abrichr · Oct 20, 2026 · Jan 17, 2026 · Jan 17, 2026 · Jan 17, 2026 · Jan 29, 2026
@@ -30,6 +30,14 @@ updates:
     open-pull-requests-limit: 5
     labels:
       - "dependencies"
+  # packages/tray keeps its own uv.lock, like packages/capture.
+  - package-ecosystem: "uv"
+    directory: "/packages/tray"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
   # packages/desktop: its uv.lock, the frontend's package-lock.json and the
   # Tauri shell's Cargo.lock. Minor and patch bumps are grouped, as they were
   # in openadapt-desktop.

@@ -4,8 +4,9 @@ name: CodeQL
 on:
   push:
     branches: [main]
+  # Every pull request, whatever its base, plus each merge queue group.
   pull_request:
-    branches: [main]
+  merge_group:
   schedule:
     - cron: "23 5 * * 1"
 

@@ -2,8 +2,11 @@ name: Dependency Review
 
 # SOC 2: dependency-review (OA-C-24). Flags vulnerable/denied deps on PRs.
 on:
+  # Every pull request, whatever its base, so a stacked PR reaches main with
+  # this required check already reported.
   pull_request:
-    branches: [main]
+  # The merge queue tests each group before it lands on main.
+  merge_group:
 
 permissions:
   contents: read
@@ -22,6 +25,16 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Dependency Review
+        if: github.event_name != 'merge_group'
         uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
         with:
           fail-on-severity: high
+      # A queue group has no pull request in its payload: compare the group's
+      # head with the main commit it was built on.
+      - name: Dependency Review (merge queue group)
+        if: github.event_name == 'merge_group'
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          fail-on-severity: high
+          base-ref: ${{ github.event.merge_group.base_sha }}
+          head-ref: ${{ github.event.merge_group.head_sha }}
@@ -35,12 +35,19 @@ jobs:
         env:
           BEFORE_SHA: ${{ github.event.before }}
           EVENT_NAME: ${{ github.event_name }}
+          GROUP_BASE_SHA: ${{ github.event.merge_group.base_sha }}
         shell: bash
         run: |
           set -euo pipefail
           changed_paths="${RUNNER_TEMP}/openadapt-desktop-changed-paths.txt"
           : > "${changed_paths}"
-          if [ "${EVENT_NAME}" = "push" ]; then
+          if [ "${EVENT_NAME}" = "merge_group" ]; then
+            # A queue group is scoped like a push to main: diff the group's
+            # head against the main commit it was built on.
+            BEFORE_SHA="${GROUP_BASE_SHA}"
+            git fetch --no-tags --depth=1 origin "${GROUP_BASE_SHA}" || true
+          fi
+          if [ "${EVENT_NAME}" = "push" ] || [ "${EVENT_NAME}" = "merge_group" ]; then
             before="${BEFORE_SHA}"
             if [ -z "${before}" ] || [ "${before}" = "0000000000000000000000000000000000000000" ]; then
               before="$(git rev-parse HEAD^)"

@@ -74,17 +74,12 @@ jobs:
       - name: Install Desktop and the exact bundled Flow runtime
         run: uv sync --locked --extra dev --extra build
 
-      - name: Checkout the exact Tray protocol peer
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          repository: OpenAdaptAI/openadapt-tray
-          ref: 3d6ffbeda50af2fc4769ae0f1ce55e3d5d49435c
-          path: packages/desktop/.integration/openadapt-tray
-          persist-credentials: false
-
+      # The Tray client is in this tree (packages/tray), so the test runs
+      # against the client from the same commit. packages.yml runs this test
+      # too when only the tray changes.
       - name: Exercise the Desktop and Tray IPC contract
         env:
-          OPENADAPT_TRAY_SOURCE: .integration/openadapt-tray/src
+          OPENADAPT_TRAY_SOURCE: ../tray/src
         run: uv run pytest tests/test_tray_integration.py -v
 
       - name: Exercise qualification safety contracts

@@ -4,6 +4,8 @@ on:
   pull_request:
     branches:
       - '**'
+  # The merge queue tests each group before it lands on main.
+  merge_group:
   push:
     branches:
       - main

@@ -42,10 +42,20 @@
 # on main, and the bundled-Flow qualification contract) and desktop-build.yml
 # (frontend, Python distribution, frozen sidecar, and Tauri installers). Their
 # jobs are in packages-gate like every other package's.
+#
+# openadapt-tray (packages/tray) keeps its own uv.lock and runs `uv sync
+# --locked` against it: its suite on Linux with Python 3.10 and 3.12 for a PR,
+# plus 3.11, macOS and Windows on main; ruff, the version and changelog
+# contract, `uv build` and the archive boundary; and Desktop's socket test
+# against this tray client, so a tray change cannot break the protocol
+# without the desktop suite running. A desktop change runs that same test in
+# desktop-test.yml.
 name: Packages
 
 on:
   pull_request:
+  # The merge queue tests each group before it lands on main.
+  merge_group:
   push:
     branches: [main]
   workflow_dispatch:
@@ -54,10 +64,33 @@ permissions:
   contents: read
 
 concurrency:
-  # A pull request's newer push supersedes its older run. Runs on main are
-  # never cancelled: desktop-release.yml needs every main commit's own result.
-  group: packages-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  # A pull request's newer push supersedes its older run.
+  #
+  # On main, desktop-release.yml waits for the Packages run of the newest
+  # first-parent commit that changed packages/desktop (#1398). A push whose
+  # commits touch packages/desktop/ therefore keeps its own group and is never
+  # cancelled. Every other push to main shares one group, so a newer one
+  # cancels it instead of queueing behind it. The test is conservative: any
+  # mention of packages/desktop/ in the push payload (file lists or messages)
+  # counts as a Desktop change. A push with no commit list, or with 20 or more
+  # commits (GitHub truncates the payload's list at 20, which could hide a
+  # Desktop change), keeps its own group. Merge queue groups and dispatches
+  # are never cancelled.
+  group: >-
+    packages-${{
+      github.event.pull_request.number
+      || (github.event_name == 'push'
+          && github.event.head_commit
+          && !github.event.commits[19]
+          && !contains(toJSON(github.event.commits), 'packages/desktop/')
+          && 'main-without-desktop')
+      || github.sha }}
+  cancel-in-progress: >-
+    ${{ github.event_name == 'pull_request'
+        || (github.event_name == 'push'
+            && github.event.head_commit != null
+            && !github.event.commits[19]
+            && !contains(toJSON(github.event.commits), 'packages/desktop/')) }}
 
 env:
   PIP_DISABLE_PIP_VERSION_CHECK: "1"
@@ -74,6 +107,7 @@ jobs:
       capture: ${{ steps.classify.outputs.capture }}
       privacy: ${{ steps.classify.outputs.privacy }}
       desktop: ${{ steps.classify.outputs.desktop }}
+      tray: ${{ steps.classify.outputs.tray }}
       program_graph: ${{ steps.classify.outputs.program_graph }}
       weight: ${{ steps.classify.outputs.weight }}
     steps:
@@ -86,15 +120,23 @@ jobs:
         env:
           EVENT_NAME: ${{ github.event_name }}
           BEFORE_SHA: ${{ github.event.before }}
+          GROUP_BASE_SHA: ${{ github.event.merge_group.base_sha }}
         run: |
           set -euo pipefail
           all() {
-            for pkg in flow types agent capture privacy desktop program_graph weight; do echo "$pkg=true" >> "$GITHUB_OUTPUT"; done
+            for pkg in flow types agent capture privacy desktop tray program_graph weight; do echo "$pkg=true" >> "$GITHUB_OUTPUT"; done
             exit 0
           }
           case "$EVENT_NAME" in
             workflow_dispatch) all ;;
             pull_request) base="HEAD^1" ;;  # the PR merge commit's first parent is the base tip
+            # A queue group runs the full matrix (the PR tier ran one lane)
+            # for every package the group's PRs touch, measured from the main
+            # commit the group was built on.
+            merge_group)
+              base="$GROUP_BASE_SHA"
+              git cat-file -e "$base^{commit}" 2>/dev/null || all
+              ;;
             *)
               if [ -z "${BEFORE_SHA:-}" ] || [ "$BEFORE_SHA" = 0000000000000000000000000000000000000000 ] \
                 || ! git cat-file -e "$BEFORE_SHA^{commit}" 2>/dev/null; then
@@ -118,7 +160,9 @@ jobs:
           agent="$(hit "^packages/(agent|flow|types)/|$wf")"
           capture="$(hit "^packages/capture/|$wf")"
           privacy="$(hit "^packages/privacy/|$wf")"
-          desktop="$(hit "^packages/desktop/|^\.github/workflows/desktop-[a-z-]+\.yml$|$wf")"
+          # Desktop bundles the program map from packages/program-graph.
+          desktop="$(hit "^packages/(desktop|program-graph)/|^\.github/workflows/desktop-[a-z-]+\.yml$|$wf")"
+          tray="$(hit "^packages/tray/|$wf")"
           # The program map checks its schema against Flow's copy.
           program_graph="$(hit "^packages/program-graph/|^packages/flow/schemas/program-graph-v2\.json$|^\.github/workflows/release-program-graph\.yml$|$wf")"
           # Any package's metadata, or the launcher's, can change what an
@@ -131,6 +175,7 @@ jobs:
             echo "capture=$capture"
             echo "privacy=$privacy"
             echo "desktop=$desktop"
+            echo "tray=$tray"
             echo "program_graph=$program_graph"
             echo "weight=$weight"
           } | tee -a "$GITHUB_OUTPUT"
@@ -681,6 +726,90 @@ jobs:
     if: needs.scope.outputs.desktop == 'true'
     uses: ./.github/workflows/desktop-build.yml
 
+  tray:
+    name: tray (${{ matrix.os }}, py${{ matrix.python-version }})
+    needs: scope
+    if: needs.scope.outputs.tray == 'true'
+    strategy:
+      fail-fast: false
+      matrix:
+        # A pull request runs Linux on the oldest and newest Python; main adds
+        # 3.11, macOS and Windows, where the tray's platform handlers differ.
+        include: ${{ fromJSON(github.event_name == 'pull_request' && '[{"os":"ubuntu-latest","python-version":"3.10"},{"os":"ubuntu-latest","python-version":"3.12"}]' || '[{"os":"ubuntu-latest","python-version":"3.10"},{"os":"ubuntu-latest","python-version":"3.11"},{"os":"ubuntu-latest","python-version":"3.12"},{"os":"macos-latest","python-version":"3.12"},{"os":"windows-latest","python-version":"3.12"}]') }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    defaults:
+      run:
+        working-directory: packages/tray
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - name: Set up Python
+        run: uv python install ${{ matrix.python-version }}
+      - name: Install
+        run: uv sync --locked --python ${{ matrix.python-version }} --extra dev
+      - name: Test
+        env:
+          # No display or input device on the Linux runners.
+          PYNPUT_BACKEND: ${{ runner.os == 'Linux' && 'dummy' || '' }}
+          PYSTRAY_BACKEND: ${{ runner.os == 'Linux' && 'dummy' || '' }}
+        run: uv run --no-sync pytest tests -q
+
+  tray-contract:
+    name: tray lint and release contract
+    needs: scope
+    if: needs.scope.outputs.tray == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    defaults:
+      run:
+        working-directory: packages/tray
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - name: Set up Python
+        run: uv python install 3.12
+      - name: Install
+        run: uv sync --locked --python 3.12 --extra dev
+      # The whole package, including examples/ and the root helper scripts.
+      - name: Ruff
+        run: uv run --no-sync ruff check .
+      - name: Build wheel and source distribution
+        run: uv build
+      - name: Versions agree and both distributions exist
+        run: uv run --no-sync python scripts/check_release_consistency.py --require-dist
+      - name: Verify release archive boundaries
+        run: uv run --no-sync python scripts/check_source_boundary.py --require-dist
+
+  tray-desktop-ipc:
+    # Desktop's socket server against this tray's IPC client, both from this
+    # commit. desktop-test.yml runs the same test when Desktop changes.
+    name: tray and desktop IPC contract
+    needs: scope
+    if: needs.scope.outputs.tray == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    defaults:
+      run:
+        working-directory: packages/desktop
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - name: Set up Python
+        run: uv python install 3.12
+      - name: Install Desktop
+        run: uv sync --locked --python 3.12 --extra dev
+      - name: Exercise the Desktop and Tray IPC contract
+        env:
+          OPENADAPT_TRAY_SOURCE: ../tray/src
+        run: uv run --no-sync pytest tests/test_tray_integration.py -v
+
   program-graph:
     name: program-graph (test, build, vendor)
     needs: scope
@@ -806,6 +935,9 @@ jobs:
       - privacy-contract
       - desktop-test
       - desktop-build
+      - tray
+      - tray-contract
+      - tray-desktop-ipc
       - program-graph
       - install-weight
       - capture-core-record

@@ -8,6 +8,8 @@ on:
   pull_request:
     branches:
       - '**'
+  # The merge queue tests each group before it lands on main.
+  merge_group:
   push:
     branches:
       - main

@@ -10,6 +10,7 @@
 #   agent    openadapt-agent  pypi-agent
 #   capture  openadapt-capture  pypi-capture
 #   privacy  openadapt-privacy  pypi-privacy
+#   tray     openadapt-tray     pypi-tray
 #
 # Manual dispatch only: there is no tag or push trigger, so nothing here runs
 # unless someone starts it. openadapt-desktop is not here: desktop-release.yml
@@ -36,7 +37,7 @@ on:
         description: "Package directory under packages/"
         required: true
         type: choice
-        options: [flow, types, agent, capture, privacy]
+        options: [flow, types, agent, capture, privacy, tray]
       version:
         description: "Version to publish; must equal packages/<package>/pyproject.toml"
         required: true
@@ -96,6 +97,7 @@ jobs:
               "agent": "openadapt-agent",
               "capture": "openadapt-capture",
               "privacy": "openadapt-privacy",
+              "tray": "openadapt-tray",
           }[pkg]
           if project["name"] != expected:
               sys.exit(f"packages/{pkg} is {project['name']!r}, expected {expected!r}")

@@ -6,6 +6,8 @@ name: Secret Scan
 # invoke it directly and pin the version. Scans full git history on PRs + main.
 on:
   pull_request:
+  # The merge queue tests each group before it lands on main.
+  merge_group:
   push:
     branches: [main]