From da5b1c757973d512f62639a02e22bc39fe4d81f6 Mon Sep 17 00:00:00 2001
From: boomzero <thomas_rainbowfish@icloud.com>
Date: Tue, 6 Oct 2026 10:00:14 +0800
Subject: [PATCH 1/9] Address review findings from the 3.9.0 release PR

- Close the expanded mobile menu before jumping to a section so the
  heading is not hidden behind it.
- Privacy notice: script settings live in the site's localStorage and
  may be cloud-synced; the messages.html session is sent with requests.
- Child protection: messages are not end-to-end encrypted.
- Make the English classic-page language test set XMOJ_LANG=en, and
  count every evaluation of the native history script in the profile
  fixture so re-execution is detectable.
- 3.8.8 release notes as HTML, since Notes is inserted with innerHTML.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E5dr7XTsCeoamqLSiT9rLp
---
 Update.json                     |  2 +-
 child-protection.html           |  2 +-
 privacy.html                    |  6 +++---
 site.js                         | 17 +++++++++++++++++
 tests/chinese-language.test.cjs |  6 +++---
 tests/fixtures/profile.html     |  2 +-
 tests/profile-page.test.cjs     |  2 +-
 7 files changed, 27 insertions(+), 10 deletions(-)

diff --git a/Update.json b/Update.json
index a9b9faee..926f44f0 100644
--- a/Update.json
+++ b/Update.json
@@ -3904,7 +3904,7 @@
                     "Description": "Fix image enlarger and minimalist skin on video replay pages; add page title"
                 }
             ],
-            "Notes": "- 修复回放视频进度条拖动球被当作图片放大的问题\n- 修复极简黑白界面下视频播放器按钮出现灰色方框的问题\n- 回放页面增加页面标题"
+            "Notes": "<ul><li>修复回放视频进度条拖动球被当作图片放大的问题</li><li>修复极简黑白界面下视频播放器按钮出现灰色方框的问题</li><li>回放页面增加页面标题</li></ul>"
         },
         "3.9.0": {
             "UpdateDate": 1791249917714,
diff --git a/child-protection.html b/child-protection.html
index f4b5f4a9..c883f3a4 100644
--- a/child-protection.html
+++ b/child-protection.html
@@ -62,7 +62,7 @@ <h2>我们收集得很少</h2>
         <h2>请家长留意</h2>
         <ul>
             <li>讨论区的帖子所有用户都能看到，上传的图片拿到链接的人都能打开。提醒孩子不要在帖子或图片里透露真实姓名、学校、联系方式、人脸等个人信息。</li>
-            <li>短消息只有收发双方能看到，加密保存，管理员也看不到内容。如果孩子收到骚扰或不当内容，请截图后联系我们处理。</li>
+            <li>短消息显示给收发双方，数据库加密保存；管理员不修改服务器代码看不到内容，但这不是端到端加密，解密在服务器上完成。如果孩子收到骚扰或不当内容，请截图后联系我们处理。</li>
         </ul>
 
         <h2>申请删除</h2>
diff --git a/privacy.html b/privacy.html
index a55f81d0..48c569f5 100644
--- a/privacy.html
+++ b/privacy.html
@@ -59,11 +59,11 @@ <h1>我们收集什么数据</h1>
             <p><strong>本产品不面向欧盟居民。</strong>XMOJ-Script 主要面向小明的OJ用户，没有专门为欧盟、英国或瑞士的用户提供服务。</p>
         </div>
 
-        <h2>只留在你电脑上的</h2>
+        <h2>存在你浏览器里的</h2>
         <ul>
-            <li><strong>脚本设置</strong>：存在你的脚本管理器里。</li>
+            <li><strong>脚本设置</strong>：存在小明的OJ网站的浏览器本地存储（localStorage）里，清除该网站的数据即可重置。开启设置云同步后，设置还会上传到我们的服务器，见下一节。</li>
             <li><strong>保存的密码</strong>：开启「自动保存用户名与密码」后，密码交给浏览器自带的密码管理器保存，<strong>不会发送给我们</strong>。</li>
-            <li><strong>短消息在线看</strong>：在 messages.html 填写的用户名和会话 ID 存在本网站的浏览器本地存储里，点「退出登录」即清除。</li>
+            <li><strong>短消息在线看</strong>：在 messages.html 填写的用户名和会话 ID 存在本网站的浏览器本地存储里，点「退出登录」即清除。查看消息时，它们会随请求发送到我们的服务器，用来确认你的身份。</li>
         </ul>
 
         <h2>会发到我们服务器的</h2>
diff --git a/site.js b/site.js
index dbac9c5c..bb00b4e8 100644
--- a/site.js
+++ b/site.js
@@ -75,6 +75,23 @@
             SelectBrowser(browser);
         }
 
+        // 手机上展开的菜单占据页面高度：先收起菜单，再跳到对应章节，标题才不会被导航栏挡住
+        const siteNav = document.getElementById("SiteNav");
+        if (siteNav && window.bootstrap) {
+            siteNav.addEventListener("click", (event) => {
+                const link = event.target.closest("a[href]");
+                if (!link || !link.hash || link.pathname !== location.pathname || !siteNav.classList.contains("show")) return;
+                const target = document.getElementById(link.hash.slice(1));
+                if (!target) return;
+                event.preventDefault();
+                siteNav.addEventListener("hidden.bs.collapse", () => {
+                    history.pushState(null, "", link.hash);
+                    target.scrollIntoView();
+                }, {once: true});
+                bootstrap.Collapse.getOrCreateInstance(siteNav).hide();
+            });
+        }
+
         const versionElements = document.querySelectorAll("[data-latest-version]");
         if (versionElements.length > 0) {
             fetch("Update.json", {cache: "no-cache"})
diff --git a/tests/chinese-language.test.cjs b/tests/chinese-language.test.cjs
index 3db28d04..6a11d576 100644
--- a/tests/chinese-language.test.cjs
+++ b/tests/chinese-language.test.cjs
@@ -14,7 +14,7 @@ const language = Between('function InitializeChineseLanguage(', '// The /web app
 const route = Between('function IsContestWebApp(', 'function GetContestRoute(');
 
 // Check reload behavior without navigating a real page away from its assertions.
-function Context({cookie = '', pathname = '/problem.php', english = false, fail = false} = {}) {
+function Context({cookie = '', pathname = '/problem.php', fail = false} = {}) {
     const storage = new Map();
     const requests = [];
     const nodes = [];
@@ -32,7 +32,7 @@ function Context({cookie = '', pathname = '/problem.php', english = false, fail
         document: {
             cookie, documentElement: {}, head: {appendChild: node => nodes.push(node)}, body: {prepend: node => nodes.push(node)},
             getElementById: id => nodes.find(node => node.id === id),
-            querySelectorAll: () => [], querySelector: () => english ? {} : null,
+            querySelectorAll: () => [], querySelector: () => null,
             createElement: () => ({appendChild() {}, addEventListener() {}})
         }
     });
@@ -52,7 +52,7 @@ test('forces the web cookie before requests and reloads an existing English app
 });
 
 test('classic English pages do not call the broken language endpoint or reload', async () => {
-    const {scope, requests, reloads} = Context({english: true});
+    const {scope, requests, reloads} = Context({cookie: 'XMOJ_LANG=en'});
     assert.equal(await scope.EnsureChinesePage(), false);
     assert.equal(scope.document.documentElement.lang, 'zh-CN');
     assert.equal(requests.length, 0);
diff --git a/tests/fixtures/profile.html b/tests/fixtures/profile.html
index 6c3812ab..27659e64 100644
--- a/tests/fixtures/profile.html
+++ b/tests/fixtures/profile.html
@@ -20,8 +20,8 @@
 </table></center></div></div>
 <script>
 // Match the history data supplied by the native profile. Its renderer is absent.
+window.nativeHistoryRuns = (window.nativeHistoryRuns || 0) + 1;
 if (window.jQuery) $(function () {
-    window.nativeHistoryRuns = (window.nativeHistoryRuns || 0) + 1;
     var d1 = [], d2 = [];
     d1.push([1704240000000, 12]);
     d1.push([1704067200000, 20]);
diff --git a/tests/profile-page.test.cjs b/tests/profile-page.test.cjs
index e6949a4f..6949d22d 100644
--- a/tests/profile-page.test.cjs
+++ b/tests/profile-page.test.cjs
@@ -238,7 +238,7 @@ test('profile page browser regressions', {timeout: 60000}, async t => {
                 assert.equal(await page.evaluate(() => document.getElementById('submission') === nativeActivity), true);
                 assert.equal(await page.locator('#submission canvas').count(), 0);
                 assert.equal(await page.evaluate(() => window.jQuery), undefined);
-                assert.equal(await page.evaluate(() => window.nativeHistoryRuns), undefined, 'never execute the broken native graph script');
+                assert.equal(await page.evaluate(() => window.nativeHistoryRuns), 1, 'never re-execute the broken native graph script');
                 assert.deepEqual(await page.evaluate(() => GetProfileActivityData()), [
                     [[1704067200000, 20], [1704153600000, 5], [1704240000000, 12]],
                     [[1704067200000, 8], [1704153600000, 2], [1704240000000, 4]]

From ce63eafcee736b5e71e7a67664de89e3431285ed Mon Sep 17 00:00:00 2001
From: boomzero <thomas_rainbowfish@icloud.com>
Date: Tue, 6 Oct 2026 10:03:07 +0800
Subject: [PATCH 2/9] Open release version PRs with the GitHub App token

PRs created with GITHUB_TOKEN need a maintainer to approve their
workflow runs, so the auto-merge on the actions/temp version PR never
completes on its own. Create it with the app token like the other
workflows. UpdateVersion still skips it because the actor ends in [bot].

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E5dr7XTsCeoamqLSiT9rLp
---
 .github/workflows/UpdateToRelease.yml | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/UpdateToRelease.yml b/.github/workflows/UpdateToRelease.yml
index 5f82aa0f..782e5d0e 100644
--- a/.github/workflows/UpdateToRelease.yml
+++ b/.github/workflows/UpdateToRelease.yml
@@ -17,9 +17,17 @@ jobs:
       pull-requests: write
       contents: write
     steps:
+      # 用 GitHub App 的 token 创建版本 PR，这样它的工作流无需手动批准就能运行并自动合并
+      - name: Generate a token
+        id: generate_token
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
+          token: ${{ steps.generate_token.outputs.token }}
       - name: Update to release
         run: |
           if [[ ${{ github.event.pull_request.head.ref }} != dev && $(git diff --name-only HEAD HEAD~1) == *XMOJ.user.js* ]]; then
@@ -27,8 +35,8 @@ jobs:
             gh pr comment ${{ github.event.pull_request.number }} --body "请向\`dev\`分支提交pull request, 本pull request将被自动关闭"
             gh pr close ${{ github.event.pull_request.number }}
           else
-            node ./Update/UpdateToRelease.js ${{ secrets.GITHUB_TOKEN }} ${{ github.event.pull_request.number }} "$PR_BODY"
+            node ./Update/UpdateToRelease.js ${{ steps.generate_token.outputs.token }} ${{ github.event.pull_request.number }} "$PR_BODY"
           fi
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
           PR_BODY: ${{ github.event.pull_request.body }}

From f117fe9cc5f4dd176c9b0486f403b3b0ec308f95 Mon Sep 17 00:00:00 2001
From: boomzero <thomas_rainbowfish@icloud.com>
Date: Tue, 6 Oct 2026 10:11:10 +0800
Subject: [PATCH 3/9] Address review on the navbar handler, wording and release
 workflow

- Navbar: treat / and /index.html as the same page, let modifier and
  non-primary clicks through, and keep intercepting clicks during the
  close animation so the last tapped link wins.
- Wording fixes on the privacy and child-protection pages.
- UpdateToRelease: skip fork PRs (no secrets to mint the app token) and
  scope the app token to contents and pull-requests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E5dr7XTsCeoamqLSiT9rLp
---
 .github/workflows/UpdateToRelease.yml |  6 ++++--
 child-protection.html                 |  2 +-
 privacy.html                          |  2 +-
 site.js                               | 29 +++++++++++++++++++--------
 4 files changed, 27 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/UpdateToRelease.yml b/.github/workflows/UpdateToRelease.yml
index 782e5d0e..aeed3d39 100644
--- a/.github/workflows/UpdateToRelease.yml
+++ b/.github/workflows/UpdateToRelease.yml
@@ -11,8 +11,8 @@ on:
 jobs:
   UpdateToRelease:
     runs-on: ubuntu-latest
-    # 添加条件：如果是 bot 触发的则跳过，避免无限循环
-    if: github.event.pull_request.user.login != 'github-actions[bot]'
+    # 添加条件：如果是 bot 触发的则跳过，避免无限循环；fork 的 PR 拿不到 secrets，也跳过
+    if: github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.user.login != 'github-actions[bot]'
     permissions:
       pull-requests: write
       contents: write
@@ -24,6 +24,8 @@ jobs:
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
diff --git a/child-protection.html b/child-protection.html
index c883f3a4..104c1a30 100644
--- a/child-protection.html
+++ b/child-protection.html
@@ -62,7 +62,7 @@ <h2>我们收集得很少</h2>
         <h2>请家长留意</h2>
         <ul>
             <li>讨论区的帖子所有用户都能看到，上传的图片拿到链接的人都能打开。提醒孩子不要在帖子或图片里透露真实姓名、学校、联系方式、人脸等个人信息。</li>
-            <li>短消息显示给收发双方，数据库加密保存；管理员不修改服务器代码看不到内容，但这不是端到端加密，解密在服务器上完成。如果孩子收到骚扰或不当内容，请截图后联系我们处理。</li>
+            <li>短消息显示给收发双方，数据库加密保存；管理员不修改服务器代码就看不到内容，但这不是端到端加密，解密在服务器上完成。如果孩子收到骚扰或不当内容，请截图后联系我们处理。</li>
         </ul>
 
         <h2>申请删除</h2>
diff --git a/privacy.html b/privacy.html
index 48c569f5..91da8add 100644
--- a/privacy.html
+++ b/privacy.html
@@ -63,7 +63,7 @@ <h2>存在你浏览器里的</h2>
         <ul>
             <li><strong>脚本设置</strong>：存在小明的OJ网站的浏览器本地存储（localStorage）里，清除该网站的数据即可重置。开启设置云同步后，设置还会上传到我们的服务器，见下一节。</li>
             <li><strong>保存的密码</strong>：开启「自动保存用户名与密码」后，密码交给浏览器自带的密码管理器保存，<strong>不会发送给我们</strong>。</li>
-            <li><strong>短消息在线看</strong>：在 messages.html 填写的用户名和会话 ID 存在本网站的浏览器本地存储里，点「退出登录」即清除。查看消息时，它们会随请求发送到我们的服务器，用来确认你的身份。</li>
+            <li><strong>短消息在线看</strong>：在 messages.html 填写的用户名和会话 ID 存在本网站的浏览器本地存储里，点「退出登录」即清除。查看消息时，用户名和会话 ID 会随请求发送到我们的服务器，用来确认你的身份。</li>
         </ul>
 
         <h2>会发到我们服务器的</h2>
diff --git a/site.js b/site.js
index bb00b4e8..c130681d 100644
--- a/site.js
+++ b/site.js
@@ -78,17 +78,30 @@
         // 手机上展开的菜单占据页面高度：先收起菜单，再跳到对应章节，标题才不会被导航栏挡住
         const siteNav = document.getElementById("SiteNav");
         if (siteNav && window.bootstrap) {
+            const PagePath = (path) => path.replace(/\/index\.html$/, "/");
+            // 收起动画期间 show 类已被移除，用 closing 记录状态；动画中再点别的链接，以最后一次为准
+            let closing = false;
+            let pendingLink = null;
+            siteNav.addEventListener("hide.bs.collapse", () => {
+                closing = true;
+            });
+            siteNav.addEventListener("hidden.bs.collapse", () => {
+                closing = false;
+                if (!pendingLink) return;
+                const target = document.getElementById(pendingLink.hash.slice(1));
+                history.pushState(null, "", pendingLink.hash);
+                pendingLink = null;
+                if (target) target.scrollIntoView();
+            });
             siteNav.addEventListener("click", (event) => {
+                if (event.button !== 0 || event.metaKey || event.ctrlKey || event.shiftKey || event.altKey) return;
                 const link = event.target.closest("a[href]");
-                if (!link || !link.hash || link.pathname !== location.pathname || !siteNav.classList.contains("show")) return;
-                const target = document.getElementById(link.hash.slice(1));
-                if (!target) return;
+                if (!link || !link.hash || PagePath(link.pathname) !== PagePath(location.pathname)) return;
+                if (!document.getElementById(link.hash.slice(1))) return;
+                if (!siteNav.classList.contains("show") && !closing) return;
                 event.preventDefault();
-                siteNav.addEventListener("hidden.bs.collapse", () => {
-                    history.pushState(null, "", link.hash);
-                    target.scrollIntoView();
-                }, {once: true});
-                bootstrap.Collapse.getOrCreateInstance(siteNav).hide();
+                pendingLink = link;
+                if (!closing) bootstrap.Collapse.getOrCreateInstance(siteNav).hide();
             });
         }
 

From eab4141de4fa6ae7270f9b8c19ddb4b64a1344b1 Mon Sep 17 00:00:00 2001
From: boomzero <thomas_rainbowfish@icloud.com>
Date: Tue, 6 Oct 2026 10:16:18 +0800
Subject: [PATCH 4/9] Retire extern-contrib workflows and harden workflows for
 fork PRs

- Remove the dev -> extern-contrib sync and the merge.yml job that
  could never run (its only job required ref extern-contrib).
- UpdateVersion: pass the PR title through env instead of pasting it
  into the shell command.
- Prerelease: skip when a release for the current version exists, so
  a merge without a version bump cannot overwrite a published release.
- Qodana: skip fork PRs, which do not receive QODANA_TOKEN.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E5dr7XTsCeoamqLSiT9rLp
---
 .github/workflows/Prerelease.yml             | 12 +++++
 .github/workflows/UpdateVersion.yml          |  7 ++-
 .github/workflows/main.yml                   |  2 +
 .github/workflows/merge.yml                  | 51 --------------------
 .github/workflows/sync-to-extern-contrib.yml | 24 ---------
 5 files changed, 20 insertions(+), 76 deletions(-)
 delete mode 100644 .github/workflows/merge.yml
 delete mode 100644 .github/workflows/sync-to-extern-contrib.yml

diff --git a/.github/workflows/Prerelease.yml b/.github/workflows/Prerelease.yml
index 3b65b206..5cb4893e 100644
--- a/.github/workflows/Prerelease.yml
+++ b/.github/workflows/Prerelease.yml
@@ -33,7 +33,19 @@ jobs:
           GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
         id: get_version
         run: node ./Update/GetVersion.js
+      # 版本号没变（例如合并了没有更新版本号的 PR）时，不能覆盖已发布的同版本 release
+      - name: Check for an existing release
+        id: existing_release
+        env:
+          GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
+          VERSION: ${{ steps.get_version.outputs.version }}
+        run: |
+          if gh release view "$VERSION" > /dev/null 2>&1; then
+            echo "Release $VERSION already exists, skipping."
+            echo exists=true >> $GITHUB_OUTPUT
+          fi
       - id: create_release
+        if: steps.existing_release.outputs.exists != 'true'
         uses: softprops/action-gh-release@v2
         env:
           GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
diff --git a/.github/workflows/UpdateVersion.yml b/.github/workflows/UpdateVersion.yml
index e43ba0c8..dbf982f7 100644
--- a/.github/workflows/UpdateVersion.yml
+++ b/.github/workflows/UpdateVersion.yml
@@ -24,6 +24,11 @@ jobs:
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
       - uses: actions/checkout@v6
       - name: Update version
+        # PR 标题不可信，通过环境变量传入，不直接拼进 shell 命令
         env:
+          GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
+          PR_NUMBER: ${{ github.event.number }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
           PR_BODY: ${{ github.event.pull_request.body }}
-        run: node ./Update/UpdateVersion.js ${{ steps.generate_token.outputs.token }} ${{ github.event.number }} "${{ github.event.pull_request.title }}" "$PR_BODY" "${{ github.event.action }}"
+          PR_ACTION: ${{ github.event.action }}
+        run: node ./Update/UpdateVersion.js "$GITHUB_TOKEN" "$PR_NUMBER" "$PR_TITLE" "$PR_BODY" "$PR_ACTION"
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index fdd59cbd..4042a1bc 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -10,6 +10,8 @@ on:
 jobs:
   qodana:
     runs-on: ubuntu-latest
+    # fork 的 PR 拿不到 QODANA_TOKEN
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     permissions:
       contents: write
       pull-requests: write
diff --git a/.github/workflows/merge.yml b/.github/workflows/merge.yml
deleted file mode 100644
index d127affd..00000000
--- a/.github/workflows/merge.yml
+++ /dev/null
@@ -1,51 +0,0 @@
-name: Merge changes to extern-contrib
-on:
-  push:
-    branches:
-      - dev
-  workflow_dispatch:
-jobs:
-  create_pull_request:
-    name: 'Create PR'
-    if: github.ref == 'refs/heads/extern-contrib'
-    runs-on: ubuntu-latest
-    permissions:
-      pull-requests: write
-    steps:
-      - name: 'Create PR'
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const { repo, owner } = context.repo;
-            const pulls = await github.rest.pulls.list({
-              owner: owner,
-              repo: repo,
-              head: context.ref,
-              base: 'dev',
-              state: 'open',
-            });
-            
-            if (pulls.data.length < 1) {
-              await github.rest.pulls.create({
-                title: 'Merge dev into extern-contrib',
-                owner: owner,
-                repo: repo,
-                head: context.ref,
-                base: 'dev',
-                body: [
-                  'This PR is auto-generated by',
-                  '[actions/github-script](https://github.com/actions/github-script)',
-                ].join('\n'),
-              });
-            } else {
-              const existingPR = pulls.data[0];
-              await github.rest.pulls.update({
-                owner: owner,
-                repo: repo,
-                pull_number: existingPR.number,
-                body: [
-                  existingPR.body,
-                  `Updated by Job ${context.job}`,
-                ].join('\n'),
-              });
-            }
diff --git a/.github/workflows/sync-to-extern-contrib.yml b/.github/workflows/sync-to-extern-contrib.yml
deleted file mode 100644
index 2bb08cb9..00000000
--- a/.github/workflows/sync-to-extern-contrib.yml
+++ /dev/null
@@ -1,24 +0,0 @@
-name: Sync
-on:
-  push:
-    branches:
-      - dev
-
-jobs:
-  sync-branches:
-    runs-on: ubuntu-latest
-    name: Syncing branches
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      - name: Set up Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: 12
-      - name: Opening pull request
-        id: pull
-        uses: tretuna/sync-branches@1.4.0
-        with:
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
-          FROM_BRANCH: "dev"
-          TO_BRANCH: "extern-contrib"

From 5685b2ac067851fec213851762980d74cb876665 Mon Sep 17 00:00:00 2001
From: boomzero <thomas_rainbowfish@icloud.com>
Date: Tue, 6 Oct 2026 10:16:18 +0800
Subject: [PATCH 5/9] Point external contributors at dev instead of
 extern-contrib

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E5dr7XTsCeoamqLSiT9rLp
---
 CLAUDE.md       | 7 +++----
 CONTRIBUTING.md | 2 +-
 README.md       | 2 +-
 index.html      | 2 +-
 4 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 61b28a22..7358ada9 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -52,8 +52,7 @@ Use: Task tool with xmoj-code-navigator agent to find specific sections
 ### Branch Structure and PR Requirements
 
 - `master`: Production branch - **DO NOT make PRs directly to master**
-- `dev`: Development branch - **ALL PRs must be based on and target this branch**
-- `extern-contrib`: External contributors must submit PRs to this branch
+- `dev`: Development branch - **ALL PRs must be based on and target this branch**, including PRs from forks
 
 **CRITICAL: All pull requests must:**
 1. Be based on the `dev` branch (branch off from `dev`)
@@ -191,10 +190,10 @@ If you see "XMOJ.user.js and Update.json have different patch versions":
 ### PR Requirements
 
 - **All PRs must be based on and target `dev` branch, not `master`**
-- Only PRs from the same repository (not forks) trigger auto-versioning
+- Only PRs from the same repository (not forks) trigger auto-versioning; fork PRs get no secrets, so a maintainer handles their version bump
 - PRs must modify `XMOJ.user.js` to trigger version bumps
 - Must merge `dev` into your branch before submitting
-- External contributors must target `extern-contrib` branch
+- External contributors fork the repo and target `dev` too
 
 ### Single-File Architecture
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 0f5c6e14..95ca944d 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -5,7 +5,7 @@ We are happy to have you here with us!
 We believe that you must be excited to contribute to our repo, but first, please read the contribution guidelines!
 
 > [!IMPORTANT]
-> 请注意, 外部开发者应向`extern-contrib`提交 pull requests。
+> 请向 `dev` 分支提交 pull requests。外部开发者请先 fork 本仓库，从 `dev` 拉分支，再向本仓库的 `dev` 提 PR。版本号由维护者和 CI 更新，不要手动修改。
 
 - Our goal for `xmoj-script` is **stability before features**. This means we focus on squashing critical bugs before adding new features. Often, we can do both in tandem, but bugs will take priority over a new feature.
 - We use Bootstrap in our project. Please use Bootstrap classes instead of writing your own CSS whenever possible.
diff --git a/README.md b/README.md
index 663645e0..3b291e01 100644
--- a/README.md
+++ b/README.md
@@ -86,7 +86,7 @@
 链接戳[这里](https://opencollective.com/xmoj-script-dev)。
 
 > [!IMPORTANT]
-> 请注意, 外部开发者应向`extern-contrib`提交 pull requests。
+> 请向 `dev` 分支提交 pull requests。外部开发者请先 fork 本仓库，从 `dev` 拉分支，再向本仓库的 `dev` 提 PR。版本号由维护者和 CI 更新，不要手动修改。
 
 ## Contributors
 
diff --git a/index.html b/index.html
index 1c19f3c8..7228464a 100644
--- a/index.html
+++ b/index.html
@@ -304,7 +304,7 @@ <h3 class="h5">报告问题</h3>
                     </div>
                     <div class="col-md-4">
                         <h3 class="h5">贡献代码</h3>
-                        <p class="mb-0">欢迎 PR。外部贡献者请提交到 <code>extern-contrib</code> 分支，详见<a href="https://github.com/XMOJ-Script-dev/XMOJ-Script/blob/master/CONTRIBUTING.md" target="_blank" rel="noopener noreferrer">贡献指南</a>。</p>
+                        <p class="mb-0">欢迎 PR。fork 本仓库后向 <code>dev</code> 分支提交，详见<a href="https://github.com/XMOJ-Script-dev/XMOJ-Script/blob/master/CONTRIBUTING.md" target="_blank" rel="noopener noreferrer">贡献指南</a>。</p>
                     </div>
                     <div class="col-md-4">
                         <h3 class="h5">赞助</h3>

From 581153a017573e96c5d94c11ccb7128aee53ab38 Mon Sep 17 00:00:00 2001
From: boomzero <thomas_rainbowfish@icloud.com>
Date: Tue, 6 Oct 2026 10:24:00 +0800
Subject: [PATCH 6/9] Bump the version for merged fork PRs from the push to dev

Fork PRs get no secrets and the bot cannot push to forks, so their
version cannot be bumped before merge. On a push to dev that touches
XMOJ.user.js, look up the PR whose merge commit it is; if it came from a
fork, run UpdateVersion in fork-merged mode: bump on actions/version-<PR>
from dev and open an auto-merging PR as the GitHub App. Runs only on the
trusted push, never on fork events, and never checks out fork code.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E5dr7XTsCeoamqLSiT9rLp
---
 .github/workflows/UpdateVersionFork.yml | 57 +++++++++++++++++++++++++
 Update/UpdateVersion.js                 | 48 +++++++++++++++------
 2 files changed, 92 insertions(+), 13 deletions(-)
 create mode 100644 .github/workflows/UpdateVersionFork.yml

diff --git a/.github/workflows/UpdateVersionFork.yml b/.github/workflows/UpdateVersionFork.yml
new file mode 100644
index 00000000..8072aa06
--- /dev/null
+++ b/.github/workflows/UpdateVersionFork.yml
@@ -0,0 +1,57 @@
+name: UpdateVersionFork
+# fork 的 PR 拿不到 secrets，也不能推送到 fork，所以合并前没法更新版本号。
+# 维护者合并后会推送到 dev：在这次（可信的）推送上找到对应的 PR，如果来自 fork，
+# 就基于 dev 更新版本号，并以 GitHub App 身份开一个自动合并的 PR。
+on:
+  push:
+    branches:
+      - dev
+    paths:
+      - XMOJ.user.js
+concurrency:
+  group: update-version-fork
+  cancel-in-progress: false
+jobs:
+  UpdateVersionFork:
+    runs-on: ubuntu-latest
+    if: ${{ !endsWith(github.actor, '[bot]') }}
+    permissions:
+      contents: read
+    steps:
+      - name: Generate a token
+        id: generate_token
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
+      - name: Find the merged fork PR
+        id: fork_pr
+        env:
+          GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
+          SHA: ${{ github.sha }}
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          PR=$(gh api "repos/$REPOSITORY/commits/$SHA/pulls" --jq "map(select(.merge_commit_sha == \"$SHA\" and .base.ref == \"dev\" and .head.repo.full_name != \"$REPOSITORY\")) | .[0].number // empty")
+          if [ -z "$PR" ]; then
+            echo "This push is not a merged fork PR."
+          else
+            echo "Merged fork PR: #$PR"
+            echo number=$PR >> $GITHUB_OUTPUT
+          fi
+      - uses: actions/checkout@v6
+        if: steps.fork_pr.outputs.number
+        with:
+          ref: dev
+          token: ${{ steps.generate_token.outputs.token }}
+      - name: Update version
+        if: steps.fork_pr.outputs.number
+        env:
+          GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
+          PR_NUMBER: ${{ steps.fork_pr.outputs.number }}
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          PR_TITLE=$(gh api "repos/$REPOSITORY/pulls/$PR_NUMBER" --jq .title)
+          PR_BODY=$(gh api "repos/$REPOSITORY/pulls/$PR_NUMBER" --jq '.body // ""')
+          node ./Update/UpdateVersion.js "$GITHUB_TOKEN" "$PR_NUMBER" "$PR_TITLE" "$PR_BODY" fork-merged
diff --git a/Update/UpdateVersion.js b/Update/UpdateVersion.js
index 891d2c46..b5ea8928 100644
--- a/Update/UpdateVersion.js
+++ b/Update/UpdateVersion.js
@@ -4,20 +4,29 @@ import {execSync} from "child_process";
 var GithubToken = process.argv[2];
 var PRNumber = process.argv[3];
 process.env.GITHUB_TOKEN = GithubToken;
-execSync("gh pr checkout " + PRNumber);
-console.info("PR #" + PRNumber + " has been checked out.");
-
-// Check if the last commit was made by github-actions[bot]
-// Only skip for synchronize events (push-triggered) to prevent infinite loops.
-// For edited events (PR title/body changes), allow metadata updates even when
-// the branch tip is a bot commit.
 const eventAction = String(process.argv[6] || "");
-const lastCommitAuthor = execSync("git log -1 --pretty=format:'%an'").toString().trim();
-console.log("Last commit author: " + lastCommitAuthor);
+// A merged PR from a fork: we cannot push to the fork, so bump the version on
+// a branch of this repository (checked out at dev) and open an auto-merging PR.
+const ForkMerged = eventAction === "fork-merged";
+const ForkBranch = "actions/version-" + Number(PRNumber);
 console.log("Event action       : " + eventAction);
-if (lastCommitAuthor === "github-actions[bot]" && eventAction !== "edited") {
-    console.log("Last commit was made by github-actions[bot]. Skipping to prevent infinite loop.");
-    process.exit(0);
+if (ForkMerged) {
+    execSync("git checkout -B " + ForkBranch);
+    console.info("Bumping the version for merged fork PR #" + PRNumber + " on " + ForkBranch + ".");
+} else {
+    execSync("gh pr checkout " + PRNumber);
+    console.info("PR #" + PRNumber + " has been checked out.");
+
+    // Check if the last commit was made by github-actions[bot]
+    // Only skip for synchronize events (push-triggered) to prevent infinite loops.
+    // For edited events (PR title/body changes), allow metadata updates even when
+    // the branch tip is a bot commit.
+    const lastCommitAuthor = execSync("git log -1 --pretty=format:'%an'").toString().trim();
+    console.log("Last commit author: " + lastCommitAuthor);
+    if (lastCommitAuthor === "github-actions[bot]" && eventAction !== "edited") {
+        console.log("Last commit was made by github-actions[bot]. Skipping to prevent infinite loop.");
+        process.exit(0);
+    }
 }
 
 const JSONFileName = "./Update.json";
@@ -26,7 +35,10 @@ var JSONFileContent = readFileSync(JSONFileName, "utf8");
 var JSFileContent = readFileSync(JSFileName, "utf8");
 execSync("git config --global user.email \"github-actions[bot]@users.noreply.github.com\"");
 execSync("git config --global user.name \"github-actions[bot]\"");
-if (JSONFileContent.includes('//!ci-no-touch')) {
+if (ForkMerged && JSONFileContent.includes('//!ci-no-touch')) {
+    // The marker only means something on an open PR branch.
+    JSONFileContent = JSONFileContent.replace('//!ci-no-touch', '');
+} else if (JSONFileContent.includes('//!ci-no-touch')) {
     var updatedContent = JSONFileContent.replace('//!ci-no-touch', '');
     writeFileSync(JSONFileName, updatedContent, "utf8");
     execSync("git config pull.rebase false");
@@ -115,6 +127,16 @@ writeFileSync(JSONFileName, JSON.stringify(JSONObject, null, 4), "utf8");
 
 console.warn("Update.json has been updated.");
 
+if (ForkMerged) {
+    execSync("git commit -a -m \"" + CommitMessage + "\"");
+    execSync("git push -u origin " + ForkBranch + " -f");
+    console.log("Pushed to " + ForkBranch + ".");
+    var VersionPR = execSync("gh pr create --base dev --head " + ForkBranch + " --title \"" + CommitMessage + " (#" + CurrentPR + ")\" --body \"Version bump for fork PR #" + CurrentPR + ".\"").toString().trim();
+    console.log("Created " + VersionPR + ".");
+    execSync("gh pr merge " + VersionPR + " --merge --auto");
+    console.log("Enabled auto merge.");
+    process.exit(0);
+}
 execSync("git config pull.rebase false");
 execSync("git pull");
 execSync("git commit -a -m \"" + CommitMessage + "\"");

From 84fc889ea35660aaff48fc07eb93f7a957c3f309 Mon Sep 17 00:00:00 2001
From: boomzero <thomas_rainbowfish@icloud.com>
Date: Tue, 6 Oct 2026 10:24:23 +0800
Subject: [PATCH 7/9] Document the post-merge version bump for fork PRs

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E5dr7XTsCeoamqLSiT9rLp
---
 CLAUDE.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 7358ada9..d4e12741 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -190,7 +190,7 @@ If you see "XMOJ.user.js and Update.json have different patch versions":
 ### PR Requirements
 
 - **All PRs must be based on and target `dev` branch, not `master`**
-- Only PRs from the same repository (not forks) trigger auto-versioning; fork PRs get no secrets, so a maintainer handles their version bump
+- Only PRs from the same repository trigger UpdateVersion before merge. Fork PRs get no secrets, so after a fork PR merges, `UpdateVersionFork` (on the push to `dev`) bumps the version on `actions/version-<PR>` and opens an auto-merging PR
 - PRs must modify `XMOJ.user.js` to trigger version bumps
 - Must merge `dev` into your branch before submitting
 - External contributors fork the repo and target `dev` too

From 461e19463859c12c35c881c7eb2d2a633b4f3868 Mon Sep 17 00:00:00 2001
From: boomzero <thomas_rainbowfish@icloud.com>
Date: Tue, 6 Oct 2026 12:30:41 +0800
Subject: [PATCH 8/9] Serialize fork version bumps and only guard stable
 releases

- UpdateVersionFork processes every merged fork PR to dev that has no
  Update.json entry, oldest first, each from the latest dev. A run
  dropped by the concurrency group loses nothing: the next run picks
  its PR up.
- fork-merged mode reuses an open version PR on a rerun and waits for
  it to merge, so the next bump starts from a dev with this version.
- Prerelease only skips when the version is already a stable release;
  an existing prerelease of the same version is still refreshed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E5dr7XTsCeoamqLSiT9rLp
---
 .github/workflows/Prerelease.yml        |  6 ++--
 .github/workflows/UpdateVersionFork.yml | 43 ++++++++++++-------------
 Update/UpdateVersion.js                 | 21 ++++++++++--
 3 files changed, 42 insertions(+), 28 deletions(-)

diff --git a/.github/workflows/Prerelease.yml b/.github/workflows/Prerelease.yml
index 5cb4893e..58ffd55b 100644
--- a/.github/workflows/Prerelease.yml
+++ b/.github/workflows/Prerelease.yml
@@ -33,15 +33,15 @@ jobs:
           GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
         id: get_version
         run: node ./Update/GetVersion.js
-      # 版本号没变（例如合并了没有更新版本号的 PR）时，不能覆盖已发布的同版本 release
+      # 版本号没变（例如合并了没有更新版本号的 PR）时，不能把已发布的正式版覆盖成预发布版；同版本的预发布版照常更新
       - name: Check for an existing release
         id: existing_release
         env:
           GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
           VERSION: ${{ steps.get_version.outputs.version }}
         run: |
-          if gh release view "$VERSION" > /dev/null 2>&1; then
-            echo "Release $VERSION already exists, skipping."
+          if [ "$(gh release view "$VERSION" --json isPrerelease --jq .isPrerelease 2>/dev/null)" = "false" ]; then
+            echo "Release $VERSION is already published as a stable release, skipping the prerelease."
             echo exists=true >> $GITHUB_OUTPUT
           fi
       - id: create_release
diff --git a/.github/workflows/UpdateVersionFork.yml b/.github/workflows/UpdateVersionFork.yml
index 8072aa06..a75fb239 100644
--- a/.github/workflows/UpdateVersionFork.yml
+++ b/.github/workflows/UpdateVersionFork.yml
@@ -1,13 +1,15 @@
 name: UpdateVersionFork
 # fork 的 PR 拿不到 secrets，也不能推送到 fork，所以合并前没法更新版本号。
-# 维护者合并后会推送到 dev：在这次（可信的）推送上找到对应的 PR，如果来自 fork，
-# 就基于 dev 更新版本号，并以 GitHub App 身份开一个自动合并的 PR。
+# 维护者合并后会推送到 dev：在这次（可信的）推送上找出所有已合并、但 Update.json 里还没有记录的 fork PR，
+# 逐个基于最新的 dev 更新版本号，并以 GitHub App 身份开自动合并的 PR，等它合并后再处理下一个。
+# 并发组最多保留一个排队的运行，被替换掉的运行要处理的 PR 也会被后面的运行补上。
 on:
   push:
     branches:
       - dev
     paths:
       - XMOJ.user.js
+  workflow_dispatch:
 concurrency:
   group: update-version-fork
   cancel-in-progress: false
@@ -26,32 +28,27 @@ jobs:
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
           permission-contents: write
           permission-pull-requests: write
-      - name: Find the merged fork PR
-        id: fork_pr
-        env:
-          GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
-          SHA: ${{ github.sha }}
-          REPOSITORY: ${{ github.repository }}
-        run: |
-          PR=$(gh api "repos/$REPOSITORY/commits/$SHA/pulls" --jq "map(select(.merge_commit_sha == \"$SHA\" and .base.ref == \"dev\" and .head.repo.full_name != \"$REPOSITORY\")) | .[0].number // empty")
-          if [ -z "$PR" ]; then
-            echo "This push is not a merged fork PR."
-          else
-            echo "Merged fork PR: #$PR"
-            echo number=$PR >> $GITHUB_OUTPUT
-          fi
       - uses: actions/checkout@v6
-        if: steps.fork_pr.outputs.number
         with:
           ref: dev
           token: ${{ steps.generate_token.outputs.token }}
-      - name: Update version
-        if: steps.fork_pr.outputs.number
+      - name: Update versions of merged fork PRs
         env:
           GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
-          PR_NUMBER: ${{ steps.fork_pr.outputs.number }}
           REPOSITORY: ${{ github.repository }}
+          # 在此之前合并的 fork PR 不再补记版本号
+          SINCE: "2026-10-06T00:00:00Z"
         run: |
-          PR_TITLE=$(gh api "repos/$REPOSITORY/pulls/$PR_NUMBER" --jq .title)
-          PR_BODY=$(gh api "repos/$REPOSITORY/pulls/$PR_NUMBER" --jq '.body // ""')
-          node ./Update/UpdateVersion.js "$GITHUB_TOKEN" "$PR_NUMBER" "$PR_TITLE" "$PR_BODY" fork-merged
+          PRS=$(gh pr list --repo "$REPOSITORY" --base dev --state merged --limit 50 --json number,isCrossRepository,mergedAt \
+            --jq "map(select(.isCrossRepository and .mergedAt >= \"$SINCE\")) | sort_by(.mergedAt) | .[].number")
+          for PR_NUMBER in $PRS; do
+            git fetch -q origin dev
+            git checkout -q -B dev origin/dev
+            if jq -e --argjson pr "$PR_NUMBER" '[.UpdateHistory[].UpdateContents[].PR] | index($pr)' Update.json > /dev/null; then
+              echo "#$PR_NUMBER already has a version."
+              continue
+            fi
+            PR_TITLE=$(gh api "repos/$REPOSITORY/pulls/$PR_NUMBER" --jq .title)
+            PR_BODY=$(gh api "repos/$REPOSITORY/pulls/$PR_NUMBER" --jq '.body // ""')
+            node ./Update/UpdateVersion.js "$GITHUB_TOKEN" "$PR_NUMBER" "$PR_TITLE" "$PR_BODY" fork-merged
+          done
diff --git a/Update/UpdateVersion.js b/Update/UpdateVersion.js
index b5ea8928..1b5ff2e3 100644
--- a/Update/UpdateVersion.js
+++ b/Update/UpdateVersion.js
@@ -131,10 +131,27 @@ if (ForkMerged) {
     execSync("git commit -a -m \"" + CommitMessage + "\"");
     execSync("git push -u origin " + ForkBranch + " -f");
     console.log("Pushed to " + ForkBranch + ".");
-    var VersionPR = execSync("gh pr create --base dev --head " + ForkBranch + " --title \"" + CommitMessage + " (#" + CurrentPR + ")\" --body \"Version bump for fork PR #" + CurrentPR + ".\"").toString().trim();
-    console.log("Created " + VersionPR + ".");
+    // A rerun may find the PR from an earlier attempt; reuse it instead of failing to create a duplicate.
+    var VersionPR = execSync("gh pr list --base dev --head " + ForkBranch + " --state open --json url --jq '.[0].url // empty'").toString().trim();
+    if (VersionPR) {
+        console.log("Reusing " + VersionPR + ".");
+    } else {
+        VersionPR = execSync("gh pr create --base dev --head " + ForkBranch + " --title \"" + CommitMessage + " (#" + CurrentPR + ")\" --body \"Version bump for fork PR #" + CurrentPR + ".\"").toString().trim();
+        console.log("Created " + VersionPR + ".");
+    }
     execSync("gh pr merge " + VersionPR + " --merge --auto");
     console.log("Enabled auto merge.");
+    // Wait for the merge, so the next fork PR is bumped from a dev that already has this version.
+    for (var Attempt = 0; ; Attempt++) {
+        var State = execSync("gh pr view " + VersionPR + " --json state --jq .state").toString().trim();
+        if (State == "MERGED") break;
+        if (State == "CLOSED" || Attempt >= 120) {
+            console.error(VersionPR + " was not merged (state: " + State + ").");
+            process.exit(1);
+        }
+        execSync("sleep 10");
+    }
+    console.log(VersionPR + " has been merged.");
     process.exit(0);
 }
 execSync("git config pull.rebase false");

From 0f68da7a8b99d293a275656acf1d2f40df1c59ba Mon Sep 17 00:00:00 2001
From: boomzero <thomas_rainbowfish@icloud.com>
Date: Tue, 6 Oct 2026 13:00:51 +0800
Subject: [PATCH 9/9] Remove the retired Qodana workflow

Qodana is no longer used and the workflow is disabled on GitHub; this
also drops the fork guard added to it earlier in this PR.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E5dr7XTsCeoamqLSiT9rLp
---
 .github/workflows/main.yml | 27 ---------------------------
 1 file changed, 27 deletions(-)
 delete mode 100644 .github/workflows/main.yml

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
deleted file mode 100644
index 4042a1bc..00000000
--- a/.github/workflows/main.yml
+++ /dev/null
@@ -1,27 +0,0 @@
-name: Qodana
-on:
-  workflow_dispatch:
-  pull_request:
-  push:
-    branches:
-      - master
-      - dev
-
-jobs:
-  qodana:
-    runs-on: ubuntu-latest
-    # fork 的 PR 拿不到 QODANA_TOKEN
-    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-    permissions:
-      contents: write
-      pull-requests: write
-      checks: write
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}  # to check out the actual pull request commit, not the merge commit
-          fetch-depth: 0  # a full history is required for pull request analysis
-      - name: 'Qodana Scan'
-        uses: JetBrains/qodana-action@v2025.2
-        env:
-          QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}