@@ -3,6 +3,7 @@
 # Batch files need CRLF for cmd.exe to parse them reliably.
 *.cmd text eol=crlf
 *.bat text eol=crlf
-# GitHub's GraphQL schema and the operations graphqlgen writes from it.
+# GitHub's and Expo's GraphQL schemas and the operations graphqlgen writes from them.
 packages/source-control-github/schema/** linguist-generated
+apps/server/schema/** linguist-generated
 **/*.graphql.ts linguist-generated
@@ -18,13 +18,34 @@ runs:
         path: ~/.vite-plus
         key: vite-plus-home-v1-${{ runner.os }}-${{ runner.arch }}-${{ steps.vp.outputs.version }}
 
+    - name: Setup Vite+
+      uses: voidzero-dev/setup-vp@v1
+      with:
+        node-version-file: package.json
+        cache: false
+        run-install: false
+
+    - name: Resolve pnpm store path
+      id: pnpm_store
+      shell: bash
+      run: |
+        store_path="$(vp pm cache dir)"
+        echo "path=$store_path" >> "$GITHUB_OUTPUT"
+
+    # setup-vp's shared cache key ignores install filters. Keep full installs in a
+    # separate namespace, including fallback restores.
     # The pnpm store stays a cache tarball on the runner's own disk. A store on a
     # Blacksmith sticky disk mounts in under a second, but pnpm then copies every
     # package across filesystems instead of hard-linking it: install took 28-49s
     # against 9s plus an 11s restore.
-    - name: Setup Vite+
-      uses: voidzero-dev/setup-vp@v1
+    - name: Cache full pnpm store
+      uses: actions/cache@v6
       with:
-        node-version-file: package.json
-        cache: true
-        run-install: true
+        path: ${{ steps.pnpm_store.outputs.path }}
+        key: pnpm-full-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', 'package.json') }}
+        restore-keys: |
+          pnpm-full-v1-${{ runner.os }}-${{ runner.arch }}-
+
+    - name: Install dependencies
+      shell: bash
+      run: vp install
@@ -36,6 +36,7 @@ const EXTRA_OWNERS = [
   // scripts/build-desktop-artifact.ts reads the GNOME extension manifest.
   [/^apps\/desktop\/gnome-extension\//, ["@t3tools/scripts"]],
   [/^native\/browser-secret\//, ["@t3tools/desktop"]],
+  [/^native\/kde-snap-shot\//, ["@t3tools/desktop"]],
   [/^native\/libghostty-vt\//, ["@t3tools/web"]],
 ];
 const RUST = /^native\/(resource-monitor|kde-snap-shot|hyprland-snap-shot)\//;
@@ -112,10 +113,10 @@ function ownersOf(file, packages) {
   // A manifest can change dependencies or versions other packages read.
   if (path.posix.basename(file) === "package.json") return null;
   if (RUNS_EVERYTHING.some((pattern) => pattern.test(file))) return null;
+  const extra = EXTRA_OWNERS.flatMap(([pattern, names]) => (pattern.test(file) ? names : []));
   // scripts/build-desktop-artifact.test.ts reads the crates' sources.
-  if (RUST.test(file)) return ["@t3tools/scripts"];
+  if (RUST.test(file)) return ["@t3tools/scripts", ...extra];
 
-  const extra = EXTRA_OWNERS.flatMap(([pattern, names]) => (pattern.test(file) ? names : []));
   const owner = packages
     .filter((pkg) => file.startsWith(`${pkg.dir}/`))
     .sort((a, b) => b.dir.length - a.dir.length)[0];
 
@@ -244,10 +244,26 @@ async function resolve({ github, context, core }) {
 
   let pullNumber = source.pull_requests?.[0]?.number;
   if (!pullNumber) {
-    const associated = await github.paginate(
-      github.rest.repos.listPullRequestsAssociatedWithCommit,
-      { owner, repo, commit_sha: source.head_sha, per_page: 100 },
-    );
+    let associated;
+    try {
+      associated = await github.paginate(github.rest.repos.listPullRequestsAssociatedWithCommit, {
+        owner,
+        repo,
+        commit_sha: source.head_sha,
+        per_page: 100,
+      });
+    } catch (error) {
+      // A force-pushed or deleted PR head can disappear before this workflow runs.
+      if (
+        error.status === 422 &&
+        error.response?.data?.message === `No commit found for SHA: ${source.head_sha}`
+      ) {
+        core.info(`Skipping CI result for unavailable commit ${source.head_sha}.`);
+        core.setOutput("publish", "false");
+        return;
+      }
+      throw error;
+    }
     const matchingPulls = associated.filter(
       (pull) =>
         pull.state === "open" &&
 
@@ -216,6 +216,47 @@ test("does not guess when a fallback commit belongs to multiple PRs", async () =
   assert.equal(fetchedPull, false);
 });
 
+test("skips a missing PR commit but preserves other lookup failures", async () => {
+  for (const [status, message, shouldSkip] of [
+    [422, "No commit found for SHA: old-head", true],
+    [422, "Validation Failed", false],
+    [403, "API rate limit exceeded", false],
+  ]) {
+    const outputs = {};
+    const error = Object.assign(new Error(message), {
+      status,
+      response: { data: { message } },
+    });
+    const run = resolve({
+      github: {
+        paginate: async () => {
+          throw error;
+        },
+        rest: { repos: { listPullRequestsAssociatedWithCommit: () => {} } },
+      },
+      context: {
+        repo: { owner: "pingdotgg", repo: "t3code" },
+        payload: {
+          workflow_run: { event: "pull_request", head_sha: "old-head", pull_requests: [] },
+        },
+      },
+      core: {
+        info: () => {},
+        setOutput: (key, value) => {
+          outputs[key] = value;
+        },
+      },
+    });
+    if (shouldSkip) {
+      await run;
+      assert.equal(outputs.publish, "false");
+    } else {
+      await assert.rejects(run, (caught) => caught === error);
+      assert.deepEqual(outputs, {});
+    }
+  }
+});
+
 test("does not report a passing run that skipped the server tests", async () => {
   const outputs = {};
   const listWorkflowRunArtifacts = () => {};
 
@@ -93,6 +93,9 @@ jobs:
       - name: Check generated GitHub GraphQL operations
         run: vp run --filter @t3tools/source-control-github generate --check
 
+      - name: Check generated Expo GraphQL operations
+        run: vp run --filter t3 generate --check
+
       - name: Check
         run: vp check
 
@@ -482,8 +485,6 @@ jobs:
             !/apps/mobile/modules/t3-terminal/Vendor/**/*.a
           sparse-checkout-cone-mode: false
 
-      # A full install: a filtered one that misses the cache first saves its
-      # partial store under the shared lockfile key for every later job.
       - name: Setup Vite+
         uses: ./.github/actions/setup-ci-deps
 
 
@@ -3,7 +3,9 @@ name: Forward to Cursor hygiene
 on:
   push:
     branches: [main]
-  pull_request:
+  # Use trusted workflow code and repository secrets for fork PRs.
+  # Keep this job payload-only: never check out or run PR code.
+  pull_request_target:
     types: [opened, reopened, ready_for_review]
   issues:
     types: [opened, closed, reopened]
@@ -34,7 +36,7 @@ jobs:
               --output /dev/null --write-out '%{http_code}' \
               -H "Authorization: $AUTH" \
               -H "Content-Type: application/json" \
-              -H "X-GitHub-Event: ${{ github.event_name }}" \
+              -H "X-GitHub-Event: ${{ github.event_name == 'pull_request_target' && 'pull_request' || github.event_name }}" \
               -H "X-GitHub-Delivery: ${{ github.run_id }}-${{ github.run_attempt }}" \
               --data-binary @"${{ github.event_path }}") || curl_status=$?
             if [ "$curl_status" -eq 0 ]; then
 
@@ -27,7 +27,7 @@ jobs:
   deploy_relay:
     name: Deploy production relay
     # A manual run from another branch would deploy that branch to production.
-    if: github.ref == 'refs/heads/main'
+    if: github.repository == 'pingdotgg/t3code' && github.ref == 'refs/heads/main'
     runs-on: blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 15
     environment:
@@ -41,6 +41,8 @@ jobs:
       RELAY_TUNNEL_ZONE_NAME: ${{ vars.RELAY_TUNNEL_ZONE_NAME }}
       RELAY_TUNNEL_CLEANUP_MODE: ${{ vars.RELAY_TUNNEL_CLEANUP_MODE }}
       RELAY_LEGACY_TUNNEL_CLEANUP_MODE: ${{ vars.RELAY_LEGACY_TUNNEL_CLEANUP_MODE }}
+      RELAY_ALERT_NOTIFIER_ID: ${{ vars.RELAY_ALERT_NOTIFIER_ID }}
+      RELAY_WARNING_NOTIFIER_ID: ${{ vars.RELAY_WARNING_NOTIFIER_ID }}
       CLERK_PUBLISHABLE_KEY: ${{ vars.CLERK_PUBLISHABLE_KEY }}
       CLERK_JWT_AUDIENCE: ${{ vars.CLERK_JWT_AUDIENCE }}
       APNS_ENVIRONMENT: ${{ vars.APNS_ENVIRONMENT }}
 
@@ -15,6 +15,7 @@ concurrency:
 jobs:
   mirror:
     name: Mirror beta APK
+    if: github.repository == 'pingdotgg/t3code'
     runs-on: blacksmith-2vcpu-ubuntu-2404
     timeout-minutes: 10
     permissions:
 
@@ -75,6 +75,7 @@ concurrency:
 jobs:
   production:
     name: EAS ${{ inputs.profile || 'production' }} ${{ github.event_name == 'push' && 'auto' || inputs.mode }}
+    if: github.repository == 'pingdotgg/t3code'
     runs-on: blacksmith-8vcpu-ubuntu-2404
     permissions:
       contents: read