 'VSCode Angular Language Service extension'
-description: Report an issue or suggest a feature for the VSCode Angular Language Service extension
-
-body:
-  - type: checkboxes
-    id: bug-report-or-feature-request
-    attributes:
-      label: Is this a bug report or a feature request?
-      description: Select one.
-      options:
-        - label: Bug Report
-        - label: Feature Request
-
-  - type: textarea
-    id: reproduction-steps
-    attributes:
-      label: Please provide the steps to reproduce the issue [Bug Report only]
-
-  - type: textarea
-    id: expected-vs-actual-behavior
-    attributes:
-      label: Please provide the expected behavior vs the actual behavior you encountered [Bug Report only]
-
-  - type: textarea
-    id: screenshot
-    attributes:
-      label: Please provide a screenshot if possible [Bug Report only]
-
-  - type: textarea
-    id: exception-or-error
-    attributes:
-      label: Please provide the exception or error you saw [Bug Report only]
-      render: true
-
-  - type: textarea
-    id: description
-    attributes:
-      label: Description [Feature Request only]
-
-  - type: textarea
-    id: proposed-solution
-    attributes:
-      label: Proposed solution [Feature Request only]
-
-  - type: textarea
-    id: alternatives-considered
-    attributes:
-      label: Alternatives considered [Feature Request only]

.github/ISSUE_TEMPLATE/config.yml

@@ -1,7 +1,7 @@
 blank_issues_enabled: false
 contact_links:
   - name: Security issue disclosure
-    url: https://angular.dev/best-practices/security#report-issues
+    url: https://angular.io/guide/security#report-issues
     about: Report a security issue in Angular Framework, CDK, Material, or CLI
   - name: Angular CLI
     url: https://github.com/angular/angular-cli/issues/new/choose

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,13 +1,12 @@
 ## PR Checklist
-
 Please check if your PR fulfills the following requirements:
 
-- [ ] The commit message follows our guidelines: https://github.com/angular/angular/blob/main/contributing-docs/commit-message-guidelines.md
+- [ ] The commit message follows our guidelines: https://github.com/angular/angular/blob/main/CONTRIBUTING.md#commit
 - [ ] Tests for the changes have been added (for bug fixes / features)
 - [ ] Docs have been added / updated (for bug fixes / features)
 
-## PR Type
 
+## PR Type
 What kind of change does this PR introduce?
 
 <!-- Please check the one that applies to this PR using "x". -->
@@ -19,22 +18,26 @@ What kind of change does this PR introduce?
 - [ ] Build related changes
 - [ ] CI related changes
 - [ ] Documentation content changes
-- [ ] angular.dev application / infrastructure changes
+- [ ] angular.io application / infrastructure changes
 - [ ] Other... Please describe:
 
-## What is the current behavior?
 
+## What is the current behavior?
 <!-- Please describe the current behavior that you are modifying, or link to a relevant issue. -->
 
 Issue Number: N/A
 
+
 ## What is the new behavior?
 
+
 ## Does this PR introduce a breaking change?
 
 - [ ] Yes
 - [ ] No
 
+
 <!-- If this PR contains a breaking change, please describe the impact and migration path for existing applications below. -->
 
+
 ## Other information

.github/actions/deploy-docs-site/BUILD.bazel

@@ -1,39 +0,0 @@
-load("//tools:defaults.bzl", "esbuild_checked_in", "ts_config", "ts_project")
-
-package(default_visibility = ["//.github/actions/deploy-docs-site:__subpackages__"])
-
-exports_files([
-    "tsconfig.json",
-])
-
-esbuild_checked_in(
-    name = "main",
-    config = "esbuild.conf.js",
-    entry_point = ":lib/main.mts",
-    external = [
-        "pnpapi",
-    ],
-    metafile = False,
-    platform = "node",
-    target = "node20",
-    deps = [
-        ":lib",
-    ],
-)
-
-ts_config(
-    name = "tsconfig",
-    src = "tsconfig.json",
-)
-
-ts_project(
-    name = "lib",
-    srcs = glob(["lib/*.mts"]),
-    tsconfig = ":tsconfig",
-    deps = [
-        "//:node_modules/@actions/core",
-        "//:node_modules/@actions/github",
-        "//:node_modules/@angular/ng-dev",
-        "//:node_modules/@types/node",
-    ],
-)

.github/actions/deploy-docs-site/action.yml

@@ -1,19 +0,0 @@
-name: 'Deploy angular.dev site'
-description: 'Automatically deploy and set up redirects for angular.dev'
-author: 'Angular'
-inputs:
-  serviceKey:
-    description: 'The service key used for firebase deployments.'
-    required: true
-  githubReleaseTrainReadToken:
-    description: 'GitHub access token for reading release trains without rate limits.'
-    required: true
-  configPath:
-    description: 'The path to the firebase config file.'
-    required: true
-  distDir:
-    description: 'The path to the firebase dist directory.'
-    required: true
-runs:
-  using: 'node20'
-  main: 'main.js'

.github/actions/deploy-docs-site/esbuild.conf.js

@@ -1,17 +0,0 @@
-/**
- * @license
- * Copyright Google LLC All Rights Reserved.
- *
- * Use of this source code is governed by an MIT-style license that can be
- * found in the LICENSE file at https://angular.dev/license
- */
-
-module.exports = {
-  resolveExtensions: ['.mjs', '.js'],
-  format: 'esm',
-  banner: {
-    // Workaround for: https://github.com/evanw/esbuild/issues/946
-    js: `import {createRequire as __cjsCompatRequire} from 'module';
-const require = __cjsCompatRequire(import.meta.url);`,
-  },
-};

.github/actions/deploy-docs-site/lib/credential.mts

@@ -1,22 +0,0 @@
-import {writeFileSync, mkdtempSync} from 'node:fs';
-import {join} from 'node:path';
-import {tmpdir} from 'node:os';
-import {getInput, setSecret} from '@actions/core';
-
-let credentialFilePath: undefined | string;
-
-export function getCredentialFilePath(): string {
-  if (credentialFilePath === undefined) {
-    const tmpDir = mkdtempSync(join(tmpdir(), 'credential-'));
-    const filePath = join(tmpDir, 'credential.json');
-    writeFileSync(filePath, getInput('serviceKey', {required: true}));
-    setSecret(filePath);
-    credentialFilePath = filePath;
-  }
-  return credentialFilePath;
-}
-
-/** Github access token. Used for querying the active release trains. */
-export const githubReleaseTrainReadToken: string = getInput('githubReleaseTrainReadToken', {
-  required: true,
-});

.github/actions/deploy-docs-site/lib/deploy.mts

@@ -1,116 +0,0 @@
-import {mkdtemp, readFile, rm, writeFile} from 'node:fs/promises';
-import {Deployment} from './deployments.mjs';
-import {join} from 'node:path';
-
-import {tmpdir} from 'node:os';
-import {spawnSync} from 'node:child_process';
-import {getCredentialFilePath} from './credential.mjs';
-
-export async function deployToFirebase(
-  deployment: Deployment,
-  configPath: string,
-  stagingDir: string,
-) {
-  if (deployment.destination == undefined) {
-    console.log(`No deployment necessary for docs created from: ${deployment.branch}`);
-    return;
-  }
-
-  console.log('Preparing for deployment to firebase...');
-
-  const deployConfigPath = join(stagingDir, 'firebase.json');
-
-  const config = JSON.parse(await readFile(configPath, {encoding: 'utf-8'})) as {
-    hosting: {public: string};
-  };
-  config['hosting']['public'] = './browser';
-
-  await writeFile(deployConfigPath, JSON.stringify(config, null, 2));
-
-  firebase(
-    `target:clear --config ${deployConfigPath} --project angular-dev-site hosting angular-docs`,
-    stagingDir,
-  );
-  firebase(
-    `target:apply --config ${deployConfigPath} --project angular-dev-site hosting angular-docs ${deployment.destination}`,
-    stagingDir,
-  );
-  firebase(
-    `deploy --config ${deployConfigPath} --project angular-dev-site --only hosting --non-interactive`,
-    stagingDir,
-  );
-  firebase(
-    `target:clear --config ${deployConfigPath} --project angular-dev-site hosting angular-docs`,
-    stagingDir,
-  );
-
-  await rm(stagingDir, {recursive: true});
-}
-
-export async function setupRedirect(deployment: Deployment) {
-  if (deployment.redirect === undefined) {
-    console.log(`No redirect necessary for docs created from: ${deployment.branch}`);
-    return;
-  }
-
-  console.log('Preparing to set up redirect on firebase...');
-
-  const redirectConfig = JSON.stringify(
-    {
-      hosting: {
-        target: 'angular-docs',
-        redirects: [
-          {
-            type: 302,
-            regex: '^(.*)$',
-            destination: `${deployment.redirect.to}:1`,
-          },
-        ],
-      },
-    },
-    null,
-    2,
-  );
-
-  const tmpRedirectDir = await mkdtemp(join(tmpdir(), 'redirect-directory'));
-  const redirectConfigPath = join(tmpRedirectDir, 'firebase.json');
-
-  await writeFile(redirectConfigPath, redirectConfig);
-  spawnSync(`chmod 777 -R ${tmpRedirectDir}`, {encoding: 'utf-8', shell: true});
-
-  firebase(
-    `target:clear --config ${redirectConfigPath} --project angular-dev-site hosting angular-docs`,
-    tmpRedirectDir,
-  );
-  firebase(
-    `target:apply --config ${redirectConfigPath} --project angular-dev-site hosting angular-docs ${deployment.redirect.from}`,
-    tmpRedirectDir,
-  );
-  firebase(
-    `deploy --config ${redirectConfigPath} --project angular-dev-site --only hosting --non-interactive`,
-    tmpRedirectDir,
-  );
-  firebase(
-    `target:clear --config ${redirectConfigPath} --project angular-dev-site hosting angular-docs`,
-    tmpRedirectDir,
-  );
-
-  await rm(tmpRedirectDir, {recursive: true});
-}
-
-function firebase(cmd: string, cwd?: string) {
-  const {status} = spawnSync('npx', `-y firebase-tools@13.15.1 ${cmd}`.split(' '), {
-    cwd,
-    encoding: 'utf-8',
-    shell: true,
-    stdio: 'inherit',
-    env: {
-      ...process.env,
-      GOOGLE_APPLICATION_CREDENTIALS: getCredentialFilePath(),
-    },
-  });
-  if (status !== 0) {
-    console.error('Firebase command failed, see log above for details.');
-    process.exit(status);
-  }
-}

.github/actions/deploy-docs-site/lib/deployments.mts

@@ -1,76 +0,0 @@
-import {
-  fetchLongTermSupportBranchesFromNpm,
-  ActiveReleaseTrains,
-  AuthenticatedGitClient,
-  ReleaseConfig,
-} from '@angular/ng-dev';
-
-export interface Deployment {
-  branch: string;
-  redirect?: {
-    from: string;
-    to: string;
-  };
-  destination?: string;
-  servingUrl: string;
-}
-
-export type Deployments = Map<string, Deployment>;
-
-export async function getDeployments(): Promise<Deployments> {
-  const {github} = await AuthenticatedGitClient.get();
-  const releaseTrains = await ActiveReleaseTrains.fetch({
-    api: github,
-    name: 'angular',
-    owner: 'angular',
-    nextBranchName: 'main',
-  });
-  const ltsBranches = await fetchLongTermSupportBranchesFromNpm({
-    representativeNpmPackage: '@angular/core',
-  } as ReleaseConfig);
-
-  const docSites = new Map<string, Deployment>();
-
-  [...ltsBranches.active, ...ltsBranches.inactive].forEach((branch) => {
-    docSites.set(branch.name, {
-      branch: branch.name,
-      destination: `v${branch.version.major}-angular-dev`,
-      servingUrl: `https://v${branch.version.major}.angular.dev/`,
-    });
-  });
-
-  docSites.set(releaseTrains.latest.branchName, {
-    branch: releaseTrains.latest.branchName,
-    redirect: {
-      from: `v${releaseTrains.latest.version.major}-angular-dev`,
-      to: 'https://angular.dev',
-    },
-    servingUrl: 'https://angular.dev/',
-    destination: 'angular-dev-site',
-  });
-
-  if (releaseTrains.releaseCandidate) {
-    docSites.set(releaseTrains.next.branchName, {
-      branch: releaseTrains.next.branchName,
-      servingUrl: 'https://next.angular.dev/',
-    });
-
-    docSites.set(releaseTrains.releaseCandidate.branchName, {
-      branch: releaseTrains.releaseCandidate.branchName,
-      destination: 'next-angular-dev',
-      redirect: {
-        from: `v${releaseTrains.releaseCandidate.version.major}-angular-dev`,
-        to: 'https://next.angular.dev',
-      },
-      servingUrl: 'https://next.angular.dev/',
-    });
-  } else {
-    docSites.set(releaseTrains.next.branchName, {
-      branch: releaseTrains.next.branchName,
-      destination: 'next-angular-dev',
-      servingUrl: 'https://next.angular.dev/',
-    });
-  }
-
-  return docSites;
-}

.github/actions/deploy-docs-site/lib/main.mts

@@ -1,79 +0,0 @@
-import {getInput, setFailed} from '@actions/core';
-import {context} from '@actions/github';
-import {deployToFirebase, setupRedirect} from './deploy.mjs';
-import {getDeployments} from './deployments.mjs';
-import {generateSitemap} from './sitemap.mjs';
-import {assertValidGithubConfig, AuthenticatedGitClient, getConfig} from '@angular/ng-dev';
-import {githubReleaseTrainReadToken} from './credential.mjs';
-import {spawnSync} from 'child_process';
-import {cp, mkdtemp} from 'fs/promises';
-import {tmpdir} from 'os';
-import {join} from 'path';
-
-const refMatcher = /refs\/heads\/(.*)/;
-
-async function deployDocs() {
-  getConfig([assertValidGithubConfig]);
-
-  AuthenticatedGitClient.configure(githubReleaseTrainReadToken);
-
-  if (context.eventName !== 'push') {
-    throw Error();
-  }
-  const matchedRef = context.ref.match(refMatcher);
-  if (matchedRef === null) {
-    throw Error();
-  }
-
-  const currentBranch = matchedRef[1];
-  const configPath = getInput('configPath');
-  const stagingDir = await mkdtemp(join(tmpdir(), 'deploy-directory'));
-
-  // Copy all files from the distDir into stagingDir and modify the permissions for editing
-  await cp(getInput('distDir'), stagingDir, {recursive: true});
-  spawnSync(`chmod 777 -R ${stagingDir}`, {encoding: 'utf-8', shell: true});
-
-  const deployment = (await getDeployments()).get(currentBranch);
-  if (deployment === undefined) {
-    console.log(`Current branch (${currentBranch}) does not deploy a documentation site.`);
-    console.log(`Exiting...`);
-    process.exit(0);
-  }
-
-  console.log('Doc site deployment information');
-  console.log('');
-  console.log('Current Branch:');
-  console.log(`  ${deployment.branch}`);
-  console.log('');
-  console.log('Firebase Site:');
-  if (deployment.destination === undefined) {
-    console.log('  No deployment of a documenation site is necessary');
-  } else {
-    console.log(`  Deploying to: ${deployment.destination}`);
-  }
-  console.log('');
-  console.log('Redirect Configuration:');
-  if (deployment.redirect === undefined) {
-    console.log('  No redirects are necessary');
-  } else {
-    console.log(`  From: ${deployment.redirect.from}`);
-    console.log(`  To: ${deployment.redirect.to}`);
-  }
-
-  await generateSitemap(deployment, stagingDir);
-  await deployToFirebase(deployment, configPath, stagingDir);
-  await setupRedirect(deployment);
-}
-
-// Only run if the action is executed in a repository with is in the Angular org. This is in place
-// to prevent the action from actually running in a fork of a repository with this action set up.
-if (context.repo.owner === 'angular') {
-  deployDocs().catch((e: Error) => {
-    setFailed(e.message);
-    console.error(e);
-  });
-} else {
-  console.warn(
-    'The action was skipped as this action is only meant to run in repos belonging to the Angular organization.',
-  );
-}

.github/actions/deploy-docs-site/lib/sitemap.mts

@@ -1,53 +0,0 @@
-import {Deployment} from './deployments.mjs';
-import {join} from 'node:path';
-import {readFile, writeFile} from 'node:fs/promises';
-
-export async function generateSitemap(deployment: Deployment, distDir: string): Promise<void> {
-  /** Timestamp string used to of the last file update. */
-  const lastModifiedTimestamp = new Date().toISOString();
-  /** An object containing all of the routes available within the application. */
-  const {routes} = JSON.parse(await readFile(join(distDir, 'prerendered-routes.json'), 'utf-8'));
-  const routePaths = Object.keys(routes);
-
-  /** The generated sitemap string. */
-  const sitemap = `<?xml version="1.0" encoding="UTF-8"?>
-  <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
-  ${routePaths
-    .map(
-      (route) => `<url>
-      <loc>${joinUrlParts(deployment.servingUrl, route)}</loc>
-      <lastmod>${lastModifiedTimestamp}</lastmod>
-      <changefreq>daily</changefreq>
-      <priority>1.0</priority>
-    </url>`,
-    )
-    .join('')}
-  </urlset>`;
-
-  await writeFile(join(distDir, 'browser', 'sitemap.xml'), sitemap, 'utf-8');
-
-  console.log(`Generated sitemap with ${routePaths.length} entries.`);
-}
-
-function joinUrlParts(...parts: string[]): string {
-  const normalizeParts: string[] = [];
-  for (const part of parts) {
-    if (part === '') {
-      // Skip any empty parts
-      continue;
-    }
-
-    let normalizedPart = part;
-    if (part[0] === '/') {
-      normalizedPart = normalizedPart.slice(1);
-    }
-    if (part.at(-1) === '/') {
-      normalizedPart = normalizedPart.slice(0, -1);
-    }
-    if (normalizedPart !== '') {
-      normalizeParts.push(normalizedPart);
-    }
-  }
-
-  return normalizeParts.join('/');
-}

.github/actions/deploy-docs-site/tsconfig.json

@@ -1,15 +0,0 @@
-{
-  "compilerOptions": {
-    "module": "NodeNext",
-    "target": "ES2021",
-    "types": ["node"],
-    "lib": ["es2021"],
-    "experimentalDecorators": true,
-    "skipLibCheck": true,
-    "noImplicitOverride": true,
-    "esModuleInterop": true,
-    "noImplicitReturns": true,
-    "declaration": true,
-    "sourceMap": true
-  }
-}

.github/actions/yarn-install/action.yml

@@ -0,0 +1,17 @@
+name: 'Installing Yarn dependencies'
+description: 'Installs the dependencies using Yarn'
+
+runs:
+  using: 'composite'
+  steps:
+    - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3
+      with:
+        path: |
+          ./node_modules/
+        # If just `WORKSPACE` or `yarn.lock` is changed, the most recent cache can be restored.
+        # See: https://docs.github.com/en/actions/guides/caching-dependencies-to-speed-up-workflows#example-using-the-cache-action.
+        key: v1-angular-main-deps-${{hashFiles('WORKSPACE')}}-${{hashFiles('yarn.lock')}}
+        restore-keys: v1-angular-main-deps-
+
+    - run: yarn install --frozen-lockfile --non-interactive
+      shell: bash

.github/angular-robot.yml

@@ -68,6 +68,7 @@ merge:
 
     # list of PR statuses that need to be successful
     requiredStatuses:
+      - 'ci/circleci: build'
       - 'google-internal-tests'
       - 'pullapprove'
 

.github/workflows/adev-preview-build.yml

@@ -1,41 +0,0 @@
-# This workflow builds the previews for pull requests when a certain label is applied.
-# The actual deployment happens as part of a dedicated second workflow to avoid security
-# issues where the building would otherwise occur in an authorized context where secrets
-# could be leaked. More details can be found here:
-
-# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/.
-
-name: Build adev for preview deployment
-
-on:
-  pull_request:
-    types: [synchronize, labeled]
-
-permissions: read-all
-
-jobs:
-  adev-build:
-    runs-on: ubuntu-latest-8core
-    if: |
-      (github.event.action == 'labeled' && github.event.label.name == 'adev: preview') ||
-      (github.event.action == 'synchronize' && contains(github.event.pull_request.labels.*.name, 'adev: preview'))
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Setup Bazel RBE
-        uses: angular/dev-infra/github-actions/bazel/configure-remote@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      - name: Build adev
-        # `snapshot-build` config is used to stamp the exact version with sha in the footer.
-        run: pnpm bazel build //adev:build.production --config=snapshot-build
-      - uses: angular/dev-infra/github-actions/previews/pack-and-upload-artifact@183403ae13b785698eaf13c819dda55b9fed430b # main
-        with:
-          workflow-artifact-name: 'adev-preview'
-          angular-robot-key: ${{ secrets.ANGULAR_ROBOT_PRIVATE_KEY || 'bypassed_for_forks' }}
-          triggering-label: 'adev: preview'
-          pull-number: '${{github.event.pull_request.number}}'
-          artifact-build-revision: '${{github.event.pull_request.head.sha}}'
-          deploy-directory: './dist/bin/adev/dist/browser'

.github/workflows/adev-preview-deploy.yml

@@ -1,56 +0,0 @@
-# This workflow runs whenever the ADEV build workflow has completed. Deployment happens
-# as part of a dedicated second workflow to avoid security issues where the building would
-# otherwise occur in an authorized context where secrets could be leaked.
-#
-# More details can be found here:
-# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/.
-
-name: Deploying adev preview to Firebase
-
-on:
-  # zizmor: ignore[dangerous-triggers] - {Trigger is safe as workflow does not checkout untrusted code}
-  workflow_run:
-    workflows: ['Build adev for preview deployment']
-    types: [completed]
-
-permissions:
-  # Needed in order to be able to comment on the pull request.
-  pull-requests: write
-  # Needed in order to checkout the repository
-  contents: read
-  # Needed in order to retrieve the artifacts from the previous job
-  actions: read
-
-env:
-  PREVIEW_PROJECT: ng-dev-previews
-  PREVIEW_SITE: ng-dev-previews-fw
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          token: '${{secrets.GITHUB_TOKEN}}'
-          persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version-file: '.nvmrc'
-          package-manager-cache: false
-      - name: Configure Firebase deploy target
-        working-directory: ./
-        run: |
-          # We can use `npx` as the Firebase deploy actions uses it too.
-          # Use stable version release
-          npx -y firebase-tools@15.15.0 target:clear --config adev/firebase.json --project ${{env.PREVIEW_PROJECT}} hosting angular-docs
-          npx -y firebase-tools@15.15.0 target:apply --config adev/firebase.json --project ${{env.PREVIEW_PROJECT}} hosting angular-docs ${{env.PREVIEW_SITE}}
-
-      - uses: angular/dev-infra/github-actions/previews/upload-artifacts-to-firebase@183403ae13b785698eaf13c819dda55b9fed430b # main
-        with:
-          github-token: '${{secrets.GITHUB_TOKEN}}'
-          workflow-artifact-name: 'adev-preview'
-          firebase-config-dir: './adev'
-          firebase-public-dir: './adev/build/browser'
-          firebase-project-id: '${{env.PREVIEW_PROJECT}}'
-          firebase-service-key: '${{secrets.FIREBASE_PREVIEW_SERVICE_TOKEN}}'

.github/workflows/aio-preview-build.yml

@@ -0,0 +1,42 @@
+# This workflow builds the AIO previews for pull requests when a certain label is applied.
+# The actual deployment happens as part of a dedicated second workflow to avoid security
+# issues where the building would otherwise occur in an authorized context where secrets
+# could be leaked. More details can be found here:
+
+# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/.
+
+name: Build AIO app for preview deployment
+
+on:
+  pull_request:
+    types: [synchronize, labeled]
+
+permissions: read-all
+
+jobs:
+  aio-build:
+    runs-on: ubuntu-latest
+    # We only want to build and deploy the AIO app if the `aio: preview` label has been
+    # added, or if the label is already applied and new changes have been made in the PR.
+    if: |
+      (github.event.action == 'labeled' && github.event.label.name == 'aio: preview') ||
+      (github.event.action == 'synchronize' && contains(github.event.pull_request.labels.*.name, 'aio: preview'))
+    steps:
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - uses: ./.github/actions/yarn-install
+
+      - uses: angular/dev-infra/github-actions/bazel/configure-remote@0109d498b0f6aae418ed4924a5e5c65695f0ac61
+        with:
+          bazelrc: ./.bazelrc.user
+
+      # Build the web package. Note: We run Bazel from a low-resource Github action container,
+      # so we manually need to instruct Bazel to run more actions concurrently as by default
+      # the number of concurrent actions is determined based on the host resources.
+      - run: bazel build //aio:build --jobs=32 --announce_rc --verbose_failures
+
+      - uses: angular/dev-infra/github-actions/previews/pack-and-upload-artifact@0109d498b0f6aae418ed4924a5e5c65695f0ac61
+        with:
+          workflow-artifact-name: 'aio'
+          pull-number: '${{github.event.pull_request.number}}'
+          artifact-build-revision: '${{github.event.pull_request.head.sha}}'
+          deploy-directory: './dist/bin/aio/build'

.github/workflows/aio-preview-deploy.yml

@@ -0,0 +1,44 @@
+# This workflow runs whenever the AIO build workflow has completed. Deployment happens
+# as part of a dedicated second workflow to avoid security issues where the building would
+# otherwise occur in an authorized context where secrets could be leaked.
+#
+# More details can be found here:
+# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/.
+
+name: Deploying AIO preview to Firebase
+
+on:
+  workflow_run:
+    workflows: ['Build AIO app for preview deployment']
+    types: [completed]
+
+permissions:
+  # Needed in order to be able to comment on the pull request.
+  pull-requests: write
+
+env:
+  PREVIEW_PROJECT: ng-dev-previews
+  PREVIEW_SITE: ng-dev-previews-fw
+
+jobs:
+  aio-deploy:
+    runs-on: ubuntu-latest
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    steps:
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+
+      - name: Configure Firebase deploy target
+        working-directory: aio/
+        run: |
+          # We can use `npx` as the Firebase deploy actions uses it too.
+          npx -y firebase-tools@latest target:clear --project ${{env.PREVIEW_PROJECT}} hosting aio
+          npx -y firebase-tools@latest target:apply --project ${{env.PREVIEW_PROJECT}} hosting aio ${{env.PREVIEW_SITE}}
+
+      - uses: angular/dev-infra/github-actions/previews/upload-artifacts-to-firebase@0109d498b0f6aae418ed4924a5e5c65695f0ac61
+        with:
+          github-token: '${{secrets.GITHUB_TOKEN}}'
+          workflow-artifact-name: 'aio'
+          firebase-config-dir: './aio/'
+          firebase-public-dir: './aio/dist'
+          firebase-project-id: '${{env.PREVIEW_PROJECT}}'
+          firebase-service-key: '${{secrets.FIREBASE_PREVIEW_SERVICE_TOKEN}}'

.github/workflows/assistant-to-the-branch-manager.yml

@@ -2,7 +2,6 @@ name: DevInfra
 
 on:
   push:
-  # zizmor: ignore[dangerous-triggers] - {Trigger is safe as workflow does not checkout untrusted code}
   pull_request_target:
     types: [opened, synchronize, reopened, ready_for_review, labeled]
 
@@ -13,11 +12,10 @@ permissions:
 jobs:
   assistant_to_the_branch_manager:
     runs-on: ubuntu-latest
-    if: github.event.repository.fork == false
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
         with:
           persist-credentials: false
-      - uses: angular/dev-infra/github-actions/branch-manager@183403ae13b785698eaf13c819dda55b9fed430b # main
+      - uses: angular/dev-infra/github-actions/branch-manager@0109d498b0f6aae418ed4924a5e5c65695f0ac61
         with:
           angular-robot-key: ${{ secrets.ANGULAR_ROBOT_PRIVATE_KEY }}

.github/workflows/benchmark-compare.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ github.event.issue.pull_request && startsWith(github.event.comment.body, '/benchmark-compare ')}}
     steps:
-      - uses: TheModdingInquisition/actions-team-membership@057d91bb80f2976a1bc6dfab5b4ae1da9aebbd89 # v1.0
+      - uses: TheModdingInquisition/actions-team-membership@a69636a92bc927f32c3910baac06bacc949c984c # v1.0
         with:
           team: 'team'
           organization: angular
@@ -19,40 +19,26 @@ jobs:
           exit: true
 
       # Indicate that the benchmark command was received.
-      - uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5
+      - uses: peter-evans/create-or-update-comment@c6c9a1a66007646a28c153e2a8580a5bad27bcfa # v3
         with:
           comment-id: ${{github.event.comment.id}}
           token: '${{secrets.BENCHMARK_POST_RESULTS_GITHUB_TOKEN}}'
           reactions: 'rocket'
 
-      - uses: alessbell/pull-request-comment-branch@ef3408c9757d05f89cb525036383033a313758a0 # v2.1.0
+      - uses: alessbell/pull-request-comment-branch@aad01d65d6982b8eacabed5e9a684cd8ceb98da6 # v1.1
         id: comment-branch
 
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
         with:
           # Specify repository as the PR branch might be from a fork.
           repository: ${{steps.comment-branch.outputs.head_owner}}/${{steps.comment-branch.outputs.head_repo}}
           # Checkout the pull request and assume it being trusted given we've checked
           # that the action was triggered by a team member.
-          ref: ${{steps.comment-branch.outputs.head_sha}}
+          ref: ${{steps.comment-branch.outputs.head_ref}}
 
-      # We cannot use `angular/dev-infra/github-actions/npm/checkout-and-setup-node` here
-      # because it does not support checking out from a fork (as it lacks a `repository` input).
-      # Thus, we checkout and setup Node/pnpm manually.
-      - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version-file: '.nvmrc'
+      - uses: ./.github/actions/yarn-install
 
-      - name: Install pnpm
-        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
-
-      - run: pnpm install --frozen-lockfile
-
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@183403ae13b785698eaf13c819dda55b9fed430b # main
-
-      - uses: angular/dev-infra/github-actions/bazel/configure-remote@183403ae13b785698eaf13c819dda55b9fed430b # main
+      - uses: angular/dev-infra/github-actions/bazel/configure-remote@0109d498b0f6aae418ed4924a5e5c65695f0ac61
         with:
           bazelrc: ./.bazelrc.user
 
@@ -61,16 +47,13 @@ jobs:
         env:
           # Untrusted input used in an executable code, must be wrapped as an env var to prevent injections
           COMMENT_BODY: ${{ github.event.comment.body }}
-        run: pnpm benchmarks prepare-for-github-action "$COMMENT_BODY"
+        run: yarn benchmarks prepare-for-github-action "$COMMENT_BODY"
 
-      - env:
-          COMPARE_SHA: ${{steps.info.outputs.compareSha}}
-          BENCHMARK_TARGET: ${{steps.info.outputs.benchmarkTarget}}
-        run: pnpm benchmarks run-compare "$COMPARE_SHA" "$BENCHMARK_TARGET"
+      - run: yarn benchmarks run-compare ${{steps.info.outputs.compareSha}} ${{steps.info.outputs.benchmarkTarget}}
         id: benchmark
         name: Running benchmark
 
-      - uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5
+      - uses: peter-evans/create-or-update-comment@c6c9a1a66007646a28c153e2a8580a5bad27bcfa # v3
         with:
           issue-number: ${{github.event.issue.number}}
           token: '${{secrets.BENCHMARK_POST_RESULTS_GITHUB_TOKEN}}'

.github/workflows/ci-privileged.yml

@@ -0,0 +1,64 @@
+name: CI
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  saucelabs:
+    runs-on: ubuntu-latest-4core
+    env:
+      SAUCE_TUNNEL_IDENTIFIER: angular-framework-${{ github.run_number }}
+      SAUCE_USERNAME: ${{ vars.SAUCE_USERNAME }}
+      SAUCE_ACCESS_KEY: ${{ secrets.SAUCE_ACCESS_KEY }}
+    steps:
+      - name: Initialize environment
+        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@1befe6d24fd5cab818e7f8bada40ab364781b8a8
+        with:
+          cache-node-modules: true
+          # Checking out the pull request commit is intended here as we need to run the changed code tests.
+          ref: ${{ github.event.pull_request.head.sha }}
+      - name: Install node modules
+        run: yarn install --frozen-lockfile
+      - name: Setup Bazel
+        uses: angular/dev-infra/github-actions/bazel/setup@1befe6d24fd5cab818e7f8bada40ab364781b8a8
+      - name: Starting Saucelabs tunnel service
+        run: ./tools/saucelabs/sauce-service.sh run &
+      # Build test fixtures for a test that rely on Bazel-generated fixtures. Note that disabling
+      # specific tests which are reliant on such generated fixtures is not an option as SystemJS
+      # in the Saucelabs legacy job always fetches referenced files, even if the imports would be
+      # guarded by an check to skip in the Saucelabs legacy job. We should be good running such
+      # test in all supported browsers on Saucelabs anyway until this job can be removed.
+      - name: Preparing Bazel-generated fixtures required in legacy tests
+        run: |
+          yarn bazel build //packages/core/test:downleveled_es5_fixture //packages/common/locales
+          # Needed for the ES5 downlevel reflector test in `packages/core/test/reflection`.
+          mkdir -p dist/legacy-test-out/core/test/reflection/
+          cp dist/bin/packages/core/test/reflection/es5_downleveled_inheritance_fixture.js \
+            dist/legacy-test-out/core/test/reflection/es5_downleveled_inheritance_fixture.js
+          # Locale files are needed for i18n tests running within Saucelabs. These are added
+          # directly as sources so that the TypeScript compilation of `/packages/tsconfig.json`
+          # can succeed. Note that the base locale and currencies files are checked-in, so
+          # we do not need to re-generate those through Bazel.
+          mkdir -p packages/common/locales/extra
+          cp dist/bin/packages/common/locales/*.ts packages/common/locales
+          cp dist/bin/packages/common/locales/extra/*.ts packages/common/locales/extra
+      - name: Build bundle of tests to run on Saucelabs
+        run: node tools/legacy-saucelabs/build-saucelabs-test-bundle.mjs
+      - name: Wait and confirm Saucelabs tunnel has connected
+        run: ./tools/saucelabs/sauce-service.sh ready-wait
+        timeout-minutes: 3
+      - name: Running tests on Saucelabs.
+        run: KARMA_WEB_TEST_MODE=SL_REQUIRED yarn karma start ./karma-js.conf.js --single-run
+      - name: Stop Saucelabs tunnel service
+        run: ./tools/saucelabs/sauce-service.sh stop

.github/workflows/ci.yml

@@ -1,10 +1,12 @@
-name: CI (push)
+name: CI
 
 on:
   push:
     branches:
       - main
       - '[0-9]+.[0-9]+.x'
+  pull_request:
+    types: [opened, synchronize, reopened]
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -21,201 +23,219 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@183403ae13b785698eaf13c819dda55b9fed430b # main
+        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@0109d498b0f6aae418ed4924a5e5c65695f0ac61
+        with:
+          cache-node-modules: true
+          node-module-directories: |
+            ./node_modules
+            ./aio/node_modules
       - name: Install node modules
-        run: pnpm install --frozen-lockfile
+        run: yarn install --frozen-lockfile
+      - name: Install node modules in aio
+        run: yarn install --frozen-lockfile --cwd aio
       - name: Check code lint
-        run: pnpm tslint
+        run: yarn -s tslint
+      - name: Check code lint in aio
+        run: yarn -s --cwd aio lint
       - name: Check for circular dependencies
-        run: pnpm ts-circular-deps:check
+        run: yarn -s ts-circular-deps:check
       - name: Validate pull approve configuration
-        run: pnpm ng-dev pullapprove verify
+        run: yarn -s ng-dev pullapprove verify
       - name: Validate angular robot configuration
-        run: pnpm ng-dev ngbot verify
-      - name: Validate agent skills
-        run: pnpm ng-dev misc validate-skills
+        run: yarn -s ng-dev ngbot verify
       - name: Confirm code builds with typescript as expected
-        run: pnpm check-tooling-setup
+        run: yarn -s check-tooling-setup
+      - name: Check commit message
+        # Commit message validation is only done on pull requests as its too late to validate once
+        # it has been merged.
+        if: github.event_name == 'pull_request'
+        run: yarn ng-dev commit-message validate-range ${{ github.event.pull_request.base.sha }} ${{ github.event.pull_request.head.sha }}
+      - name: Check code format
+        # Code formatting checks are only done on pull requests as its too late to validate once
+        # it has been merged.
+        if: github.event_name == 'pull_request'
+        run: yarn ng-dev format changed --check ${{ github.event.pull_request.base.sha }}
 
   devtools:
     runs-on: ubuntu-latest
     steps:
       - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@183403ae13b785698eaf13c819dda55b9fed430b # main
+        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@0109d498b0f6aae418ed4924a5e5c65695f0ac61
         with:
-          disable-package-manager-cache: true
+          cache-node-modules: true
       - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@183403ae13b785698eaf13c819dda55b9fed430b # main
+        uses: angular/dev-infra/github-actions/bazel/setup@0109d498b0f6aae418ed4924a5e5c65695f0ac61
       - name: Setup Bazel RBE
-        uses: angular/dev-infra/github-actions/bazel/configure-remote@183403ae13b785698eaf13c819dda55b9fed430b # main
-        with:
-          google_credential: ${{ secrets.RBE_TRUSTED_BUILDS_USER }}
+        uses: angular/dev-infra/github-actions/bazel/configure-remote@0109d498b0f6aae418ed4924a5e5c65695f0ac61
       - name: Install node modules
-        run: pnpm install --frozen-lockfile
+        run: yarn install --frozen-lockfile
       - name: Run unit tests
-        run: pnpm devtools:test
+        run: yarn devtools:test
       - name: Test build
-        run: pnpm devtools:build:chrome
-      - name: Cypress run
-        uses: cypress-io/github-action@09090944bd8aaa2a517cefb6e38bf1aae336b42b # v7.4.3
+        run: yarn devtools:build:chrome
+
+  framework-win:
+    runs-on: windows-latest
+    steps:
+      - name: Initialize environment
+        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@0109d498b0f6aae418ed4924a5e5c65695f0ac61
         with:
-          command: pnpm devtools:test:e2e
-          start: pnpm bazel run //devtools/src:devserver
-          wait-on: 'http://localhost:4200'
-          wait-on-timeout: 300
-          install: false
+          cache-node-modules: true
+      - name: Setup Bazel
+        uses: angular/dev-infra/github-actions/bazel/setup@0109d498b0f6aae418ed4924a5e5c65695f0ac61
+      - name: Setup Bazel Remote Caching
+        uses: angular/dev-infra/github-actions/bazel/configure-remote@0109d498b0f6aae418ed4924a5e5c65695f0ac61
+      - name: Install node modules
+        run: yarn install --frozen-lockfile --network-timeout 100000
+      - name: Test all windows CI targets
+        run: bazel test --test_tag_filters="-browser:chromium-local" //packages/compiler-cli/...
 
   test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-4core
     steps:
       - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Setup Bazel Remote Caching
-        uses: angular/dev-infra/github-actions/bazel/configure-remote@183403ae13b785698eaf13c819dda55b9fed430b # main
+        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@45de46d9ba0e0689b7a846fd31ec9e241807ca71
         with:
-          google_credential: ${{ secrets.RBE_TRUSTED_BUILDS_USER }}
+          cache-node-modules: true
+      - name: Setup Bazel
+        uses: angular/dev-infra/github-actions/bazel/setup@45de46d9ba0e0689b7a846fd31ec9e241807ca71
+      - name: Setup Bazel Remote Caching
+        uses: angular/dev-infra/github-actions/bazel/configure-remote@45de46d9ba0e0689b7a846fd31ec9e241807ca71
       - name: Install node modules
-        run: pnpm install --frozen-lockfile
+        run: yarn install --frozen-lockfile --network-timeout 100000
       - name: Run CI tests for framework
-        run: pnpm test:ci
+        run: yarn test:ci
 
-  integration-tests:
-    runs-on: ubuntu-latest
+  aio:
+    runs-on: ubuntu-latest-4core
     steps:
       - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Setup Bazel Remote Caching
-        uses: angular/dev-infra/github-actions/bazel/configure-remote@183403ae13b785698eaf13c819dda55b9fed430b # main
+        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@45de46d9ba0e0689b7a846fd31ec9e241807ca71
         with:
-          google_credential: ${{ secrets.RBE_TRUSTED_BUILDS_USER }}
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      - name: Run integration CI tests for framework
-        run: pnpm integration-tests:ci
+          cache-node-modules: true
+          node-module-directories: |
+            ./aio/node_modules
+      - name: Setup Bazel
+        uses: angular/dev-infra/github-actions/bazel/setup@45de46d9ba0e0689b7a846fd31ec9e241807ca71
+      - name: Setup Bazel RBE
+        uses: angular/dev-infra/github-actions/bazel/configure-remote@45de46d9ba0e0689b7a846fd31ec9e241807ca71
+      - name: Install node modules for aio
+        run: yarn install --cwd aio --frozen-lockfile
+      - name: Run AIO tests with upstream packages
+        run: yarn --cwd aio test:ci
+      - name: Check generated bundle sizes
+        run: yarn --cwd aio payload-size
 
-  adev:
+  aio-local:
+    runs-on:
+      labels: ubuntu-latest-4core
+    steps:
+      - name: Initialize environment
+        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@45de46d9ba0e0689b7a846fd31ec9e241807ca71
+        with:
+          cache-node-modules: true
+          node-module-directories: |
+            ./aio/node_modules
+      - name: Setup Bazel
+        uses: angular/dev-infra/github-actions/bazel/setup@45de46d9ba0e0689b7a846fd31ec9e241807ca71
+      - name: Setup Bazel RBE
+        uses: angular/dev-infra/github-actions/bazel/configure-remote@45de46d9ba0e0689b7a846fd31ec9e241807ca71
+      - name: Install node modules
+        run: yarn install --cwd aio --frozen-lockfile
+      - name: Run AIO tests with local packages
+        run: yarn --cwd aio test-local:ci
+      - name: Check generated bundle sizes
+        run: yarn --cwd aio payload-size aio-local
+
+  aio-deploy:
+    needs: [aio]
+    if: needs.aio.result == 'success' && github.event_name == 'push'
     runs-on:
       labels: ubuntu-latest
     steps:
       - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Setup Bazel RBE
-        uses: angular/dev-infra/github-actions/bazel/configure-remote@183403ae13b785698eaf13c819dda55b9fed430b # main
+        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@45de46d9ba0e0689b7a846fd31ec9e241807ca71
         with:
-          google_credential: ${{ secrets.RBE_TRUSTED_BUILDS_USER }}
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      - name: Run tests
-        run: pnpm bazel test //adev/...
-      - name: Build adev in fast mode to ensure it continues to work
-        run: pnpm bazel build //adev:build
-
-  vscode-ng-language-service:
-    runs-on:
-      labels: ubuntu-latest
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@183403ae13b785698eaf13c819dda55b9fed430b # main
+          cache-node-modules: true
+          node-module-directories: |
+            ./aio/node_modules
       - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@183403ae13b785698eaf13c819dda55b9fed430b # main
+        uses: angular/dev-infra/github-actions/bazel/setup@45de46d9ba0e0689b7a846fd31ec9e241807ca71
       - name: Setup Bazel RBE
-        uses: angular/dev-infra/github-actions/bazel/configure-remote@183403ae13b785698eaf13c819dda55b9fed430b # main
+        uses: angular/dev-infra/github-actions/bazel/configure-remote@45de46d9ba0e0689b7a846fd31ec9e241807ca71
+      - name: Install node modules for aio
+        run: yarn install --cwd aio --frozen-lockfile
+      - name: Set the stable branch environment variable
+        id: latest_version
+        run: |
+          echo "CI_STABLE_BRANCH=$(npm info @angular/core dist-tags.latest | sed -r 's/^\s*([0-9]+\.[0-9]+)\.[0-9]+.*$/\1.x/')" >> $GITHUB_OUTPUT
+          echo "CI_BRANCH=$(echo ${{ github.event.ref }} | cut -d '/' -f 3)" >> $GITHUB_OUTPUT
+      - name: Deploy aio to production
+        env:
+          CI_AIO_MIN_PWA_SCORE: '95'
+          CI_COMMIT: ${{ github.event.after }}
+          CI_REPO_NAME: 'angular'
+          CI_PULL_REQUEST: 'false'
+          CI_REPO_OWNER: 'angular'
+          CI_BUILD_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
+          CI_STABLE_BRANCH: ${{ steps.latest_version.outputs.CI_STABLE_BRANCH }}
+          CI_BRANCH: ${{ steps.latest_version.outputs.CI_BRANCH }}
+          CI_SECRET_AIO_DEPLOY_FIREBASE_TOKEN: ${{ secrets.AIO_DEPLOY_TOKEN }}
+          CI_SECRET_PAYLOAD_FIREBASE_TOKEN: ${{ secrets.AIO_PAYLOAD_TOKEN }}
+        run: yarn --cwd aio deploy-production
+      - name: Notify about failed deployment
+        if: ${{ failure() }}
+        uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117 # v=v1.24.0
         with:
-          google_credential: ${{ secrets.RBE_TRUSTED_BUILDS_USER }}
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      - name: Run tests
-        run: pnpm bazel test //vscode-ng-language-service/...
-
-  publish-snapshots:
-    runs-on:
-      labels: ubuntu-latest
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Setup Bazel RBE
-        uses: angular/dev-infra/github-actions/bazel/configure-remote@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      - run: echo "https://${{secrets.SNAPSHOT_BUILDS_GITHUB_TOKEN}}:@github.com" > ${HOME}/.git_credentials
-      - run: pnpm build
-      - run: ./scripts/ci/publish-snapshot-build-artifacts.sh
+          channel-id: 'C07DT5M6V,CKV1F72BG'
+          slack-message: 'Deploy to aio job failed for ${{ github.base_ref }} branch failed on build ${{ github.event.after }}: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.ANGULAR_ROBOT_SLACK_TOKEN }}
 
   zone-js:
     runs-on:
-      labels: ubuntu-latest
+      labels: ubuntu-latest-4core
     steps:
       - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Setup Bazel RBE
-        uses: angular/dev-infra/github-actions/bazel/configure-remote@183403ae13b785698eaf13c819dda55b9fed430b # main
+        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@45de46d9ba0e0689b7a846fd31ec9e241807ca71
         with:
-          google_credential: ${{ secrets.RBE_TRUSTED_BUILDS_USER }}
+          cache-node-modules: true
+          node-module-directories: |
+            ./node_modules
+            ./packages/zone.js/node_modules
+            ./packages/zone.js/test/typings/node_modules
+      - name: Setup Bazel
+        uses: angular/dev-infra/github-actions/bazel/setup@45de46d9ba0e0689b7a846fd31ec9e241807ca71
+      - name: Setup Bazel RBE
+        uses: angular/dev-infra/github-actions/bazel/configure-remote@45de46d9ba0e0689b7a846fd31ec9e241807ca71
       - name: Install node modules
-        run: pnpm install --frozen-lockfile
+        run: yarn install --frozen-lockfile
       - run: |
-          pnpm bazel build \
+          yarn bazel build \
           //packages/zone.js/bundles:zone.umd.js \
           //packages/zone.js:npm_package \
-          //packages/zone.js/test/closure:closure
+          //packages/zone.js/test/closure:closure_js \
+          //packages/zone.js:zone_externs
 
       - run: |
-          rm -Rf packages/zone.js/build
-          rm -Rf packages/zone.js/test/extra/*.umd.js
-
           mkdir -p packages/zone.js/build/
           mkdir -p packages/zone.js/build/test/
+          mkdir -p packages/zone.js/test/
 
           cp dist/bin/packages/zone.js/bundles/zone.umd.js packages/zone.js/build/zone.umd.js
           cp dist/bin/packages/zone.js/npm_package/bundles/zone-mix.umd.js ./packages/zone.js/test/extra/
           cp dist/bin/packages/zone.js/npm_package/bundles/zone-patch-electron.umd.js ./packages/zone.js/test/extra/
-          cp dist/bin/packages/zone.js/test/closure/zone.closure.js ./packages/zone.js/build/test/zone.closure.mjs
+          cp dist/bin/packages/zone.js/test/closure/zone.closure.mjs ./packages/zone.js/build/test/zone.closure.mjs
+          cp dist/bin/packages/zone.js/zone_externs.js ./packages/zone.js/build/zone_externs.js
 
         # Install
-      - run: pnpm -C packages/zone.js install --frozen-lockfile
+      - run: yarn --cwd packages/zone.js install --frozen-lockfile --non-interactive
         # Run zone.js tools tests
-      - run: pnpm -C packages/zone.js promisefinallytest
-      - run: pnpm -C packages/zone.js jest:test
-      - run: pnpm -C packages/zone.js jest:nodetest
-      - run: pnpm -C packages/zone.js vitest:test
-      - run: pnpm -C packages/zone.js vitest-globals:test
-      - run: pnpm -C packages/zone.js electrontest
-      - run: pnpm -C packages/zone.js/test/typings test
-
-  adev-deploy:
-    needs: [adev]
-    if: needs.adev.result == 'success'
-    runs-on: ubuntu-latest-8core
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Setup Bazel RBE
-        uses: angular/dev-infra/github-actions/bazel/configure-remote@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      - name: Build adev
-        # `snapshot-build` config is used to stamp the exact version with sha in the footer.
-        run: pnpm bazel build //adev:build.production --config=snapshot-build
-      - name: Deploy to firebase
-        uses: ./.github/actions/deploy-docs-site
-        with:
-          serviceKey: ${{ secrets.ANGULAR_DEV_SITE_DEPLOY }}
-          githubReleaseTrainReadToken: ${{ secrets.DOCS_DEPLOY_GITHUB_RELEASE_TRAIN_TOKEN }}
-          configPath: 'adev/firebase.json'
-          distDir: 'dist/bin/adev/dist'
-      - name: Update Algolia synonym record
-        run: node adev/scripts/synonyms/update-synonyms.mts
-        env:
-          ALGOLIA_KEY: ${{ secrets.ALGOLIA_SYNONYM_MANAGER }}
+      - run: yarn --cwd packages/zone.js promisetest
+      - run: yarn --cwd packages/zone.js promisefinallytest
+      - run: yarn --cwd packages/zone.js jest:test
+      - run: yarn --cwd packages/zone.js jest:nodetest
+      - run: yarn --cwd packages/zone.js electrontest
+      - run: yarn --cwd packages/zone.js closuretest
+      - run: yarn --cwd packages/zone.js/test/typings install --frozen-lockfile --non-interactive
+      - run: yarn --cwd packages/zone.js/test/typings test

.github/workflows/cross-repo-adev-docs.yml

@@ -1,59 +0,0 @@
-name: Update ADEV Cross Repo Docs
-
-on:
-  workflow_dispatch:
-    inputs: {}
-  push:
-    branches:
-      - 'main'
-      - '[0-9]+.[0-9]+.x'
-
-# Declare default permissions as read only.
-permissions:
-  contents: read
-
-jobs:
-  update_adev_cross_repo_docs:
-    name: Update Cross Repo ADEV Docs
-    if: github.repository == 'angular/angular'
-    runs-on: ubuntu-latest
-    # Prevents multiple concurrent runs of this workflow for the same branch
-    concurrency:
-      group: ${{ github.workflow }}-${{ github.ref }}
-      cancel-in-progress: true
-
-    steps:
-      - name: Checkout the repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          # Setting `persist-credentials: false` prevents the github-action account from being the
-          # account that is attempted to be used for authentication, instead the remote is set to
-          # an authenticated URL.
-          persist-credentials: false
-
-      - name: Generate Docs
-        run: node adev/scripts/update-cross-repo-docs/index.mjs
-        env:
-          ANGULAR_READONLY_GITHUB_TOKEN: ${{ secrets.READONLY_GITHUB_TOKEN }}
-
-      - name: Create a PR (if necessary)
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
-        with:
-          token: ${{ secrets.ANGULAR_ROBOT_ACCESS_TOKEN }}
-          push-to-fork: 'angular-robot/angular'
-          delete-branch: true
-          maintainer-can-modify: false
-          branch: docs-cross-repo-update-${{github.ref_name}}
-          committer: Angular Robot <angular-robot@google.com>
-          author: Angular Robot <angular-robot@google.com>
-          title: 'docs: update cross-repo adev docs [${{github.ref_name}}]'
-          body: |
-            Updated Angular adev cross repo docs files.
-          labels: |
-            action: merge
-            area: docs
-            target: automation
-          commit-message: |
-            docs: update cross-repo adev docs
-
-            Updated Angular adev cross repo docs files.

.github/workflows/dev-infra.yml

@@ -1,37 +1,25 @@
 name: DevInfra
 
 on:
-  # zizmor: ignore[dangerous-triggers] - {Trigger is safe as workflow does not checkout untrusted code}
   pull_request_target:
     types: [opened, synchronize, reopened]
-  issues:
-    types: [opened, reopened]
 
 # Declare default permissions as read only.
 permissions:
   contents: read
 
 jobs:
-  pull_request_labels:
-    if: github.event_name == 'pull_request_target'
+  labels:
     runs-on: ubuntu-latest
     steps:
-      - uses: angular/dev-infra/github-actions/labeling/pull-request@183403ae13b785698eaf13c819dda55b9fed430b # main
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - uses: angular/dev-infra/github-actions/commit-message-based-labels@0109d498b0f6aae418ed4924a5e5c65695f0ac61
         with:
           angular-robot-key: ${{ secrets.ANGULAR_ROBOT_PRIVATE_KEY }}
-          labels: '{"requires: TGP": ["packages/core/primitives/**/{*,.*}"]}'
   post_approval_changes:
-    if: github.event_name == 'pull_request_target'
     runs-on: ubuntu-latest
     steps:
-      - uses: angular/dev-infra/github-actions/post-approval-changes@183403ae13b785698eaf13c819dda55b9fed430b # main
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - uses: angular/dev-infra/github-actions/post-approval-changes@0109d498b0f6aae418ed4924a5e5c65695f0ac61
         with:
           angular-robot-key: ${{ secrets.ANGULAR_ROBOT_PRIVATE_KEY }}
-  issue_labels:
-    if: github.event_name == 'issues'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: angular/dev-infra/github-actions/labeling/issue@183403ae13b785698eaf13c819dda55b9fed430b # main
-        with:
-          angular-robot-key: ${{ secrets.ANGULAR_ROBOT_PRIVATE_KEY }}
-          google-generative-ai-key: ${{ secrets.GOOGLE_GENERATIVE_AI_KEY }}

.github/workflows/feature-requests.yml

@@ -0,0 +1,19 @@
+name: Feature request triage bot
+
+on:
+  schedule:
+    # Run at 14:00 every day
+    - cron: '0 14 * * *'
+
+# Declare default permissions as read only.
+permissions:
+  contents: read
+
+jobs:
+  feature_triage:
+    if: github.repository == 'angular/angular'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: angular/dev-infra/github-actions/feature-request@0109d498b0f6aae418ed4924a5e5c65695f0ac61
+        with:
+          angular-robot-key: ${{ secrets.ANGULAR_ROBOT_PRIVATE_KEY }}

.github/workflows/google-internal-tests.yml

@@ -1,7 +1,6 @@
 name: Google Internal Tests Enforcement
 
 on:
-  # zizmor: ignore[dangerous-triggers] - {Trigger is safe as workflow does not checkout untrusted code}
   pull_request_target:
     types: [opened, reopened, synchronize]
 
@@ -14,8 +13,8 @@ jobs:
       statuses: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: angular/dev-infra/github-actions/google-internal-tests@183403ae13b785698eaf13c819dda55b9fed430b # main
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - uses: angular/dev-infra/github-actions/google-internal-tests@0109d498b0f6aae418ed4924a5e5c65695f0ac61
         with:
           run-tests-guide-url: http://go/angular-g3sync-start
           github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/merge-ready-status.yml

@@ -1,8 +1,6 @@
 name: Merge Ready
 
-on:
-  # zizmor: ignore[dangerous-triggers] - {Trigger is safe as workflow does not checkout untrusted code}
-  pull_request_target:
+on: pull_request_target
 
 # Declare default permissions as read only.
 permissions: {}
@@ -11,6 +9,6 @@ jobs:
   status:
     runs-on: ubuntu-latest
     steps:
-      - uses: angular/dev-infra/github-actions/unified-status-check@183403ae13b785698eaf13c819dda55b9fed430b # main
+      - uses: angular/dev-infra/github-actions/unified-status-check@0109d498b0f6aae418ed4924a5e5c65695f0ac61
         with:
           angular-robot-key: ${{ secrets.ANGULAR_ROBOT_PRIVATE_KEY }}

.github/workflows/monitoring.yml

@@ -0,0 +1,55 @@
+name: Monitoring
+
+on:
+  schedule:
+    # Run at 10:00AM every day.
+    - cron: '0 10 * * *'
+
+permissions: {}
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  check_aio:
+    runs-on: ubuntu-latest
+    env:
+      MINIMUM_PWA_SCORE: 95
+    strategy:
+      fail-fast: false
+      matrix:
+        version: ['https://next.angular.io/', 'https://angular.io/']
+    steps:
+      - name: Initialize environment
+        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@0109d498b0f6aae418ed4924a5e5c65695f0ac61
+        with:
+          cache-node-modules: true
+          node-module-directories: |
+            ./aio/node_modules
+      - name: Setup Bazel
+        uses: angular/dev-infra/github-actions/bazel/setup@0109d498b0f6aae418ed4924a5e5c65695f0ac61
+      - name: Setup Bazel RBE
+        uses: angular/dev-infra/github-actions/bazel/configure-remote@0109d498b0f6aae418ed4924a5e5c65695f0ac61
+      - name: Install node modules in aio
+        run: yarn install --frozen-lockfile --cwd aio
+      - name: Run basic e2e and deployment config tests.
+        run: yarn --cwd aio test-production-url --test_env=TARGET_URL="${{ matrix.version }}"
+      - name: Run PWA-score tests.
+        run: yarn --cwd aio test-pwa-score "${{ matrix.version }}" "${{ env.MINIMUM_PWA_SCORE }}"
+      - name: Run a11y tests.
+        run: yarn --cwd aio test-a11y-score "${{ matrix.version }}"
+
+  check_contributor_links:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Initialize environment
+        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@0109d498b0f6aae418ed4924a5e5c65695f0ac61
+        with:
+          cache-node-modules: true
+          node-module-directories: |
+            ./aio/node_modules
+      - name: Install node modules in aio
+        run: yarn install --frozen-lockfile --cwd aio
+      - name: Check website provided in contributors.json file
+        run: node aio/scripts/test-external-urls.js

.github/workflows/perf.yml

@@ -1,58 +0,0 @@
-name: Performance Tracking
-
-on:
-  push:
-    branches:
-      - main
-
-permissions:
-  contents: 'read'
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  list:
-    timeout-minutes: 3
-    runs-on: ubuntu-latest
-    outputs:
-      workflows: ${{ steps.workflows.outputs.workflows }}
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      - id: workflows
-        run: echo "workflows=$(pnpm --silent ng-dev perf workflows --list)" >> "$GITHUB_OUTPUT"
-
-  workflow:
-    timeout-minutes: 30
-    runs-on: ubuntu-latest
-    needs: list
-    permissions:
-      contents: 'read'
-      id-token: 'write'
-    strategy:
-      matrix:
-        workflow: ${{ fromJSON(needs.list.outputs.workflows) }}
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      # We utilize the google-github-actions/auth action to allow us to get an active credential using workflow
-      # identity federation. This allows us to request short lived credentials on demand, rather than storing
-      # credentials in secrets long term. More information can be found at:
-      # https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-google-cloud-platform
-      - uses: 'google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093' # v3
-        with:
-          project_id: 'internal-200822'
-          workload_identity_provider: 'projects/823469418460/locations/global/workloadIdentityPools/measurables-tracking/providers/angular'
-          service_account: 'measures-uploader@internal-200822.iam.gserviceaccount.com'
-      - run: pnpm ng-dev perf workflows --name "$WORKFLOW" --commit-sha "$COMMIT_SHA"
-        env:
-          WORKFLOW: ${{ matrix.workflow }}
-          COMMIT_SHA: ${{ github.sha }}

.github/workflows/pr.yml

@@ -1,179 +0,0 @@
-name: Pull Request
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened]
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions: {}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      - name: Check code lint
-        run: pnpm tslint
-      - name: Check for circular dependencies
-        run: pnpm ts-circular-deps:check
-      - name: Validate pull approve configuration
-        run: pnpm ng-dev pullapprove verify
-      - name: Validate angular robot configuration
-        run: pnpm ng-dev ngbot verify
-      - name: Confirm code builds with typescript as expected
-        run: pnpm check-tooling-setup
-      - name: Validate agent skills
-        run: pnpm ng-dev misc validate-skills
-      - name: Check commit message
-        run: pnpm ng-dev commit-message validate-range ${{ github.event.pull_request.base.sha }} ${{ github.event.pull_request.head.sha }}
-      - name: Check code format
-        run: pnpm ng-dev format changed --check ${{ github.event.pull_request.base.sha }}
-      - name: Check Package Licenses
-        uses: angular/dev-infra/github-actions/linting/licenses@183403ae13b785698eaf13c819dda55b9fed430b # main
-        with:
-          allow-dependencies-licenses: 'pkg:npm/google-protobuf@'
-
-  devtools:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@183403ae13b785698eaf13c819dda55b9fed430b # main
-        with:
-          disable-package-manager-cache: true
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Setup Bazel RBE
-        uses: angular/dev-infra/github-actions/bazel/configure-remote@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      - name: Run unit tests
-        run: pnpm devtools:test
-      - name: Test build
-        run: pnpm devtools:build:chrome
-      - name: Cypress run
-        uses: cypress-io/github-action@09090944bd8aaa2a517cefb6e38bf1aae336b42b # v7.4.3
-        with:
-          command: pnpm devtools:test:e2e
-          start: pnpm bazel run //devtools/src:devserver
-          wait-on: 'http://localhost:4200'
-          wait-on-timeout: 300
-          install: false
-
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Setup Bazel Remote Caching
-        uses: angular/dev-infra/github-actions/bazel/configure-remote@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      - name: Run CI tests for framework
-        run: pnpm test:ci
-        env:
-          # Ensures Aspect lock files are up-to-date.
-          # TODO(devversion): Remove when removing pnpm.
-          ASPECT_RULES_JS_FROZEN_PNPM_LOCK: '1'
-      - name: Upload GRPC logs (for debugging of RBE issues)
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          path: /tmp/rbe-grpc.log
-          retention-days: 1
-
-  integration-tests:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Setup Bazel Remote Caching
-        uses: angular/dev-infra/github-actions/bazel/configure-remote@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      - name: Run integration CI tests for framework
-        run: pnpm integration-tests:ci
-
-  adev:
-    runs-on:
-      labels: ubuntu-latest
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Setup Bazel RBE
-        uses: angular/dev-infra/github-actions/bazel/configure-remote@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      - name: Run tests
-        run: pnpm bazel test //adev/...
-      - name: Build adev in fast mode to ensure it continues to work
-        run: pnpm bazel build //adev:build
-
-  vscode-ng-language-service:
-    runs-on:
-      labels: ubuntu-latest
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Setup Bazel RBE
-        uses: angular/dev-infra/github-actions/bazel/configure-remote@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      - name: Run tests
-        run: pnpm bazel test //vscode-ng-language-service/...
-
-  zone-js:
-    runs-on:
-      labels: ubuntu-latest
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Setup Bazel RBE
-        uses: angular/dev-infra/github-actions/bazel/configure-remote@183403ae13b785698eaf13c819dda55b9fed430b # main
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      - run: |
-          pnpm bazel build \
-          //packages/zone.js/bundles:zone.umd.js \
-          //packages/zone.js:npm_package \
-          //packages/zone.js/test/closure:closure
-
-      - run: |
-          rm -Rf packages/zone.js/build
-          rm -Rf packages/zone.js/test/extra/*.umd.js
-
-          mkdir -p packages/zone.js/build/
-          mkdir -p packages/zone.js/build/test/
-
-          cp dist/bin/packages/zone.js/bundles/zone.umd.js packages/zone.js/build/zone.umd.js
-          cp dist/bin/packages/zone.js/npm_package/bundles/zone-mix.umd.js ./packages/zone.js/test/extra/
-          cp dist/bin/packages/zone.js/npm_package/bundles/zone-patch-electron.umd.js ./packages/zone.js/test/extra/
-          cp dist/bin/packages/zone.js/test/closure/zone.closure.js ./packages/zone.js/build/test/zone.closure.mjs
-
-        # Run zone.js tools tests
-      - run: pnpm -C packages/zone.js promisefinallytest
-      - run: pnpm -C packages/zone.js jest:test
-      - run: pnpm -C packages/zone.js jest:nodetest
-      - run: pnpm -C packages/zone.js vitest:test
-      - run: pnpm -C packages/zone.js vitest-globals:test
-      - run: pnpm -C packages/zone.js electrontest
-      - run: pnpm -C packages/zone.js/test/typings test

.github/workflows/release.yml

@@ -1,24 +0,0 @@
-name: Publish Release
-
-on:
-  push:
-    branches:
-      - main
-      - '[0-9]+.[0-9]+.x'
-  workflow_dispatch: # Allow manual trigger for verification
-
-# Ensure only one release runs at a time PER BRANCH to avoid race conditions.
-concurrency:
-  group: release-${{ github.ref }}
-  cancel-in-progress: false
-
-permissions:
-  contents: read # Required to checkout the repository
-  id-token: write # Required for NPM provenance in reusable workflow
-
-jobs:
-  release:
-    uses: angular/dev-infra/.github/workflows/reusable-release.yml@183403ae13b785698eaf13c819dda55b9fed430b # main
-    secrets:
-      wombot-token: ${{ secrets.WOMBOT_TOKEN }}
-      angular-robot-key: ${{ secrets.ANGULAR_ROBOT_PRIVATE_KEY }}

.github/workflows/scorecard.yml

@@ -0,0 +1,52 @@
+name: OpenSSF Scorecard
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: '0 0 * * 0'
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+# Declare default permissions as read only.
+permissions:
+  contents: read
+
+jobs:
+  analysis:
+    name: Scorecards analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results
+      id-token: write
+      actions: read
+      contents: read
+
+    steps:
+      - name: 'Checkout code'
+        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+        with:
+          persist-credentials: false
+
+      - name: 'Run analysis'
+        uses: ossf/scorecard-action@08b4669551908b1024bb425080c797723083c031 # v2.2.0
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          repo_token: ${{ secrets.GITHUB_TOKEN }}
+          publish_results: true
+
+      # Upload the results as artifacts.
+      - name: 'Upload artifact'
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard.
+      - name: 'Upload to code-scanning'
+        uses: github/codeql-action/upload-sarif@6a28655e3dcb49cb0840ea372fd6d17733edd8a4 # v2.21.8
+        with:
+          sarif_file: results.sarif

.github/workflows/update-cli-help.yml

@@ -0,0 +1,44 @@
+name: Update AIO Angular CLI help
+
+on:
+  workflow_dispatch:
+    inputs: {}
+  push:
+    branches:
+      - 'main'
+      - '[0-9]+.[0-9]+.x'
+
+# Declare default permissions as read only.
+permissions:
+  contents: read
+
+jobs:
+  update_cli_help:
+    name: Update Angular CLI help (if necessary)
+    if: github.repository == 'angular/angular'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout the repository
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          # Setting `persist-credentials: false` prevents the github-action account from being the
+          # account that is attempted to be used for authentication, instead the remote is set to
+          # an authenticated URL.
+          persist-credentials: false
+          # This is needed as otherwise the PR creation will fail with `shallow update not allowed` when the forked branch is not in sync.
+          fetch-depth: 0
+      - name: Generate CLI help
+        run: node aio/scripts/update-cli-help/index.mjs
+        env:
+          ANGULAR_CLI_BUILDS_READONLY_GITHUB_TOKEN: ${{ secrets.ANGULAR_CLI_BUILDS_READONLY_GITHUB_TOKEN }}
+      - name: Create a PR (if necessary)
+        uses: angular/dev-infra/github-actions/create-pr-for-changes@0109d498b0f6aae418ed4924a5e5c65695f0ac61
+        with:
+          branch-prefix: update-cli-help
+          pr-title: 'docs: update Angular CLI help [${{github.ref_name}}]'
+          pr-description: |
+            Updated Angular CLI help contents.
+          pr-labels: |
+            action: review
+            area: docs
+          angular-robot-token: ${{ secrets.ANGULAR_ROBOT_ACCESS_TOKEN }}

.github/workflows/update-events.yml

@@ -0,0 +1,48 @@
+# Update the `events.json` file that powers the [AIO events page](https://angular.io/events) (if
+# necessary) and create a pull request.
+#
+# For more details on the overall process, see
+# [aio/scripts/generate-events/README.md](../../aio/scripts/generate-events/README.md).
+
+name: Update AIO events
+
+on:
+  workflow_dispatch:
+    inputs: {}
+  schedule:
+    # Run every day at 15:00.
+    - cron: '0 15 * * *'
+
+# Declare default permissions as read only.
+permissions:
+  contents: read
+
+jobs:
+  update_events:
+    name: Update `events.json` (if necessary)
+    if: github.repository == 'angular/angular'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout the repository
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          # Setting `persist-credentials: false` prevents the github-action account from being the
+          # account that is attempted to be used for authentication, instead the remote is set to
+          # an authenticated URL.
+          persist-credentials: false
+          # This is needed as otherwise the PR creation will fail with `shallow update not allowed` when the forked branch is not in sync.
+          fetch-depth: 0
+      - name: Generate `events.json`
+        run: node aio/scripts/generate-events/index.mjs --ignore-invalid-dates
+      - name: Create a PR (if necessary)
+        uses: angular/dev-infra/github-actions/create-pr-for-changes@0109d498b0f6aae418ed4924a5e5c65695f0ac61
+        with:
+          branch-prefix: docs-update-events
+          pr-title: 'docs: update events'
+          pr-description: |
+            Generated `events.json` with the latest events retrieved from the Firebase DB.
+          pr-labels: |
+            action: review
+            area: docs
+            target: patch
+          angular-robot-token: ${{ secrets.ANGULAR_ROBOT_ACCESS_TOKEN }}

.gitignore

@@ -4,8 +4,11 @@
 /bazel-out
 /integration/bazel/bazel-*
 *.log
-node_modules/
-modules/ssr-benchmarks/node_modules/
+/node_modules/
+
+# CircleCI temporary file for cache key computation.
+# See `save_month_to_file` in `.circleci/config.yml`.
+month.txt
 
 # Include when developing application packages.
 pubspec.lock
@@ -16,7 +19,9 @@ pubspec.lock
 !.devcontainer/recommended-devcontainer.json
 !.devcontainer/recommended-Dockerfile
 .settings/
+.vscode/launch.json
 .vscode/settings.json
+.vscode/tasks.json
 *.swo
 *.swp
 modules/.settings
@@ -51,9 +56,4 @@ baseline.json
 
 # Husky
 .husky/_
-
-# Ignore cache created with the Angular CLI.
-.angular/
-
-# pnpm store
-.pnpm-store
+aio/content/examples/.DS_Store

.gitmessage

@@ -74,7 +74,7 @@ Fixes #<issue number>
 # =============================
 #
 # The full specification of the Angular Commit Message Format can be found at
-# https://github.com/angular/angular/blob/main/contributing-docs/commit-message-guidelines.md
+# https://github.com/angular/angular/blob/main/CONTRIBUTING.md#commit
 #
 # The following is an excerpt of the specification with the most commonly needed info.
 #

.husky/commit-msg

@@ -1,6 +1,9 @@
+#!/bin/sh
+. "$(dirname $0)/_/husky.sh"
+
 set +e
 
-pnpm --silent ng-dev commit-message pre-commit-validate --file $1 2>/dev/null
+yarn -s ng-dev commit-message pre-commit-validate --file $1 2>/dev/null
 if [ $? -ne 0 ]; then
   echo "WARNING: failed to run commit message validation (ng-dev commit-mesage pre-commit-validate)"
 fi

.husky/pre-commit

@@ -1,8 +1,11 @@
-set +e
+#!/bin/sh
+. "$(dirname $0)/_/husky.sh"
 
-pnpm --silent ng-dev format staged 2>/dev/null
+set +e
+yarn -s ng-dev format staged 2>/dev/null
 if [ $? -ne 0 ]; then
   echo "WARNING: failed to run file formatting (ng-dev format staged)"
 fi
 
+
 exit 0;

.husky/prepare-commit-msg

@@ -1,6 +1,9 @@
+#!/bin/sh
+. "$(dirname $0)/_/husky.sh"
+
 set +e
 
-pnpm --silent ng-dev commit-message restore-commit-message-draft $1 $2 2>/dev/null
+yarn -s ng-dev commit-message restore-commit-message-draft $1 $2 2>/dev/null
 if [ $? -ne 0 ]; then
   echo "WARNING: failed to attempt to restore commit message draft (ng-dev commit-message restore-commit-message-draft)"
 fi

.ng-dev/caretaker.mjs

@@ -1,23 +0,0 @@
-/**
- * The configuration for `ng-dev caretaker` commands.
- *
- * @type { import("@angular/ng-dev").CaretakerConfig }
- */
-export const caretaker = {
-  g3SyncConfigPath: './.ng-dev/google-sync-config.json',
-  githubQueries: [
-    {
-      name: 'Merge Queue',
-      query: `is:pr is:open label:"action: merge"`,
-    },
-    {
-      name: 'Merge Assistance Queue',
-      query: `is:pr is:open label:"merge: caretaker note" label:"action: merge"`,
-    },
-    {
-      name: 'Initial Triage Queue',
-      query: `is:open no:milestone -draft:true`,
-    },
-  ],
-  hasEmeaCaretaker: true,
-};

.ng-dev/caretaker.mts

@@ -0,0 +1,21 @@
+import {CaretakerConfig} from '@angular/ng-dev';
+
+/** The configuration for `ng-dev caretaker` commands. */
+export const caretaker: CaretakerConfig = {
+  g3SyncConfigPath: './.ng-dev/google-sync-config.json',
+  githubQueries: [
+    {
+      name: 'Merge Queue',
+      query: `is:pr is:open status:success label:"action: merge"`,
+    },
+    {
+      name: 'Merge Assistance Queue',
+      query: `is:pr is:open label:"merge: caretaker note" label:"action: merge"`,
+    },
+    {
+      name: 'Initial Triage Queue',
+      query: `is:open no:milestone -draft:true`,
+    },
+  ],
+  caretakerGroup: 'angular-caretaker',
+};

.ng-dev/commit-message.mjs

@@ -1,38 +0,0 @@
-/**
- * The configuration for `ng-dev commit-message` commands.
- *
- * @type { import("@angular/ng-dev").CommitMessageConfig }
- */
-export const commitMessage = {
-  maxLineLength: Infinity,
-  minBodyLength: 20,
-  minBodyLengthTypeExcludes: ['docs'],
-  // If you update this, also update the docs.
-  // https://github.com/angular/angular/blob/main/contributing-docs/commit-message-guidelines.md#scope
-  scopes: [
-    'animations',
-    'benchpress',
-    'common',
-    'compiler',
-    'compiler-cli',
-    'core',
-    'dev-infra',
-    'devtools',
-    'docs-infra',
-    'elements',
-    'forms',
-    'http',
-    'language-service',
-    'language-server',
-    'localize',
-    'migrations',
-    'platform-browser',
-    'platform-browser-dynamic',
-    'platform-server',
-    'router',
-    'service-worker',
-    'upgrade',
-    'vscode-extension',
-    'zone.js',
-  ],
-};

.ng-dev/commit-message.mts

@@ -0,0 +1,38 @@
+import {CommitMessageConfig} from '@angular/ng-dev';
+
+/**
+ * The configuration for `ng-dev commit-message` commands.
+ */
+export const commitMessage: CommitMessageConfig = {
+  maxLineLength: Infinity,
+  minBodyLength: 20,
+  minBodyLengthTypeExcludes: ['docs'],
+  scopes: [
+    'animations',
+    'bazel',
+    'benchpress',
+    'changelog',
+    'common',
+    'compiler',
+    'compiler-cli',
+    'core',
+    'dev-infra',
+    'devtools',
+    'docs-infra',
+    'elements',
+    'forms',
+    'http',
+    'language-service',
+    'localize',
+    'migrations',
+    'packaging',
+    'platform-browser',
+    'platform-browser-dynamic',
+    'platform-server',
+    'router',
+    'service-worker',
+    'upgrade',
+    've',
+    'zone.js',
+  ],
+};

.ng-dev/config.mjs

@@ -1,8 +0,0 @@
-import {caretaker} from './caretaker.mjs';
-import {commitMessage} from './commit-message.mjs';
-import {format} from './format.mjs';
-import {github} from './github.mjs';
-import {pullRequest} from './pull-request.mjs';
-import {release} from './release.mjs';
-
-export {commitMessage, format, github, pullRequest, caretaker, release};

.ng-dev/config.mts

@@ -0,0 +1,15 @@
+import {caretaker} from './caretaker.mjs';
+import {commitMessage} from './commit-message.mjs';
+import {format} from './format.mjs';
+import {github} from './github.mjs';
+import {pullRequest} from './pull-request.mjs';
+import {release} from './release.mjs';
+
+export {
+  commitMessage,
+  format,
+  github,
+  pullRequest,
+  caretaker,
+  release,
+};

.ng-dev/dx-perf-workflows.yml

@@ -1,7 +0,0 @@
-workflows:
-  build-adev:
-    name: Build adev
-    prepare:
-      - bazel clean
-    workflow:
-      - bazel build //adev:build

.ng-dev/format.mjs

@@ -1,9 +0,0 @@
-/**
- * Configuration for the `ng-dev format` command.
- *
- * @type { import("@angular/ng-dev").FormatConfig }
- */
-export const format = {
-  'prettier': true,
-  'buildifier': true,
-};

.ng-dev/format.mts

@@ -0,0 +1,35 @@
+import {FormatConfig} from '@angular/ng-dev';
+
+/**
+ * Configuration for the `ng-dev format` command.
+ */
+export const format: FormatConfig = {
+  'prettier': {
+    'matchers': ['**/*.{yaml,yml}'],
+  },
+  'clang-format': {
+    'matchers': [
+      '**/*.{js,ts}',
+      // TODO: burn down format failures and remove aio and integration exceptions.
+      '!aio/**',
+      '!integration/**',
+      // Both third_party and .yarn are directories containing copied code which should
+      // not be modified.
+      '!third_party/**',
+      '!.yarn/**',
+      // Do not format d.ts files as they are generated
+      '!**/*.d.ts',
+      // Do not format generated ng-dev script
+      '!dev-infra/ng-dev.js',
+      '!dev-infra/build-worker.js',
+      // Do not format compliance test-cases since they must match generated code
+      '!packages/compiler-cli/test/compliance/test_cases/**/*.js',
+      // Do not format the locale files which are checked-in for Google3, but generated using
+      // the `generate-locales-tool` from `packages/common/locales`.
+      '!packages/core/src/i18n/locale_en.ts',
+      '!packages/common/locales/closure-locale.ts',
+      '!packages/common/src/i18n/currencies.ts',
+    ],
+  },
+  'buildifier': true,
+};

.ng-dev/github.mjs

@@ -1,13 +0,0 @@
-/**
- * Github configuration for the `ng-dev` command. This repository is used as
- * remote for the merge script and other utilities like `ng-dev pr rebase`.
- *
- * @type { import("@angular/ng-dev").GithubConfig }
- */
-export const github = {
-  owner: 'angular',
-  name: 'angular',
-  mainBranchName: 'main',
-  mergeMode: 'caretaker-only',
-  requireReleaseModeForRelease: false,
-};

.ng-dev/github.mts

@@ -0,0 +1,12 @@
+import {GithubConfig} from '@angular/ng-dev';
+
+/**
+ * Github configuration for the `ng-dev` command. This repository is used as
+ * remote for the merge script and other utilities like `ng-dev pr rebase`.
+ */
+export const github: GithubConfig = {
+  owner: 'angular',
+  name: 'angular',
+  mainBranchName: 'main',
+  useNgDevAuthService: true,
+};

.ng-dev/google-sync-config.json

@@ -1,32 +1,38 @@
 {
   "syncedFilePatterns": ["LICENSE", "modules/benchmarks/**", "packages/**"],
-  "separateFilePatterns": ["packages/core/primitives/**"],
   "alwaysExternalFilePatterns": [
     "packages/*",
-    "packages/bazel/**",
+    "packages/bazel/*",
+    "packages/bazel/src/*",
+    "packages/bazel/src/api-extractor/**",
+    "packages/bazel/src/builders/**",
+    "packages/bazel/src/ng_module/**",
+    "packages/bazel/src/ng_package/**",
+    "packages/bazel/src/protractor/**",
+    "packages/bazel/src/schematics/**",
+    "packages/bazel/src/types_bundle/**",
     "packages/compiler-cli/linker/**",
     "packages/compiler-cli/src/ngtsc/sourcemaps/**",
     "packages/compiler-cli/src/ngtsc/testing/**",
     "packages/compiler-cli/private/bazel.ts",
     "packages/compiler-cli/private/localize.ts",
     "packages/compiler-cli/private/tooling.ts",
-    "packages/compiler-cli/private/hybrid_analysis.ts",
     "packages/compiler-cli/private/babel.d.ts",
     "packages/compiler-cli/src/bin/**",
-    "packages/core/schematics/utils/tsurge/helpers/angular_devkit/**",
     "packages/docs/**",
     "packages/elements/schematics/**",
     "packages/examples/**",
-    "packages/forms/signals/src/api/rules/validation/standard_schema.ts",
+    "packages/language-service/**",
     "packages/localize/**",
     "packages/private/**",
     "packages/service-worker/**",
-    "packages/ssr/BUILD.bazel",
     "packages/common/locales/generate-locales-tool/**",
     "packages/common/locales/index.bzl",
     "packages/http/**",
     "**/.gitignore",
     "**/.gitkeep",
+    "**/yarn.lock",
+    "**/package.json",
     "**/third_party/**",
     "**/tsconfig-build.json",
     "**/tsconfig-tsec.json",
@@ -34,7 +40,6 @@
     "**/rollup.config.js",
     "**/BUILD.bazel",
     "**/*.md",
-    "**/package.json",
     "packages/**/integrationtest/**",
     "packages/**/test/**",
     "packages/zone.js/*",

.ng-dev/pull-request.mjs

@@ -1,34 +0,0 @@
-/**
- * Configuration for the merge tool in `ng-dev`. This sets up the labels which
- * are respected by the merge script (e.g. the target labels).
- *
- * @type { import("@angular/ng-dev").PullRequestConfig }
- */
-export const pullRequest = {
-  githubApiMerge: {
-    default: 'auto',
-    labels: [{pattern: 'merge: squash commits', method: 'squash'}],
-  },
-  requiredBaseCommits: {
-    // PRs that target either `main` or the patch branch, need to be rebased
-    // on top of the latest commit message validation fix.
-    // These SHAs are the commits that update the required license text in the header.
-    'main': '5aeb9a4124922d8ac08eb73b8f322905a32b0b3a',
-    '10.0.x': '27b95ba64a5d99757f4042073fd1860e20e3ed24',
-  },
-  // `docs-infra` are not affecting the public NPM packages.
-  targetLabelExemptScopes: ['docs-infra'],
-  // enables specific validations during the pull request merge process
-  validators: {
-    assertEnforceTested: true,
-    assertIsolatedSeparateFiles: true,
-  },
-
-  requiredStatuses: [
-    {type: 'check', name: 'test'},
-    {type: 'check', name: 'lint'},
-    {type: 'check', name: 'adev'},
-    {type: 'check', name: 'zone-js'},
-    {type: 'status', name: 'google-internal-tests'},
-  ],
-};

.ng-dev/pull-request.mts

@@ -0,0 +1,20 @@
+import {PullRequestConfig} from '@angular/ng-dev';
+
+/**
+ * Configuration for the merge tool in `ng-dev`. This sets up the labels which
+ * are respected by the merge script (e.g. the target labels).
+ */
+export const pullRequest: PullRequestConfig = {
+  githubApiMerge: false,
+  requiredBaseCommits: {
+    // PRs that target either `main` or the patch branch, need to be rebased
+    // on top of the latest commit message validation fix.
+    // These SHAs are the commits that update the required license text in the header.
+    'main': '5aeb9a4124922d8ac08eb73b8f322905a32b0b3a',
+    '10.0.x': '27b95ba64a5d99757f4042073fd1860e20e3ed24',
+  },
+  // `dev-infra` and `docs-infra` are not affecting the public NPM packages. Similarly,
+  // the `bazel` package is not considered part of the public API so that features
+  // can land in patch branches.
+  targetLabelExemptScopes: ['dev-infra', 'docs-infra', 'bazel'],
+};

.ng-dev/release.mjs

@@ -1,58 +0,0 @@
-/**
- * Configuration for the `ng-dev release` command.
- *
- * @type { import("@angular/ng-dev").ReleaseConfig }
- */
-export const release = {
-  publishRegistry: 'https://wombat-dressing-room.appspot.com',
-  representativeNpmPackage: '@angular/core',
-  npmPackages: [
-    {
-      name: '@angular/animations',
-      deprecated: {
-        version: '>=20.2.0-next.3',
-        message:
-          '@angular/animations is deprecated. Use `animate.enter` and `animate.leave` instead. For more information see: https://v22.angular.dev/guide/animations.',
-      },
-    },
-    {name: '@angular/common'},
-    {name: '@angular/compiler-cli'},
-    {name: '@angular/compiler'},
-    {name: '@angular/core'},
-    {name: '@angular/elements'},
-    {name: '@angular/forms'},
-    {name: '@angular/language-server'},
-    {name: '@angular/language-service'},
-    {name: '@angular/localize'},
-    {
-      name: '@angular/platform-browser-dynamic',
-      deprecated: {
-        version: '>=20.1.0-next.0',
-        message:
-          '@angular/platform-browser-dynamic is deprecated. Use `@angular/platform-browser` instead.',
-      },
-    },
-    {name: '@angular/platform-browser'},
-    {name: '@angular/platform-server'},
-    {name: '@angular/router'},
-    {name: '@angular/service-worker'},
-    {name: '@angular/upgrade'},
-  ],
-  buildPackages: async () => {
-    // The buildTargetPackages function is loaded at runtime as the loading the script
-    // causes an invocation of Bazel.
-    const {performNpmReleaseBuild} = await import('../scripts/build/package-builder.mts');
-    return performNpmReleaseBuild();
-  },
-  releaseNotes: {
-    hiddenScopes: [
-      'dev-infra',
-      'docs-infra',
-      'zone.js',
-      'devtools',
-      'vscode-extension',
-      'benchpress',
-    ],
-  },
-  releasePrLabels: ['area: build & ci', 'action: merge', 'PullApprove: disable'],
-};

.ng-dev/release.mts

@@ -0,0 +1,34 @@
+import {ReleaseConfig} from '@angular/ng-dev';
+
+/** Configuration for the `ng-dev release` command. */
+export const release: ReleaseConfig = {
+  publishRegistry: 'https://wombat-dressing-room.appspot.com',
+  representativeNpmPackage: '@angular/core',
+  npmPackages: [
+    {name: '@angular/animations'},
+    {name: '@angular/common'},
+    {name: '@angular/compiler'},
+    {name: '@angular/compiler-cli'},
+    {name: '@angular/core'},
+    {name: '@angular/elements'},
+    {name: '@angular/forms'},
+    {name: '@angular/language-service'},
+    {name: '@angular/localize'},
+    {name: '@angular/platform-browser'},
+    {name: '@angular/platform-browser-dynamic'},
+    {name: '@angular/platform-server'},
+    {name: '@angular/router'},
+    {name: '@angular/service-worker'},
+    {name: '@angular/upgrade'},
+  ],
+  buildPackages: async () => {
+    // The buildTargetPackages function is loaded at runtime as the loading the script
+    // causes an invocation of Bazel.
+    const {performNpmReleaseBuild} = await import('../scripts/build/package-builder.mjs');
+    return performNpmReleaseBuild();
+  },
+  releaseNotes: {
+    hiddenScopes: ['aio', 'bazel', 'dev-infra', 'docs-infra', 'zone.js', 'devtools'],
+  },
+  releasePrLabels: ['area: build & ci', 'action: merge', 'PullApprove: disable'],
+};

.ng-dev/tsconfig.json

@@ -1,9 +1,10 @@
 {
   "compilerOptions": {
+    "strict": true,
     "target": "es2020",
     "module": "Node16",
     "noEmit": true,
     "skipLibCheck": true,
-    "types": ["node"]
+    "types": []
   }
 }

.npmrc

@@ -0,0 +1 @@
+engine-strict = true

.nvmrc

@@ -1 +1 @@
-24.21.0
+18.13.0

.pnpmfile.cjs

@@ -1,70 +0,0 @@
-// TODO: Define these packages in a single common location.
-const localAngularPackages = new Set([
-  '@angular/animations',
-  '@angular/common',
-  '@angular/compiler',
-  '@angular/compiler-cli',
-  '@angular/core',
-  '@angular/elements',
-  '@angular/forms',
-  '@angular/language-service',
-  '@angular/localize',
-  '@angular/platform-browser',
-  '@angular/platform-browser-dynamic',
-  '@angular/platform-server',
-  '@angular/router',
-  '@angular/service-worker',
-  '@angular/upgrade',
-]);
-
-const peerDepsToChange = new Set(['zone.js', 'rxjs']);
-
-function readPackage(pkg, context) {
-  // TODO(devversion): This allows us to make compiler/TS a production dependency of compiler-cli
-  // because `rules_js` doesn't otherwise include the dependency in the `npm_package_store`.
-  // See: https://github.com/aspect-build/rules_js/issues/2226
-  if (pkg.name === '@angular/compiler-cli') {
-    pkg.dependencies = {
-      ...pkg.dependencies,
-      '@angular/compiler': 'workspace:*',
-      'typescript': pkg.devDependencies['typescript'],
-    };
-
-    delete pkg.devDependencies['typescript'];
-  }
-
-  for (const [key, version] of Object.entries(pkg.peerDependencies)) {
-    // Any package that has a peerDependency on rxjs or zone.js, should instead treat the peerDependency as a
-    // regular dependency.
-    if (peerDepsToChange.has(key)) {
-      pkg.dependencies = {
-        ...pkg.dependencies,
-        [key]: pkg.devDependencies[key] ?? version,
-      };
-
-      delete pkg.devDependencies[key];
-
-      continue;
-    }
-
-    // Change all locally generated packages to directly depend on the other local packages, instead
-    // of expecting them as peerDependencies automatically as we do not auto install peer deps. The
-    // package is also removed from peerDependencies as it was moved over and will just cause errors.
-    if (pkg.version === '0.0.0-PLACEHOLDER' && localAngularPackages.has(key)) {
-      pkg.dependencies = {
-        ...pkg.dependencies,
-        [key]: 'workspace:*',
-      };
-
-      delete pkg.peerDependencies[key];
-    }
-  }
-
-  return pkg;
-}
-
-module.exports = {
-  hooks: {
-    readPackage,
-  },
-};

.prettierignore

@@ -1,49 +0,0 @@
-pnpm-lock.yaml
-
-# Do not format d.ts files as they are generated
-**/*.d.ts
-
-# Both third_party and .yarn are directories containing copied code which should
-# not be modified.
-third_party/**/*.js
-third_party/**/*.css
-third_party/**/*.md
-third_party/**/*.json
-
-# Do not format the locale files which are checked-in for Google3, but generated using
-# the `generate-locales-tool` from `packages/common/locales`.
-packages/core/src/i18n/locale_en.ts
-packages/common/locales/closure-locale.ts
-packages/common/src/i18n/currencies.ts
-
-# Test cases contain non valid code.
-packages/compiler-cli/test/compliance/test_cases/**/*.js
-packages/compiler-cli/test/compliance/test_cases/**/*.ts
-
-# Ignore generated javascript file(s)
-.github/actions/deploy-docs-site/main.js
-
-# Ignore testing data files for language service
-vscode-ng-language-service/syntaxes/test/data/*.ts
-vscode-ng-language-service/syntaxes/test/data/*.html
-
-# Ignore goldens MD files
-goldens/**/*.api.md
-
-# Ignore golden symbol json files
-packages/**/*.golden_symbols.json
-
-# adev generated files
-adev/src/content/aria/**/*.json
-adev/src/content/cli/**/*.json
-adev/src/content/cdk/**/*.json
-
-# Example package.json containing docregion (`// #docregion`) markers, which are
-# not valid JSON and cannot be processed by Prettier's json-stringify parser.
-adev/src/content/examples/schematics-for-libraries/projects/my-lib/package.json
-
-# Antigravity rules
-.agent/rules/agents.md
-
-CHANGELOG.md
-CHANGELOG_ARCHIVE.md

.prettierrc

@@ -1,25 +1,9 @@
 {
   "printWidth": 100,
   "tabWidth": 2,
-  "useTabs": false,
+  "tabs": false,
   "singleQuote": true,
-  "semi": true,
+  "semicolon": true,
   "quoteProps": "preserve",
-  "bracketSpacing": false,
-  "trailingComma": "all",
-  "overrides": [
-    {
-      "files": ["./.prettierrc"],
-      "options": {
-        "parser": "json"
-      }
-    },
-    {
-      "files": ["*.html"],
-      "excludeFiles": ["**/test/**"],
-      "options": {
-        "parser": "angular"
-      }
-    }
-  ]
+  "bracketSpacing": false
 }