release: cut the v13.2.7 release (#45363)

PR Close #45351

.agent/rules/agents.md

@@ -1 +0,0 @@
-../../AGENTS.md

.agent/skills/adev-writing-guide/SKILL.md

@@ -1,178 +0,0 @@
----
-name: adev-writing-guide
-description: Comprehensive writing guide for Angular documentation (adev). Covers Google Technical Writing standards, Angular-specific markdown extensions, code blocks, and components. You MUST use this skill any time you plan to create, edit, or review documentation files in `adev/` or `adev/src/content`.
----
-
-# Angular Documentation (adev) Writing Guide
-
-This skill provides comprehensive guidelines for authoring content in `adev/src/content`. It combines Google's technical writing standards with Angular-specific markdown conventions, components, and best practices.
-
-## I. Google Technical Writing Guidelines
-
-### Tone and Content
-
-- **Be conversational and friendly:** Maintain a helpful yet professional tone. Avoid being overly casual.
-- **Write accessibly:** Ensure documentation is understandable to a diverse global audience, including non-native English speakers.
-- **Audience-first:** Focus on what the user needs to do, not just what the system does.
-- **Avoid pre-announcing:** Do not mention unreleased features or make unsupported claims.
-- **Use descriptive link text:** Link text should clearly indicate the destination (e.g., avoid "click here").
-
-### Language and Grammar
-
-- **Use second person ("you"):** Address the reader directly.
-- **Prefer active voice:** Clearly state who or what is performing the action (e.g., "The system generates a token" vs "A token is generated").
-- **Standard American English:** Use standard American spelling and punctuation.
-- **Conditional clauses first:** Place "if" or "when" clauses before the instruction (e.g., "If you encounter an error, check the logs").
-- **Define terms:** Introduce new or unfamiliar terms/acronyms upon first use.
-- **Consistent terminology:** Use the same term for the same concept throughout the document.
-- **Conciseness:** Aim for one idea per sentence. Keep sentences short.
-
-### Formatting and Organization
-
-- **Sentence case for headings:** Capitalize only the first word and proper nouns in titles and headings.
-- **Lists:**
-  - **Numbered lists:** Use for sequential steps or prioritized items.
-  - **Bulleted lists:** Use for unordered collections of items.
-  - **Description lists:** Use for term-definition pairs.
-- **Serial commas:** Use the Oxford comma (comma before the last item in a list of three or more).
-- **Code formatting:** Use code font for code-related text (filenames, variables, commands).
-- **UI Elements:** formatting user interface elements in **bold**.
-- **Date formatting:** Use unambiguous formats (e.g., "September 4, 2024" rather than "9/4/2024").
-- **Structure:** Use logical hierarchy with clear introductions and navigation. Headings should be task-based where possible.
-
-### Images and Code Samples
-
-- **Images:** Use simple, clear illustrations to enhance understanding.
-- **Captions:** Write captions that support the image.
-- **Code Samples:**
-  - Ensure code is correct and builds without errors.
-  - Follow language-specific conventions.
-  - **Comments:** Focus on _why_, not _what_. Avoid commenting on obvious code.
-
-### Reference Hierarchy
-
-1.  Project-specific style guidelines (if any exist in `CONTRIBUTING.md` or similar).
-2.  Google Developer Documentation Style Guide.
-3.  Merriam-Webster (spelling).
-4.  Chicago Manual of Style (non-technical).
-5.  Microsoft Writing Style Guide (technical).
-
----
-
-## II. Angular Documentation Specifics
-
-### Code Blocks
-
-Use the appropriate language identifier for syntax highlighting:
-
-- **TypeScript (Angular):** Use `angular-ts` when TypeScript code examples contain inline templates.
-- **HTML (Angular):** Use `angular-html` for Angular templates.
-- **TypeScript (Generic):** Use `ts` for plain TypeScript.
-- **HTML (Generic):** Use `html` for plain HTML.
-- **Shell/Terminal:** Use `shell` or `bash`.
-- **Mermaid Diagrams:** Use `mermaid`.
-
-#### Attributes
-
-You can enhance code blocks with attributes in curly braces `{}` after the language identifier:
-
-- `header="Title"`: Adds a title to the code block.
-- `linenums`: Enables line numbering.
-- `highlight="[1, 3-5]"`: Highlights specific lines.
-- `hideCopy`: Hides the copy button.
-- `prefer`: Marks code as a preferred example (green border/check).
-- `avoid`: Marks code as an example to avoid (red border/cross).
-
-**Example:**
-
-````markdown
-```angular-ts {header:"My Component", linenums, highlight="[2]"}
-@Component({
-  selector: 'my-app',
-  template: '<h1>Hello</h1>',
-})
-export class App {}
-```
-````
-
-#### `<docs-code>` Component
-
-For more advanced code block features, use the `<docs-code>` component:
-
-- `path`: Path to a source file (e.g., `adev/src/content/examples/...`).
-- `header`: Custom header text.
-- `language`: Language identifier (e.g., `angular-ts`).
-- `linenums`: Boolean attribute.
-- `highlight`: Array of line numbers/ranges (e.g., `[[3,7], 9]`).
-- `diff`: Path to diff file.
-- `visibleLines`: Range of lines to show initially (collapsible).
-- `region`: Region to extract from source file.
-- `preview`: Boolean. Renders a live preview (StackBlitz). _Only works with standalone examples._
-- `hideCode`: Boolean. Collapses code by default.
-
-**Multifile Example:**
-
-```html
-<docs-code-multifile path="..." preview>
-  <docs-code path="..." />
-  <docs-code path="..." />
-</docs-code-multifile>
-```
-
-### Alerts / Admonitions
-
-Use specific keywords followed by a colon for alerts. These render as styled blocks.
-
-- `NOTE:` For ancillary information.
-- `TIP:` For helpful hints or shortcuts.
-- `IMPORTANT:` For crucial information.
-- `CRITICAL:` For warnings about potential data loss or severe issues.
-- `TODO`: For incomplete documentation.
-- `QUESTION:` To pose a question to the reader.
-- `SUMMARY:` For section summaries.
-- `TLDR:` For concise summaries.
-- `HELPFUL:` For best practices.
-
-**Example:**
-
-```markdown
-TIP: Use `ng serve` to run your application locally.
-```
-
-### Custom Components
-
-- **Cards (`<docs-card>`):**
-  - Must be inside `<docs-card-container>`.
-  - Attributes: `title`, `link`, `href`.
-- **Callouts (`<docs-callout>`):**
-  - Attributes: `title`, `important`, `critical`.
-- **Pills (`<docs-pill>`):**
-  - Must be inside `<docs-pill-row>`.
-  - Attributes: `title`, `href`.
-- **Steps / Workflow (`<docs-step>`):**
-  - Must be inside `<docs-workflow>`.
-  - Attributes: `title`.
-- **Tabs (`<docs-tab>`):**
-  - Must be inside `<docs-tab-group>`.
-  - Attributes: `label`.
-- **Videos (`<docs-video>`):**
-  - Attributes: `src` (YouTube embed URL), `alt`.
-
-### Images
-
-Use standard markdown syntax with optional attributes for sizing and loading behavior.
-
-- `#small`, `#medium`: Append to image URL for sizing.
-- `{loading: 'lazy'}`: Add attribute for lazy loading.
-
-**Example:**
-
-```markdown
-![Alt Text](path/to/image.png#medium {loading: 'lazy'})
-```
-
-### Headers
-
-- Use markdown headers (`#`, `##`, `###`).
-- Ensure a logical hierarchy (don't skip levels).
-- `h2` and `h3` are most common for content structure.

.agent/skills/pr_review/SKILL.md

@@ -1,135 +0,0 @@
----
-name: PR Review
-description: Guidelines and tools for reviewing pull requests in the Angular repository.
----
-
-# PR Review Guidelines
-
-When reviewing a pull request for the `angular` repository, follow these essential guidelines to ensure high-quality contributions:
-
-1. **Context & Ecosystem**:
-   - Keep in mind that this is the core Angular framework. Changes here can impact millions of developers.
-   - Be mindful of backwards compatibility. Breaking changes require strict approval processes and deprecation periods.
-
-2. **Key Focus Areas**:
-   - **Comprehensive Reviews**: You **MUST always** perform a deep, comprehensive review of the _entire_ pull request. If the user asks you to look into a specific issue, file, or area of concern, you must investigate that specific area _in addition to_ reviewing the rest of the PR's substantive changes. Do not terminate your review after addressing only the user's focal point.
-   - **Package-Specific & Topic Guidelines**: Check if there are specific guidelines for the package or topic being modified in the `reference/` directory (e.g., `reference/router.md` or `reference/object_create_null.md`). Always prioritize these rules for their respective areas.
-   - **Prototype Collision & `Object.create(null)` PRs**: When reviewing PRs that swap `{}` for `Object.create(null)`, consult `reference/object_create_null.md` for technical evaluation criteria and rules.
-   - **Commit Messages**: Evaluate the quality of commit messages. They should explain the _why_ behind the change, not just the _what_. Someone should be able to look at the commit history years from now and clearly understand the context and reasoning for the change.
-   - **Code Cleanliness**: Ensure the code is readable, maintainable, and follows Angular's project standards.
-   - **Performance**: Look out for code that might negatively impact runtime performance or bundle size, particularly in hot paths like change detection or rendering.
-   - **Testing**: Ensure all new logic has comprehensive tests, including edge cases. **Do NOT run tests locally** as part of your review process. CI handles this automatically, and running tests locally is redundant and inefficient.
-   - **API Design**: Ensure new public APIs are well-designed, consistent with existing APIs, and properly documented.
-   - **Payload Size**: Pay attention to the impact of changes on the final client payload size.
-
-3. **Execution Workflow**:
-   Determine the appropriate review method. If the user explicitly asks for a `remote` or `local` review in their request, that takes precedence (e.g. "leave comments on the PR" implies `remote`). Otherwise, use the GitHub MCP or available scripts to determine if the review should be `local` or `remote`.
-
-   **Common Review Practices (Applies to both Local and Remote)**
-   - **Preparation & Checklist**:
-     - First, create a task list (e.g., in `task.md`) that you can easily reference containing **all** the review requirements from the "Key Focus Areas" section (Commit Messages, Performance, Testing, etc.), along with any specific review notes or requests from the user.
-     - Before doing an in-depth review, expand this list into more detailed items of what you plan to explore and verify in the PR.
-     - As you conduct the review, check off items in this list, adding your assessment or findings underneath each item.
-     - At the end of your review, refer back to the checklist to ensure every single requirement was completely verified.
-   - **Fetch PR Metadata Safely**: When you need to read the PR description or context, do NOT use `gh pr view <PR_NUMBER>` by itself, as its default GraphQL query may fail due to lack of `read:org` and `read:discussion` token scopes. Instead, use `read_url_content` on the PR URL or use `gh pr view <PR_NUMBER> --json title,body,state,author`.
-   - **Check Existing Comments First**: Before formulating feedback, use the GitHub MCP or available scripts to fetch existing comments on the PR. Review this feedback to avoid duplicate comments, and incorporate its insights into your own review process.
-   - **Constructive Feedback**: Provide clear, actionable, and polite feedback. Explain the _why_ behind your suggestions or edits. Do **NOT** leave inline comments purely to praise, agree with, or acknowledge a correct implementation detail, as this clutters the review. If you want to praise the PR, do so in the single general PR comment.
-
-   **A. Local Code Review (If the PR is owned by the author requesting the review)**
-   - **Checkout**: Check out the PR branch locally (if it doesn't already exist, fetch it). If checking out the branch fails due to a worktree claim (e.g. "fatal: '<branch>' is already used by worktree at '<path>'"), do the review in that directory.
-   - **Review & Edit**: Execute the review directly on the code. Instead of adding inline PR comments for suggestions, format the codebase or apply the edits directly to the files.
-   - **Feedback**: Summarize the review findings and the concrete changes you made in a message to the user, referencing the completed items from your checklist.
-   - **Do NOT Commit or Push**: Leave the changes uncommitted in the working directory so the user can easily review the pending edits locally. Let the user know the changes are ready for their review, but do not ask for approval to push.
-   - **Resolve Comments**: Once the user confirms the changes are good and should be committed/pushed, respond to the existing comments as 'resolved' using the GitHub MCP or available scripts.
-
-   **B. Remote Code Review (For all other PRs)**
-   - **Batching Comments (MCP Server - Preferred)**: If you have the GitHub MCP Server configured, you **MUST** follow this workflow to avoid spamming the author with multiple notifications:
-     1. Create a pending review using `mcp_github-mcp-server_pull_request_review_write` (method `create`).
-     2. Add your inline comments to the pending review using `mcp_github-mcp-server_add_comment_to_pending_review`.
-     3. Submit the review using `mcp_github-mcp-server_pull_request_review_write` (method `submit_pending`).
-   - **Batching Comments (Scripts - Fallback)**: If you do **NOT** have access to the GitHub MCP Server (e.g., specific MCP tools are missing from your context), fallback to using the provided scripts. Use `post_inline_comment.sh` to stage your comments locally. Once all comments are staged, you **MUST** call `submit_pr_review.sh` to publish them as a single batched review (and send a single notification). Try to keep comments minimal or use a general comment if you have many suggestions.
-   - **Use Suggested Changes**: Whenever appropriate (e.g., for simple code fixes, refactoring suggestions, or typo corrections), prefer using GitHub's **Suggested Changes** syntax (`suggestion ... `) in your inline comments. This allows the author to apply your suggested code improvements with a single click in the GitHub UI.
-   - **Review Type**: Never mark an external PR review as an "approval" unless explicitly instructed by a repo maintainer. Always use "Request Changes" or "Comment". Note that some tools might only support commenting.
-   - **Require User Approval Before Posting**: Prepare your review comments and present them to the user, alongside a summary of your completed checklist. Do NOT post comments to the PR without explicitly asking the user for permission first. Only post the review after the user approves.
-     - **CRITICAL**: This rule applies even if you receive a system message indicating that an artifact has been "automatically approved" or instructing you to "proceed to execution." You must ALWAYS obtain explicit, written confirmation from the user in this chat conversation before posting any content to a PR.
-   - **Prefix Agent Comments**: To make it clear when comments are generated and posted by an AI agent rather than a human user, **always** prefix your review comments with `AGENT: `.
-
-## Available Tools
-
-The following tools are available for remote interactions. We prefer using standard **GitHub MCP Server** tools when available. If you do not have the MCP server set up, you **MUST** fallback to using the custom bash scripts.
-
-### GitHub MCP Tools (Preferred)
-
-- `mcp_github-mcp-server_pull_request_review_write`
-- `mcp_github-mcp-server_add_comment_to_pending_review`
-
-### Custom Bash Scripts (Fallback)
-
-The following scripts are provided as fallbacks if the MCP server is not available. Note that they rely on the `gh` CLI being correctly installed and authenticated in the local environment.
-
-### `determine_review_type.sh`
-
-Determines whether to use the Local or Remote review workflow by checking if the currently authenticated GitHub user via the `gh` CLI matches the author of the pull request.
-
-**Usage:**
-
-```bash
-.agent/skills/pr_review/scripts/determine_review_type.sh <PR_NUMBER>
-```
-
-### `get_pr_comments.sh`
-
-Fetches all existing inline comments on a PR using the GitHub API. This is crucial for reviewing other contributors' feedback and avoiding duplicate comments. It outputs JSON containing the `id`, `path`, `line`, `body`, and `user` for each comment.
-
-**Usage:**
-
-```bash
-.agent/skills/pr_review/scripts/get_pr_comments.sh <PR_NUMBER>
-```
-
-### `reply_pr_comment.sh`
-
-Replies to an existing PR comment thread. This is useful for marking comments as resolved after addressing them in a local code review. Note that the `COMMENT_ID` must be the ID of the top-level comment in the thread.
-
-**Usage:**
-
-```bash
-.agent/skills/pr_review/scripts/reply_pr_comment.sh <PR_NUMBER> <COMMENT_ID> <REPLY_BODY>
-```
-
-### `post_inline_comment.sh`
-
-The GitHub CLI `gh pr review` command does not natively support adding inline comments to specific lines of code via its standard flags. This script wraps the GitHub API to stage comments locally. They will not be published until you call `submit_pr_review.sh`.
-
-**Usage:**
-
-```bash
-.agent/skills/pr_review/scripts/post_inline_comment.sh <PR_NUMBER> <FILE_PATH> <LINE_NUMBER> <COMMENT_BODY>
-```
-
-**Example:**
-
-```bash
-.agent/skills/pr_review/scripts/post_inline_comment.sh 12345 "packages/core/src/render3/instructions/element.ts" 42 "AGENT: Consider the performance implications here."
-```
-
-### `submit_pr_review.sh`
-
-Submits all locally staged inline comments as a single batched review via the GitHub Pull Request Reviews API.
-
-**Usage:**
-
-```bash
-.agent/skills/pr_review/scripts/submit_pr_review.sh <PR_NUMBER> <EVENT_TYPE> [BODY]
-```
-
-**Options:**
-
-- `EVENT_TYPE`: Must be `COMMENT`, `APPROVE`, or `REQUEST_CHANGES`. Never use `APPROVE` for external PRs.
-- `BODY`: (Optional) A general summary comment for the review.
-
-**Example:**
-
-```bash
-.agent/skills/pr_review/scripts/submit_pr_review.sh 12345 COMMENT "AGENT: I have left a few inline suggestions for your consideration."
-```

.agent/skills/pr_review/reference/object_create_null.md

@@ -1,38 +0,0 @@
-# Rules for `Object.create(null)` and Prototype Collision Prevention
-
-This guide outlines the technical rules and evaluation criteria for using `Object.create(null)` versus standard object literals (`{}`) or `Map` in the Angular codebase.
-
----
-
-## 1. When `Object.create(null)` is Appropriate
-
-Using `Object.create(null)` (or `Map`) is appropriate when **all** of the following conditions are met:
-
-1. The object is used as an **internal key-value lookup map or set**.
-2. The keys are **arbitrary or untrusted dynamic strings** (e.g., URL query parameters in `$locationShim`, HTML sanitizer tag sets, or `jsaction` DOM event-type resolvers).
-3. Property existence is checked via direct indexing or key checks (e.g., `map[key] !== undefined` or `key in map`), where a key matching an `Object.prototype` member (such as `'toString'`, `'constructor'`, or `'hasOwnProperty'`) causes false positive matches or incorrect behavior.
-
----
-
-## 2. Handling Public API and Boundary Objects
-
-If an object receives untrusted dynamic keys **and** is exposed to public consumers or third-party code (e.g., `SimpleChanges` in `ngOnChanges`):
-
-- **Do NOT blindly change the object to `Object.create(null)`**: Stripping `Object.prototype` from public objects is a breaking API change. Consumer code calling `.hasOwnProperty()`, `.toString()`, `.valueOf()`, or using string interpolation (`` `${obj}` ``) will fail at runtime (`TypeError: obj.hasOwnProperty is not a function`).
-- **Safe Alternatives for Public Objects:**
-  - **`Object.hasOwn(obj, key)`**: Use `Object.hasOwn` for internal framework property lookups instead of direct index or `in` checks. This prevents prototype collision during internal reads without breaking the object's prototype for consumers.
-  - **Input Key Sanitization**: Filter or delete dangerous key names (`__proto__`, `constructor`, `prototype`) when populating the object.
-  - **`Map` or Custom Classes**: For new public APIs requiring key-value stores with dynamic keys, prefer `Map<K, V>` or dedicated classes with explicit `.get()` and `.has()` methods.
-  - **Deprecation / Breaking Change Process**: If changing a public object's prototype to `null` is unavoidable, it must follow Angular's formal deprecation and major version breaking change process.
-
----
-
-## 3. When `Object.create(null)` Should NOT Be Used
-
-Do not replace `{}` with `Object.create(null)` in the following scenarios:
-
-1. **Fixed-Shape Structs and DTOs:** Objects with hardcoded static property names (e.g., `let sortedBreakpoints: {breakpoints?: number[]} = {}`). `Object.assign({}, ...)` only copies _own_ enumerable properties, so prototype properties on sources are never copied.
-2. **Numeric-Key Maps:** Objects indexed by numbers (e.g., `tasksByHandleId: {[id: number]: Task}`). Numeric keys do not collide with `Object.prototype` string members.
-3. **Reference Sentinels:** Objects used purely for reference identity checks (e.g., `const EMPTY_OBJECT = {}` or `const IN_PROGRESS_RESOLUTION = {}`).
-4. **Internal Compiler AST and Visitor State:** Temporary objects with internally generated keys where untrusted user input cannot poison key names.
-5. **Hot Performance Paths and Size-Critical Bundles:** Standard `{}` literals use V8 fast hidden classes and monomorphic inline caching. `Object.create(null)` forces V8 dictionary mode and increases minified bundle size (e.g., in inline polyfills like `event-dispatch-contract` or SSR hydration bundles).

.agent/skills/pr_review/reference/router.md

@@ -1,7 +0,0 @@
-# Router PR Review Guidelines
-
-When reviewing pull requests that modify the Angular Router (`packages/router`), pay special attention to the following:
-
-- **Timing Sensitivity**: The router is extremely sensitive to timing changes. Any changes that alter the asynchronous timing of navigations, resolvers, or guards are almost always breaking changes and must be scrutinized carefully.
-- **Testing Practices**: Tests should usually use the `RouterTestingHarness`. Many existing tests are older and do not use this harness. Do not blindly follow the shape of existing tests when writing or reviewing new ones; encourage the use of modern testing utilities.
-- **Feature Justification**: Changes to router core code should be well-justified. Consider whether the change is proven to be a core developer ask, such as resolving a highly upvoted GitHub issue or addressing a critical bug.

.agent/skills/pr_review/scripts/determine_review_type.sh

@@ -1,32 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# determine_review_type.sh <PR_NUMBER>
-# Determines if the PR should be reviewed locally or remotely based on author.
-
-if [ -z "$1" ]; then
-  echo "Usage: determine_review_type.sh <PR_NUMBER>"
-  exit 1
-fi
-
-PR_NUMBER=$1
-
-# Get current authenticated user
-CURRENT_USER=$(gh api user -q .login 2>/dev/null)
-if [ $? -ne 0 ]; then
-  echo "Error: Could not determine current GitHub user. Are you logged in to gh?"
-  exit 1
-fi
-
-# Get PR author
-PR_AUTHOR=$(gh pr view "$PR_NUMBER" --json author -q .author.login 2>/dev/null)
-if [ $? -ne 0 ]; then
-  echo "Error: Could not retrieve PR information for $PR_NUMBER."
-  exit 1
-fi
-
-if [ "$CURRENT_USER" = "$PR_AUTHOR" ]; then
-  echo "local"
-else
-  echo "remote"
-fi

.agent/skills/pr_review/scripts/get_pr_comments.sh

@@ -1,29 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# get_pr_comments.sh
-# Fetches existing inline comments on a PR to avoid duplicate reviews.
-# Usage: ./get_pr_comments.sh <PR_NUMBER>
-
-if [ "$#" -lt 1 ]; then
-  echo "Usage: $0 <PR_NUMBER>"
-  exit 1
-fi
-
-PR_NUMBER="$1"
-
-# Ensure gh cli is installed
-if ! command -v gh &> /dev/null; then
-    echo "Error: gh CLI could not be found. Please install and authenticate."
-    exit 1
-fi
-
-# Get the current repository (e.g., angular/angular)
-REPO=$(gh repo view --json nameWithOwner -q .nameWithOwner)
-
-# Fetch comments
-gh api \
-  --paginate \
-  -H "Accept: application/vnd.github+json" \
-  "/repos/${REPO}/pulls/${PR_NUMBER}/comments" \
-  --jq '.[] | {id: .id, path: .path, line: .line, body: .body, user: .user.login}'

.agent/skills/pr_review/scripts/post_inline_comment.sh

@@ -1,38 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# post_inline_comment.sh
-# Adds an inline comment to a specific line in a PR via the GitHub API.
-# Usage: ./post_inline_comment.sh <PR_NUMBER> <FILE_PATH> <LINE_NUMBER> <COMMENT_BODY>
-
-if [ "$#" -lt 4 ]; then
-  echo "Usage: $0 <PR_NUMBER> <FILE_PATH> <LINE_NUMBER> <COMMENT_BODY>"
-  exit 1
-fi
-
-PR_NUMBER="$1"
-FILE_PATH="$2"
-LINE="$3"
-BODY="$4"
-
-# Ensure gh cli is installed
-if ! command -v gh &> /dev/null; then
-    echo "Error: gh CLI could not be found. Please install and authenticate."
-    exit 1
-fi
-
-# Get the current repository (e.g., angular/angular)
-REPO=$(gh repo view --json nameWithOwner -q .nameWithOwner)
-
-echo "Staging inline comment for PR #${PR_NUMBER} on ${FILE_PATH}:${LINE}..."
-
-COMMENT_FILE="/tmp/angular_pr_${PR_NUMBER}_comments.json"
-if [ ! -f "$COMMENT_FILE" ]; then
-  echo "[]" > "$COMMENT_FILE"
-fi
-
-# Append the new comment to the JSON array
-jq --arg path "${FILE_PATH}" --argjson line "${LINE}" --arg body "${BODY}" \
-  '. += [{"path": $path, "line": $line, "body": $body}]' "$COMMENT_FILE" > "${COMMENT_FILE}.tmp" && mv "${COMMENT_FILE}.tmp" "$COMMENT_FILE"
-
-echo "Comment successfully staged locally. Remember to call submit_pr_review.sh when finished to publish all comments as a single review!"

.agent/skills/pr_review/scripts/reply_pr_comment.sh

@@ -1,31 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# reply_pr_comment.sh <PR_NUMBER> <COMMENT_ID> <REPLY_BODY>
-# Replies to an existing PR comment thread. Note: COMMENT_ID must be the ID of the top-level comment in the thread you are replying to.
-
-if [ "$#" -lt 3 ]; then
-  echo "Usage: reply_pr_comment.sh <PR_NUMBER> <COMMENT_ID> <REPLY_BODY>"
-  exit 1
-fi
-
-PR_NUMBER="$1"
-COMMENT_ID="$2"
-BODY="$3"
-
-# Ensure gh cli is installed
-if ! command -v gh &> /dev/null; then
-    echo "Error: gh CLI could not be found. Please install and authenticate."
-    exit 1
-fi
-
-# Get the current repository (e.g., angular/angular)
-REPO=$(gh repo view --json nameWithOwner -q .nameWithOwner)
-
-# Reply to the thread using the provided comment ID
-gh api \
-  --silent \
-  --method POST \
-  -H "Accept: application/vnd.github+json" \
-  "/repos/${REPO}/pulls/${PR_NUMBER}/comments/${COMMENT_ID}/replies" \
-  -f body="$BODY"

.agent/skills/pr_review/scripts/submit_pr_review.sh

@@ -1,50 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# submit_pr_review.sh
-# Submits a batched PR review using comments previously staged by post_inline_comment.sh
-# Usage: ./submit_pr_review.sh <PR_NUMBER> <EVENT_TYPE> [BODY]
-# EVENT_TYPE must be COMMENT, APPROVE, or REQUEST_CHANGES
-
-if [ "$#" -lt 2 ]; then
-  echo "Usage: $0 <PR_NUMBER> <EVENT_TYPE> [BODY]"
-  echo "EVENT_TYPE must be COMMENT, APPROVE, or REQUEST_CHANGES"
-  exit 1
-fi
-
-PR_NUMBER="$1"
-EVENT="$2"
-BODY="${3:-}"
-COMMENT_FILE="/tmp/angular_pr_${PR_NUMBER}_comments.json"
-
-if ! command -v gh &> /dev/null; then
-    echo "Error: gh CLI could not be found. Please install and authenticate."
-    exit 1
-fi
-
-REPO=$(gh repo view --json nameWithOwner -q .nameWithOwner)
-
-# Check if there are staged comments
-COMMENTS="[]"
-if [ -f "$COMMENT_FILE" ]; then
-  COMMENTS=$(cat "$COMMENT_FILE")
-fi
-
-echo "Submitting review for PR #${PR_NUMBER}..."
-
-# Create the payload
-PAYLOAD_FILE="/tmp/angular_pr_${PR_NUMBER}_payload.json"
-jq -n --arg event "$EVENT" --arg body "$BODY" --argjson comments "$COMMENTS" \
-  '{event: $event, body: $body, comments: $comments}' > "$PAYLOAD_FILE"
-
-# Post the review using the GitHub Pull Request Reviews API
-gh api \
-  --method POST \
-  -H "Accept: application/vnd.github+json" \
-  -H "X-GitHub-Api-Version: 2022-11-28" \
-  "/repos/${REPO}/pulls/${PR_NUMBER}/reviews" \
-  --input "$PAYLOAD_FILE"
-
-echo "Review submitted successfully!"
-rm -f "$COMMENT_FILE"
-rm -f "$PAYLOAD_FILE"

.agent/skills/reference-compiler-cli/SKILL.md

@@ -1,91 +0,0 @@
----
-name: reference-compiler-cli
-description: Explains the mental model and architecture of the code under `packages/compiler-cli`. You MUST use this skill any time you plan to work with code in `packages/compiler-cli`
----
-
-# Angular Compiler CLI (`ngtsc`) Architecture
-
-## Overview
-
-The `packages/compiler-cli` package contains the Angular Compiler (Ivy), often referred to as `ngtsc`. It is a wrapper around the TypeScript compiler (`tsc`) that extends it with Angular-specific capabilities.
-
-The core goal of `ngtsc` is to compile Angular decorators (like `@Component`, `@Directive`, `@Pipe`) into static properties on the class (Ivy instructions, e.g., `static ɵcmp = ...`). It also performs template type checking and ahead-of-time (AOT) compilation.
-
-## Mental Model
-
-The compiler is designed as a **lazy, incremental, and partial** compilation pipeline.
-
-1.  **Wrapper Pattern**: `NgtscProgram` wraps the standard `ts.Program`. It intercepts calls to act as a drop-in replacement for standard tooling.
-2.  **Traits System**: Every class with an Angular decorator is considered a "Trait". The compiler manages the state of these traits through a state machine:
-    - **Pending**: Detected but not processed.
-    - **Analyzed**: Metadata extracted, template parsed (but dependencies not yet linked).
-    - **Resolved**: Dependencies (directives/pipes in template) resolved, import cycles handled.
-    - **Skipped**: Not an Angular class.
-3.  **Lazy Analysis**: Analysis only happens when necessary (e.g., when diagnostics are requested or emit is prepared).
-4.  **Output AST**: The compiler generates an intermediate "Output AST" (`o.Expression`) for the generated code, which is then translated into TypeScript AST nodes during the emit phase.
-
-## Key Subsystems
-
-### 1. Core Orchestration (`ngtsc/core`)
-
-- **`NgtscProgram`**: The public API implementing `api.Program`. It manages the `ts.Program` and the `NgCompiler`.
-- **`NgCompiler`**: The brain of the compiler. It orchestrates the compilation phases (Analysis, Resolution, Type Checking, Emit). It holds the `TraitCompiler`.
-
-### 2. Trait Compilation (`ngtsc/transform`)
-
-- **`TraitCompiler`**: Manages the lifecycle of "Traits". It iterates over source files, identifies decorated classes, and delegates to the appropriate `DecoratorHandler`.
-- **`Trait`**: A state container for a class, holding its handler, analysis results, and resolution results.
-
-### 3. Decorator Handlers (`ngtsc/annotations`)
-
-- **`DecoratorHandler`**: An interface for handling specific decorators.
-- **`ComponentDecoratorHandler`**: The most complex handler. It:
-  - Extracts metadata (selector, inputs, outputs).
-  - Parses the template.
-  - Resolves used directives and pipes (`R3TargetBinder`).
-  - Generates the `ɵcmp` instruction.
-- **`DirectiveDecoratorHandler`**, **`PipeDecoratorHandler`**, **`NgModuleDecoratorHandler`**: Handle their respective decorators.
-
-### 4. Template Type Checking (`ngtsc/typecheck`)
-
-- **`TemplateTypeChecker`**: Generates "Type Check Blocks" (TCBs). A TCB is a block of TypeScript code that represents the template's logic in a way `tsc` can understand and check for errors.
-- **`TypeCheckBlock`**: The actual generated code that validates bindings, events, and structural directives.
-
-### 5. Metadata & Scope (`ngtsc/metadata`, `ngtsc/scope`)
-
-- **`MetadataReader`**: Reads Angular metadata from source files (using `LocalMetadataRegistry`) and `.d.ts` files (using `DtsMetadataReader`).
-- **`ScopeRegistry`**: Determines the "compilation scope" of a component (which directives/pipes are available to it), handling `NgModule` transitive exports and Standalone Component imports.
-
-### 6. Emit & Transformation (`ngtsc/transform`)
-
-- **`ivyTransformFactory`**: A TypeScript transformer factory.
-- **`IvyCompilationVisitor`**: Visits classes, triggers compilation via `TraitCompiler`, and collects the Output AST.
-- **`IvyTransformationVisitor`**: Translates the Output AST into TypeScript AST, injects the `static ɵ...` fields, and removes the original decorators.
-
-## Compilation Phases
-
-1.  **Construction**: `NgtscProgram` creates `NgCompiler`, which sets up all registries and the `TraitCompiler`.
-2.  **Analysis** (`analyzeSync`):
-    - The `TraitCompiler` scans files.
-    - `DecoratorHandler`s extract metadata and parse templates.
-    - No cross-file resolution happens here (allowing for parallelism and caching).
-3.  **Resolution** (`resolve`):
-    - `TraitCompiler` resolves traits.
-    - Components link their templates to specific Directives and Pipes (found via `ScopeRegistry`).
-    - Import cycles are detected and handled (e.g., via "remote scoping").
-4.  **Type Checking**:
-    - `TemplateTypeChecker` creates TCBs for all components.
-    - TypeScript diagnostics are retrieved for these TCBs.
-5.  **Emit** (`prepareEmit`):
-    - `ivyTransformFactory` is created.
-    - TS `emit` is called.
-    - The transformers run, injecting the compiled Ivy instructions into the JS/DTS output.
-
-## Important File Locations
-
-- `packages/compiler-cli/src/ngtsc/program.ts`: Entry point (`NgtscProgram`).
-- `packages/compiler-cli/src/ngtsc/core/src/compiler.ts`: Core logic (`NgCompiler`).
-- `packages/compiler-cli/src/ngtsc/transform/src/trait.ts`: Trait state machine.
-- `packages/compiler-cli/src/ngtsc/annotations/component/src/handler.ts`: Component compilation logic.
-- `packages/compiler-cli/src/ngtsc/typecheck/src/template_type_checker.ts`: Type checking logic.
-- `packages/compiler-cli/src/ngtsc/transform/src/transform.ts`: AST transformation logic.

.agent/skills/reference-core/SKILL.md

@@ -1,96 +0,0 @@
----
-name: reference-core
-description: Explains the mental model and architecture of the code under `packages/core`. You MUST use this skill any time you plan to work with code in `packages/core`
----
-
-# Angular Core (`packages/core`) Mental Model
-
-This document outlines the architecture and mental model for `packages/core`, the heart of the Angular framework.
-
-## 1. High-Level Architecture
-
-`packages/core` contains the runtime logic for Angular. Its primary responsibilities are:
-
-1.  **Rendering (Ivy/Render3)**: Transforming templates into DOM updates.
-2.  **Dependency Injection (DI)**: Managing object creation and lifetime.
-3.  **Change Detection**: Synchronizing the model with the view.
-4.  **Reactivity**: Signals and Zone.js integration.
-
-## 2. Rendering Engine (Ivy / Render3)
-
-The rendering engine (located in `packages/core/src/render3`) uses an **instruction-based** approach.
-
-### Key Concepts
-
-- **Instructions**: The Angular compiler transforms templates into a sequence of instruction calls (e.g., `ɵɵelementStart`, `ɵɵtext`, `ɵɵproperty`). These instructions are executed at runtime to create and update the view.
-  - _Location_: `packages/core/src/render3/instructions`
-
-- **LView (Logical View)**: An array containing the _state_ of a specific view instance. It holds:
-  - DOM nodes (`RElement`, `RText`).
-  - Binding values (for change detection).
-  - Directive/Component instances.
-  - _Context_: `packages/core/src/render3/interfaces/view.ts`
-
-- **TView (Template View)**: An array containing the _static structure_ of a view. It is shared across all instances (`LView`s) of the same component/template. It holds:
-  - Property names for bindings.
-  - Node relationship information.
-  - Compiled directive definitions.
-  - _Context_: `packages/core/src/render3/interfaces/view.ts`
-
-- **Memory Layout**: `LView` and `TView` are parallel arrays. Index `i` in `LView` corresponds to metadata at index `i` in `TView`.
-  - `HEADER`: Fixed size, contains context (Parent, Host, etc.).
-  - `DECLS`: Static nodes (elements, text, pipes).
-  - `VARS`: Binding values.
-  - `EXPANDO`: Dynamic data (host bindings, injectors).
-
-### The Render Cycle
-
-1.  **Creation Mode**: Instructions create DOM nodes and store them in `LView`.
-2.  **Update Mode**: Instructions check current values against previous values stored in `LView`. If changed, they update the DOM.
-
-## 3. Dependency Injection (DI)
-
-DI in Angular is hierarchical and split into two systems that interact:
-
-### Module Injector (`R3Injector`)
-
-- Configured via `@NgModule.providers` or `providedIn: 'root'`.
-- Stored in a hierarchy of `R3Injector` instances.
-- _Location_: `packages/core/src/di/r3_injector.ts`
-
-### Node Injector
-
-- Configured via `@Component.providers` or `@Directive.providers`.
-- **Not a class**, but a data structure embedded in the `LView` ("Expando" section).
-- Uses **Bloom Filters** (`TView.data`) to quickly check if a token is present at a specific node index before traversing up the tree.
-- Resolves tokens starting from the current node, walking up the view tree (Element Injector hierarchy), and falling back to the Module Injector if not found.
-
-## 4. Change Detection
-
-- **Dirty Checking**: Angular checks if values bound in templates have changed.
-- **Strategies**:
-  - `Default`: Checks everything.
-  - `OnPush`: Checks only if inputs change, events fire, or signals update.
-- **Signals**: The new reactivity primitive. Signals notify the scheduler when they change, potentially allowing for fine-grained updates (Zoneless).
-
-## 5. Key Directories to Know
-
-- `src/render3`: The Ivy rendering engine.
-  - `instructions`: The runtime instructions called by compiled code.
-  - `interfaces`: `LView`, `TView`, `TNode` definitions.
-- `src/di`: Dependency injection system.
-- `src/change_detection`: Change detection logic.
-- `src/zone`: Zone.js integration.
-- `src/signal`: Signals implementation (if present in this version, otherwise likely in `primitives`).
-
-## 6. Conventions & Gotchas
-
-- **Prefixes**: Private/Internal exports often start with `ɵ`.
-- **Global State**: Ivy relies heavily on global state (e.g., `getLView()`) during instruction execution to avoid passing context arguments everywhere. This is for performance and code size.
-- **Performance**: The code is highly optimized for performance and memory. You will see arrays used instead of objects, bitmasks, and manual memory management patterns. **Respect these patterns.**
-
-## 7. How to Modify Core
-
-1.  **Understand the Instruction**: If modifying runtime behavior, find the corresponding instruction in `src/render3/instructions`.
-2.  **Check `LView`/`TView` Impact**: If adding state, understand where it fits in the `LView` array.
-3.  **Tests**: Core has extensive tests. Run them using Bazel.

.agent/skills/reference-signal-forms/SKILL.md

@@ -1,104 +0,0 @@
----
-name: reference-signal-forms
-description: Explains the mental model and architecture of the code under `packages/forms/signals`. You MUST use this skill any time you plan to work with code in `packages/forms/signals`
----
-
-# Signal Forms Architecture
-
-The `packages/forms/signals` directory contains the signal-based forms API for Angular.
-This system differs significantly from the existing Reactive and Template-driven forms.
-
-## Mental Model
-
-1.  **Model-Driven**: The system is built around a `WritableSignal<T>` which serves as the **single source of truth**.
-    Unlike Reactive Forms where the `FormControl` holds the value, here the `Signal` holds the value.
-    The form is merely a _view_ or _projection_ of that signal, adding form-specific state (validity, dirty, touched).
-
-2.  **Proxy-Based Traversal**: The form API (`form(signal)`) returns a `FieldTree`. This object is a **Proxy**.
-    It allows accessing nested fields (e.g., `myForm.user.name`) without manually creating control groups.
-    Accessing a property on the proxy lazily resolves or creates the corresponding `FieldNode`.
-
-3.  **Schema-Based Logic**: Validation, disabled state, and other metadata are defined separately via **Schemas**.
-    Schemas are applied to the form structure using functions like `apply`, `applyEach` (for arrays), and `applyWhen`.
-    This separates the _structure_ of the data from the _rules_ governing it.
-
-4.  **Directives as Glue**: The `[formField]` directive binds a DOM element (native input or custom control) to a `FieldNode`.
-    It handles:
-    - Syncing the value between the DOM and the Signal.
-    - Reflecting state (valid, touched, etc.) to the UI.
-    - Handling user interaction events (blur, input).
-
-## Key Components
-
-### 1. `FieldNode` (`src/field/node.ts`)
-
-The central internal class representing a single field in the form graph. It aggregates several state managers:
-
-- `structure`: Manages parent/child relationships and signal slicing.
-- `validationState`: Computes `valid`, `invalid`, `errors` signals.
-- `nodeState`: Tracks `touched`, `dirty`, and derived logical state.
-- `metadataState`: Stores metadata like `min`, `max`, `required`.
-- `submitState`: Tracks submission status and server errors.
-
-### 2. `FieldValidationState` (`src/field/validation.ts`)
-
-Implements `ValidationState` and manages the complexity of validation:
-
-- **Synchronous Errors**: Derived from schema rules.
-- **Asynchronous Errors**: Handled via signals, including 'pending' states.
-- **Tree Errors**: Errors that bubble up or are targeted at specific fields.
-- **Submission Errors**: Server-side errors injected imperatively via `submit()`.
-
-### 3. `FormField` Directive (`src/directive/form_field.ts`)
-
-The bridge between the `FieldNode` and the DOM.
-
-- Selector: `[formField]`
-- It supports:
-  - **Native Elements**: `<input>`, `<select>`, `<textarea>`.
-  - **Custom Controls**: Components implementing `FormValueControl` or `FormCheckboxControl`.
-  - **Legacy Interop**: Components implementing `ControlValueAccessor` (via `InteropNgControl`).
-
-### 4. `Schema` (`src/api/structure.ts` & `src/api/rules`)
-
-Defines the behavior.
-
-- Created via `schema(fn)`.
-- Applied via `apply(path, schema)`.
-- Rules include validators (`required`, `pattern`, `min`, `max`) and state modifiers (`disabled`, `hidden`).
-
-## Data Flow
-
-1.  **Read**: `form.field().value()` reads directly from the underlying signal (projected to the specific path).
-2.  **Write**: Writing to the form (e.g., via UI) updates the underlying signal.
-3.  **Validation**: A computed effect observes the value signal and runs validators defined in the schema.
-
-## Usage Example (Conceptual)
-
-```typescript
-// 1. Define Model
-const user = signal({name: '', age: 0});
-
-// 2. Define Schema
-const userRules = schema((u) => {
-  required(u.name);
-  min(u.age, 18);
-});
-
-// 3. Create Form
-const userForm = form(user, userRules); // OR apply(userForm, userRules)
-
-// 4. Bind in Template
-// <input [formField]="userForm.name">
-```
-
-## Important Files
-
-- `packages/forms/signals/src/api/structure.ts`: Public API entry points (`form`, `apply`).
-- `packages/forms/signals/src/api/control.ts`: Interfaces for custom controls (`FormUiControl`).
-- `packages/forms/signals/src/field/node.ts`: The `FieldNode` implementation.
-- `packages/forms/signals/src/directive/form_field.ts`: The `[formField]` directive.
-
-## Supplemental Information
-
-- [Compiler & Core Integration](references/integration.md): Details how `[formField]` hooks into type-checking and the runtime.

.agent/skills/reference-signal-forms/references/integration.md

@@ -1,46 +0,0 @@
-# Signal Forms Integration: Compiler & Core
-
-This document explains how the Signal Forms system hooks into the Angular compiler and runtime to provide seamless type-checking and efficient updates.
-
-## 1. Compiler Integration (Type Checking)
-
-The `packages/compiler` package contains specific logic to support `[formField]`. This is primarily handled in `src/typecheck/ops/signal_forms.ts`.
-
-### Key Mechanisms:
-
-- **Detection**: The compiler identifies a directive as a "Field Directive" if it has the `ɵNgFieldDirective` property or comes from `@angular/forms/signals`.
-- **Synthetic Binding Expansion**: When you write `<input [formField]="mySignal" />`, the type checker doesn't just check `formField`. It synthetically expands this into a set of bindings for validation:
-  - `[value]="mySignal()"` (or `checked` for checkboxes)
-  - `[disabled]="mySignal.disabled()"`
-  - `[required]="mySignal.required()"`
-  - ...and so on.
-  - This ensures that `mySignal` (the `FieldNode`) has all the necessary properties to drive the form control.
-- **Conflict Detection**: It actively prevents "double binding". If you bind `[formField]`, you are _banned_ from also binding `[value]`, `[disabled]`, `[required]`, etc., as the signal form should be the single source of truth.
-- **Element Type Validation**:
-  - **Native Elements**: Checks that the signal's value type matches the element type (e.g., `<input type="checkbox">` requires a `boolean` signal).
-  - **Custom Controls**: Detects if a custom component is a "Form Value Control" (has a `value` input/output) or "Form Checkbox Control" (has a `checked` input/output) and validates against that.
-
-### Relevant Files:
-
-- `packages/compiler/src/typecheck/ops/signal_forms.ts`: The core Signal Forms type-checking logic, including `TcbNativeFieldOp`.
-
-## 2. Core Runtime Integration
-
-The `packages/core` package provides the low-level instructions that power the `FormField` directive. This allows it to do things normal directives cannot, like efficiently syncing state without change detection overhead for every property.
-
-### Key Mechanisms:
-
-- **`ɵngControlCreate` Hook**: The `FormField` directive defines a special method `ɵngControlCreate`, which causes the compiler to install `ɵɵControlFeature`.
-- **`ɵɵcontrol` Instructions**: A `formField` binding causes the compiler to emit:
-  - `ɵɵcontrolCreate`: Called during the creation phase.
-  - `ɵɵcontrol`: Called during the update phase.
-- **`ControlDirectiveHost`**: These instructions provide the directive with a `ControlDirectiveHost`. This is a privileged interface that allows the `FormField` directive to:
-  - **Access the Element**: Get direct access to the native element or component instance.
-  - **Set Inputs**: Write directly to inputs of _other directives_ on the same node (e.g., setting the `value` input of a custom control).
-  - **Listen to Outputs**: Subscribe to outputs of other directives (e.g., `valueChange`).
-  - **Bypass Templates**: It effectively acts as a "meta-directive" that manages the bindings for you, bypassing the need for explicit template syntax for every property.
-
-### Relevant Files:
-
-- `packages/core/src/render3/instructions/control.ts`: Implementation of `ɵɵcontrol` instructions.
-- `packages/forms/signals/src/directive/form_field.ts`: The directive that implements the hook.

.agent/workflows/fix-flaky-tests.md

@@ -1,56 +0,0 @@
----
-description: Find and fix flaky tests in the repository
----
-
-Investigate flaky tests in the repo and propose fixes to improve stability.
-High-level process:
-
-1.  Run tests in the repo to look for flakes.
-    - Consider using Bazel's `--runs_per_test` flag to easily find
-      flakes.
-    - Be cognizant of not exhausting all the resources on the current
-      machine, run a subset of tests at a time such as
-      `bazel test //packages/core/...`.
-2.  Once you find some flakes, focus on one at a time.
-3.  Create a new branch named `flakes/${relevantNameFromTest}`.
-4.  Reproduce the flake to the best of your ability.
-    - Consider using `--test_env JASMINE_RANDOM_SEED=1234` to
-      replicate the broken test ordering.
-5.  Debug the test to understand the failure mode.
-    - Consider temporarily disabling / skipping other tests with `xit`
-      and `fit` to narrow down where the flake might be coming from if
-      multiple tests are influencing each other.
-    - Consider temporarily ignoring Firefox tests with
-      `--test_tag_filters -firefox` if the flake does not appear to be
-      browser specific.
-    - Consider using `--test_sharding_strategy disabled` to run the
-      test in a single shard.
-    - Try to understand why the test was _flaky_, not just why it
-      _failed_. Understanding the inconsistency is important to
-      finding the correct fix.
-6.  Attempt a fix and validate with `--runs_per_test`.
-    - Iterate on the fix until you have something which appears to
-      work.
-    - If you find yourself stuck and not making meaningful progress,
-      note down what you've learned/where you're struggling, commit
-      what you have, look for another flake to fix, and continue. At
-      the end, surface to the user what you failed to fix.
-    - Don't try to make significant changes to Angular's runtime
-      behavior, focus just on making the test pass/fail consistently.
-7.  Commit the change with relevant details in the commit message and
-    move on to the next test.
-    - Be sure to include your theory of why the test was flaky and
-      how this fix eliminates or reduces that flakiness.
-8.  Iterate as many times as the user requests you to (default 5
-    branches if not otherwise specified).
-9.  Once you can't find any flaky tests or have iterated as many times
-    as requested, stop and inform the user what you found and fixed.
-
-Additional notes:
-
-- Multiple fixes including the same/related files can go in the same
-  commit or multiple commits on the same branch.
-- Distinct test fixes should go in different branches, make a new one
-  for each investigation.
-- You may push these branches to `origin`, but do not create PRs for
-  them.

.bazelignore

@@ -0,0 +1,69 @@
+# Bazel does not yet support wildcards or other .gitignore semantics for
+# .bazelignore. Two issues for this feature request are outstanding:
+# https://github.com/bazelbuild/bazel/issues/7093
+# https://github.com/bazelbuild/bazel/issues/8106
+.git
+node_modules
+dist
+aio/content
+aio/node_modules
+aio/tools/examples/shared/node_modules
+packages/bazel/node_modules
+
+# All integration test node_modules folders
+integration/bazel_workspace_tests/bazel_ngtsc_plugin/node_modules
+integration/cli-elements-universal/node_modules
+integration/cli-hello-world/node_modules
+integration/cli-hello-world-ivy-compat/node_modules
+integration/cli-hello-world-ivy-i18n/node_modules
+integration/cli-hello-world-ivy-minimal/node_modules
+integration/cli-hello-world-lazy/node_modules
+integration/dynamic-compiler/node_modules
+integration/hello_world__closure/node_modules
+integration/hello_world__systemjs_umd/node_modules
+integration/i18n/node_modules
+integration/injectable-def/node_modules
+integration/ivy-i18n/node_modules
+integration/ng-add-localize/node_modules
+integration/trusted-types/node_modules
+integration/forms/node_modules
+integration/ng_elements/node_modules
+integration/ng_elements_schematics/node_modules
+integration/ng_update/node_modules
+integration/ng_update_migrations/node_modules
+integration/ngcc/node_modules
+integration/platform-server/node_modules
+integration/service-worker-schema/node_modules
+integration/side-effects/node_modules
+integration/terser/node_modules
+integration/typings_test_ts36/node_modules
+integration/typings_test_ts37/node_modules
+
+# All integration test .yarn_local_cache folders
+integration/bazel_workspace_tests/bazel_ngtsc_plugin/.yarn_local_cache
+integration/cli-elements-universal/.yarn_local_cache
+integration/cli-hello-world/.yarn_local_cache
+integration/cli-hello-world-ivy-compat/.yarn_local_cache
+integration/cli-hello-world-ivy-i18n/.yarn_local_cache
+integration/cli-hello-world-ivy-minimal/.yarn_local_cache
+integration/cli-hello-world-lazy/.yarn_local_cache
+integration/dynamic-compiler/.yarn_local_cache
+integration/hello_world__closure/.yarn_local_cache
+integration/hello_world__systemjs_umd/.yarn_local_cache
+integration/i18n/.yarn_local_cache
+integration/injectable-def/.yarn_local_cache
+integration/ivy-i18n/.yarn_local_cache
+integration/ng-add-localize/.yarn_local_cache
+integration/trusted-types/.yarn_local_cache
+integration/forms/.yarn_local_cache
+integration/ng_elements/.yarn_local_cache
+integration/ng_elements_schematics/.yarn_local_cache
+integration/ng_update/.yarn_local_cache
+integration/ng_update_migrations/.yarn_local_cache
+integration/ngcc/.yarn_local_cache
+integration/platform-server/.yarn_local_cache
+integration/service-worker-schema/.yarn_local_cache
+integration/side-effects/.yarn_local_cache
+integration/terser/.yarn_local_cache
+integration/typings_test_ts36/.yarn_local_cache
+integration/typings_test_ts37/.yarn_local_cache

.bazelrc

@@ -1,22 +1,5 @@
-# Disable NG CLI TTY mode
-build --action_env=NG_FORCE_TTY=false
-
 # Enable debugging tests with --config=debug
-test:debug --test_arg=--node_options=--inspect-brk --test_output=streamed --test_strategy=exclusive --test_timeout=9999 --nocache_test_results --strategy=TestRunner=standalone
-
-# Do not attempt to de-flake locally.
-# On CI we might set this to `3` to run with deflaking.
-test --flaky_test_attempts=1
-
-# Required by `rules_ts`.
-common --@aspect_rules_ts//ts:skipLibCheck=always
-common --@aspect_rules_ts//ts:default_to_tsc_transpiler
-
-# Needed as otherwise `env` of TS actions would be ignored.
-common --incompatible_merge_fixed_and_default_shell_env
-
-# Frozen lockfile
-common --lockfile_mode=error
+test:debug --test_arg=--node_options=--inspect-brk --test_output=streamed --test_strategy=exclusive --test_timeout=9999 --nocache_test_results
 
 ###############################
 # Filesystem interactions     #
@@ -44,7 +27,7 @@ test --nolegacy_external_runfiles
 # in Bazel 0.21.0 but turned off again in 0.22.0. Follow
 # https://github.com/bazelbuild/bazel/issues/7026 for more details.
 # This flag is needed to so that the bazel cache is not invalidated
-# when running bazel via `pnpm bazel`.
+# when running bazel via `yarn bazel`.
 # See https://github.com/angular/angular/issues/27514.
 build --incompatible_strict_action_env
 run --incompatible_strict_action_env
@@ -55,8 +38,6 @@ test --incompatible_strict_action_env
 # and https://github.com/bazelbuild/bazel/commit/03246077f948f2790a83520e7dccc2625650e6df
 build --nobuild_runfile_links
 
-build --enable_runfiles
-
 ###############################
 # Release support             #
 # Turn on these settings with #
@@ -66,22 +47,12 @@ build --enable_runfiles
 # Releases should always be stamped with version control info
 # This command assumes node on the path and is a workaround for
 # https://github.com/bazelbuild/bazel/issues/4802
-build:release --workspace_status_command="pnpm --silent ng-dev release build-env-stamp --mode=release"
+build:release --workspace_status_command="yarn -s ng-dev release build-env-stamp --mode=release"
 build:release --stamp
 
 # Snapshots should also be stamped with version control information.
-build:snapshot-build --workspace_status_command="pnpm --silent ng-dev release build-env-stamp --mode=snapshot"
-build:snapshot-build --stamp
-# @angular/language-server package depends directly on other Angular framework packages.
-# This flag ensures that the language server uses the snapshot-built framework packages from the repository.
-build:snapshot-build --//:enable_language_server_snapshot_repo_deps
-
-# Angular DevTools for Firefox releases *cannot* be stamped and `--config snapshot-build-firefox` is a no-op.
-# This is because Mozilla requires add-on source code to be uploaded and then they manually reproduce the build.
-# If we stamp the build based on Git information such as the current commit, then reproducing the build would require
-# uploading the entire `.git` directory. We already must upload the entire monorepo, and uploading `.git` as well
-# exceeds the max source file size. To address this, we just *don't* stamp Firefox builds of Angular DevTools.
-build:snapshot-build-firefox --nostamp
+build:snapshot --workspace_status_command="yarn -s ng-dev release build-env-stamp --mode=snapshot"
+build:snapshot --stamp
 
 ###############################
 # Output                      #
@@ -94,6 +65,12 @@ query --output=label_kind
 # By default, failing tests don't print any output, it goes to the log file
 test --test_output=errors
 
+################################
+# Settings for CircleCI        #
+################################
+
+# Bazel flags for CircleCI are in /.circleci/bazel.linux.rc and /.circleci/bazel.windows.rc
+
 ##################################
 # Remote Build Execution support #
 # Turn on these settings with    #
@@ -107,10 +84,9 @@ build:remote --define=EXECUTOR=remote
 # Set a higher timeout value, just in case.
 build:remote --remote_timeout=600
 
-# Bazel detects maximum number of jobs based on host resources.
-# Since we run remotely, we can increase this number significantly.
-common:remote --jobs=200
-
+# Increase the default number of jobs by 50% because our build has lots of
+# parallelism
+build:remote --jobs=150
 build:remote --google_default_credentials
 
 # Force remote exeuctions to consider the entire run as linux
@@ -118,46 +94,27 @@ build:remote --cpu=k8
 build:remote --host_cpu=k8
 
 # Toolchain and platform related flags
-build:remote --extra_execution_platforms=@devinfra//bazel/remote-execution:platform_with_network
-build:remote --host_platform=@devinfra//bazel/remote-execution:platform_with_network
-build:remote --platforms=@devinfra//bazel/remote-execution:platform_with_network
+build:remote --crosstool_top=@npm//@angular/dev-infra-private/bazel/remote-execution/cpp:cc_toolchain_suite
+build:remote --extra_toolchains=@npm//@angular/dev-infra-private/bazel/remote-execution/cpp:cc_toolchain
+build:remote --extra_execution_platforms=@npm//@angular/dev-infra-private/bazel/remote-execution:platform
+build:remote --host_platform=@npm//@angular/dev-infra-private/bazel/remote-execution:platform
+build:remote --platforms=@npm//@angular/dev-infra-private/bazel/remote-execution:platform
 
 # Remote instance and caching
 build:remote --remote_instance_name=projects/internal-200822/instances/primary_instance
-build:remote --bes_instance_name=internal-200822
+build:remote --project_id=internal-200822
 build:remote --remote_cache=remotebuildexecution.googleapis.com
 build:remote --remote_executor=remotebuildexecution.googleapis.com
-build:remote --remote_upload_local_results=false
 
-build:remote --remote_grpc_log=/tmp/rbe-grpc.log
+##################################
+# Saucelabs tests settings       #
+# Turn on these settings with    #
+#  --config=saucelabs            #
+##################################
 
-# See: https://docs.google.com/document/d/1NgDPsCIwprDdqC1zj0qQrh5KGK2hQTSTux1DAvi4rSc/edit?tab=t.0.
-build:remote --experimental_remote_execution_keepalive
-
-# Use HTTP remote cache
-build:remote-cache --remote_cache=https://storage.googleapis.com/angular-team-cache
-build:remote-cache --remote_accept_cached=true
-build:remote-cache --remote_upload_local_results=false
-build:remote-cache --google_default_credentials
-
-# Additional flags added when running a "trusted build" with additional access
-build:trusted-build --remote_upload_local_results=true
-
-# Ensure that tags like "no-remote-exec" get propagated to actions created by rules,
-# even if the rule implementation does not explicitly pass them to the execution requirements.
-# https://bazel.build/reference/command-line-reference#flag--experimental_allow_tags_propagation
-common --incompatible_allow_tags_propagation
-
-# Disable network access in the sandbox by default. To enable network access
-# for a particular target, use:
-#
-# load("@devinfra//bazel/remote-execution:index.bzl", "ENABLE_NETWORK")
-# my_target(
-#   ...,
-#   exec_properties = ENABLE_NETWORK,   # Enables network in remote exec
-#   tags = ["requires-network"]         # Enables network in sandbox
-# )
-build --nosandbox_default_allow_network
+# For saucelabs tests we don't want to enable flaky test attempts. Karma has its own integrated
+# retry mechanism and we do not want to retry unnecessarily if Karma already tried multiple times.
+test:saucelabs --flaky_test_attempts=1
 
 ################
 # Flag Aliases #
@@ -166,6 +123,16 @@ build --nosandbox_default_allow_network
 # --ng_perf will ask the Ivy compiler to produce performance results for each build.
 build --flag_alias=ng_perf=//packages/compiler-cli:ng_perf
 
+#####################################################################
+# Folders to ignore for integration tests (nested Bazel workspaces) #
+#####################################################################
+
+# The nested Bazel integration test workspace should not be analysed as part of
+# Skyframe, but should also not be ignored in order to be able to glob for its files.
+# TODO: Simplify this once https://github.com/bazelbuild/bazel/issues/12034 is fixed
+build --deleted_packages=integration/bazel_workspace_tests/bazel_ngtsc_plugin,integration/bazel_workspace_tests/bazel_ngtsc_plugin/src,integration/bazel_workspace_tests/bazel_ngtsc_plugin/src/hello-world,integration/bazel_workspace_tests/bazel_ngtsc_plugin/test,integration/bazel_workspace_tests/bazel_ngtsc_plugin/test/e2e,integration/bazel_workspace_tests/bazel_ngtsc_plugin/tools,integration/bazel_workspace_tests/bazel_ngtsc_plugin/tools/angular
+query --deleted_packages=integration/bazel_workspace_tests/bazel_ngtsc_plugin,integration/bazel_workspace_tests/bazel_ngtsc_plugin/src,integration/bazel_workspace_tests/bazel_ngtsc_plugin/src/hello-world,integration/bazel_workspace_tests/bazel_ngtsc_plugin/test,integration/bazel_workspace_tests/bazel_ngtsc_plugin/test/e2e,integration/bazel_workspace_tests/bazel_ngtsc_plugin/tools,integration/bazel_workspace_tests/bazel_ngtsc_plugin/tools/angular
+
 ####################################################
 # User bazel configuration
 # NOTE: This needs to be the *last* entry in the config.
@@ -173,4 +140,4 @@ build --flag_alias=ng_perf=//packages/compiler-cli:ng_perf
 
 # Load any settings which are specific to the current user. Needs to be *last* statement
 # in this config, as the user configuration should be able to overwrite flags from this file.
-try-import %workspace%/.bazelrc.user
+try-import .bazelrc.user

.bazelversion

@@ -1 +1 @@
-8.8.0
+4.2.2

.circleci/README.md

@@ -0,0 +1,19 @@
+# Encryption
+
+Based on https://github.com/circleci/encrypted-files
+
+In the CircleCI web UI, we have a secret variable called `KEY`
+https://circleci.com/gh/angular/angular/edit#env-vars
+which is only exposed to non-fork builds
+(see "Pass secrets to builds from forked pull requests" under
+https://circleci.com/gh/angular/angular/edit#advanced-settings)
+
+We use this as a symmetric AES encryption key to encrypt tokens like
+a GitHub token that enables publishing snapshots.
+
+To create the github_token file, we take this approach:
+- Find the angular-builds:token in the internal pw database
+- Go inside the CircleCI default docker image so you use the same version of openssl as we will at runtime: `docker run --rm -it circleci/node:10.12`
+- echo "https://[token]:@github.com" > credentials
+- openssl aes-256-cbc -e -in credentials -out .circleci/github_token -k $KEY
+- If needed, base64-encode the result so you can copy-paste it out of docker: `base64 github_token`

.circleci/bazel.common.rc

@@ -0,0 +1,15 @@
+# Settings in this file should be OS agnostic. Use the bazel.<OS>.rc files for OS specific settings.
+
+# Don't be spammy in the logs
+build --noshow_progress
+
+# Print all the options that apply to the build.
+# This helps us diagnose which options override others
+# (e.g. /etc/bazel.bazelrc vs. tools/bazel.rc)
+build --announce_rc
+
+# Retry in the event of flakes, eg. https://circleci.com/gh/angular/angular/31309
+test --flaky_test_attempts=2
+
+# More details on failures
+build --verbose_failures=true

.circleci/bazel.linux.rc

@@ -0,0 +1,23 @@
+# These options are enabled when running on CI
+# We do this by copying this file to /etc/bazel.bazelrc at the start of the build.
+# See documentation in /docs/BAZEL.md
+
+# Import config items common to both Linux and Windows setups.
+# https://docs.bazel.build/versions/master/guide.html#bazelrc-syntax-and-semantics
+try-import %workspace%/.circleci/bazel.common.rc
+
+# Save downloaded repositories in a location that can be cached by CircleCI. This helps us
+# speeding up the analysis time significantly with Bazel managed node dependencies on the CI.
+build --repository_cache=/home/circleci/bazel_repository_cache
+
+# Workaround https://github.com/bazelbuild/bazel/issues/3645
+# Bazel doesn't calculate the memory ceiling correctly when running under Docker.
+# Limit Bazel to consuming resources that fit in CircleCI "xlarge" class
+# https://circleci.com/docs/2.0/configuration-reference/#resource_class
+build --local_cpu_resources=20
+build --local_ram_resources=32768
+
+# All build executed remotely should be done using our RBE configuration.
+build:remote --google_default_credentials
+
+build --config=remote

.circleci/bazel.windows.rc

@@ -0,0 +1,17 @@
+# These options are enabled when running on CI
+# We do this by copying this file to $env:ProgramData\bazel.bazelrc at the start of the build.
+# See documentation in /docs/BAZEL.md
+
+# Import config items common to both Linux and Windows setups.
+# https://docs.bazel.build/versions/master/guide.html#bazelrc-syntax-and-semantics
+try-import %workspace%/.circleci/bazel.common.rc
+
+# Manually set the local resources used in windows CI runs
+build --local_ram_resources=120000
+build --local_cpu_resources=32
+
+# All windows jobs run on master and should use http caching
+build --remote_http_cache=https://storage.googleapis.com/angular-team-cache
+build --remote_accept_cached=true
+build --remote_upload_local_results=true
+build --google_default_credentials

.circleci/config.yml

@@ -0,0 +1,830 @@
+# Configuration file for https://circleci.com/gh/angular/angular
+
+# Note: YAML anchors allow an object to be re-used, reducing duplication.
+# The ampersand declares an alias for an object, then later the `<<: *name`
+# syntax dereferences it.
+# See https://blog.daemonl.com/2016/02/yaml.html
+# To validate changes, use an online parser, eg.
+# https://yaml-online-parser.appspot.com/
+
+# CircleCI configuration version
+# Version 2.1 allows for extra config reuse features
+# https://circleci.com/docs/2.0/reusing-config/#getting-started-with-config-reuse
+version: 2.1
+
+# We don't want to include the current branch name in the cache key because that would prevent
+# PRs from being able to restore the cache since the branch names are always different for PRs.
+# The cache key should only consist of dynamic values that change whenever something in the
+# cache changes. For example:
+# 1) yarn lock file changes --> cached "node_modules" are different.
+# 2) bazel repository definitions change --> cached bazel repositories are different.
+# Windows needs its own cache key because binaries in node_modules are different.
+# **NOTE 1 **: In order to avoid the cache from growing indefinitely and causing slow-downs, we invalidate the cache monthly.
+#              (See https://support.circleci.com/hc/en-us/articles/360012618473-Creating-a-daily-cache.)
+# **NOTE 2 **: If you change the cache key prefix, also sync the cache_key_fallback to match.
+# **NOTE 3 **: Keep the static part of the cache key as prefix to enable correct fallbacks.
+# See https://circleci.com/docs/2.0/caching/#restoring-cache for how prefixes work in CircleCI.
+var_3: &cache_key v6-angular-node-14-{{ checksum "month.txt" }}-{{ checksum ".bazelversion" }}-{{ checksum "yarn.lock" }}-{{ checksum "WORKSPACE" }}-{{ checksum "aio/yarn.lock" }}
+# We invalidate the cache if the Bazel version changes because otherwise the `bazelisk` cache
+# folder will contain all previously used versions and ultimately cause the cache restoring to
+# be slower due to its growing size.
+var_4: &cache_key_fallback v6-angular-node-14-{{ checksum "month.txt" }}-{{ checksum ".bazelversion" }}
+
+# Windows needs its own cache key because binaries in node_modules are different.
+var_3_win: &cache_key_win v6-angular-win-node-14-{{ checksum "month.txt" }}-{{ checksum ".bazelversion" }}-{{ checksum "yarn.lock" }}-{{ checksum "WORKSPACE" }}-{{ checksum "aio/yarn.lock" }}
+var_4_win: &cache_key_win_fallback v6-angular-win-node-14-{{ checksum "month.txt" }}-{{ checksum ".bazelversion" }}
+
+# Cache key for the `components-repo-unit-tests` job. **Note** when updating the SHA in the
+# cache keys also update the SHA for the "COMPONENTS_REPO_COMMIT" environment variable.
+var_5: &components_repo_unit_tests_cache_key v1-angular-components-{{ checksum "month.txt" }}-e0b76ed029939a7bb8246410b0170cfdbf35da25
+var_6: &components_repo_unit_tests_cache_key_fallback v1-angular-components-{{ checksum "month.txt" }}
+
+# Workspace initially persisted by the `setup` job, and then enhanced by `build-npm-packages`.
+# https://circleci.com/docs/2.0/workflows/#using-workspaces-to-share-data-among-jobs
+# https://circleci.com/blog/deep-diving-into-circleci-workspaces/
+var_7: &workspace_location ~/
+
+# Filter to run a job on builds for pull requests only.
+var_8: &only_on_pull_requests
+  filters:
+    branches:
+      only:
+        - /pull\/\d+/
+
+# Filter to skip a job on builds for pull requests.
+var_9: &skip_on_pull_requests
+  filters:
+    branches:
+      ignore:
+        - /pull\/\d+/
+
+# Filter to run a job on builds for the master branch only.
+var_10: &only_on_master
+  filters:
+    branches:
+      only:
+        - master
+
+# Filter to run a job on all releasable branches.
+var_11: &only_release_branches
+  filters:
+    branches:
+      only:
+        - master
+        - /\d+\.\d+\.x/
+
+# Executor Definitions
+# https://circleci.com/docs/2.0/reusing-config/#authoring-reusable-executors
+# **NOTE 1**: Pin to exact images using an ID (SHA). See https://circleci.com/docs/2.0/circleci-images/#using-a-docker-image-id-to-pin-an-image-to-a-fixed-version.
+#             (Using the tag in not necessary when pinning by ID, but include it anyway for documentation purposes.)
+# **NOTE 2**: If you change the version of the docker images, also change the `cache_key` suffix.
+# **NOTE 3**: If you change the version of Node.js provided by the docker images, also update `.devcontainer/recommended-Dockerfile` to match the new version.
+executors:
+  default-executor:
+    parameters:
+      resource_class:
+        type: string
+        default: medium
+    docker:
+      - image: cimg/node:16.10.0
+    resource_class: << parameters.resource_class >>
+    working_directory: ~/ng
+
+  test-browser-executor:
+    parameters:
+      resource_class:
+        type: string
+        default: medium
+    docker:
+      - image: cimg/node:16.10.0-browsers
+    resource_class: << parameters.resource_class >>
+    working_directory: ~/ng
+
+  windows-executor:
+    working_directory: ~/ng
+    resource_class: windows.2xlarge
+    # CircleCI windows VMs do have the GitBash shell available:
+    # https://github.com/CircleCI-Public/windows-preview-docs#shells
+    # But in this specific case we really should not use it because Bazel must not be ran from
+    # GitBash. These issues discuss why:
+    # https://github.com/bazelbuild/bazel/issues/5751
+    # https://github.com/bazelbuild/bazel/issues/5724#issuecomment-410194038
+    # https://github.com/bazelbuild/bazel/issues/6339#issuecomment-441600879
+    shell: powershell.exe -ExecutionPolicy Bypass
+    machine:
+      # Windows preview image that includes the following:
+      # - Visual Studio 2019 build tools
+      # - Node 14
+      # - yarn 1.17
+      # - Python 3 3.7.4
+      image: windows-server-2019-vs2019:201908-02
+
+# Command Definitions
+# https://circleci.com/docs/2.0/reusing-config/#authoring-reusable-commands
+commands:
+  custom_attach_workspace:
+    description: Attach workspace at a predefined location
+    steps:
+      - attach_workspace:
+          at: *workspace_location
+
+  # Install java runtime which is required by some integration tests such as
+  # //integration:hello_world__closure_test, //integration:i18n_test and
+  # //integration:ng_elements_test to run the closure compiler
+  install_java:
+    description: Install java
+    steps:
+      - run:
+          name: Install java
+          command: |
+            sudo apt-get update
+            # Install java runtime
+            sudo apt-get install default-jre
+
+  # Initializes the CI environment by setting up common environment variables.
+  init_environment:
+    description: Initializing environment (setting up variables)
+    steps:
+      - run:
+          name: Set up environment
+          environment:
+            CIRCLE_GIT_BASE_REVISION: << pipeline.git.base_revision >>
+            CIRCLE_GIT_REVISION: << pipeline.git.revision >>
+          command: ./.circleci/env.sh
+      - run:
+          # Configure git as the CircleCI `checkout` command does.
+          # This is needed because we only checkout on the setup job.
+          # Add GitHub to known hosts
+          name: Configure git
+          command: |
+            mkdir -p ~/.ssh
+            echo 'github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==' >> ~/.ssh/known_hosts
+            git config --global url."ssh://git@github.com".insteadOf "https://github.com" || true
+            git config --global gc.auto 0 || true
+
+  init_saucelabs_environment:
+    description: Sets up a domain that resolves to the local host.
+    steps:
+      - run:
+          name: Preparing environment for running tests on Sauce Labs.
+          command: |
+            # For SauceLabs jobs, we set up a domain which resolves to the machine which launched
+            # the tunnel. We do this because devices are sometimes not able to properly resolve
+            # `localhost` or `127.0.0.1` through the SauceLabs tunnel. Using a domain that does not
+            # resolve to anything on SauceLabs VMs ensures that such requests are always resolved
+            # through the tunnel, and resolve to the actual tunnel host machine (i.e. the CircleCI VM).
+            # More context can be found in: https://github.com/angular/angular/pull/35171.
+            setPublicVar SAUCE_LOCALHOST_ALIAS_DOMAIN "angular-ci.local"
+            setSecretVar SAUCE_ACCESS_KEY $(echo $SAUCE_ACCESS_KEY | rev)
+      - run:
+          # Sets up a local domain in the machine's host file that resolves to the local
+          # host. This domain is helpful in Sauce Labs tests where devices are not able to
+          # properly resolve `localhost` or `127.0.0.1` through the sauce-connect tunnel.
+          name: Setting up alias domain for local host.
+          command: echo "127.0.0.1 $SAUCE_LOCALHOST_ALIAS_DOMAIN" | sudo tee -a /etc/hosts
+
+  save_month_to_file:
+    description: Store the current year and month in a file, so that it can be used for computing the cache key.
+    steps:
+      - run:
+          name: Save month to file
+          # Note: Make sure this file is excluded in the `.gitignore` as otherwise the
+          # snapshot stamping would have the `-with-local-changes` suffix.
+          command: date +%Y-%m > month.txt
+
+  # Normally this would be an individual job instead of a command.
+  # But startup and setup time for each individual windows job are high enough to discourage
+  # many small jobs, so instead we use a command for setup unless the gain becomes significant.
+  setup_win:
+    description: Setup windows node environment
+    steps:
+      - checkout
+      - save_month_to_file
+      # Install Bazel pre-requisites that aren't in the preconfigured CircleCI Windows VM.
+      - run: ./.circleci/windows-env.ps1
+      - run: node --version
+      - run: yarn --version
+      - restore_cache:
+          keys:
+            - *cache_key_win
+            - *cache_key_win_fallback
+      # Install @bazel/bazelisk globally and use that for the first run.
+      # Workaround for https://github.com/bazelbuild/rules_nodejs/issues/894
+      # NB: the issue was for @bazel/bazel but the same problem applies to @bazel/bazelisk
+      - run: yarn global add @bazel/bazelisk@$env:BAZELISK_VERSION
+      # On Windows `~/` is not resolved when using as a CLI value. `../` results in the same path.
+      - run: yarn install --frozen-lockfile --non-interactive --cache-folder ../.cache/yarn
+
+  notify_webhook_on_fail:
+    description: Notify a webhook about failure
+    parameters:
+      # `webhook_url_env_var` are secret env vars defined in CircleCI project settings.
+      # The URLs come from https://angular-team.slack.com/apps/A0F7VRE7N-circleci.
+      webhook_url_env_var:
+        type: env_var_name
+    steps:
+      - run:
+          when: on_fail
+          command: |
+            notificationJson="{\"text\":\":x: \`$CIRCLE_JOB\` job for $CIRCLE_BRANCH branch failed on build $CIRCLE_BUILD_NUM: $CIRCLE_BUILD_URL :scream:\"}"
+            curl --request POST --header "Content-Type: application/json" --data "$notificationJson" ${<< parameters.webhook_url_env_var >>}
+
+# Job definitions
+# Jobs can include parameters that are passed in the workflow job invocation.
+# https://circleci.com/docs/2.0/reusing-config/#authoring-parameterized-jobs
+jobs:
+  setup:
+    executor: default-executor
+    steps:
+      - checkout
+      - save_month_to_file
+      - init_environment
+      - run:
+          name: Rebase PR on target branch
+          # After checkout, rebase on top of target branch.
+          command: >
+            if [[ -n "${CIRCLE_PR_NUMBER}" ]]; then
+              # User is required for rebase.
+              git config user.name "angular-ci"
+              git config user.email "angular-ci"
+              # Rebase PR on top of target branch.
+              node .circleci/rebase-pr.js
+            else
+              echo "This build is not over a PR, nothing to do."
+            fi
+      # This cache is saved in the build-npm-packages so that Bazel cache is also included.
+      - restore_cache:
+          keys:
+            - *cache_key
+            - *cache_key_fallback
+      - run:
+          name: Running Yarn install
+          command: yarn install --frozen-lockfile --non-interactive --cache-folder ~/.cache/yarn
+          # Yarn's requests sometimes take more than 10mins to complete.
+          no_output_timeout: 45m
+      - run: yarn --cwd aio install --frozen-lockfile --non-interactive --cache-folder ~/.cache/yarn
+      # Make the bazel directories and add a file to them if they don't exist already so that
+      # persist_to_workspace does not fail.
+      - run: |
+          if [ ! -d ~/bazel_repository_cache ]; then
+            mkdir ~/bazel_repository_cache
+            touch ~/bazel_repository_cache/MARKER
+          fi
+      # Persist any changes at this point to be reused by further jobs.
+      # **NOTE**: To add new content to the workspace, always persist on the same root.
+      - persist_to_workspace:
+          root: *workspace_location
+          paths:
+            - ./ng
+            - ./bazel_repository_cache
+
+  lint:
+    executor: default-executor
+    steps:
+      - custom_attach_workspace
+      - init_environment
+
+      - run: yarn -s tslint
+      - run: yarn -s ng-dev format changed $CI_GIT_BASE_REVISION --check
+      - run: yarn -s ts-circular-deps:check
+      - run: yarn -s ng-dev pullapprove verify
+      - run: yarn -s ng-dev ngbot verify
+      - run: yarn -s ng-dev commit-message validate-range $CI_GIT_BASE_REVISION $CI_GIT_REVISION
+      - run: yarn -s check-tooling-setup
+
+  test:
+    executor:
+      name: test-browser-executor
+      # Now that large integration tests are running locally in parallel (they can't run on RBE yet
+      # as they require network access for yarn install), this test is running out of memory
+      # consistently with the xlarge machine.
+      # TODO: switch back to xlarge once integration tests are running on remote-exec
+      resource_class: 2xlarge+
+    steps:
+      - custom_attach_workspace
+      - init_environment
+      - install_java
+      - run:
+          # We need to explicitly specify the --symlink_prefix option because otherwise we would
+          # not be able to easily find the output bin directory when uploading artifacts for size
+          # measurements.
+          command: yarn test --symlink_prefix=dist/ -- //...
+          no_output_timeout: 20m
+        # Publish bundle artifacts which will be used to calculate the size change. **Note**: Make
+        # sure that the size plugin from the Angular robot fetches the artifacts from this CircleCI
+        # job (see .github/angular-robot.yml). Additionally any artifacts need to be stored with the
+        # following path format: "{projectName}/{context}/{fileName}". This format is necessary
+        # because otherwise the bot is not able to pick up the artifacts from CircleCI. See:
+        # https://github.com/angular/github-robot/blob/master/functions/src/plugins/size.ts#L392-L394
+      - store_artifacts:
+          path: dist/bin/packages/core/test/bundling/hello_world/bundle.min.js
+          destination: core/hello_world/bundle
+      - store_artifacts:
+          path: dist/bin/packages/core/test/bundling/todo/bundle.min.js
+          destination: core/todo/bundle
+      - store_artifacts:
+          path: dist/bin/packages/core/test/bundling/hello_world/bundle.min.js.br
+          destination: core/hello_world/bundle.br
+      - store_artifacts:
+          path: dist/bin/packages/core/test/bundling/todo/bundle.min.js.br
+          destination: core/todo/bundle.br
+
+  # NOTE: This is currently limited to master builds only. See the `monitoring` configuration.
+  saucelabs:
+    executor:
+      name: default-executor
+      # In order to avoid the bottleneck of having a slow host machine, we acquire a better
+      # container for this job. This is necessary because we launch a lot of browsers concurrently
+      # and therefore the tunnel and Karma need to process a lot of file requests and tests.
+      resource_class: xlarge
+    steps:
+      - custom_attach_workspace
+      - init_environment
+      - init_saucelabs_environment
+      - run:
+          name: Run Bazel tests on Saucelabs
+          # See /tools/saucelabs/README.md for more info
+          command: |
+            yarn bazel run //tools/saucelabs:sauce_service_setup
+            TESTS=$(./node_modules/.bin/bazelisk query --output label '(kind(karma_web_test, ...) intersect attr("tags", "saucelabs", ...)) except attr("tags", "fixme-saucelabs", ...)')
+            yarn bazel test --config=saucelabs ${TESTS}
+            yarn bazel run //tools/saucelabs:sauce_service_stop
+          no_output_timeout: 40m
+      - notify_webhook_on_fail:
+          webhook_url_env_var: SLACK_DEV_INFRA_CI_FAILURES_WEBHOOK_URL
+
+  test_aio:
+    executor: test-browser-executor
+    steps:
+      - custom_attach_workspace
+      - init_environment
+        # Build aio
+      - run: yarn --cwd aio build --progress=false
+        # Lint the code
+      - run: yarn --cwd aio lint
+        # Run unit tests
+      - run: yarn --cwd aio test --progress=false --watch=false
+        # Run e2e tests
+      - run: yarn --cwd aio e2e --configuration=ci
+        # Run PWA-score tests
+      - run: yarn --cwd aio test-pwa-score-localhost $CI_AIO_MIN_PWA_SCORE
+        # Run accessibility tests
+      - run: yarn --cwd aio test-a11y-score-localhost
+        # Check the bundle sizes.
+      - run: yarn --cwd aio payload-size
+        # Run unit tests for Firebase redirects
+      - run: yarn --cwd aio redirects-test
+
+  deploy_aio:
+    executor: test-browser-executor
+    steps:
+      - custom_attach_workspace
+      - init_environment
+        # Deploy angular.io to production (if necessary)
+      - run: setPublicVar_CI_STABLE_BRANCH
+      - run: yarn --cwd aio deploy-production
+
+  test_aio_local:
+    executor: test-browser-executor
+    steps:
+      - custom_attach_workspace
+      - init_environment
+        # Build aio (with local Angular packages)
+      - run: yarn --cwd aio build-local-ci
+        # Run unit tests
+      - run: yarn --cwd aio test --progress=false --watch=false
+        # Run e2e tests
+      - run: yarn --cwd aio e2e --configuration=ci
+        # Run PWA-score tests
+      - run: yarn --cwd aio test-pwa-score-localhost $CI_AIO_MIN_PWA_SCORE
+        # Check the bundle sizes.
+      - run: yarn --cwd aio payload-size aio-local
+
+  test_aio_tools:
+    executor: default-executor
+    steps:
+      - custom_attach_workspace
+      - init_environment
+        # Install
+      - run: yarn --cwd aio install --frozen-lockfile --non-interactive --cache-folder ~/.cache/yarn
+      - run: yarn --cwd aio extract-cli-command-docs
+        # Run tools tests
+      - run: yarn --cwd aio tools-test
+      - run: ./aio/aio-builds-setup/scripts/test.sh
+
+  test_docs_examples:
+    executor:
+      name: test-browser-executor
+      resource_class: xlarge
+    parallelism: 5
+    steps:
+      - custom_attach_workspace
+      - init_environment
+        # Install aio
+      - run: yarn --cwd aio install --frozen-lockfile --non-interactive --cache-folder ~/.cache/yarn
+        # Run examples tests. The "CIRCLE_NODE_INDEX" will be set if "parallelism" is enabled.
+        # Since the parallelism is set to "5", there will be five parallel CircleCI containers.
+        # with either "0", "1", etc as node index. This can be passed to the "--shard" argument.
+      - run: yarn --cwd aio example-e2e --setup --local --cliSpecsConcurrency=5 --shard=${CIRCLE_NODE_INDEX}/${CIRCLE_NODE_TOTAL}
+
+  # This job should only be run on PR builds, where `CI_PULL_REQUEST` is not `false`.
+  aio_preview:
+    executor: default-executor
+    environment:
+      AIO_SNAPSHOT_ARTIFACT_PATH: &aio_preview_artifact_path 'aio/tmp/snapshot.tgz'
+    steps:
+      - custom_attach_workspace
+      - init_environment
+      - run: ./aio/scripts/build-artifacts.sh $AIO_SNAPSHOT_ARTIFACT_PATH $CI_PULL_REQUEST $CI_COMMIT
+      - store_artifacts:
+          path: *aio_preview_artifact_path
+          # The `destination` needs to be kept in sync with the value of
+          # `AIO_ARTIFACT_PATH` in `aio/aio-builds-setup/Dockerfile`
+          destination: aio/dist/aio-snapshot.tgz
+      - run: node ./aio/scripts/create-preview $CIRCLE_BUILD_NUM
+
+  # This job should only be run on PR builds, where `CI_PULL_REQUEST` is not `false`.
+  test_aio_preview:
+    executor: test-browser-executor
+    steps:
+      - custom_attach_workspace
+      - init_environment
+      - run: yarn --cwd aio install --frozen-lockfile --non-interactive --cache-folder ~/.cache/yarn
+      - run:
+          name: Wait for preview and run tests
+          command: node aio/scripts/test-preview.js $CI_PULL_REQUEST $CI_COMMIT $CI_AIO_MIN_PWA_SCORE
+
+  # The `build-npm-packages` tasks exist for backwards-compatibility with old scripts and
+  # tests that rely on the pre-Bazel `dist/packages-dist` output structure (build.sh).
+  # Having multiple jobs that independently build in this manner duplicates some work; we build
+  # the bazel packages more than once. Even though we have a remote cache, these jobs will
+  # typically run in parallel so up-to-date outputs will not be available at the time the build
+  # starts.
+  build-npm-packages:
+    executor:
+      name: default-executor
+      resource_class: xlarge
+    steps:
+      - custom_attach_workspace
+      - init_environment
+      - run: node scripts/build/build-packages-dist.js
+
+      # Save the npm packages from //packages/... for other workflow jobs to read
+      - persist_to_workspace:
+          root: *workspace_location
+          paths:
+            - ng/dist/packages-dist
+            - ng/dist/angular-in-memory-web-api-dist
+            - ng/dist/zone.js-dist
+
+      # Save dependencies and bazel repository cache to use on subsequent runs.
+      - save_cache:
+          key: *cache_key
+          paths:
+            - ~/.cache/yarn
+            - ~/bazel_repository_cache
+            - ~/.cache/bazelisk
+
+  # This job creates compressed tarballs (`.tgz` files) for all Angular packages and stores them as
+  # build artifacts. This makes it easy to try out changes from a PR build for testing purposes.
+  # More info CircleCI build artifacts: https://circleci.com/docs/2.0/artifacts
+  #
+  # NOTE: Currently, this job only runs for PR builds. See `publish_snapshot` for non-PR builds.
+  publish_packages_as_artifacts:
+    executor: default-executor
+    environment:
+      AIMWA_PACKAGES_DIR: &aimwa_packages_dir 'dist/angular-in-memory-web-api-dist'
+      AIMWA_PACKAGES_ARCHIVES_DIR: &aimwa_packages_archives_dir 'dist/angular-in-memory-web-api-dist-archives'
+      NG_PACKAGES_DIR: &ng_packages_dir 'dist/packages-dist'
+      NG_PACKAGES_ARCHIVES_DIR: &ng_packages_archives_dir 'dist/packages-dist-archives'
+      ZONEJS_PACKAGES_DIR: &zonejs_packages_dir 'dist/zone.js-dist'
+      ZONEJS_PACKAGES_ARCHIVES_DIR: &zonejs_packages_archives_dir 'dist/zone.js-dist-archives'
+    steps:
+      - custom_attach_workspace
+      - init_environment
+      # Publish `@angular/*` packages.
+      - run:
+          name: Create artifacts for @angular/* packages
+          command: ./scripts/ci/create-package-archives.sh $CI_BRANCH $CI_COMMIT $NG_PACKAGES_DIR $NG_PACKAGES_ARCHIVES_DIR
+      - store_artifacts:
+          path: *ng_packages_archives_dir
+          destination: angular
+      # Publish the `angular-in-memory-web-api` package.
+      - run:
+          name: Create artifacts for the `angular-in-memory-web-api` package
+          # Need to remove the zone.js.tgz before archive
+          command: ./scripts/ci/create-package-archives.sh $CI_BRANCH $CI_COMMIT $AIMWA_PACKAGES_DIR $AIMWA_PACKAGES_ARCHIVES_DIR
+      - store_artifacts:
+          path: *aimwa_packages_archives_dir
+          destination: angular-in-memory-web-api
+      # Publish the `zone.js` package.
+      - run:
+          name: Create artifacts for the `zone.js` package
+          # Need to remove the zone.js.tgz before archive
+          command: rm -rf $ZONEJS_PACKAGES_DIR/archive && ./scripts/ci/create-package-archives.sh $CI_BRANCH $CI_COMMIT $ZONEJS_PACKAGES_DIR $ZONEJS_PACKAGES_ARCHIVES_DIR
+      - store_artifacts:
+          path: *zonejs_packages_archives_dir
+          destination: zone.js
+
+  # This job updates the content of repos like github.com/angular/core-builds
+  # for every green build on angular/angular.
+  publish_snapshot:
+    executor: default-executor
+    steps:
+      - custom_attach_workspace
+      - init_environment
+      # CircleCI has a config setting to force SSH for all github connections
+      # This is not compatible with our mechanism of using a Personal Access Token
+      # Clear the global setting
+      - run: git config --global --unset "url.ssh://git@github.com.insteadof"
+      - run:
+          name: Decrypt github credentials
+          # We need ensure that the same default digest is used for encoding and decoding with
+          # OpenSSL. OpenSSL versions might have different default digests which can cause
+          # decryption failures based on the installed OpenSSL version. https://stackoverflow.com/a/39641378/4317734
+          command: 'openssl aes-256-cbc -d -in .circleci/github_token -md md5 -k "${KEY}" -out ~/.git_credentials'
+      - run: ./scripts/ci/publish-build-artifacts.sh
+
+  aio_misc:
+    executor: default-executor
+    steps:
+      - custom_attach_workspace
+      - run:
+          name: Check website provided in contributors.json file
+          command: yarn node aio/scripts/test-external-urls.js
+
+  aio_monitoring_stable:
+    executor: test-browser-executor
+    steps:
+      - custom_attach_workspace
+      - init_environment
+      - run: setPublicVar_CI_STABLE_BRANCH
+      - run:
+          name: Check out `aio/` and yarn from the stable branch
+          command: |
+            git fetch origin $CI_STABLE_BRANCH
+            git checkout --force origin/$CI_STABLE_BRANCH -- aio/ .yarn/ .yarnrc
+      # Ignore yarn's engines check, because we checked out `aio/package.json` from the stable
+      # branch and there could be a node version skew, which is acceptable in this monitoring job.
+      - run: yarn config set ignore-engines true
+      - run:
+          name: Run tests against https://angular.io/
+          command: ./aio/scripts/test-production.sh https://angular.io/ $CI_AIO_MIN_PWA_SCORE
+      - notify_webhook_on_fail:
+          webhook_url_env_var: SLACK_CARETAKER_WEBHOOK_URL
+      - notify_webhook_on_fail:
+          webhook_url_env_var: SLACK_DEV_INFRA_CI_FAILURES_WEBHOOK_URL
+
+  aio_monitoring_next:
+    executor: test-browser-executor
+    steps:
+      - custom_attach_workspace
+      - init_environment
+      - run:
+          name: Run tests against https://next.angular.io/
+          command: ./aio/scripts/test-production.sh https://next.angular.io/ $CI_AIO_MIN_PWA_SCORE
+      - notify_webhook_on_fail:
+          webhook_url_env_var: SLACK_CARETAKER_WEBHOOK_URL
+      - notify_webhook_on_fail:
+          webhook_url_env_var: SLACK_DEV_INFRA_CI_FAILURES_WEBHOOK_URL
+
+  legacy-unit-tests-saucelabs:
+    executor:
+      name: default-executor
+      # In order to avoid the bottleneck of having a slow host machine, we acquire a better
+      # container for this job. This is necessary because we launch a lot of browsers concurrently
+      # and therefore the tunnel and Karma need to process a lot of file requests and tests.
+      resource_class: xlarge
+    steps:
+      - custom_attach_workspace
+      - init_environment
+      - init_saucelabs_environment
+      - run:
+          name: Starting Saucelabs tunnel service
+          command: ./tools/saucelabs/sauce-service.sh run
+          background: true
+      # Build test fixtures for a test that rely on Bazel-generated fixtures. Note that disabling
+      # specific tests which are reliant on such generated fixtures is not an option as SystemJS
+      # in the Saucelabs legacy job always fetches referenced files, even if the imports would be
+      # guarded by an check to skip in the Saucelabs legacy job. We should be good running such
+      # test in all supported browsers on Saucelabs anyway until this job can be removed.
+      - run:
+          name: Preparing Bazel-generated fixtures required in legacy tests
+          command: |
+            yarn bazel build \
+                //packages/core/test:downleveled_es5_fixture \
+                //packages/common/locales
+
+            # Needed for the ES5 downlevel reflector test in `packages/core/test/reflection`.
+            mkdir -p dist/legacy-test-out/core/test/reflection/
+            cp dist/bin/packages/core/test/reflection/es5_downleveled_inheritance_fixture.js \
+              dist/legacy-test-out/core/test/reflection/es5_downleveled_inheritance_fixture.js
+            # Locale files are needed for i18n tests running within Saucelabs. These are added
+            # directly as sources so that the TypeScript compilation of `/packages/tsconfig.json`
+            # can succeed. Note that the base locale and currencies files are checked-in, so
+            # we do not need to re-generate those through Bazel.
+            mkdir -p packages/common/locales/extra
+            cp dist/bin/packages/common/locales/*.ts packages/common/locales
+            cp dist/bin/packages/common/locales/extra/*.ts packages/common/locales/extra
+      # Build ZoneJS so that it can be loaded globally in the Karma tests.
+      - run: yarn bazel build //packages/zone.js:npm_package
+      # Build the bundle for all tests to run within Saucelabs
+      - run: node tools/legacy-saucelabs/build-saucelabs-test-bundle.mjs
+      - run:
+          # Waiting on ready ensures that we don't run tests too early without Saucelabs not being ready.
+          name: Waiting for Saucelabs tunnel to connect
+          command: ./tools/saucelabs/sauce-service.sh ready-wait
+      - run:
+          name: Running tests on Saucelabs.
+          command: |
+            KARMA_WEB_TEST_MODE=SL_REQUIRED yarn karma start ./karma-js.conf.js --single-run
+      - run:
+          name: Stop Saucelabs tunnel service
+          command: ./tools/saucelabs/sauce-service.sh stop
+
+  # Job that runs all unit tests of the `angular/components` repository.
+  components-repo-unit-tests:
+    executor:
+      name: default-executor
+      resource_class: xlarge
+    steps:
+      - custom_attach_workspace
+      - init_environment
+      # Restore the cache before cloning the repository because the clone script re-uses
+      # the restored repository if present. This reduces the amount of times the components
+      # repository needs to be cloned (this is slow and increases based on commits in the repo).
+      - restore_cache:
+          keys:
+            - *components_repo_unit_tests_cache_key
+            # Whenever the `angular/components` SHA is updated, the cache key will no longer
+            # match. The fallback cache will still match, and CircleCI will restore the most
+            # recently cached repository folder. Without the fallback cache, we'd need to download
+            # the repository from scratch and it would slow down the job. This is because we can't
+            # clone the repository with reduced `--depth`, but rather need to clone the whole
+            # repository to be able to support arbitrary SHAs.
+            - *components_repo_unit_tests_cache_key_fallback
+      - run:
+          name: 'Fetching angular/components repository'
+          command: ./scripts/ci/clone_angular_components_repo.sh
+      - run:
+          # Run yarn install to fetch the Bazel binaries as used in the components repo.
+          name: Installing dependencies.
+          command: yarn --cwd ${COMPONENTS_REPO_TMP_DIR} install --frozen-lockfile --non-interactive --cache-folder ~/.cache/yarn
+      - save_cache:
+          key: *components_repo_unit_tests_cache_key
+          paths:
+            # Temporary directory must be kept in sync with the `$COMPONENTS_REPO_TMP_DIR` env
+            # variable. It needs to be hardcoded here, because env variables interpolation is
+            # not supported.
+            - '/tmp/angular-components-repo'
+      - run:
+          # Copy zone.js package to dist/packages-dist, so `angular/components` can also use the local zone.js build.
+          name: Setting up zone.js release packages.
+          command: cp -r dist/zone.js-dist/zone.js dist/packages-dist/
+      - run:
+          # Updates the `angular/components` `package.json` file to refer to the release output
+          # inside the `packages-dist` directory.
+          name: Setting up framework release packages.
+          command: node scripts/ci/update-framework-deps-to-dist-packages.js ${COMPONENTS_REPO_TMP_DIR}/package.json dist/packages-dist/
+      - run:
+          # Run `yarn install` again to install the Angular packages from `packages-dist/` and update the lockfile.
+          # NOTE: We cannot rely on Bazel to run `yarn install`, because it uses the `--frozen-lockfile` flag and fails.
+          name: Installing local Angular packages.
+          command: yarn --cwd ${COMPONENTS_REPO_TMP_DIR} install --non-interactive --cache-folder ~/.cache/yarn
+      - run:
+          name: 'Running `angular/components` unit tests'
+          command: ./scripts/ci/run_angular_components_unit_tests.sh
+
+  test_zonejs:
+    executor:
+      name: default-executor
+      resource_class: xlarge
+    steps:
+      - custom_attach_workspace
+      - init_environment
+      - install_java
+        # Install
+      - run: yarn --cwd packages/zone.js install --frozen-lockfile --non-interactive --cache-folder ~/.cache/yarn
+        # Run zone.js tools tests
+      - run: yarn --cwd packages/zone.js promisetest
+      - run: yarn --cwd packages/zone.js promisefinallytest
+      - run: yarn bazel build //packages/zone.js:npm_package &&
+          cp dist/bin/packages/zone.js/npm_package/bundles/zone-mix.umd.js ./packages/zone.js/test/extra/ &&
+          cp dist/bin/packages/zone.js/npm_package/bundles/zone-patch-electron.umd.js ./packages/zone.js/test/extra/ &&
+          cp dist/bin/packages/zone.js/npm_package/bundles/zone.umd.js ./packages/zone.js/build/test/closure/zone.js
+      - run: yarn --cwd packages/zone.js jest:test
+      - run: yarn --cwd packages/zone.js jest:nodetest
+      - run: yarn --cwd packages/zone.js electrontest
+      - run: yarn --cwd packages/zone.js closuretest
+      - run: yarn --cwd packages/zone.js/test/typings install --frozen-lockfile --non-interactive --cache-folder ~/.cache/yarn
+      - run: yarn --cwd packages/zone.js/test/typings test
+
+  # Windows jobs
+  # Docs: https://circleci.com/docs/2.0/hello-world-windows/
+  test_win:
+    executor: windows-executor
+    steps:
+      - setup_win
+      - run:
+          name: Build all windows CI targets
+          command: bazel build //packages/compiler-cli/...
+          no_output_timeout: 15m
+      - run:
+          name: Test all windows CI targets
+          command: bazel test --test_tag_filters="-browser:chromium-local" //packages/compiler-cli/...
+          no_output_timeout: 15m
+
+workflows:
+  version: 2
+  default_workflow:
+    jobs:
+      - setup:
+          filters:
+            branches:
+              ignore: g3
+      - lint:
+          requires:
+            - setup
+      - test:
+          requires:
+            - setup
+      - build-npm-packages:
+          requires:
+            - setup
+      - legacy-unit-tests-saucelabs:
+          requires:
+            - setup
+      - test_aio:
+          requires:
+            - setup
+      - deploy_aio:
+          requires:
+            - test_aio
+      - test_aio_local:
+          requires:
+            - build-npm-packages
+      - test_aio_tools:
+          requires:
+            - build-npm-packages
+      - test_docs_examples:
+          requires:
+            - build-npm-packages
+      - aio_preview:
+          # Only run on PR builds. (There can be no previews for non-PR builds.)
+          <<: *only_on_pull_requests
+          requires:
+            - setup
+      - test_aio_preview:
+          requires:
+            - aio_preview
+      - publish_packages_as_artifacts:
+          requires:
+            - build-npm-packages
+      - publish_snapshot:
+          <<: *only_release_branches
+          requires:
+            # Only publish if tests and integration tests pass
+            - test
+            # Only publish if `aio`/`docs` tests using the locally built Angular packages pass
+            - test_aio_local
+            - test_docs_examples
+            # Get the artifacts to publish from the build-packages-dist job
+            # since the publishing script expects the legacy outputs layout.
+            - build-npm-packages
+            - legacy-unit-tests-saucelabs
+      - components-repo-unit-tests:
+          requires:
+            - build-npm-packages
+      - test_zonejs:
+          requires:
+            - setup
+      - test_win:
+          requires:
+            - setup
+
+  monitoring:
+    jobs:
+      - setup
+      - aio_misc:
+          requires:
+            - setup
+      - aio_monitoring_stable:
+          requires:
+            - setup
+      - aio_monitoring_next:
+          requires:
+            - setup
+      - saucelabs:
+          # Testing saucelabs via Bazel currently taking longer than the legacy saucelabs job as it
+          # each karma_web_test target is provisioning and tearing down browsers which is adding
+          # a lot of overhead. Running once daily on master only to avoid wasting resources and
+          # slowing down CI for PRs.
+          # TODO: Run this job on all branches (including PRs) once karma_web_test targets can
+          # share provisioned browsers and we can remove the legacy saucelabs job.
+          requires:
+            - setup
+    triggers:
+      - schedule:
+          <<: *only_on_master
+          # Runs monitoring jobs at 10:00AM every day.
+          cron: '0 10 * * *'

.circleci/env-helpers.inc.sh

@@ -0,0 +1,73 @@
+####################################################################################################
+# Helpers for defining environment variables for CircleCI.
+#
+# In CircleCI, each step runs in a new shell. The way to share ENV variables across steps is to
+# export them from `$BASH_ENV`, which is automatically sourced at the beginning of every step (for
+# the default `bash` shell).
+#
+# See also https://circleci.com/docs/2.0/env-vars/#using-bash_env-to-set-environment-variables.
+####################################################################################################
+
+# Set and print an environment variable.
+#
+# Use this function for setting environment variables that are public, i.e. it is OK for them to be
+# visible to anyone through the CI logs.
+#
+# Usage: `setPublicVar <name> <value>`
+function setPublicVar() {
+  setSecretVar $1 "$2";
+  echo "$1=$2";
+}
+
+# Set (without printing) an environment variable.
+#
+# Use this function for setting environment variables that are secret, i.e. should not be visible to
+# everyone through the CI logs.
+#
+# Usage: `setSecretVar <name> <value>`
+function setSecretVar() {
+  # WARNING: Secrets (e.g. passwords, access tokens) should NOT be printed.
+  # (Keep original shell options to restore at the end.)
+  local -r originalShellOptions=$(set +o);
+  set +x -eu -o pipefail;
+
+  echo "export $1=\"${2:-}\";" >> $BASH_ENV;
+
+  # Restore original shell options.
+  eval "$originalShellOptions";
+}
+
+
+# Create a function to set an environment variable, when called.
+#
+# Use this function for creating setter for public environment variables that require expensive or
+# time-consuming computaions and may not be needed. When needed, you can call this function to set
+# the environment variable (which will be available through `$BASH_ENV` from that point onwards).
+#
+# Arguments:
+# - `<name>`: The name of the environment variable. The generated setter function will be
+#   `setPublicVar_<name>`.
+# - `<code>`: The code to run to compute the value for the variable. Since this code should be
+#   executed lazily, it must be properly escaped. For example:
+#   ```sh
+#   # DO NOT do this:
+#   createPublicVarSetter MY_VAR "$(whoami)";  # `whoami` will be evaluated eagerly
+#
+#   # DO this isntead:
+#   createPublicVarSetter MY_VAR "\$(whoami)";  # `whoami` will NOT be evaluated eagerly
+#   ```
+#
+# Usage: `createPublicVarSetter <name> <code>`
+#
+# Example:
+# ```sh
+# createPublicVarSetter MY_VAR 'echo "FOO"';
+# echo $MY_VAR;  # Not defined
+#
+# setPublicVar_MY_VAR;
+# source $BASH_ENV;
+# echo $MY_VAR;  # FOO
+# ```
+function createPublicVarSetter() {
+  echo "setPublicVar_$1() { setPublicVar $1 \"$2\"; }" >> $BASH_ENV;
+}

.circleci/env.sh

@@ -0,0 +1,112 @@
+#!/usr/bin/env bash
+
+# Variables
+readonly projectDir=$(realpath "$(dirname ${BASH_SOURCE[0]})/..")
+readonly envHelpersPath="$projectDir/.circleci/env-helpers.inc.sh";
+
+# Load helpers and make them available everywhere (through `$BASH_ENV`).
+source $envHelpersPath;
+echo "source $envHelpersPath;" >> $BASH_ENV;
+
+
+####################################################################################################
+# Define PUBLIC environment variables for CircleCI.
+####################################################################################################
+# See https://circleci.com/docs/2.0/env-vars/#built-in-environment-variables for more info.
+####################################################################################################
+setPublicVar CI "$CI"
+setPublicVar PROJECT_ROOT "$projectDir";
+setPublicVar CI_AIO_MIN_PWA_SCORE "95";
+# This is the branch being built; e.g. `pull/12345` for PR builds.
+setPublicVar CI_BRANCH "$CIRCLE_BRANCH";
+setPublicVar CI_BUILD_URL "$CIRCLE_BUILD_URL";
+setPublicVar CI_COMMIT "$CIRCLE_SHA1";
+# `CI_COMMIT_RANGE` is only used on push builds (a.k.a. non-PR, non-scheduled builds and rerun
+# workflows of such builds).
+setPublicVar CI_GIT_BASE_REVISION "${CIRCLE_GIT_BASE_REVISION}";
+setPublicVar CI_GIT_REVISION "${CIRCLE_GIT_REVISION}";
+setPublicVar CI_COMMIT_RANGE "$CIRCLE_GIT_BASE_REVISION..$CIRCLE_GIT_REVISION";
+setPublicVar CI_PULL_REQUEST "${CIRCLE_PR_NUMBER:-false}";
+setPublicVar CI_REPO_NAME "$CIRCLE_PROJECT_REPONAME";
+setPublicVar CI_REPO_OWNER "$CIRCLE_PROJECT_USERNAME";
+setPublicVar CI_PR_REPONAME "$CIRCLE_PR_REPONAME";
+setPublicVar CI_PR_USERNAME "$CIRCLE_PR_USERNAME";
+
+
+####################################################################################################
+# Define "lazy" PUBLIC environment variables for CircleCI.
+# (I.e. functions to set an environment variable when called.)
+####################################################################################################
+createPublicVarSetter CI_STABLE_BRANCH "\$(npm info @angular/core dist-tags.latest | sed -r 's/^\\s*([0-9]+\\.[0-9]+)\\.[0-9]+.*$/\\1.x/')";
+
+
+####################################################################################################
+# Define SECRET environment variables for CircleCI.
+####################################################################################################
+setSecretVar CI_SECRET_AIO_DEPLOY_FIREBASE_TOKEN "$AIO_DEPLOY_TOKEN";
+setSecretVar CI_SECRET_PAYLOAD_FIREBASE_TOKEN "$ANGULAR_PAYLOAD_TOKEN";
+
+
+####################################################################################################
+# Define SauceLabs environment variables for CircleCI.
+####################################################################################################
+setPublicVar SAUCE_USERNAME "angular-framework";
+setSecretVar SAUCE_ACCESS_KEY "0c731274ed5f-cbc9-16f4-021a-9835e39f";
+# TODO(josephperrott): Remove environment variables once all saucelabs tests are via bazel method.
+setPublicVar SAUCE_LOG_FILE /tmp/angular/sauce-connect.log
+setPublicVar SAUCE_READY_FILE /tmp/angular/sauce-connect-ready-file.lock
+setPublicVar SAUCE_PID_FILE /tmp/angular/sauce-connect-pid-file.lock
+setPublicVar SAUCE_TUNNEL_IDENTIFIER "angular-framework-${CIRCLE_BUILD_NUM}-${CIRCLE_NODE_INDEX}"
+# Amount of seconds we wait for sauceconnect to establish a tunnel instance. In order to not
+# acquire CircleCI instances for too long if sauceconnect failed, we need a connect timeout.
+setPublicVar SAUCE_READY_FILE_TIMEOUT 120
+
+
+####################################################################################################
+# Define environment variables for the `angular/components` repo unit tests job.
+####################################################################################################
+# We specifically use a directory within "/tmp" here because we want the cloned repo to be
+# completely isolated from angular/angular in order to avoid any bad interactions between
+# their separate build setups. **NOTE**: When updating the temporary directory, also update
+# the `save_cache` path configuration in `config.yml`
+setPublicVar COMPONENTS_REPO_TMP_DIR "/tmp/angular-components-repo"
+setPublicVar COMPONENTS_REPO_URL "https://github.com/angular/components.git"
+setPublicVar COMPONENTS_REPO_BRANCH "master"
+# **NOTE**: When updating the commit SHA, also update the cache key in the CircleCI `config.yml`.
+setPublicVar COMPONENTS_REPO_COMMIT "e0b76ed029939a7bb8246410b0170cfdbf35da25"
+
+
+####################################################################################################
+# Decrypt GCP Credentials and store them as the Google default credentials.
+####################################################################################################
+mkdir -p "$HOME/.config/gcloud";
+openssl aes-256-cbc -d -in "${projectDir}/.circleci/gcp_token" \
+        -md md5 -k "$CIRCLE_PROJECT_REPONAME" -out "$HOME/.config/gcloud/application_default_credentials.json"
+####################################################################################################
+# Set bazel configuration for CircleCI runs.
+####################################################################################################
+cp "${projectDir}/.circleci/bazel.linux.rc" "$HOME/.bazelrc";
+
+####################################################################################################
+# Create shell script in /tmp for Bazel actions to access CI envs without
+# busting the cache. Used by payload-size.sh script in integration tests.
+####################################################################################################
+readonly bazelVarEnv="/tmp/bazel-ci-env.sh"
+echo "# Setup by /.circle/env.sh" > $bazelVarEnv
+echo "export PROJECT_ROOT=\"${PROJECT_ROOT}\";" >> $bazelVarEnv
+echo "export CI_BRANCH=\"${CI_BRANCH}\";" >> $bazelVarEnv
+echo "export CI_BUILD_URL=\"${CI_BUILD_URL}\";" >> $bazelVarEnv
+echo "export CI_COMMIT=\"${CI_COMMIT}\";" >> $bazelVarEnv
+echo "export CI_COMMIT_RANGE=\"${CI_COMMIT_RANGE}\";" >> $bazelVarEnv
+echo "export CI_PULL_REQUEST=\"${CI_PULL_REQUEST}\";" >> $bazelVarEnv
+echo "export CI_REPO_NAME=\"${CI_REPO_NAME}\";" >> $bazelVarEnv
+echo "export CI_REPO_OWNER=\"${CI_REPO_OWNER}\";" >> $bazelVarEnv
+echo "export CI_SECRET_PAYLOAD_FIREBASE_TOKEN=\"${CI_SECRET_PAYLOAD_FIREBASE_TOKEN}\";" >> $bazelVarEnv
+
+####################################################################################################
+####################################################################################################
+##                  Source `$BASH_ENV` to make the variables available immediately.               ##
+##                  ***NOTE: This must remain the last action in this script***               ##
+####################################################################################################
+####################################################################################################
+source $BASH_ENV;

.circleci/rebase-pr.js

@@ -0,0 +1,207 @@
+/**
+ * @license
+ * Copyright Google LLC All Rights Reserved.
+ *
+ * Use of this source code is governed by an MIT-style license that can be
+ * found in the LICENSE file at https://angular.io/license
+ */
+
+/**
+ * Rebases the current branch on top of the GitHub PR target branch.
+ *
+ * **Context:**
+ * Since a GitHub PR is not necessarily up to date with its target branch, it is useful to rebase
+ * prior to testing it on CI to ensure more up to date test results.
+ *
+ * **NOTE:**
+ * This script cannot use external dependencies or be compiled because it needs to run before the
+ * environment is setup.
+ * Use only features supported by the NodeJS versions used in the environment.
+ */
+// tslint:disable:no-console
+const {execSync} = require('child_process');
+
+
+/** A regex to select a ref that matches our semver refs. */
+const semverRegex = /^(\d+)\.(\d+)\.x$/;
+
+// Run
+_main().catch(err => {
+  console.log('Failed to rebase on top of target branch.\n');
+  console.error(err);
+  process.exitCode = 1;
+});
+
+// Helpers
+async function _main() {
+  const refs = await getRefsAndShasForChange();
+
+  // Log known refs and shas
+  console.log(`--------------------------------`);
+  console.log(`    Target Branch:                   ${refs.base.ref}`);
+  console.log(`    Latest Commit for Target Branch: ${refs.target.latestSha}`);
+  console.log(`    Latest Commit for PR:            ${refs.base.latestSha}`);
+  console.log(`    First Common Ancestor SHA:       ${refs.commonAncestorSha}`);
+  console.log(`--------------------------------`);
+  console.log();
+
+  // Get the count of commits between the latest commit from origin and the common ancestor SHA.
+  const commitCount =
+      exec(`git rev-list --count origin/${refs.base.ref}...${refs.commonAncestorSha}`);
+  console.log(`Checking ${commitCount} commits for changes in the CircleCI config file.`);
+
+  // Check if the files changed between the latest commit from origin and the common ancestor SHA
+  // includes the CircleCI config.
+  const circleCIConfigChanged = exec(`git diff --name-only origin/${refs.base.ref} ${
+      refs.commonAncestorSha} -- .circleci/config.yml`);
+
+  if (!!circleCIConfigChanged) {
+    throw Error(`
+        CircleCI config on ${refs.base.ref} has been modified since commit
+        ${refs.commonAncestorSha.slice(0, 7)}, which this PR is based on.
+
+        Please rebase the PR on ${refs.base.ref} after fetching from upstream.
+
+        Rebase instructions for PR Author, please run the following commands:
+
+          git fetch upstream ${refs.base.ref};
+          git checkout ${refs.target.ref};
+          git rebase upstream/${refs.base.ref};
+          git push --force-with-lease;
+        `);
+  } else {
+    console.log('No change found in the CircleCI config file, continuing.');
+  }
+  console.log();
+
+  // Rebase the PR.
+  exec(`git rebase origin/${refs.base.ref}`);
+  console.log(`Rebased current branch onto ${refs.base.ref}.`);
+}
+
+
+
+/**
+ * Sort a list of fullpath refs into a list and then provide the first entry.
+ *
+ * The sort order will first find master ref, and then any semver ref, followed
+ * by the rest of the refs in the order provided.
+ *
+ * Branches are sorted in this order as work is primarily done on master, and
+ * otherwise on a semver branch. If neither of those were to match, the most
+ * likely correct branch will be the first one encountered in the list.
+ */
+function getRefFromBranchList(gitOutput) {
+  const branches = gitOutput.split('\n').map(b => b.split('/').slice(1).join('/').trim());
+  return branches.sort((a, b) => {
+    if (a === 'master') {
+      return -1;
+    }
+    if (b === 'master') {
+      return 1;
+    }
+    const aIsSemver = semverRegex.test(a);
+    const bIsSemver = semverRegex.test(b);
+    if (aIsSemver && bIsSemver) {
+      const [, aMajor, aMinor] = a.match(semverRegex);
+      const [, bMajor, bMinor] = b.match(semverRegex);
+      return parseInt(bMajor, 10) - parseInt(aMajor, 10) ||
+          parseInt(aMinor, 10) - parseInt(bMinor, 10) || 0;
+    }
+    if (aIsSemver) {
+      return -1;
+    }
+    if (bIsSemver) {
+      return 1;
+    }
+    return 0;
+  })[0];
+}
+
+/**
+ * Get the full sha of the ref provided.
+ *
+ * example: 1bc0c1a6c01ede7168f22fa9b3508ba51f1f464e
+ */
+function getShaFromRef(ref) {
+  return exec(`git rev-parse ${ref}`);
+}
+
+/**
+ * Get the list of branches which contain the provided sha, sorted in descending order
+ * by committerdate.
+ *
+ * example:
+ *   upstream/master
+ *   upstream/9.0.x
+ *   upstream/test
+ *   upstream/1.1.x
+ */
+function getBranchListForSha(sha, remote) {
+  return exec(`git branch -r '${remote}/*' --sort=-committerdate --contains ${sha}`);
+}
+
+/** Get the common ancestor sha of the two provided shas. */
+function getCommonAncestorSha(sha1, sha2) {
+  return exec(`git merge-base ${sha1} ${sha2}`);
+}
+
+/**
+ * Adds the remote to git, if it doesn't already exist. Returns a boolean indicating
+ * whether the remote was added by the command.
+ */
+function addAndFetchRemote(owner, name) {
+  const remoteName = `${owner}_${name}`;
+  exec(`git remote add ${remoteName} https://github.com/${owner}/${name}.git`, true);
+  exec(`git fetch ${remoteName}`);
+  return remoteName;
+}
+
+
+/** Get the ref and latest shas for the provided sha on a specific remote. */
+function getRefAndShas(sha, owner, name) {
+  const remoteName = addAndFetchRemote(owner, name);
+
+  // Get the ref on the remote for the sha provided.
+  const branches = getBranchListForSha(sha, remoteName);
+  const ref = getRefFromBranchList(branches);
+
+  // Get the latest sha on the discovered remote ref.
+  const latestSha = getShaFromRef(`${remoteName}/${ref}`);
+
+  return {remote: remoteName, ref, latestSha, sha};
+}
+
+
+/** Gets the refs and shas for the base and target of the current environment. */
+function getRefsAndShasForChange() {
+  const base = getRefAndShas(
+      process.env['CI_GIT_BASE_REVISION'], process.env['CI_REPO_OWNER'],
+      process.env['CI_REPO_NAME']);
+  const target = getRefAndShas(
+      process.env['CI_GIT_REVISION'], process.env['CI_PR_USERNAME'], process.env['CI_PR_REPONAME']);
+  const commonAncestorSha = getCommonAncestorSha(base.sha, target.sha);
+  return {
+    base,
+    target,
+    commonAncestorSha,
+  };
+}
+
+
+/**
+ * Synchronously executes the command.
+ *
+ * Return the trimmed stdout as a string, with an added attribute of the exit code.
+ */
+function exec(command, ignoreError = false) {
+  try {
+    return execSync(command, {stdio: 'pipe'}).toString().trim();
+  } catch (err) {
+    if (ignoreError) {
+      return '';
+    }
+
+    throw err;
+  }
+}

.circleci/setup_cache.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+# Install bazel remote cache proxy
+# This is temporary until the feature is no longer experimental on CircleCI.
+# See remote cache documentation in /docs/BAZEL.md
+
+set -u -e
+
+readonly DOWNLOAD_URL="https://5-116431813-gh.circle-artifacts.com/0/pkg/bazel-remote-proxy-$(uname -s)_$(uname -m)"
+
+curl --fail -o ~/bazel-remote-proxy "$DOWNLOAD_URL"
+chmod +x ~/bazel-remote-proxy

.circleci/trigger-webhook.js

@@ -0,0 +1,105 @@
+#!/usr/bin/env node
+
+/**
+ * Usage (cli):
+ * ```
+ * node create-preview <build-number> <job-name> <webhook-url>
+ * ```
+ *
+ * Usage (JS):
+ * ```js
+ * require('./trigger-webhook').
+ *   triggerWebhook(buildNumber, jobName, webhookUrl).
+ *   then(...);
+ * ```
+ *
+ * Triggers a notification webhook with CircleCI specific info.
+ *
+ * It can be used for notifying external servers and trigger operations based on CircleCI job status
+ * (e.g. triggering the creation of a preview based on previously stored build atrifacts).
+ *
+ * The body of the sent payload is of the form:
+ * ```json
+ * {
+ *   "payload": {
+ *     "build_num": ${buildNumber}
+ *     "build_parameters": {
+ *       "CIRCLE_JOB": "${jobName}"
+ *     }
+ *   }
+ * }
+ * ```
+ *
+ * When used from JS, it returns a promise which resolves to an object of the form:
+ * ```json
+ * {
+ *   "statucCode": ${statusCode},
+ *   "responseText": "${responseText}"
+ * }
+ * ```
+ *
+ * NOTE:
+ * - When used from the cli, the command will exit with an error code if the response's status code
+ *   is outside the [200, 400) range.
+ * - When used from JS, the returned promise will be resolved, even if the response's status code is
+ *   outside the [200, 400) range. It is up to the caller to decide how this should be handled.
+ */
+
+// Imports
+const {request} = require('https');
+
+// Exports
+module.exports = {
+  triggerWebhook,
+};
+
+// Run
+if (require.resolve === module) {
+  _main(process.argv.slice(2));
+}
+
+// Helpers
+function _main(args) {
+  triggerWebhook(...args)
+      .then(
+          ({statusCode, responseText}) => (200 <= statusCode && statusCode < 400) ?
+              console.log(`Status: ${statusCode}\n${responseText}`) :
+              Promise.reject(new Error(`Request failed (status: ${statusCode}): ${responseText}`)))
+      .catch(err => {
+        console.error(err);
+        process.exit(1);
+      });
+}
+
+function postJson(url, data) {
+  return new Promise((resolve, reject) => {
+    const opts = {method: 'post', headers: {'Content-Type': 'application/json'}};
+    const onResponse = res => {
+      const statusCode = res.statusCode || -1;
+      let responseText = '';
+
+      res.on('error', reject)
+          .on('data', d => responseText += d)
+          .on('end', () => resolve({statusCode, responseText}));
+    };
+
+    request(url, opts, onResponse).on('error', reject).end(JSON.stringify(data));
+  });
+}
+
+async function triggerWebhook(buildNumber, jobName, webhookUrl) {
+  if (!buildNumber || !jobName || !webhookUrl || isNaN(buildNumber)) {
+    throw new Error(
+        'Missing or invalid arguments.\n' +
+        'Expected: buildNumber (number), jobName (string), webhookUrl (string)');
+  }
+
+  const data = {
+    payload: {
+      build_num: +buildNumber,
+      build_parameters: {CIRCLE_JOB: jobName},
+    },
+  };
+
+  return postJson(webhookUrl, data);
+}

.circleci/windows-env.ps1

@@ -0,0 +1,57 @@
+# Install Bazel pre-reqs on Windows
+# https://docs.bazel.build/versions/master/install-windows.html
+# https://docs.bazel.build/versions/master/windows.html
+# Install MSYS2 and packages
+choco install msys2 --version 20200903.0.0 --no-progress --package-parameters "/NoUpdate"
+C:\tools\msys64\usr\bin\bash.exe -l -c "pacman --needed --noconfirm -S zip unzip patch diffutils"
+
+# Add PATH modifications to the Powershell profile. This is the win equivalent of .bash_profile.
+# https://docs.microsoft.com/en-us/previous-versions//bb613488(v=vs.85)
+new-item -path $profile -itemtype file -force
+# Paths for nodejs, npm, yarn, and msys2. Use single quotes to prevent interpolation.
+# Add before the original path to use msys2 instead of the installed gitbash.
+Add-Content $profile '$Env:path = "${Env:ProgramFiles}\nodejs\;C:\Users\circleci\AppData\Roaming\npm\;${Env:ProgramFiles(x86)}\Yarn\bin\;C:\Users\circleci\AppData\Local\Yarn\bin\;C:\tools\msys64\usr\bin\;" + $Env:path'
+# Environment variables for Bazel
+Add-Content $profile '$Env:BAZEL_SH = "C:\tools\msys64\usr\bin\bash.exe"'
+
+# Get the bazelisk version devdep and store it in a global var for use in the circleci job.
+$bazeliskVersion = & ${Env:ProgramFiles}\nodejs\node.exe -e "console.log(require('./package.json').devDependencies['@bazel/bazelisk'])"
+# This is a tricky situation: we want $bazeliskVersion to be evaluated but not $Env:BAZELISK_VERSION.
+# Formatting works https://stackoverflow.com/questions/32127583/expand-variable-inside-single-quotes
+$bazeliskVersionGlobalVar = '$Env:BAZELISK_VERSION = "{0}"' -f $bazeliskVersion
+Add-Content $profile $bazeliskVersionGlobalVar
+
+# Remove the CircleCI checkout SSH override, because it breaks cloning repositories through Bazel.
+# See https://circleci.com/gh/angular/angular/401454 for an example.
+# TODO: is this really needed? Maybe there's a better way. It doesn't happen on Linux or on Codefresh.
+git config --global --unset url.ssh://git@github.com.insteadOf
+
+
+####################################################################################################
+# Decrypt GCP Credentials and store them as the Google default credentials.
+####################################################################################################
+mkdir ${env:APPDATA}\gcloud
+openssl aes-256-cbc -d -in .circleci\gcp_token -md md5 -out "$env:APPDATA\gcloud\application_default_credentials.json" -k "$env:CIRCLE_PROJECT_REPONAME"
+
+####################################################################################################
+# Set bazel configuration for CircleCI runs.
+####################################################################################################
+copy .circleci\bazel.windows.rc ${Env:USERPROFILE}\.bazelrc
+
+####################################################################################################
+# Install specific version of node.
+####################################################################################################
+nvm install 16.10.0
+nvm use 16.10.0
+
+# These Bazel prereqs aren't needed because the CircleCI image already includes them.
+# choco install yarn --version 1.16.0 --no-progress
+# choco install vcredist2015 --version 14.0.24215.20170201
+
+# We don't need VS Build Tools for the tested bazel targets.
+# If it's needed again, uncomment these lines.
+# VS Build Tools are needed for Bazel C++ targets (like com_google_protobuf)
+# choco install visualstudio2019buildtools --version 16.1.2.0 --no-progress --package-parameters "--add Microsoft.VisualStudio.Workload.VCTools --add Microsoft.VisualStudio.Component.VC.Tools.x86.x64 --add Microsoft.Component.VC.Runtime.UCRTSDK --add Microsoft.VisualStudio.Component.Windows10SDK.17763"
+# Add-Content $profile '$Env:BAZEL_VC = "${Env:ProgramFiles(x86)}\Microsoft Visual Studio\2019\BuildTools\VC\"'
+# Python is needed for Bazel Python targets
+# choco install python --version 3.5.1 --no-progress

.clang-format

@@ -0,0 +1,3 @@
+Language:        JavaScript
+BasedOnStyle:    Google
+ColumnLimit:     100

.devcontainer/README.md

@@ -3,19 +3,18 @@
 This folder contains configuration files that can be used to opt into working on this repository in a [Docker container](https://www.docker.com/resources/what-container) via [VSCode](https://code.visualstudio.com/)'s Remote Development feature (see below).
 
 Info on remote development and developing inside a container with VSCode:
-
 - [VSCode: Remote Development](https://code.visualstudio.com/docs/remote/remote-overview)
 - [VSCode: Developing inside a Container](https://code.visualstudio.com/docs/remote/containers)
 - [VSCode: Remote Development FAQ](https://code.visualstudio.com/docs/remote/faq)
 
+
 ## Usage
 
 _Prerequisite: [Install Docker](https://docs.docker.com/install) on your local environment._
 
-To get started, read and follow the instructions in [Developing inside a Container](https://code.visualstudio.com/docs/remote/containers). The [.devcontainer/](.) directory contains pre-configured `devcontainer.json` and `Dockerfile` files, which you can use to set up remote development with a docker container.
+To get started, read and follow the instuctions in [Developing inside a Container](https://code.visualstudio.com/docs/remote/containers). The [.devcontainer/](.) directory contains pre-configured `devcontainer.json` and `Dockerfile` files, which you can use to set up remote development with a docker container.
 
 In a nutshell, you need to:
-
 - Install the [Remote - Containers](https://marketplace.visualstudio.com/items?itemName=ms-vscode-remote.remote-containers) extension.
 - Copy [recommended-Dockerfile](./recommended-Dockerfile) to `Dockerfile` (and optionally tweak to suit your needs).
 - Copy [recommended-devcontainer.json](./recommended-devcontainer.json) to `devcontainer.json` (and optionally tweak to suit your needs).
@@ -24,6 +23,7 @@ In a nutshell, you need to:
 
 The `.devcontainer/devcontainer.json` and `.devcontainer/Dockerfile` files are ignored by git, so you can have your own local versions. We may occasionally update the template files ([recommended-devcontainer.json](./recommended-devcontainer.json), [recommended-Dockerfile](./recommended-Dockerfile)), in which case you will need to manually update your local copies (if desired).
 
+
 ## Updating `recommended-devcontainer.json` and `recommended-Dockerfile`
 
 You can update and commit the recommended config files (which people use as basis for their local configs), if you find that something is broken, out-of-date or can be improved.

.devcontainer/recommended-Dockerfile

@@ -1,16 +1,24 @@
 # Image metadata and config.
 # Ideally, the Node.js version should match what we use on CI.
-FROM cimg/node:22.21.1-browsers@sha256:eee8ed828d5a54196456a86ac6872c43325acad54e59632261e23b486c458992
+# See `executors > default-executor` in `.circleci/config.yml`.
+FROM cimg/node:14-browsers
+
 
 LABEL name="Angular dev environment" \
-  description="This image can be used to create a dev environment for building Angular." \
-  vendor="angular" \
-  version="1.0"
+      description="This image can be used to create a dev environment for building Angular." \
+      vendor="angular" \
+      version="1.0"
 
-EXPOSE 4200 4201 4205 4206 9876
+EXPOSE 4000 4200 4433 5000 8080 9876
 
-# Switch to `root`.
+
+# Switch to `root` (CircleCI images use `circleci` as the user).
 USER root
 
+
+# Configure `Node.js`/`npm`.
+RUN npm config --global set user root
+
+
 # Go! (And keep going.)
 CMD ["tail", "--follow", "/dev/null"]

.devcontainer/recommended-devcontainer.json

@@ -2,11 +2,15 @@
 {
   "name": "Angular dev container",
   "dockerFile": "Dockerfile",
-  "forwardPorts": [4200, 4201, 4205, 4206, 9876],
-  "postCreateCommand": "pnpm install",
-  "customizations": {
-    "vscode": {
-      "extensions": ["BazelBuild.vscode-bazel", "ms-vscode.vscode-typescript-tslint-plugin"]
-    }
-  }
+  "appPort": [4000, 4200, 4433, 5000, 8080, 9876],
+  "postCreateCommand": "yarn install",
+  "extensions": [
+    "devondcarew.bazel-code",
+    "gkalpak.aio-docs-utils",
+    "ms-vscode.vscode-typescript-tslint-plugin",
+    "xaver.clang-format",
+    // The following extensions are useful when working on angular.io (i.e. inside the `aio/` directory).
+    //"angular.ng-template",
+    //"dbaeumer.vscode-eslint",
+  ],
 }

.gemini/commands/explain.toml

@@ -1,70 +0,0 @@
-description = "Researches part of the codebase and creates a skill for it"
-prompt="""
-## Role
-
-You are an experienced senior developer specializing in reverse engineering and understanding
-complex code, prompt engineering, and context engineering.
-
-Your task is to build a complete understanding of the mental model and architecture of the code,
-and to create an efficient context file that allows a coding agent to understand and work with the
-code.
-
-## Guiding Principles
-
-1. **Deep Analysis:** Understand the _why_ behind the code. Not just a surface level listing of
-   files and classes.
-
-2. **Curiosity:** Be curious. If something is unclear, confusing, or unexpected you _MUST_
-   investigate further until you fully understand.
-
-3. **Efficient Token Use:** The final output will be directly included into the context of the
-   coding assistant, so be sure to make efficient use of tokens. Think deeply, but only capture the
-   most important information for the coding agent in the final output
-
-## Procedure
-
-1. Fully explore the code before first, with a focus on understanding the architecture and how all
-   of the pieces fit together.
-
-2. Develop an understanding of the mental model behind the architecture. _Why_ is the code is
-   architected this way? How should developers think about the system?
-
-3. Document your findings using the given output format described in the next section.
-
-## Output Format
-
-Note the following placeholders below:
-
-- `[package]`: is a unique identifier for the current code package (for example if you're looking at
-  code under `packages/forms/signals` you might use `signal-forms` as the `[package]`)
-- `[code-location]`: is the location of the current code within the larger repository
-- `[context]`: is the context to add to the coding agent when it is working with this code.
-
-With those placeholders in mind, write a file create a new directory under `.gemini/skills` with the
-name `reference-[package]/`, and under that directory add a `SKILL.md` file with the following
-content:
-
-```md
----
-name: reference-[package]
-description: Explains the mental model and architecture of the code under `[code-location]`. You MUST use this skill any time you plan to work with code in `[code-location]`
----
-
-[context]
-```
-
-## Additional User Instructions
-
-The user may have additional instructions.
-
-- The user should indicate what package to research
-- The user may indicate that they want to update a package that has already been researched. In this
-  case, read the existing skill and make any required updates based on your research
-- The user may request supplemental information be added to the skill (if so, add this to the
-  existing skill in a new markdown file under a `references` directory within the skill. Add a
-  section to the main `SKILL.md` that mentions what supplemental information is available)
-
-Here are the user's additional instructions:
-
-{{args}}
-"""

.gemini/config.yaml

@@ -1,11 +0,0 @@
-have_fun: false
-code_review:
-  disable: false
-  comment_severity_threshold: MEDIUM
-  max_review_comments: -1
-  pull_request_opened:
-    help: false
-    summary: false
-    code_review: false
-ignore_patterns:
-  - pnpm-lock.yaml

.gemini/settings.json

@@ -1,5 +0,0 @@
-{
-  "context": {
-    "fileName": ["AGENTS.md", "GEMINI.md"]
-  }
-}

.git-blame-ignore-revs

@@ -1,47 +0,0 @@
-# all commits that change formatting to prettier
-fd544159e300340a25a48e3f40c58795991a4c17
-31fdf0fbea6b89c8d3d141b2ef8e79c2737287cb
-0d78a92431178be73342aeddda4b62d9e49138ba
-f307e95459898b9027d5e13357a809d8952e9017
-b1dffa4abe8321a47d79b2ea29ee32a81acfe031
-ca517d7f2c38775969a65fde1d88f41ad5f27931
-8f69c83b848ad0dc3c7ffce2541fc726693dedcf
-a5b5b7d5ef84b9852d2115dd7a764f4ab3299379
-894c1c5f100a62866cc7ed3e23d025c8e505c60d
-ca39926de2ccaceb11de47a35e5bf9899147a877
-b857aafcb9bdb5f1400a4cfedd56657e71ebe8cd
-c4b880a025823efadb9d76195c6261f2992c7654
-4c2b0d94e22f022969b86b95af516b76322840e0
-0460a9dfafe3a7ebbff1b87e52048fb7416bba43
-ec03e462f3d4ec90d1267474cc344563c949c2cf
-bbbe477f479f20722f0fea7ccc46095aad5d4253
-cc34e5fb072e7903e01463953a19d18503a39347
-f9781f9804f1e7c84df356d9aeb267730a7fc499
-dc62446ef7f2898a20d3be1196ecaf2a92a1077d
-711cb416260ca11ff158fc39b372efa2cf022d36
-af77b89e2abb67bba201a53d500874ad572b8384
-6270bba056cfaadb3fe0b2bf3b17036bdc28b90e
-# commits that switch to relative imports
-3d2263cb1f208e561692e41c5a17196c3c57877f
-ae047c59c0041e0a43cec020520d40ccd981b444
-6a207ebfb0b915bcb848e8e17425757314116ce3
-88ae6517a2490ccbef97126c011a3d5bcaddd637
-6d3849ffc85cc52b0eba3836b24f10895621acbe
-bc042935d045c46d09c2c316dcbbc39cbae4615c
-34393874e6b6f53692f1f30d0f536cd72e5220d2
-cfda43b97d3c1aedc4a1eccf123475617640e696
-006a14da89c58692d411e403b1b1cc8fd733de25
-33c24624be73a4c16abdd5fb2f93810e151f6a58
-e5cc624b8736c4e2aa87f86bb268957e656e0994
-30a61f12a7d414ad35a1a06eaadff873880d8e8f
-f773e08ee59724739093a33811a62661680df1f0
-49234007916980526db78503452bba7121dc91ff
-5c0335754a2b45b2a27fa7a9bffe5df93aec4eee
-be7c8d4fc6cb3a71bd21fbb228e01cfcdce0717f
-c702e8af0b2144d97b93171dc2806ed1a0346762
-4f458a825d17e776500cc1597efb904e0dfdfe20
-6d3f5752f204a5a30f3c09fbf6d4a510a4522bcb
-3fa7b2b136696464e0a91b5ec25c6adf272d4d6b
-ad65f44877f22caadbc8b977b5b720c3c86fcc45
-# commit that changed formatting
-698b0288bee60b8c5926148b79b5b93f454098db

.gitattributes

@@ -4,3 +4,6 @@
 # JS and TS files must always use LF for tools to work
 *.js eol=lf
 *.ts eol=lf
+
+# Must keep Windows line ending to be parsed correctly
+scripts/windows/packages.txt eol=crlf

.github/ISSUE_TEMPLATE/1-bug-report.yaml

@@ -23,7 +23,6 @@ body:
         - router
         - service-worker
         - upgrade
-        - zone.js
         - Don't known / other
       multiple: true
     validations:

.github/ISSUE_TEMPLATE/3-docs-bug.yaml

@@ -1,58 +1,42 @@
-name: 'Docs or angular.dev Bug Report'
-description: Report an issue in Angular's documentation or angular.dev application
+name: 'Docs or angular.io Bug Report'
+description: Report an issue in Angular's documentation or angular.io application
 
 body:
   - type: textarea
     id: description
     attributes:
-      label: Describe the problem that you experienced
+      label: Description
     validations:
       required: true
 
   - type: input
     id: affected-url
     attributes:
-      label: Enter the URL of the topic with the problem
-
-  - type: textarea
-    id: documentation-goal
-    attributes:
-      label: Describe what you were looking for in the documentation
+      label: What is the affected URL?
 
   - type: textarea
     id: reproduction-steps
     attributes:
-      label: Describe the actions that led you to experience the problem
+      label: Please provide the steps to reproduce the issue
 
   - type: textarea
     id: expected-vs-actual-behavior
     attributes:
-      label: Describe what you want to experience that would fix the problem
+      label: Please provide the expected behavior vs the actual behavior you encountered
 
   - type: textarea
     id: screenshot
     attributes:
-      label: Add a screenshot if that helps illustrate the problem
+      label: Please provide a screenshot if possible
 
   - type: textarea
     id: exception-or-error
     attributes:
-      label: If this problem caused an exception or error, please paste it here
+      label: Please provide the exception or error you saw
       render: true
-      placeholder: |
-        ```
-        Paste the exception or error here inside a markdown code block,
-        which is annotated by three grave \(`\) characters before and after the text block.
-        ```
 
   - type: textarea
     id: browser-info
     attributes:
-      label: If the problem is browser-specific, please specify the device, OS, browser, and version
-      render: true
-
-  - type: textarea
-    id: additional-info
-    attributes:
-      label: Provide any additional information here in as much as detail as you can
+      label: Is this a browser-specific issue? If so, please specify the device, browser, and version.
       render: true

.github/ISSUE_TEMPLATE/4-devtools.yaml

@@ -1,54 +0,0 @@
-name: 'Angular DevTools'
-description: Report an issue or suggest a feature for Angular DevTools
-
-body:
-  - type: checkboxes
-    id: bug-report-or-feature-request
-    attributes:
-      label: Is this a bug report or a feature request?
-      description: Select one.
-      options:
-        - label: Bug Report
-        - label: Feature Request
-
-  - type: textarea
-    id: reproduction-steps
-    attributes:
-      label: Please provide the steps to reproduce the issue [Bug Report only]
-
-  - type: textarea
-    id: expected-vs-actual-behavior
-    attributes:
-      label: Please provide the expected behavior vs the actual behavior you encountered [Bug Report only]
-
-  - type: textarea
-    id: screenshot
-    attributes:
-      label: Please provide a screenshot if possible [Bug Report only]
-
-  - type: textarea
-    id: exception-or-error
-    attributes:
-      label: Please provide the exception or error you saw [Bug Report only]
-      render: true
-
-  - type: textarea
-    id: browser-info
-    attributes:
-      label: Is this a browser-specific issue? If so, please specify the device, browser, and version. [Bug Report only]
-      render: true
-
-  - type: textarea
-    id: description
-    attributes:
-      label: Description [Feature Request only]
-
-  - type: textarea
-    id: proposed-solution
-    attributes:
-      label: Proposed solution [Feature Request only]
-
-  - type: textarea
-    id: alternatives-considered
-    attributes:
-      label: Alternatives considered [Feature Request only]

.github/ISSUE_TEMPLATE/5-vscode.yaml

@@ -1,48 +0,0 @@
-name: 'VSCode Angular Language Service extension'
-description: Report an issue or suggest a feature for the VSCode Angular Language Service extension
-
-body:
-  - type: checkboxes
-    id: bug-report-or-feature-request
-    attributes:
-      label: Is this a bug report or a feature request?
-      description: Select one.
-      options:
-        - label: Bug Report
-        - label: Feature Request
-
-  - type: textarea
-    id: reproduction-steps
-    attributes:
-      label: Please provide the steps to reproduce the issue [Bug Report only]
-
-  - type: textarea
-    id: expected-vs-actual-behavior
-    attributes:
-      label: Please provide the expected behavior vs the actual behavior you encountered [Bug Report only]
-
-  - type: textarea
-    id: screenshot
-    attributes:
-      label: Please provide a screenshot if possible [Bug Report only]
-
-  - type: textarea
-    id: exception-or-error
-    attributes:
-      label: Please provide the exception or error you saw [Bug Report only]
-      render: true
-
-  - type: textarea
-    id: description
-    attributes:
-      label: Description [Feature Request only]
-
-  - type: textarea
-    id: proposed-solution
-    attributes:
-      label: Proposed solution [Feature Request only]
-
-  - type: textarea
-    id: alternatives-considered
-    attributes:
-      label: Alternatives considered [Feature Request only]

.github/ISSUE_TEMPLATE/config.yml

@@ -1,14 +1,14 @@
 blank_issues_enabled: false
 contact_links:
   - name: Security issue disclosure
-    url: https://angular.dev/best-practices/security#report-issues
+    url: https://angular.io/guide/security#report-issues
     about: Report a security issue in Angular Framework, CDK, Material, or CLI
   - name: Angular CLI
-    url: https://github.com/angular/angular-cli/issues/new/choose
+    url: https://github.com/angular/angular/issues/new/choose
     about: Issues and feature requests for Angular CLI
   - name: Angular Material and Components Development Kit (CDK)
     url: https://github.com/angular/components/issues/new/choose
     about: Issues and feature requests for Angular Material
   - name: Support Request
-    url: https://github.com/angular/angular/blob/main/CONTRIBUTING.md#question
+    url: https://github.com/angular/angular/blob/master/CONTRIBUTING.md#question
     about: Questions and requests for support

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,13 +1,12 @@
 ## PR Checklist
-
 Please check if your PR fulfills the following requirements:
 
-- [ ] The commit message follows our guidelines: https://github.com/angular/angular/blob/main/contributing-docs/commit-message-guidelines.md
+- [ ] The commit message follows our guidelines: https://github.com/angular/angular/blob/master/CONTRIBUTING.md#commit
 - [ ] Tests for the changes have been added (for bug fixes / features)
 - [ ] Docs have been added / updated (for bug fixes / features)
 
-## PR Type
 
+## PR Type
 What kind of change does this PR introduce?
 
 <!-- Please check the one that applies to this PR using "x". -->
@@ -19,22 +18,26 @@ What kind of change does this PR introduce?
 - [ ] Build related changes
 - [ ] CI related changes
 - [ ] Documentation content changes
-- [ ] angular.dev application / infrastructure changes
+- [ ] angular.io application / infrastructure changes
 - [ ] Other... Please describe:
 
-## What is the current behavior?
 
+## What is the current behavior?
 <!-- Please describe the current behavior that you are modifying, or link to a relevant issue. -->
 
 Issue Number: N/A
 
+
 ## What is the new behavior?
 
+
 ## Does this PR introduce a breaking change?
 
 - [ ] Yes
 - [ ] No
 
+
 <!-- If this PR contains a breaking change, please describe the impact and migration path for existing applications below. -->
 
+
 ## Other information

.github/actions/deploy-docs-site/BUILD.bazel

@@ -1,39 +0,0 @@
-load("//tools:defaults.bzl", "esbuild_checked_in", "ts_config", "ts_project")
-
-package(default_visibility = ["//.github/actions/deploy-docs-site:__subpackages__"])
-
-exports_files([
-    "tsconfig.json",
-])
-
-esbuild_checked_in(
-    name = "main",
-    config = "esbuild.conf.js",
-    entry_point = ":lib/main.mts",
-    external = [
-        "pnpapi",
-    ],
-    metafile = False,
-    platform = "node",
-    target = "node20",
-    deps = [
-        ":lib",
-    ],
-)
-
-ts_config(
-    name = "tsconfig",
-    src = "tsconfig.json",
-)
-
-ts_project(
-    name = "lib",
-    srcs = glob(["lib/*.mts"]),
-    tsconfig = ":tsconfig",
-    deps = [
-        "//:node_modules/@actions/core",
-        "//:node_modules/@actions/github",
-        "//:node_modules/@angular/ng-dev",
-        "//:node_modules/@types/node",
-    ],
-)

.github/actions/deploy-docs-site/action.yml

@@ -1,19 +0,0 @@
-name: 'Deploy angular.dev site'
-description: 'Automatically deploy and set up redirects for angular.dev'
-author: 'Angular'
-inputs:
-  serviceKey:
-    description: 'The service key used for firebase deployments.'
-    required: true
-  githubReleaseTrainReadToken:
-    description: 'GitHub access token for reading release trains without rate limits.'
-    required: true
-  configPath:
-    description: 'The path to the firebase config file.'
-    required: true
-  distDir:
-    description: 'The path to the firebase dist directory.'
-    required: true
-runs:
-  using: 'node20'
-  main: 'main.js'

.github/actions/deploy-docs-site/esbuild.conf.js

@@ -1,17 +0,0 @@
-/**
- * @license
- * Copyright Google LLC All Rights Reserved.
- *
- * Use of this source code is governed by an MIT-style license that can be
- * found in the LICENSE file at https://angular.dev/license
- */
-
-module.exports = {
-  resolveExtensions: ['.mjs', '.js'],
-  format: 'esm',
-  banner: {
-    // Workaround for: https://github.com/evanw/esbuild/issues/946
-    js: `import {createRequire as __cjsCompatRequire} from 'module';
-const require = __cjsCompatRequire(import.meta.url);`,
-  },
-};

.github/actions/deploy-docs-site/lib/credential.mts

@@ -1,22 +0,0 @@
-import {writeFileSync, mkdtempSync} from 'node:fs';
-import {join} from 'node:path';
-import {tmpdir} from 'node:os';
-import {getInput, setSecret} from '@actions/core';
-
-let credentialFilePath: undefined | string;
-
-export function getCredentialFilePath(): string {
-  if (credentialFilePath === undefined) {
-    const tmpDir = mkdtempSync(join(tmpdir(), 'credential-'));
-    const filePath = join(tmpDir, 'credential.json');
-    writeFileSync(filePath, getInput('serviceKey', {required: true}));
-    setSecret(filePath);
-    credentialFilePath = filePath;
-  }
-  return credentialFilePath;
-}
-
-/** Github access token. Used for querying the active release trains. */
-export const githubReleaseTrainReadToken: string = getInput('githubReleaseTrainReadToken', {
-  required: true,
-});

.github/actions/deploy-docs-site/lib/deploy.mts

@@ -1,116 +0,0 @@
-import {mkdtemp, readFile, rm, writeFile} from 'node:fs/promises';
-import {Deployment} from './deployments.mjs';
-import {join} from 'node:path';
-
-import {tmpdir} from 'node:os';
-import {spawnSync} from 'node:child_process';
-import {getCredentialFilePath} from './credential.mjs';
-
-export async function deployToFirebase(
-  deployment: Deployment,
-  configPath: string,
-  stagingDir: string,
-) {
-  if (deployment.destination == undefined) {
-    console.log(`No deployment necessary for docs created from: ${deployment.branch}`);
-    return;
-  }
-
-  console.log('Preparing for deployment to firebase...');
-
-  const deployConfigPath = join(stagingDir, 'firebase.json');
-
-  const config = JSON.parse(await readFile(configPath, {encoding: 'utf-8'})) as {
-    hosting: {public: string};
-  };
-  config['hosting']['public'] = './browser';
-
-  await writeFile(deployConfigPath, JSON.stringify(config, null, 2));
-
-  firebase(
-    `target:clear --config ${deployConfigPath} --project angular-dev-site hosting angular-docs`,
-    stagingDir,
-  );
-  firebase(
-    `target:apply --config ${deployConfigPath} --project angular-dev-site hosting angular-docs ${deployment.destination}`,
-    stagingDir,
-  );
-  firebase(
-    `deploy --config ${deployConfigPath} --project angular-dev-site --only hosting --non-interactive`,
-    stagingDir,
-  );
-  firebase(
-    `target:clear --config ${deployConfigPath} --project angular-dev-site hosting angular-docs`,
-    stagingDir,
-  );
-
-  await rm(stagingDir, {recursive: true});
-}
-
-export async function setupRedirect(deployment: Deployment) {
-  if (deployment.redirect === undefined) {
-    console.log(`No redirect necessary for docs created from: ${deployment.branch}`);
-    return;
-  }
-
-  console.log('Preparing to set up redirect on firebase...');
-
-  const redirectConfig = JSON.stringify(
-    {
-      hosting: {
-        target: 'angular-docs',
-        redirects: [
-          {
-            type: 302,
-            regex: '^(.*)$',
-            destination: `${deployment.redirect.to}:1`,
-          },
-        ],
-      },
-    },
-    null,
-    2,
-  );
-
-  const tmpRedirectDir = await mkdtemp(join(tmpdir(), 'redirect-directory'));
-  const redirectConfigPath = join(tmpRedirectDir, 'firebase.json');
-
-  await writeFile(redirectConfigPath, redirectConfig);
-  spawnSync(`chmod 777 -R ${tmpRedirectDir}`, {encoding: 'utf-8', shell: true});
-
-  firebase(
-    `target:clear --config ${redirectConfigPath} --project angular-dev-site hosting angular-docs`,
-    tmpRedirectDir,
-  );
-  firebase(
-    `target:apply --config ${redirectConfigPath} --project angular-dev-site hosting angular-docs ${deployment.redirect.from}`,
-    tmpRedirectDir,
-  );
-  firebase(
-    `deploy --config ${redirectConfigPath} --project angular-dev-site --only hosting --non-interactive`,
-    tmpRedirectDir,
-  );
-  firebase(
-    `target:clear --config ${redirectConfigPath} --project angular-dev-site hosting angular-docs`,
-    tmpRedirectDir,
-  );
-
-  await rm(tmpRedirectDir, {recursive: true});
-}
-
-function firebase(cmd: string, cwd?: string) {
-  const {status} = spawnSync('npx', `-y firebase-tools@13.15.1 ${cmd}`.split(' '), {
-    cwd,
-    encoding: 'utf-8',
-    shell: true,
-    stdio: 'inherit',
-    env: {
-      ...process.env,
-      GOOGLE_APPLICATION_CREDENTIALS: getCredentialFilePath(),
-    },
-  });
-  if (status !== 0) {
-    console.error('Firebase command failed, see log above for details.');
-    process.exit(status);
-  }
-}

.github/actions/deploy-docs-site/lib/deployments.mts

@@ -1,76 +0,0 @@
-import {
-  fetchLongTermSupportBranchesFromNpm,
-  ActiveReleaseTrains,
-  AuthenticatedGitClient,
-  ReleaseConfig,
-} from '@angular/ng-dev';
-
-export interface Deployment {
-  branch: string;
-  redirect?: {
-    from: string;
-    to: string;
-  };
-  destination?: string;
-  servingUrl: string;
-}
-
-export type Deployments = Map<string, Deployment>;
-
-export async function getDeployments(): Promise<Deployments> {
-  const {github} = await AuthenticatedGitClient.get();
-  const releaseTrains = await ActiveReleaseTrains.fetch({
-    api: github,
-    name: 'angular',
-    owner: 'angular',
-    nextBranchName: 'main',
-  });
-  const ltsBranches = await fetchLongTermSupportBranchesFromNpm({
-    representativeNpmPackage: '@angular/core',
-  } as ReleaseConfig);
-
-  const docSites = new Map<string, Deployment>();
-
-  [...ltsBranches.active, ...ltsBranches.inactive].forEach((branch) => {
-    docSites.set(branch.name, {
-      branch: branch.name,
-      destination: `v${branch.version.major}-angular-dev`,
-      servingUrl: `https://v${branch.version.major}.angular.dev/`,
-    });
-  });
-
-  docSites.set(releaseTrains.latest.branchName, {
-    branch: releaseTrains.latest.branchName,
-    redirect: {
-      from: `v${releaseTrains.latest.version.major}-angular-dev`,
-      to: 'https://angular.dev',
-    },
-    servingUrl: 'https://angular.dev/',
-    destination: 'angular-dev-site',
-  });
-
-  if (releaseTrains.releaseCandidate) {
-    docSites.set(releaseTrains.next.branchName, {
-      branch: releaseTrains.next.branchName,
-      servingUrl: 'https://next.angular.dev/',
-    });
-
-    docSites.set(releaseTrains.releaseCandidate.branchName, {
-      branch: releaseTrains.releaseCandidate.branchName,
-      destination: 'next-angular-dev',
-      redirect: {
-        from: `v${releaseTrains.releaseCandidate.version.major}-angular-dev`,
-        to: 'https://next.angular.dev',
-      },
-      servingUrl: 'https://next.angular.dev/',
-    });
-  } else {
-    docSites.set(releaseTrains.next.branchName, {
-      branch: releaseTrains.next.branchName,
-      destination: 'next-angular-dev',
-      servingUrl: 'https://next.angular.dev/',
-    });
-  }
-
-  return docSites;
-}

.github/actions/deploy-docs-site/lib/main.mts

@@ -1,79 +0,0 @@
-import {getInput, setFailed} from '@actions/core';
-import {context} from '@actions/github';
-import {deployToFirebase, setupRedirect} from './deploy.mjs';
-import {getDeployments} from './deployments.mjs';
-import {generateSitemap} from './sitemap.mjs';
-import {assertValidGithubConfig, AuthenticatedGitClient, getConfig} from '@angular/ng-dev';
-import {githubReleaseTrainReadToken} from './credential.mjs';
-import {spawnSync} from 'child_process';
-import {cp, mkdtemp} from 'fs/promises';
-import {tmpdir} from 'os';
-import {join} from 'path';
-
-const refMatcher = /refs\/heads\/(.*)/;
-
-async function deployDocs() {
-  getConfig([assertValidGithubConfig]);
-
-  AuthenticatedGitClient.configure(githubReleaseTrainReadToken);
-
-  if (context.eventName !== 'push') {
-    throw Error();
-  }
-  const matchedRef = context.ref.match(refMatcher);
-  if (matchedRef === null) {
-    throw Error();
-  }
-
-  const currentBranch = matchedRef[1];
-  const configPath = getInput('configPath');
-  const stagingDir = await mkdtemp(join(tmpdir(), 'deploy-directory'));
-
-  // Copy all files from the distDir into stagingDir and modify the permissions for editing
-  await cp(getInput('distDir'), stagingDir, {recursive: true});
-  spawnSync(`chmod 777 -R ${stagingDir}`, {encoding: 'utf-8', shell: true});
-
-  const deployment = (await getDeployments()).get(currentBranch);
-  if (deployment === undefined) {
-    console.log(`Current branch (${currentBranch}) does not deploy a documentation site.`);
-    console.log(`Exiting...`);
-    process.exit(0);
-  }
-
-  console.log('Doc site deployment information');
-  console.log('');
-  console.log('Current Branch:');
-  console.log(`  ${deployment.branch}`);
-  console.log('');
-  console.log('Firebase Site:');
-  if (deployment.destination === undefined) {
-    console.log('  No deployment of a documenation site is necessary');
-  } else {
-    console.log(`  Deploying to: ${deployment.destination}`);
-  }
-  console.log('');
-  console.log('Redirect Configuration:');
-  if (deployment.redirect === undefined) {
-    console.log('  No redirects are necessary');
-  } else {
-    console.log(`  From: ${deployment.redirect.from}`);
-    console.log(`  To: ${deployment.redirect.to}`);
-  }
-
-  await generateSitemap(deployment, stagingDir);
-  await deployToFirebase(deployment, configPath, stagingDir);
-  await setupRedirect(deployment);
-}
-
-// Only run if the action is executed in a repository with is in the Angular org. This is in place
-// to prevent the action from actually running in a fork of a repository with this action set up.
-if (context.repo.owner === 'angular') {
-  deployDocs().catch((e: Error) => {
-    setFailed(e.message);
-    console.error(e);
-  });
-} else {
-  console.warn(
-    'The action was skipped as this action is only meant to run in repos belonging to the Angular organization.',
-  );
-}

.github/actions/deploy-docs-site/lib/sitemap.mts

@@ -1,53 +0,0 @@
-import {Deployment} from './deployments.mjs';
-import {join} from 'node:path';
-import {readFile, writeFile} from 'node:fs/promises';
-
-export async function generateSitemap(deployment: Deployment, distDir: string): Promise<void> {
-  /** Timestamp string used to of the last file update. */
-  const lastModifiedTimestamp = new Date().toISOString();
-  /** An object containing all of the routes available within the application. */
-  const {routes} = JSON.parse(await readFile(join(distDir, 'prerendered-routes.json'), 'utf-8'));
-  const routePaths = Object.keys(routes);
-
-  /** The generated sitemap string. */
-  const sitemap = `<?xml version="1.0" encoding="UTF-8"?>
-  <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
-  ${routePaths
-    .map(
-      (route) => `<url>
-      <loc>${joinUrlParts(deployment.servingUrl, route)}</loc>
-      <lastmod>${lastModifiedTimestamp}</lastmod>
-      <changefreq>daily</changefreq>
-      <priority>1.0</priority>
-    </url>`,
-    )
-    .join('')}
-  </urlset>`;
-
-  await writeFile(join(distDir, 'browser', 'sitemap.xml'), sitemap, 'utf-8');
-
-  console.log(`Generated sitemap with ${routePaths.length} entries.`);
-}
-
-function joinUrlParts(...parts: string[]): string {
-  const normalizeParts: string[] = [];
-  for (const part of parts) {
-    if (part === '') {
-      // Skip any empty parts
-      continue;
-    }
-
-    let normalizedPart = part;
-    if (part[0] === '/') {
-      normalizedPart = normalizedPart.slice(1);
-    }
-    if (part.at(-1) === '/') {
-      normalizedPart = normalizedPart.slice(0, -1);
-    }
-    if (normalizedPart !== '') {
-      normalizeParts.push(normalizedPart);
-    }
-  }
-
-  return normalizeParts.join('/');
-}

.github/actions/deploy-docs-site/tsconfig.json

@@ -1,15 +0,0 @@
-{
-  "compilerOptions": {
-    "module": "NodeNext",
-    "target": "ES2021",
-    "types": ["node"],
-    "lib": ["es2021"],
-    "experimentalDecorators": true,
-    "skipLibCheck": true,
-    "noImplicitOverride": true,
-    "esModuleInterop": true,
-    "noImplicitReturns": true,
-    "declaration": true,
-    "sourceMap": true
-  }
-}

.github/angular-robot.yml

@@ -1,8 +1,8 @@
 # Configuration for angular-robot
 
-# options for the size plugin
+#options for the size plugin
 size:
-  disabled: true
+  disabled: false
   maxSizeIncrease: 2000
   circleCiStatusName: 'ci/circleci: test'
 
@@ -22,7 +22,7 @@ merge:
   # the g3 status will be added to your pull requests if they include files that match the patterns
   g3Status:
     # set to true to disable
-    disabled: true
+    disabled: false
     # the name of the status
     context: 'google3'
     # text to show when the status is pending, {{PRNumber}} will be replaced by the PR number
@@ -32,8 +32,50 @@ merge:
     # link to use for the details
     url: 'http://go/angular/g3sync'
     # list of patterns to check for the files changed by the PR
+    # this list must be manually kept in sync with google3/third_party/javascript/angular2/copy.bara.sky
     include:
+      - 'LICENSE'
+      - 'modules/benchmarks/**'
+      - 'modules/system.d.ts'
+      - 'packages/**'
+    # list of patterns to ignore for the files changed by the PR
     exclude:
+      - 'packages/*'
+      - 'packages/bazel/*'
+      - 'packages/bazel/src/api-extractor/**'
+      - 'packages/bazel/src/ng_package/**'
+      - 'packages/bazel/src/ng_module/**'
+      - 'packages/compiler-cli/src/ngcc/**'
+      - 'packages/compiler-cli/linker/**'
+      - 'packages/compiler-cli/ngcc/**'
+      - 'packages/compiler-cli/src/ngtsc/sourcemaps/**'
+      - 'packages/docs/**'
+      - 'packages/elements/schematics/**'
+      - 'packages/examples/**'
+      - 'packages/language-service/**'
+      - 'packages/localize/**'
+      - 'packages/private/**'
+      - 'packages/service-worker/**'
+      - 'packages/common/locales/**'
+      - 'packages/http/**'
+      - '**/.gitignore'
+      - '**/.gitkeep'
+      - '**/yarn.lock'
+      - '**/package.json'
+      - '**/third_party/**'
+      - '**/tsconfig-build.json'
+      - '**/tsconfig-tsec.json'
+      - '**/tsconfig.json'
+      - '**/rollup.config.js'
+      - '**/BUILD.bazel'
+      - '**/*.md'
+      - 'packages/**/integrationtest/**'
+      - 'packages/**/test/**'
+      - 'packages/zone.js/*'
+      - 'packages/zone.js/dist/**'
+      - 'packages/zone.js/doc/**'
+      - 'packages/zone.js/example/**'
+      - 'packages/zone.js/scripts/**'
 
   # comment that will be added to a PR when there is a conflict, leave empty or set to false to disable
   mergeConflictComment: "Hi @{{PRAuthor}}! This PR has merge conflicts due to recent upstream merges.\nPlease help to unblock it by resolving these conflicts. Thanks!"
@@ -55,7 +97,7 @@ merge:
 
     # whether the PR shouldn't have a conflict with the base branch
     noConflict: true
-    # list of labels that a PR needs to have, checked with a regexp.
+    # list of labels that a PR needs to have, checked with a regexp (e.g. "target:" will work for the label "target: master")
     requiredLabels:
       - 'target: *'
 
@@ -68,13 +110,16 @@ merge:
 
     # list of PR statuses that need to be successful
     requiredStatuses:
-      - 'google-internal-tests'
+      - 'ci/circleci: build'
+      - 'ci/circleci: lint'
+      - 'ci/angular: size'
+      - 'google3'
       - 'pullapprove'
 
   # the comment that will be added when the merge label is added despite failing checks, leave empty or set to false to disable
   # {{MERGE_LABEL}} will be replaced by the value of the mergeLabel option
   # {{PLACEHOLDER}} will be replaced by the list of failing checks
-  mergeRemovedComment: "I see that you just added the `{{MERGE_LABEL}}` label, but the following checks are still failing:\n{{PLACEHOLDER}}\n\n**If you want your PR to be merged, it has to pass all the CI checks.**\n\nIf you can't get the PR to a green state due to flakes or broken `main`, please try rebasing to `main` and/or restarting the CI job. If that fails and you believe that the issue is not due to your change, please contact the caretaker and ask for help."
+  mergeRemovedComment: "I see that you just added the `{{MERGE_LABEL}}` label, but the following checks are still failing:\n{{PLACEHOLDER}}\n\n**If you want your PR to be merged, it has to pass all the CI checks.**\n\nIf you can't get the PR to a green state due to flakes or broken master, please try rebasing to master and/or restarting the CI job. If that fails and you believe that the issue is not due to your change, please contact the caretaker and ask for help."
 
 # options for the triage plugin
 triage:
@@ -84,29 +129,29 @@ triage:
   defaultMilestone: 82,
   # arrays of labels that determine if an issue has been triaged by the caretaker
   l1TriageLabels:
-    - - 'area: *'
+    - - 'comp: *'
   # arrays of labels that determine if an issue has been fully triaged
   l2TriageLabels:
     - - 'P0'
-      - 'area: *'
+      - 'comp: *'
     - - 'P1'
-      - 'area: *'
+      - 'comp: *'
     - - 'P2'
-      - 'area: *'
+      - 'comp: *'
     - - 'P3'
-      - 'area: *'
+      - 'comp: *'
     - - 'P4'
-      - 'area: *'
+      - 'comp: *'
     - - 'P5'
-      - 'area: *'
+      - 'comp: *'
     - - 'feature'
-      - 'area: *'
+      - 'comp: *'
     - - 'discussion'
-      - 'area: *'
+      - 'comp: *'
     - - 'needs clarification'
-      - 'area: *'
+      - 'comp: *'
     - - 'needs reproduction'
-      - 'area: *'
+      - 'comp: *'
 
 # options for the triage PR plugin
 triagePR:
@@ -118,10 +163,10 @@ triagePR:
   defaultMilestone: 82,
   # arrays of labels that determine if a PR has been triaged by the caretaker
   l1TriageLabels:
-    - - 'area: *'
+    - - 'comp: *'
   # arrays of labels that determine if a PR has been fully triaged
   l2TriageLabels:
-    - - 'area: *'
+    - - 'comp: *'
 
 # options for rerunning CI
 rerunCircleCI:

.github/workflows/adev-preview-build.yml

@@ -1,39 +0,0 @@
-# This workflow builds the previews for pull requests when a certain label is applied.
-# The actual deployment happens as part of a dedicated second workflow to avoid security
-# issues where the building would otherwise occur in an authorized context where secrets
-# could be leaked. More details can be found here:
-
-# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/.
-
-name: Build adev for preview deployment
-
-on:
-  pull_request:
-    types: [synchronize, labeled]
-
-permissions: read-all
-
-jobs:
-  adev-build:
-    runs-on: ubuntu-latest-8core
-    if: |
-      (github.event.action == 'labeled' && github.event.label.name == 'adev: preview') ||
-      (github.event.action == 'synchronize' && contains(github.event.pull_request.labels.*.name, 'adev: preview'))
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Setup Bazel RBE
-        uses: angular/dev-infra/github-actions/bazel/configure-remote@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      - name: Build adev
-        # `snapshot-build` config is used to stamp the exact version with sha in the footer.
-        run: pnpm bazel build //adev:build.production --config=snapshot-build
-      - uses: angular/dev-infra/github-actions/previews/pack-and-upload-artifact@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-        with:
-          workflow-artifact-name: 'adev-preview'
-          pull-number: '${{github.event.pull_request.number}}'
-          artifact-build-revision: '${{github.event.pull_request.head.sha}}'
-          deploy-directory: './dist/bin/adev/dist/browser'

.github/workflows/adev-preview-deploy.yml

@@ -1,56 +0,0 @@
-# This workflow runs whenever the ADEV build workflow has completed. Deployment happens
-# as part of a dedicated second workflow to avoid security issues where the building would
-# otherwise occur in an authorized context where secrets could be leaked.
-#
-# More details can be found here:
-# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/.
-
-name: Deploying adev preview to Firebase
-
-on:
-  # zizmor: ignore[dangerous-triggers] - {Trigger is safe as workflow does not checkout untrusted code}
-  workflow_run:
-    workflows: ['Build adev for preview deployment']
-    types: [completed]
-
-permissions:
-  # Needed in order to be able to comment on the pull request.
-  pull-requests: write
-  # Needed in order to checkout the repository
-  contents: read
-  # Needed in order to retrieve the artifacts from the previous job
-  actions: read
-
-env:
-  PREVIEW_PROJECT: ng-dev-previews
-  PREVIEW_SITE: ng-dev-previews-fw
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          token: '${{secrets.GITHUB_TOKEN}}'
-          persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version-file: '.nvmrc'
-          package-manager-cache: false
-      - name: Configure Firebase deploy target
-        working-directory: ./
-        run: |
-          # We can use `npx` as the Firebase deploy actions uses it too.
-          # Use stable version release
-          npx -y firebase-tools@15.15.0 target:clear --config adev/firebase.json --project ${{env.PREVIEW_PROJECT}} hosting angular-docs
-          npx -y firebase-tools@15.15.0 target:apply --config adev/firebase.json --project ${{env.PREVIEW_PROJECT}} hosting angular-docs ${{env.PREVIEW_SITE}}
-
-      - uses: angular/dev-infra/github-actions/previews/upload-artifacts-to-firebase@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-        with:
-          github-token: '${{secrets.GITHUB_TOKEN}}'
-          workflow-artifact-name: 'adev-preview'
-          firebase-config-dir: './adev'
-          firebase-public-dir: './adev/build/browser'
-          firebase-project-id: '${{env.PREVIEW_PROJECT}}'
-          firebase-service-key: '${{secrets.FIREBASE_PREVIEW_SERVICE_TOKEN}}'

.github/workflows/assistant-to-the-branch-manager.yml

@@ -1,23 +0,0 @@
-name: DevInfra
-
-on:
-  push:
-  # zizmor: ignore[dangerous-triggers] - {Trigger is safe as workflow does not checkout untrusted code}
-  pull_request_target:
-    types: [opened, synchronize, reopened, ready_for_review, labeled]
-
-# Declare default permissions as read only.
-permissions:
-  contents: read
-
-jobs:
-  assistant_to_the_branch_manager:
-    runs-on: ubuntu-latest
-    if: github.event.repository.fork == false
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - uses: angular/dev-infra/github-actions/branch-manager@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-        with:
-          angular-robot-key: ${{ secrets.ANGULAR_ROBOT_PRIVATE_KEY }}

.github/workflows/benchmark-compare.yml

@@ -1,85 +0,0 @@
-name: Run benchmark comparison
-
-on:
-  issue_comment:
-    types: [created]
-
-permissions: read-all
-
-jobs:
-  benchmark-compare:
-    runs-on: ubuntu-latest
-    if: ${{ github.event.issue.pull_request && startsWith(github.event.comment.body, '/benchmark-compare ')}}
-    steps:
-      - uses: TheModdingInquisition/actions-team-membership@057d91bb80f2976a1bc6dfab5b4ae1da9aebbd89 # v1.0
-        with:
-          team: 'team'
-          organization: angular
-          token: ${{secrets.BENCHMARK_COMPARE_MEMBERSHIP_GITHUB_TOKEN}}
-          exit: true
-
-      # Indicate that the benchmark command was received.
-      - uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5
-        with:
-          comment-id: ${{github.event.comment.id}}
-          token: '${{secrets.BENCHMARK_POST_RESULTS_GITHUB_TOKEN}}'
-          reactions: 'rocket'
-
-      - uses: alessbell/pull-request-comment-branch@ef3408c9757d05f89cb525036383033a313758a0 # v2.1.0
-        id: comment-branch
-
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          # Specify repository as the PR branch might be from a fork.
-          repository: ${{steps.comment-branch.outputs.head_owner}}/${{steps.comment-branch.outputs.head_repo}}
-          # Checkout the pull request and assume it being trusted given we've checked
-          # that the action was triggered by a team member.
-          ref: ${{steps.comment-branch.outputs.head_sha}}
-
-      # We cannot use `angular/dev-infra/github-actions/npm/checkout-and-setup-node` here
-      # because it does not support checking out from a fork (as it lacks a `repository` input).
-      # Thus, we checkout and setup Node/pnpm manually.
-      - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version-file: '.nvmrc'
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
-
-      - run: pnpm install --frozen-lockfile
-
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-
-      - uses: angular/dev-infra/github-actions/bazel/configure-remote@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-        with:
-          bazelrc: ./.bazelrc.user
-
-      - name: Preparing benchmark for GitHub action
-        id: info
-        env:
-          # Untrusted input used in an executable code, must be wrapped as an env var to prevent injections
-          COMMENT_BODY: ${{ github.event.comment.body }}
-        run: pnpm benchmarks prepare-for-github-action "$COMMENT_BODY"
-
-      - env:
-          COMPARE_SHA: ${{steps.info.outputs.compareSha}}
-          BENCHMARK_TARGET: ${{steps.info.outputs.benchmarkTarget}}
-        run: pnpm benchmarks run-compare "$COMPARE_SHA" "$BENCHMARK_TARGET"
-        id: benchmark
-        name: Running benchmark
-
-      - uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5
-        with:
-          issue-number: ${{github.event.issue.number}}
-          token: '${{secrets.BENCHMARK_POST_RESULTS_GITHUB_TOKEN}}'
-          body: |
-            ## Benchmark Test Results
-            **Test**: `${{steps.info.outputs.benchmarkTarget}}`
-
-            ### PR (${{steps.info.outputs.prHeadSha}})
-            ${{steps.benchmark.outputs.workingStageResultsText}}
-
-            ### Compare Ref (${{steps.info.outputs.compareSha}})
-            ${{steps.benchmark.outputs.comparisonResultsText}}

.github/workflows/ci.yml

@@ -1,221 +0,0 @@
-name: CI (push)
-
-on:
-  push:
-    branches:
-      - main
-      - '[0-9]+.[0-9]+.x'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions: {}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      - name: Check code lint
-        run: pnpm tslint
-      - name: Check for circular dependencies
-        run: pnpm ts-circular-deps:check
-      - name: Validate pull approve configuration
-        run: pnpm ng-dev pullapprove verify
-      - name: Validate angular robot configuration
-        run: pnpm ng-dev ngbot verify
-      - name: Validate agent skills
-        run: pnpm ng-dev misc validate-skills
-      - name: Confirm code builds with typescript as expected
-        run: pnpm check-tooling-setup
-
-  devtools:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-        with:
-          disable-package-manager-cache: true
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Setup Bazel RBE
-        uses: angular/dev-infra/github-actions/bazel/configure-remote@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-        with:
-          google_credential: ${{ secrets.RBE_TRUSTED_BUILDS_USER }}
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      - name: Run unit tests
-        run: pnpm devtools:test
-      - name: Test build
-        run: pnpm devtools:build:chrome
-      - name: Cypress run
-        uses: cypress-io/github-action@09090944bd8aaa2a517cefb6e38bf1aae336b42b # v7.4.3
-        with:
-          command: pnpm devtools:test:e2e
-          start: pnpm bazel run //devtools/src:devserver
-          wait-on: 'http://localhost:4200'
-          wait-on-timeout: 300
-          install: false
-
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Setup Bazel Remote Caching
-        uses: angular/dev-infra/github-actions/bazel/configure-remote@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-        with:
-          google_credential: ${{ secrets.RBE_TRUSTED_BUILDS_USER }}
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      - name: Run CI tests for framework
-        run: pnpm test:ci
-
-  integration-tests:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Setup Bazel Remote Caching
-        uses: angular/dev-infra/github-actions/bazel/configure-remote@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-        with:
-          google_credential: ${{ secrets.RBE_TRUSTED_BUILDS_USER }}
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      - name: Run integration CI tests for framework
-        run: pnpm integration-tests:ci
-
-  adev:
-    runs-on:
-      labels: ubuntu-latest
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Setup Bazel RBE
-        uses: angular/dev-infra/github-actions/bazel/configure-remote@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-        with:
-          google_credential: ${{ secrets.RBE_TRUSTED_BUILDS_USER }}
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      - name: Run tests
-        run: pnpm bazel test //adev/...
-      - name: Build adev in fast mode to ensure it continues to work
-        run: pnpm bazel build //adev:build
-
-  vscode-ng-language-service:
-    runs-on:
-      labels: ubuntu-latest
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Setup Bazel RBE
-        uses: angular/dev-infra/github-actions/bazel/configure-remote@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-        with:
-          google_credential: ${{ secrets.RBE_TRUSTED_BUILDS_USER }}
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      - name: Run tests
-        run: pnpm bazel test //vscode-ng-language-service/...
-
-  publish-snapshots:
-    runs-on:
-      labels: ubuntu-latest
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Setup Bazel RBE
-        uses: angular/dev-infra/github-actions/bazel/configure-remote@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      - run: echo "https://${{secrets.SNAPSHOT_BUILDS_GITHUB_TOKEN}}:@github.com" > ${HOME}/.git_credentials
-      - run: pnpm build
-      - run: ./scripts/ci/publish-snapshot-build-artifacts.sh
-
-  zone-js:
-    runs-on:
-      labels: ubuntu-latest
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Setup Bazel RBE
-        uses: angular/dev-infra/github-actions/bazel/configure-remote@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-        with:
-          google_credential: ${{ secrets.RBE_TRUSTED_BUILDS_USER }}
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      - run: |
-          pnpm bazel build \
-          //packages/zone.js/bundles:zone.umd.js \
-          //packages/zone.js:npm_package \
-          //packages/zone.js/test/closure:closure
-
-      - run: |
-          rm -Rf packages/zone.js/build
-          rm -Rf packages/zone.js/test/extra/*.umd.js
-
-          mkdir -p packages/zone.js/build/
-          mkdir -p packages/zone.js/build/test/
-
-          cp dist/bin/packages/zone.js/bundles/zone.umd.js packages/zone.js/build/zone.umd.js
-          cp dist/bin/packages/zone.js/npm_package/bundles/zone-mix.umd.js ./packages/zone.js/test/extra/
-          cp dist/bin/packages/zone.js/npm_package/bundles/zone-patch-electron.umd.js ./packages/zone.js/test/extra/
-          cp dist/bin/packages/zone.js/test/closure/zone.closure.js ./packages/zone.js/build/test/zone.closure.mjs
-
-        # Install
-      - run: pnpm -C packages/zone.js install --frozen-lockfile
-        # Run zone.js tools tests
-      - run: pnpm -C packages/zone.js promisefinallytest
-      - run: pnpm -C packages/zone.js jest:test
-      - run: pnpm -C packages/zone.js jest:nodetest
-      - run: pnpm -C packages/zone.js vitest:test
-      - run: pnpm -C packages/zone.js vitest-globals:test
-      - run: pnpm -C packages/zone.js electrontest
-      - run: pnpm -C packages/zone.js/test/typings test
-
-  adev-deploy:
-    needs: [adev]
-    if: needs.adev.result == 'success'
-    runs-on: ubuntu-latest-8core
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Setup Bazel RBE
-        uses: angular/dev-infra/github-actions/bazel/configure-remote@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      - name: Build adev
-        # `snapshot-build` config is used to stamp the exact version with sha in the footer.
-        run: pnpm bazel build //adev:build.production --config=snapshot-build
-      - name: Deploy to firebase
-        uses: ./.github/actions/deploy-docs-site
-        with:
-          serviceKey: ${{ secrets.ANGULAR_DEV_SITE_DEPLOY }}
-          githubReleaseTrainReadToken: ${{ secrets.DOCS_DEPLOY_GITHUB_RELEASE_TRAIN_TOKEN }}
-          configPath: 'adev/firebase.json'
-          distDir: 'dist/bin/adev/dist'
-      - name: Update Algolia synonym record
-        run: node adev/scripts/synonyms/update-synonyms.mts
-        env:
-          ALGOLIA_KEY: ${{ secrets.ALGOLIA_SYNONYM_MANAGER }}

.github/workflows/cross-repo-adev-docs.yml

@@ -1,59 +0,0 @@
-name: Update ADEV Cross Repo Docs
-
-on:
-  workflow_dispatch:
-    inputs: {}
-  push:
-    branches:
-      - 'main'
-      - '[0-9]+.[0-9]+.x'
-
-# Declare default permissions as read only.
-permissions:
-  contents: read
-
-jobs:
-  update_adev_cross_repo_docs:
-    name: Update Cross Repo ADEV Docs
-    if: github.repository == 'angular/angular'
-    runs-on: ubuntu-latest
-    # Prevents multiple concurrent runs of this workflow for the same branch
-    concurrency:
-      group: ${{ github.workflow }}-${{ github.ref }}
-      cancel-in-progress: true
-
-    steps:
-      - name: Checkout the repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          # Setting `persist-credentials: false` prevents the github-action account from being the
-          # account that is attempted to be used for authentication, instead the remote is set to
-          # an authenticated URL.
-          persist-credentials: false
-
-      - name: Generate Docs
-        run: node adev/scripts/update-cross-repo-docs/index.mjs
-        env:
-          ANGULAR_READONLY_GITHUB_TOKEN: ${{ secrets.READONLY_GITHUB_TOKEN }}
-
-      - name: Create a PR (if necessary)
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
-        with:
-          token: ${{ secrets.ANGULAR_ROBOT_ACCESS_TOKEN }}
-          push-to-fork: 'angular-robot/angular'
-          delete-branch: true
-          maintainer-can-modify: false
-          branch: docs-cross-repo-update-${{github.ref_name}}
-          committer: Angular Robot <angular-robot@google.com>
-          author: Angular Robot <angular-robot@google.com>
-          title: 'docs: update cross-repo adev docs [${{github.ref_name}}]'
-          body: |
-            Updated Angular adev cross repo docs files.
-          labels: |
-            action: merge
-            area: docs
-            target: automation
-          commit-message: |
-            docs: update cross-repo adev docs
-
-            Updated Angular adev cross repo docs files.

.github/workflows/dev-infra.yml

@@ -1,37 +1,18 @@
 name: DevInfra
 
 on:
-  # zizmor: ignore[dangerous-triggers] - {Trigger is safe as workflow does not checkout untrusted code}
   pull_request_target:
     types: [opened, synchronize, reopened]
-  issues:
-    types: [opened, reopened]
 
 # Declare default permissions as read only.
 permissions:
   contents: read
 
 jobs:
-  pull_request_labels:
-    if: github.event_name == 'pull_request_target'
+  labels:
     runs-on: ubuntu-latest
     steps:
-      - uses: angular/dev-infra/github-actions/labeling/pull-request@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
+      - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3.0.0
+      - uses: angular/dev-infra/github-actions/commit-message-based-labels@ff24a8ca7be9066fc9a7ece62c1b62d064c3dfff
         with:
           angular-robot-key: ${{ secrets.ANGULAR_ROBOT_PRIVATE_KEY }}
-          labels: '{"requires: TGP": ["packages/core/primitives/**/{*,.*}"]}'
-  post_approval_changes:
-    if: github.event_name == 'pull_request_target'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: angular/dev-infra/github-actions/post-approval-changes@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-        with:
-          angular-robot-key: ${{ secrets.ANGULAR_ROBOT_PRIVATE_KEY }}
-  issue_labels:
-    if: github.event_name == 'issues'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: angular/dev-infra/github-actions/labeling/issue@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-        with:
-          angular-robot-key: ${{ secrets.ANGULAR_ROBOT_PRIVATE_KEY }}
-          google-generative-ai-key: ${{ secrets.GOOGLE_GENERATIVE_AI_KEY }}

.github/workflows/feature-requests.yml

@@ -0,0 +1,19 @@
+name: Feature request triage bot
+
+on:
+  schedule:
+    # Run at 14:00 every day
+    - cron: '0 14 * * *'
+
+# Declare default permissions as read only.
+permissions:
+  contents: read
+
+jobs:
+  feature_triage:
+    if: github.repository == 'angular/angular'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: angular/dev-infra/github-actions/feature-request@ff24a8ca7be9066fc9a7ece62c1b62d064c3dfff
+        with:
+          angular-robot-key: ${{ secrets.ANGULAR_ROBOT_PRIVATE_KEY }}

.github/workflows/google-internal-tests.yml

@@ -1,22 +0,0 @@
-name: Google Internal Tests Enforcement
-
-on:
-  # zizmor: ignore[dangerous-triggers] - {Trigger is safe as workflow does not checkout untrusted code}
-  pull_request_target:
-    types: [opened, reopened, synchronize]
-
-permissions: {}
-
-jobs:
-  trigger:
-    permissions:
-      pull-requests: read
-      statuses: write
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: angular/dev-infra/github-actions/google-internal-tests@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-        with:
-          run-tests-guide-url: http://go/angular-g3sync-start
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          sync-config: ./.ng-dev/google-sync-config.json

.github/workflows/lock-closed.yml

@@ -0,0 +1,19 @@
+name: Lock closed inactive issues
+
+on:
+  schedule:
+    # Run at 16:00 every day
+    - cron: '0 16 * * *'
+
+# Declare default permissions as read only.
+permissions:
+  contents: read
+
+jobs:
+  lock_closed:
+    if: github.repository == 'angular/angular'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: angular/dev-infra/github-actions/lock-closed@ff24a8ca7be9066fc9a7ece62c1b62d064c3dfff
+        with:
+          lock-bot-key: ${{ secrets.LOCK_BOT_PRIVATE_KEY }}

.github/workflows/merge-ready-status.yml

@@ -1,16 +0,0 @@
-name: Merge Ready
-
-on:
-  # zizmor: ignore[dangerous-triggers] - {Trigger is safe as workflow does not checkout untrusted code}
-  pull_request_target:
-
-# Declare default permissions as read only.
-permissions: {}
-
-jobs:
-  status:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: angular/dev-infra/github-actions/unified-status-check@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-        with:
-          angular-robot-key: ${{ secrets.ANGULAR_ROBOT_PRIVATE_KEY }}

.github/workflows/perf.yml

@@ -1,58 +0,0 @@
-name: Performance Tracking
-
-on:
-  push:
-    branches:
-      - main
-
-permissions:
-  contents: 'read'
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  list:
-    timeout-minutes: 3
-    runs-on: ubuntu-latest
-    outputs:
-      workflows: ${{ steps.workflows.outputs.workflows }}
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      - id: workflows
-        run: echo "workflows=$(pnpm --silent ng-dev perf workflows --list)" >> "$GITHUB_OUTPUT"
-
-  workflow:
-    timeout-minutes: 30
-    runs-on: ubuntu-latest
-    needs: list
-    permissions:
-      contents: 'read'
-      id-token: 'write'
-    strategy:
-      matrix:
-        workflow: ${{ fromJSON(needs.list.outputs.workflows) }}
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      # We utilize the google-github-actions/auth action to allow us to get an active credential using workflow
-      # identity federation. This allows us to request short lived credentials on demand, rather than storing
-      # credentials in secrets long term. More information can be found at:
-      # https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-google-cloud-platform
-      - uses: 'google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093' # v3
-        with:
-          project_id: 'internal-200822'
-          workload_identity_provider: 'projects/823469418460/locations/global/workloadIdentityPools/measurables-tracking/providers/angular'
-          service_account: 'measures-uploader@internal-200822.iam.gserviceaccount.com'
-      - run: pnpm ng-dev perf workflows --name "$WORKFLOW" --commit-sha "$COMMIT_SHA"
-        env:
-          WORKFLOW: ${{ matrix.workflow }}
-          COMMIT_SHA: ${{ github.sha }}

.github/workflows/pr.yml

@@ -1,179 +0,0 @@
-name: Pull Request
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened]
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions: {}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      - name: Check code lint
-        run: pnpm tslint
-      - name: Check for circular dependencies
-        run: pnpm ts-circular-deps:check
-      - name: Validate pull approve configuration
-        run: pnpm ng-dev pullapprove verify
-      - name: Validate angular robot configuration
-        run: pnpm ng-dev ngbot verify
-      - name: Confirm code builds with typescript as expected
-        run: pnpm check-tooling-setup
-      - name: Validate agent skills
-        run: pnpm ng-dev misc validate-skills
-      - name: Check commit message
-        run: pnpm ng-dev commit-message validate-range ${{ github.event.pull_request.base.sha }} ${{ github.event.pull_request.head.sha }}
-      - name: Check code format
-        run: pnpm ng-dev format changed --check ${{ github.event.pull_request.base.sha }}
-      - name: Check Package Licenses
-        uses: angular/dev-infra/github-actions/linting/licenses@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-        with:
-          allow-dependencies-licenses: 'pkg:npm/google-protobuf@'
-
-  devtools:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-        with:
-          disable-package-manager-cache: true
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Setup Bazel RBE
-        uses: angular/dev-infra/github-actions/bazel/configure-remote@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      - name: Run unit tests
-        run: pnpm devtools:test
-      - name: Test build
-        run: pnpm devtools:build:chrome
-      - name: Cypress run
-        uses: cypress-io/github-action@09090944bd8aaa2a517cefb6e38bf1aae336b42b # v7.4.3
-        with:
-          command: pnpm devtools:test:e2e
-          start: pnpm bazel run //devtools/src:devserver
-          wait-on: 'http://localhost:4200'
-          wait-on-timeout: 300
-          install: false
-
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Setup Bazel Remote Caching
-        uses: angular/dev-infra/github-actions/bazel/configure-remote@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      - name: Run CI tests for framework
-        run: pnpm test:ci
-        env:
-          # Ensures Aspect lock files are up-to-date.
-          # TODO(devversion): Remove when removing pnpm.
-          ASPECT_RULES_JS_FROZEN_PNPM_LOCK: '1'
-      - name: Upload GRPC logs (for debugging of RBE issues)
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          path: /tmp/rbe-grpc.log
-          retention-days: 1
-
-  integration-tests:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Setup Bazel Remote Caching
-        uses: angular/dev-infra/github-actions/bazel/configure-remote@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      - name: Run integration CI tests for framework
-        run: pnpm integration-tests:ci
-
-  adev:
-    runs-on:
-      labels: ubuntu-latest
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Setup Bazel RBE
-        uses: angular/dev-infra/github-actions/bazel/configure-remote@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      - name: Run tests
-        run: pnpm bazel test //adev/...
-      - name: Build adev in fast mode to ensure it continues to work
-        run: pnpm bazel build //adev:build
-
-  vscode-ng-language-service:
-    runs-on:
-      labels: ubuntu-latest
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Setup Bazel RBE
-        uses: angular/dev-infra/github-actions/bazel/configure-remote@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      - name: Run tests
-        run: pnpm bazel test //vscode-ng-language-service/...
-
-  zone-js:
-    runs-on:
-      labels: ubuntu-latest
-    steps:
-      - name: Initialize environment
-        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Setup Bazel
-        uses: angular/dev-infra/github-actions/bazel/setup@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Setup Bazel RBE
-        uses: angular/dev-infra/github-actions/bazel/configure-remote@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-      - name: Install node modules
-        run: pnpm install --frozen-lockfile
-      - run: |
-          pnpm bazel build \
-          //packages/zone.js/bundles:zone.umd.js \
-          //packages/zone.js:npm_package \
-          //packages/zone.js/test/closure:closure
-
-      - run: |
-          rm -Rf packages/zone.js/build
-          rm -Rf packages/zone.js/test/extra/*.umd.js
-
-          mkdir -p packages/zone.js/build/
-          mkdir -p packages/zone.js/build/test/
-
-          cp dist/bin/packages/zone.js/bundles/zone.umd.js packages/zone.js/build/zone.umd.js
-          cp dist/bin/packages/zone.js/npm_package/bundles/zone-mix.umd.js ./packages/zone.js/test/extra/
-          cp dist/bin/packages/zone.js/npm_package/bundles/zone-patch-electron.umd.js ./packages/zone.js/test/extra/
-          cp dist/bin/packages/zone.js/test/closure/zone.closure.js ./packages/zone.js/build/test/zone.closure.mjs
-
-        # Run zone.js tools tests
-      - run: pnpm -C packages/zone.js promisefinallytest
-      - run: pnpm -C packages/zone.js jest:test
-      - run: pnpm -C packages/zone.js jest:nodetest
-      - run: pnpm -C packages/zone.js vitest:test
-      - run: pnpm -C packages/zone.js vitest-globals:test
-      - run: pnpm -C packages/zone.js electrontest
-      - run: pnpm -C packages/zone.js/test/typings test

.github/workflows/release.yml

@@ -1,24 +0,0 @@
-name: Publish Release
-
-on:
-  push:
-    branches:
-      - main
-      - '[0-9]+.[0-9]+.x'
-  workflow_dispatch: # Allow manual trigger for verification
-
-# Ensure only one release runs at a time PER BRANCH to avoid race conditions.
-concurrency:
-  group: release-${{ github.ref }}
-  cancel-in-progress: false
-
-permissions:
-  contents: read # Required to checkout the repository
-  id-token: write # Required for NPM provenance in reusable workflow
-
-jobs:
-  release:
-    uses: angular/dev-infra/.github/workflows/reusable-release.yml@4a09f9588769980eacb41fcc76e2c76d048eac42 # main
-    secrets:
-      wombot-token: ${{ secrets.WOMBOT_TOKEN }}
-      angular-robot-key: ${{ secrets.ANGULAR_ROBOT_PRIVATE_KEY }}

.github/workflows/scorecard.yml

@@ -0,0 +1,50 @@
+name: OpenSSF Scorecard
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: '0 0 * * 0'
+  push:
+    branches: [master]
+  workflow_dispatch:
+
+# Declare default permissions as read only.
+permissions:
+  contents: read
+
+jobs:
+  analysis:
+    name: Scorecards analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      actions: read
+      contents: read
+
+    steps:
+      - name: 'Checkout code'
+        uses: actions/checkout@230611dbd0eb52da1e1f4f7bc8bb0c3a339fc8b7
+        with:
+          persist-credentials: false
+
+      - name: 'Run analysis'
+        uses: ossf/scorecard-action@3662744abc9b750123cb8965fef31e3802d52da5
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          repo_token: ${{ secrets.GITHUB_TOKEN }}
+          publish_results: true
+
+      # Upload the results as artifacts.
+      - name: 'Upload artifact'
+        uses: actions/upload-artifact@2244c8200304ec9588bf9399eac622d9fadc28c4
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard.
+      - name: 'Upload to code-scanning'
+        uses: github/codeql-action/upload-sarif@040feefecff4ae0fc15c110822a5f96516b0629e
+        with:
+          sarif_file: results.sarif

.gitignore

@@ -4,8 +4,11 @@
 /bazel-out
 /integration/bazel/bazel-*
 *.log
-node_modules/
-modules/ssr-benchmarks/node_modules/
+node_modules
+
+# CircleCI temporary file for cache key computation.
+# See `save_month_to_file` in `.circleci/config.yml`.
+month.txt
 
 # Include when developing application packages.
 pubspec.lock
@@ -16,7 +19,9 @@ pubspec.lock
 !.devcontainer/recommended-devcontainer.json
 !.devcontainer/recommended-Dockerfile
 .settings/
+.vscode/launch.json
 .vscode/settings.json
+.vscode/tasks.json
 *.swo
 *.swp
 modules/.settings
@@ -51,9 +56,3 @@ baseline.json
 
 # Husky
 .husky/_
-
-# Ignore cache created with the Angular CLI.
-.angular/
-
-# pnpm store
-.pnpm-store

.gitmessage

@@ -74,7 +74,7 @@ Fixes #<issue number>
 # =============================
 #
 # The full specification of the Angular Commit Message Format can be found at
-# https://github.com/angular/angular/blob/main/contributing-docs/commit-message-guidelines.md
+# https://github.com/angular/angular/blob/master/CONTRIBUTING.md#commit
 #
 # The following is an excerpt of the specification with the most commonly needed info.
 #
@@ -106,12 +106,11 @@ Fixes #<issue number>
 #   │       └─⫸ Commit Scope: animations|bazel|benchpress|common|compiler|compiler-cli|core|
 #   │                          elements|forms|http|language-service|localize|platform-browser|
 #   │                          platform-browser-dynamic|platform-server|router|service-worker|
-#   │                          upgrade|zone.js|packaging|changelog|docs-infra|migrations|ngcc|ve|
-#   │                          devtools
-#   │                          https://github.com/angular/angular/blob/main/CONTRIBUTING.md#scope
+#   │                          upgrade|zone.js|packaging|changelog|docs-infra|migrations|ngcc|ve
+#   │                          https://github.com/angular/angular/blob/master/CONTRIBUTING.md#scope
 #   │
 #   └─⫸ Commit Type: build|ci|docs|feat|fix|perf|refactor|style|test
-#                     https://github.com/angular/angular/blob/main/CONTRIBUTING.md#type
+#                     https://github.com/angular/angular/blob/master/CONTRIBUTING.md#type
 #
 #
 # Commit Message Body

.husky/commit-msg

@@ -1,6 +1,9 @@
+#!/bin/sh
+. "$(dirname $0)/_/husky.sh"
+
 set +e
 
-pnpm --silent ng-dev commit-message pre-commit-validate --file $1 2>/dev/null
+yarn -s ng-dev commit-message pre-commit-validate --file $1 2>/dev/null
 if [ $? -ne 0 ]; then
   echo "WARNING: failed to run commit message validation (ng-dev commit-mesage pre-commit-validate)"
 fi

.husky/pre-commit

@@ -1,8 +1,11 @@
-set +e
+#!/bin/sh
+. "$(dirname $0)/_/husky.sh"
 
-pnpm --silent ng-dev format staged 2>/dev/null
+set +e
+yarn -s ng-dev format staged 2>/dev/null
 if [ $? -ne 0 ]; then
   echo "WARNING: failed to run file formatting (ng-dev format staged)"
 fi
 
+
 exit 0;

.husky/prepare-commit-msg

@@ -1,6 +1,9 @@
+#!/bin/sh
+. "$(dirname $0)/_/husky.sh"
+
 set +e
 
-pnpm --silent ng-dev commit-message restore-commit-message-draft $1 $2 2>/dev/null
+yarn -s ng-dev commit-message restore-commit-message-draft $1 $2 2>/dev/null
 if [ $? -ne 0 ]; then
   echo "WARNING: failed to attempt to restore commit message draft (ng-dev commit-message restore-commit-message-draft)"
 fi

.ng-dev/caretaker.mjs

@@ -1,23 +0,0 @@
-/**
- * The configuration for `ng-dev caretaker` commands.
- *
- * @type { import("@angular/ng-dev").CaretakerConfig }
- */
-export const caretaker = {
-  g3SyncConfigPath: './.ng-dev/google-sync-config.json',
-  githubQueries: [
-    {
-      name: 'Merge Queue',
-      query: `is:pr is:open label:"action: merge"`,
-    },
-    {
-      name: 'Merge Assistance Queue',
-      query: `is:pr is:open label:"merge: caretaker note" label:"action: merge"`,
-    },
-    {
-      name: 'Initial Triage Queue',
-      query: `is:open no:milestone -draft:true`,
-    },
-  ],
-  hasEmeaCaretaker: true,
-};

.ng-dev/caretaker.ts

@@ -0,0 +1,20 @@
+import {CaretakerConfig} from '@angular/dev-infra-private/ng-dev';
+
+/** The configuration for `ng-dev caretaker` commands. */
+export const caretaker: CaretakerConfig = {
+  githubQueries: [
+    {
+      name: 'Merge Queue',
+      query: `is:pr is:open status:success label:"action: merge"`,
+    },
+    {
+      name: 'Merge Assistance Queue',
+      query: `is:pr is:open label:"action: merge-assistance"`,
+    },
+    {
+      name: 'Initial Triage Queue',
+      query: `is:open no:milestone`,
+    },
+  ],
+  caretakerGroup: 'angular-caretaker',
+};

.ng-dev/commit-message.mjs

@@ -1,38 +0,0 @@
-/**
- * The configuration for `ng-dev commit-message` commands.
- *
- * @type { import("@angular/ng-dev").CommitMessageConfig }
- */
-export const commitMessage = {
-  maxLineLength: Infinity,
-  minBodyLength: 20,
-  minBodyLengthTypeExcludes: ['docs'],
-  // If you update this, also update the docs.
-  // https://github.com/angular/angular/blob/main/contributing-docs/commit-message-guidelines.md#scope
-  scopes: [
-    'animations',
-    'benchpress',
-    'common',
-    'compiler',
-    'compiler-cli',
-    'core',
-    'dev-infra',
-    'devtools',
-    'docs-infra',
-    'elements',
-    'forms',
-    'http',
-    'language-service',
-    'language-server',
-    'localize',
-    'migrations',
-    'platform-browser',
-    'platform-browser-dynamic',
-    'platform-server',
-    'router',
-    'service-worker',
-    'upgrade',
-    'vscode-extension',
-    'zone.js',
-  ],
-};

.ng-dev/commit-message.ts

@@ -0,0 +1,40 @@
+import {CommitMessageConfig} from '@angular/dev-infra-private/ng-dev';
+
+/**
+ * The configuration for `ng-dev commit-message` commands.
+ */
+export const commitMessage: CommitMessageConfig = {
+  maxLineLength: Infinity,
+  minBodyLength: 20,
+  minBodyLengthTypeExcludes: ['docs'],
+  scopes: [
+    'animations',
+    'bazel',
+    'benchpress',
+    'changelog',
+    'common',
+    'compiler',
+    'compiler-cli',
+    'core',
+    'dev-infra',
+    'docs-infra',
+    'elements',
+    'forms',
+    'http',
+    'language-service',
+    'localize',
+    'migrations',
+    'ngcc',
+    'packaging',
+    'platform-browser',
+    'platform-browser-dynamic',
+    'platform-server',
+    'platform-webworker',
+    'platform-webworker-dynamic',
+    'router',
+    'service-worker',
+    'upgrade',
+    've',
+    'zone.js',
+  ],
+};

.ng-dev/config.mjs

@@ -1,8 +0,0 @@
-import {caretaker} from './caretaker.mjs';
-import {commitMessage} from './commit-message.mjs';
-import {format} from './format.mjs';
-import {github} from './github.mjs';
-import {pullRequest} from './pull-request.mjs';
-import {release} from './release.mjs';
-
-export {commitMessage, format, github, pullRequest, caretaker, release};

.ng-dev/config.ts

@@ -0,0 +1,15 @@
+import {caretaker} from './caretaker';
+import {commitMessage} from './commit-message';
+import {format} from './format';
+import {github} from './github';
+import {pullRequest} from './pullRequest';
+import {release} from './release';
+
+module.exports = {
+  commitMessage,
+  format,
+  github,
+  pullRequest,
+  caretaker,
+  release,
+};

.ng-dev/dx-perf-workflows.yml

@@ -1,7 +0,0 @@
-workflows:
-  build-adev:
-    name: Build adev
-    prepare:
-      - bazel clean
-    workflow:
-      - bazel build //adev:build

.ng-dev/format.mjs

@@ -1,9 +0,0 @@
-/**
- * Configuration for the `ng-dev format` command.
- *
- * @type { import("@angular/ng-dev").FormatConfig }
- */
-export const format = {
-  'prettier': true,
-  'buildifier': true,
-};

.ng-dev/format.ts

@@ -0,0 +1,35 @@
+import {FormatConfig} from '@angular/dev-infra-private/ng-dev';
+
+/**
+ * Configuration for the `ng-dev format` command.
+ */
+export const format: FormatConfig = {
+  'prettier': {
+    'matchers': ['**/*.{yaml,yml}'],
+  },
+  'clang-format': {
+    'matchers': [
+      '**/*.{js,ts}',
+      // TODO: burn down format failures and remove aio and integration exceptions.
+      '!aio/**',
+      '!integration/**',
+      // Both third_party and .yarn are directories containing copied code which should
+      // not be modified.
+      '!third_party/**',
+      '!.yarn/**',
+      // Do not format d.ts files as they are generated
+      '!**/*.d.ts',
+      // Do not format generated ng-dev script
+      '!dev-infra/ng-dev.js',
+      '!dev-infra/build-worker.js',
+      // Do not format compliance test-cases since they must match generated code
+      '!packages/compiler-cli/test/compliance/test_cases/**/*.js',
+      // Do not format the locale files which are checked-in for Google3, but generated using
+      // the `generate-locales-tool` from `packages/common/locales`.
+      '!packages/core/src/i18n/locale_en.ts',
+      '!packages/common/locales/closure-locale.ts',
+      '!packages/common/src/i18n/currencies.ts',
+    ],
+  },
+  'buildifier': true,
+};

.ng-dev/github.mjs

@@ -1,13 +0,0 @@
-/**
- * Github configuration for the `ng-dev` command. This repository is used as
- * remote for the merge script and other utilities like `ng-dev pr rebase`.
- *
- * @type { import("@angular/ng-dev").GithubConfig }
- */
-export const github = {
-  owner: 'angular',
-  name: 'angular',
-  mainBranchName: 'main',
-  mergeMode: 'caretaker-only',
-  requireReleaseModeForRelease: false,
-};

.ng-dev/github.ts

@@ -0,0 +1,11 @@
+import {GithubConfig} from '@angular/dev-infra-private/ng-dev';
+
+/**
+ * Github configuration for the `ng-dev` command. This repository is used as
+ * remote for the merge script and other utilities like `ng-dev pr rebase`.
+ */
+export const github: GithubConfig = {
+  owner: 'angular',
+  name: 'angular',
+  mainBranchName: 'master',
+};

.ng-dev/google-sync-config.json

@@ -1,46 +0,0 @@
-{
-  "syncedFilePatterns": ["LICENSE", "modules/benchmarks/**", "packages/**"],
-  "separateFilePatterns": ["packages/core/primitives/**"],
-  "alwaysExternalFilePatterns": [
-    "packages/*",
-    "packages/bazel/**",
-    "packages/compiler-cli/linker/**",
-    "packages/compiler-cli/src/ngtsc/sourcemaps/**",
-    "packages/compiler-cli/src/ngtsc/testing/**",
-    "packages/compiler-cli/private/bazel.ts",
-    "packages/compiler-cli/private/localize.ts",
-    "packages/compiler-cli/private/tooling.ts",
-    "packages/compiler-cli/private/hybrid_analysis.ts",
-    "packages/compiler-cli/private/babel.d.ts",
-    "packages/compiler-cli/src/bin/**",
-    "packages/core/schematics/utils/tsurge/helpers/angular_devkit/**",
-    "packages/docs/**",
-    "packages/elements/schematics/**",
-    "packages/examples/**",
-    "packages/forms/signals/src/api/rules/validation/standard_schema.ts",
-    "packages/localize/**",
-    "packages/private/**",
-    "packages/service-worker/**",
-    "packages/ssr/BUILD.bazel",
-    "packages/common/locales/generate-locales-tool/**",
-    "packages/common/locales/index.bzl",
-    "packages/http/**",
-    "**/.gitignore",
-    "**/.gitkeep",
-    "**/third_party/**",
-    "**/tsconfig-build.json",
-    "**/tsconfig-tsec.json",
-    "**/tsconfig.json",
-    "**/rollup.config.js",
-    "**/BUILD.bazel",
-    "**/*.md",
-    "**/package.json",
-    "packages/**/integrationtest/**",
-    "packages/**/test/**",
-    "packages/zone.js/*",
-    "packages/zone.js/dist/**",
-    "packages/zone.js/doc/**",
-    "packages/zone.js/example/**",
-    "packages/zone.js/scripts/**"
-  ]
-}

.ng-dev/pull-request.mjs

@@ -1,34 +0,0 @@
-/**
- * Configuration for the merge tool in `ng-dev`. This sets up the labels which
- * are respected by the merge script (e.g. the target labels).
- *
- * @type { import("@angular/ng-dev").PullRequestConfig }
- */
-export const pullRequest = {
-  githubApiMerge: {
-    default: 'auto',
-    labels: [{pattern: 'merge: squash commits', method: 'squash'}],
-  },
-  requiredBaseCommits: {
-    // PRs that target either `main` or the patch branch, need to be rebased
-    // on top of the latest commit message validation fix.
-    // These SHAs are the commits that update the required license text in the header.
-    'main': '5aeb9a4124922d8ac08eb73b8f322905a32b0b3a',
-    '10.0.x': '27b95ba64a5d99757f4042073fd1860e20e3ed24',
-  },
-  // `docs-infra` are not affecting the public NPM packages.
-  targetLabelExemptScopes: ['docs-infra'],
-  // enables specific validations during the pull request merge process
-  validators: {
-    assertEnforceTested: true,
-    assertIsolatedSeparateFiles: true,
-  },
-
-  requiredStatuses: [
-    {type: 'check', name: 'test'},
-    {type: 'check', name: 'lint'},
-    {type: 'check', name: 'adev'},
-    {type: 'check', name: 'zone-js'},
-    {type: 'status', name: 'google-internal-tests'},
-  ],
-};

.ng-dev/pullRequest.ts

@@ -0,0 +1,23 @@
+import {PullRequestConfig} from '@angular/dev-infra-private/ng-dev';
+
+/**
+ * Configuration for the merge tool in `ng-dev`. This sets up the labels which
+ * are respected by the merge script (e.g. the target labels).
+ */
+export const pullRequest: PullRequestConfig = {
+  githubApiMerge: false,
+  mergeReadyLabel: /^action: merge(-assistance)?/,
+  caretakerNoteLabel: /^(action: merge-assistance)|(PullApprove: disable)/,
+  commitMessageFixupLabel: 'commit message fixup',
+  requiredBaseCommits: {
+    // PRs that target either `master` or the patch branch, need to be rebased
+    // on top of the latest commit message validation fix.
+    // These SHAs are the commits that update the required license text in the header.
+    'master': '5aeb9a4124922d8ac08eb73b8f322905a32b0b3a',
+    '10.0.x': '27b95ba64a5d99757f4042073fd1860e20e3ed24',
+  },
+  // `dev-infra` and `docs-infra` are not affecting the public NPM packages. Similarly,
+  // the `bazel` package is not considered part of the public API so that features
+  // can land in patch branches.
+  targetLabelExemptScopes: ['dev-infra', 'docs-infra', 'bazel'],
+};

.ng-dev/release.mjs

@@ -1,58 +0,0 @@
-/**
- * Configuration for the `ng-dev release` command.
- *
- * @type { import("@angular/ng-dev").ReleaseConfig }
- */
-export const release = {
-  publishRegistry: 'https://wombat-dressing-room.appspot.com',
-  representativeNpmPackage: '@angular/core',
-  npmPackages: [
-    {
-      name: '@angular/animations',
-      deprecated: {
-        version: '>=20.2.0-next.3',
-        message:
-          '@angular/animations is deprecated. Use `animate.enter` and `animate.leave` instead. For more information see: https://v22.angular.dev/guide/animations.',
-      },
-    },
-    {name: '@angular/common'},
-    {name: '@angular/compiler-cli'},
-    {name: '@angular/compiler'},
-    {name: '@angular/core'},
-    {name: '@angular/elements'},
-    {name: '@angular/forms'},
-    {name: '@angular/language-server'},
-    {name: '@angular/language-service'},
-    {name: '@angular/localize'},
-    {
-      name: '@angular/platform-browser-dynamic',
-      deprecated: {
-        version: '>=20.1.0-next.0',
-        message:
-          '@angular/platform-browser-dynamic is deprecated. Use `@angular/platform-browser` instead.',
-      },
-    },
-    {name: '@angular/platform-browser'},
-    {name: '@angular/platform-server'},
-    {name: '@angular/router'},
-    {name: '@angular/service-worker'},
-    {name: '@angular/upgrade'},
-  ],
-  buildPackages: async () => {
-    // The buildTargetPackages function is loaded at runtime as the loading the script
-    // causes an invocation of Bazel.
-    const {performNpmReleaseBuild} = await import('../scripts/build/package-builder.mts');
-    return performNpmReleaseBuild();
-  },
-  releaseNotes: {
-    hiddenScopes: [
-      'dev-infra',
-      'docs-infra',
-      'zone.js',
-      'devtools',
-      'vscode-extension',
-      'benchpress',
-    ],
-  },
-  releasePrLabels: ['area: build & ci', 'action: merge', 'PullApprove: disable'],
-};

.ng-dev/release.ts

@@ -0,0 +1,36 @@
+import {ReleaseConfig} from '@angular/dev-infra-private/ng-dev';
+import {join} from 'path';
+
+/** Configuration for the `ng-dev release` command. */
+export const release: ReleaseConfig = {
+  publishRegistry: 'https://wombat-dressing-room.appspot.com',
+  representativeNpmPackage: '@angular/core',
+  npmPackages: [
+    {name: '@angular/animations'},
+    {name: '@angular/bazel'},
+    {name: '@angular/common'},
+    {name: '@angular/compiler'},
+    {name: '@angular/compiler-cli'},
+    {name: '@angular/core'},
+    {name: '@angular/elements'},
+    {name: '@angular/forms'},
+    {name: '@angular/language-service'},
+    {name: '@angular/localize'},
+    {name: '@angular/platform-browser'},
+    {name: '@angular/platform-browser-dynamic'},
+    {name: '@angular/platform-server'},
+    {name: '@angular/router'},
+    {name: '@angular/service-worker'},
+    {name: '@angular/upgrade'},
+  ],
+  buildPackages: async () => {
+    // The buildTargetPackages function is loaded at runtime as the loading the script causes an
+    // invocation of bazel.
+    const {buildTargetPackages} = require(join(__dirname, '../scripts/build/package-builder'));
+    return buildTargetPackages('dist/release-output', false, 'Release', /* isRelease */ true);
+  },
+  releaseNotes: {
+    hiddenScopes: ['aio', 'dev-infra', 'docs-infra', 'zone.js', 'devtools'],
+  },
+  releasePrLabels: ['comp: build & ci', 'action: merge', 'PullApprove: disable'],
+};

.ng-dev/tsconfig.json

@@ -1,9 +1,10 @@
 {
   "compilerOptions": {
-    "target": "es2020",
-    "module": "Node16",
+    "strict": true,
+    "target": "es2015",
+    "module": "commonjs",
     "noEmit": true,
     "skipLibCheck": true,
-    "types": ["node"]
-  }
+    "types": []
+  },
 }

.npmrc

@@ -0,0 +1 @@
+engine-strict = true

.nvmrc

@@ -1 +1 @@
-24.21.0
+16.10.0

.pnpmfile.cjs

@@ -1,70 +0,0 @@
-// TODO: Define these packages in a single common location.
-const localAngularPackages = new Set([
-  '@angular/animations',
-  '@angular/common',
-  '@angular/compiler',
-  '@angular/compiler-cli',
-  '@angular/core',
-  '@angular/elements',
-  '@angular/forms',
-  '@angular/language-service',
-  '@angular/localize',
-  '@angular/platform-browser',
-  '@angular/platform-browser-dynamic',
-  '@angular/platform-server',
-  '@angular/router',
-  '@angular/service-worker',
-  '@angular/upgrade',
-]);
-
-const peerDepsToChange = new Set(['zone.js', 'rxjs']);
-
-function readPackage(pkg, context) {
-  // TODO(devversion): This allows us to make compiler/TS a production dependency of compiler-cli
-  // because `rules_js` doesn't otherwise include the dependency in the `npm_package_store`.
-  // See: https://github.com/aspect-build/rules_js/issues/2226
-  if (pkg.name === '@angular/compiler-cli') {
-    pkg.dependencies = {
-      ...pkg.dependencies,
-      '@angular/compiler': 'workspace:*',
-      'typescript': pkg.devDependencies['typescript'],
-    };
-
-    delete pkg.devDependencies['typescript'];
-  }
-
-  for (const [key, version] of Object.entries(pkg.peerDependencies)) {
-    // Any package that has a peerDependency on rxjs or zone.js, should instead treat the peerDependency as a
-    // regular dependency.
-    if (peerDepsToChange.has(key)) {
-      pkg.dependencies = {
-        ...pkg.dependencies,
-        [key]: pkg.devDependencies[key] ?? version,
-      };
-
-      delete pkg.devDependencies[key];
-
-      continue;
-    }
-
-    // Change all locally generated packages to directly depend on the other local packages, instead
-    // of expecting them as peerDependencies automatically as we do not auto install peer deps. The
-    // package is also removed from peerDependencies as it was moved over and will just cause errors.
-    if (pkg.version === '0.0.0-PLACEHOLDER' && localAngularPackages.has(key)) {
-      pkg.dependencies = {
-        ...pkg.dependencies,
-        [key]: 'workspace:*',
-      };
-
-      delete pkg.peerDependencies[key];
-    }
-  }
-
-  return pkg;
-}
-
-module.exports = {
-  hooks: {
-    readPackage,
-  },
-};

.prettierignore

@@ -1,49 +0,0 @@
-pnpm-lock.yaml
-
-# Do not format d.ts files as they are generated
-**/*.d.ts
-
-# Both third_party and .yarn are directories containing copied code which should
-# not be modified.
-third_party/**/*.js
-third_party/**/*.css
-third_party/**/*.md
-third_party/**/*.json
-
-# Do not format the locale files which are checked-in for Google3, but generated using
-# the `generate-locales-tool` from `packages/common/locales`.
-packages/core/src/i18n/locale_en.ts
-packages/common/locales/closure-locale.ts
-packages/common/src/i18n/currencies.ts
-
-# Test cases contain non valid code.
-packages/compiler-cli/test/compliance/test_cases/**/*.js
-packages/compiler-cli/test/compliance/test_cases/**/*.ts
-
-# Ignore generated javascript file(s)
-.github/actions/deploy-docs-site/main.js
-
-# Ignore testing data files for language service
-vscode-ng-language-service/syntaxes/test/data/*.ts
-vscode-ng-language-service/syntaxes/test/data/*.html
-
-# Ignore goldens MD files
-goldens/**/*.api.md
-
-# Ignore golden symbol json files
-packages/**/*.golden_symbols.json
-
-# adev generated files
-adev/src/content/aria/**/*.json
-adev/src/content/cli/**/*.json
-adev/src/content/cdk/**/*.json
-
-# Example package.json containing docregion (`// #docregion`) markers, which are
-# not valid JSON and cannot be processed by Prettier's json-stringify parser.
-adev/src/content/examples/schematics-for-libraries/projects/my-lib/package.json
-
-# Antigravity rules
-.agent/rules/agents.md
-
-CHANGELOG.md
-CHANGELOG_ARCHIVE.md

.prettierrc

@@ -1,25 +1,9 @@
 {
   "printWidth": 100,
   "tabWidth": 2,
-  "useTabs": false,
+  "tabs": false,
   "singleQuote": true,
-  "semi": true,
+  "semicolon": true,
   "quoteProps": "preserve",
-  "bracketSpacing": false,
-  "trailingComma": "all",
-  "overrides": [
-    {
-      "files": ["./.prettierrc"],
-      "options": {
-        "parser": "json"
-      }
-    },
-    {
-      "files": ["*.html"],
-      "excludeFiles": ["**/test/**"],
-      "options": {
-        "parser": "angular"
-      }
-    }
-  ]
+  "bracketSpacing": false
 }