Merge branch 'main' into plan-local-image-display

feat(ci): publish PR Android APK to comment (#28283 )
* feat(ci): publish PR Android APK to R2 with installable links Adds a universal debug APK to PR builds and uploads it to a public R2 bucket alongside the existing GitHub Actions artifact. Posts a sticky PR comment with tap-to-install links and a QR code so testers can install directly on their device without unzipping artifacts. Required setup: - Secrets: R2_APK_ACCESS_KEY_ID, R2_APK_SECRET_ACCESS_KEY, R2_APK_ACCOUNT_ID, R2_APK_BUCKET - Optional repo variable: APK_PUBLIC_HOST (defaults to apk.immich.app) - R2 bucket configured with a public custom domain matching APK_PUBLIC_HOST * chore(ci): drop R2 upload, link directly to GitHub artifact Surfaces the existing release-apk-signed artifact in a sticky PR comment with a QR code. Avoids new infra and secrets — the trade-off is GitHub login and a zip wrapper instead of tap-to-install. * feat(ci): build PR APK as release and publish to GitHub Release PR builds now produce a release APK signed with the release keystore. The universal APK is published as a GitHub Release asset under tag 'pr-<num>' (prerelease), giving testers a direct, unzipped, tap-to- install URL plus a QR code in the PR comment. The release-apk-signed artifact is unchanged. * chore(ci): drop GitHub Release, publish universal APK as own artifact Reverts the prerelease publish. Uploads the universal release APK as a separate single-file artifact so its download URL gives a zip containing only that APK — no extra files to dig through. The QR in the PR comment points at this universal-only artifact. * chore(ci): build only universal APK for PR, drop split artifact PR builds skip the arm64-only split — release-apk-signed now contains just the universal app-release.apk, so the download zip is a single file. Removes the redundant separate universal artifact and points the PR comment QR at the main artifact URL. * feat(mobile): suffix PR APK applicationId so it installs alongside production Each PR build now becomes app.alextran.immich.pr<num> via PR_NUMBER env read in build.gradle, so testers can install multiple PR builds and the Play Store version on the same device without uninstalling. Also tags the version with -pr<num> for visibility. * feat(ci): allow PR APK build to run on forks Forks can now run the Android build job. Steps that need repo secrets (create-workflow-token, Create Keystore) are skipped when the PR is from a fork, the checkout falls back to GITHUB_TOKEN, and build.gradle falls back to debug signing if the release keystore isn't materialised. The PR comment still requires write access, so it's gated to non-fork PRs — fork APKs are reachable from the workflow run's artifact tab.
2026-05-21 23:26:31 -04:00 · 2026-05-09 07:49:21 -05:00 · 2026-05-09 07:46:40 -05:00 · 2026-05-09 10:47:41 +07:00 · 2026-05-09 09:44:41 +07:00 · 2026-05-09 01:53:18 +00:00
39 changed files with 534 additions and 379 deletions
@@ -51,6 +51,7 @@ jobs:
      should_run: ${{ steps.check.outputs.should_run }}
    steps:
      - id: token
+        if: ${{ !github.event.pull_request.head.repo.fork }}
        uses: immich-app/devtools/actions/create-workflow-token@caa599d954228439ea3e8ce1c3328f41ab120ee6 # create-workflow-token-action-v2.0.0
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
@@ -60,7 +61,7 @@ jobs:
        id: check
        uses: immich-app/devtools/actions/pre-job@91f342bb4477c4bc10c576ae739da875d85aa164 # pre-job-action-v2.0.4
        with:
-          github-token: ${{ steps.token.outputs.token }}
+          github-token: ${{ steps.token.outputs.token || github.token }}
          filters: |
            mobile:
              - 'mobile/**'
@@ -73,12 +74,13 @@ jobs:
    needs: pre-job
    permissions:
      contents: read
-    # Skip when PR from a fork
-    if: ${{ !github.event.pull_request.head.repo.fork && github.actor != 'dependabot[bot]' && fromJSON(needs.pre-job.outputs.should_run).mobile == true }}
+      pull-requests: write
+    if: ${{ github.actor != 'dependabot[bot]' && fromJSON(needs.pre-job.outputs.should_run).mobile == true }}
    runs-on: mich

    steps:
      - id: token
+        if: ${{ !github.event.pull_request.head.repo.fork }}
        uses: immich-app/devtools/actions/create-workflow-token@caa599d954228439ea3e8ce1c3328f41ab120ee6 # create-workflow-token-action-v2.0.0
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
@@ -88,9 +90,10 @@ jobs:
        with:
          ref: ${{ inputs.ref || github.sha }}
          persist-credentials: false
-          token: ${{ steps.token.outputs.token }}
+          token: ${{ steps.token.outputs.token || github.token }}

      - name: Create the Keystore
+        if: ${{ !github.event.pull_request.head.repo.fork }}
        env:
          KEY_JKS: ${{ secrets.KEY_JKS }}
        working-directory: ./mobile
@@ -144,20 +147,40 @@ jobs:
          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
          ANDROID_STORE_PASSWORD: ${{ secrets.ANDROID_STORE_PASSWORD }}
          IS_MAIN: ${{ github.ref == 'refs/heads/main' }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          if [[ $IS_MAIN == 'true' ]]; then
            flutter build apk --release
            flutter build apk --release --split-per-abi --target-platform android-arm,android-arm64,android-x64
          else
-            flutter build apk --debug --split-per-abi --target-platform android-arm64
+            flutter build apk --release
          fi

      - name: Publish Android Artifact
+        id: upload-apk
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: release-apk-signed
          path: mobile/build/app/outputs/flutter-apk/*.apk

+      - name: Comment APK download link on PR
+        if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork }}
+        uses: mshick/add-pr-comment@8e4927817251f1ff60c001f04568532b38e0b4a0 # v3.11.0
+        env:
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          APK_URL: ${{ steps.upload-apk.outputs.artifact-url }}
+        with:
+          github-token: ${{ steps.token.outputs.token }}
+          message-id: 'mobile-android-apk'
+          message: |
+            📱 **Android release APK (universal)** — `${{ env.HEAD_SHA }}`
+
+            Download: ${{ env.APK_URL }}
+
+            <img src="https://api.qrserver.com/v1/create-qr-code/?size=240x240&data=${{ env.APK_URL }}" alt="QR code" />
+
+            GitHub login required. Downloads as a zip containing a single `app-release.apk` — extract and install. Installs as a separate app (applicationId `app.alextran.immich.pr${{ github.event.pull_request.number }}`), so it coexists with the Play Store version and any other PR builds.
+
      - name: Save Gradle Cache
        id: cache-gradle-save
        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
@@ -36,30 +36,20 @@ jobs:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}

-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          token: ${{ steps.token.outputs.token }}

-      - name: Setup pnpm
-        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
-
-      - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - name: Setup Mise
+        uses: immich-app/devtools/actions/use-mise@01a4d354b70f99a6baf4a1b72827f6d4922e4978 # use-mise-action-v2.0.0
        with:
-          node-version-file: './cli/.nvmrc'
-          registry-url: 'https://registry.npmjs.org'
-          cache: 'pnpm'
-          cache-dependency-path: '**/pnpm-lock.yaml'
+          github_token: ${{ steps.token.outputs.token }}

-      - name: Setup typescript-sdk
-        run: pnpm install && pnpm run build
-        working-directory: ./open-api/typescript-sdk
-
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm build
-      - run: pnpm publish --provenance --no-git-checks
+      - name: Publish
        if: ${{ github.event_name == 'release' }}
+        run: mise run ci-publish

  docker:
    name: Docker
@@ -64,17 +64,11 @@ jobs:
        with:
          persist-credentials: false
          token: ${{ steps.token.outputs.token }}
-          fetch-depth: 0

-      - name: Setup pnpm
-        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
-
-      - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - name: Setup Mise
+        uses: immich-app/devtools/actions/use-mise@01a4d354b70f99a6baf4a1b72827f6d4922e4978 # use-mise-action-v2.0.0
        with:
-          node-version-file: './docs/.nvmrc'
-          cache: 'pnpm'
-          cache-dependency-path: '**/pnpm-lock.yaml'
+          github_token: ${{ steps.token.outputs.token }}

      - name: Run install
        run: pnpm install
@@ -14,29 +14,23 @@ jobs:
      contents: write
      pull-requests: write
    steps:
-      - name: Generate a token
-        id: generate-token
-        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@caa599d954228439ea3e8ce1c3328f41ab120ee6 # create-workflow-token-action-v2.0.0
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}

-      - name: 'Checkout'
+      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.event.pull_request.head.ref }}
-          token: ${{ steps.generate-token.outputs.token }}
          persist-credentials: true
+          token: ${{ steps.token.outputs.token }}

-      - name: Setup pnpm
-        uses: pnpm/action-setup@26f6d4f2c533a43e6b5da0b4a5dd983f98f7b49a # v6.0.4
-
-      - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - name: Setup Mise
+        uses: immich-app/devtools/actions/use-mise@01a4d354b70f99a6baf4a1b72827f6d4922e4978 # use-mise-action-v2.0.0
        with:
-          node-version-file: './server/.nvmrc'
-          cache: 'pnpm'
-          cache-dependency-path: '**/pnpm-lock.yaml'
+          github_token: ${{ steps.token.outputs.token }}

      - name: Fix formatting
        run: pnpm --recursive install && pnpm run --recursive --if-present --parallel format:fix
@@ -48,33 +48,28 @@ jobs:
      version: ${{ steps.output.outputs.version }}
    permissions: {} # No job-level permissions are needed because it uses the app-token
    steps:
-      - name: Generate a token
-        id: generate-token
-        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@caa599d954228439ea3e8ce1c3328f41ab120ee6 # create-workflow-token-action-v2.0.0
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}

-      - name: Checkout
+      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
-          token: ${{ steps.generate-token.outputs.token }}
+          token: ${{ steps.token.outputs.token }}
          persist-credentials: true
          ref: main

+      - name: Setup Mise
+        uses: immich-app/devtools/actions/use-mise@01a4d354b70f99a6baf4a1b72827f6d4922e4978 # use-mise-action-v2.0.0
+        with:
+          github_token: ${{ steps.token.outputs.token }}
+
+      # TODO move to mise
      - name: Install uv
        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0

-      - name: Setup pnpm
-        uses: pnpm/action-setup@26f6d4f2c533a43e6b5da0b4a5dd983f98f7b49a # v6.0.4
-
-      - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version-file: './server/.nvmrc'
-          cache: 'pnpm'
-          cache-dependency-path: '**/pnpm-lock.yaml'
-
      - name: Bump version
        env:
          SERVER_BUMP: ${{ inputs.serverBump }}
@@ -24,24 +24,22 @@ jobs:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}

-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          token: ${{ steps.token.outputs.token }}

-      - name: Setup pnpm
-        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
-
-      # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - name: Setup Mise
+        uses: immich-app/devtools/actions/use-mise@01a4d354b70f99a6baf4a1b72827f6d4922e4978 # use-mise-action-v2.0.0
        with:
-          node-version-file: './open-api/typescript-sdk/.nvmrc'
-          registry-url: 'https://registry.npmjs.org'
-          cache: 'pnpm'
-          cache-dependency-path: '**/pnpm-lock.yaml'
+          github_token: ${{ steps.token.outputs.token }}
+
      - name: Install deps
        run: pnpm install --frozen-lockfile
+
      - name: Build
        run: pnpm build
+
      - name: Publish
        run: pnpm publish --provenance --no-git-checks
@@ -78,28 +78,14 @@ jobs:
          persist-credentials: false
          token: ${{ steps.token.outputs.token }}

-      - name: Setup pnpm
-        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
-      - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - name: Setup Mise
+        uses: immich-app/devtools/actions/use-mise@01a4d354b70f99a6baf4a1b72827f6d4922e4978 # use-mise-action-v2.0.0
        with:
-          node-version-file: './server/.nvmrc'
-          cache: 'pnpm'
-          cache-dependency-path: '**/pnpm-lock.yaml'
-      - name: Run package manager install
-        run: pnpm install
-      - name: Run linter
-        run: pnpm lint
-        if: ${{ !cancelled() }}
-      - name: Run formatter
-        run: pnpm format
-        if: ${{ !cancelled() }}
-      - name: Run tsc
-        run: pnpm check
-        if: ${{ !cancelled() }}
-      - name: Run small tests & coverage
-        run: pnpm test
-        if: ${{ !cancelled() }}
+          github_token: ${{ steps.token.outputs.token }}
+
+      - name: Run ci-unit
+        run: mise run ci-unit
+
  cli-unit-tests:
    name: Unit Test CLI
    needs: pre-job
@@ -122,31 +108,15 @@ jobs:
        with:
          persist-credentials: false
          token: ${{ steps.token.outputs.token }}
-      - name: Setup pnpm
-        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
-      - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+
+      - name: Setup Mise
+        uses: immich-app/devtools/actions/use-mise@01a4d354b70f99a6baf4a1b72827f6d4922e4978 # use-mise-action-v2.0.0
        with:
-          node-version-file: './cli/.nvmrc'
-          cache: 'pnpm'
-          cache-dependency-path: '**/pnpm-lock.yaml'
-      - name: Setup typescript-sdk
-        run: pnpm install && pnpm run build
-        working-directory: ./open-api/typescript-sdk
-      - name: Install deps
-        run: pnpm install
-      - name: Run linter
-        run: pnpm lint
-        if: ${{ !cancelled() }}
-      - name: Run formatter
-        run: pnpm format
-        if: ${{ !cancelled() }}
-      - name: Run tsc
-        run: pnpm check
-        if: ${{ !cancelled() }}
-      - name: Run unit tests & coverage
-        run: pnpm test
-        if: ${{ !cancelled() }}
+          github_token: ${{ steps.token.outputs.token }}
+
+      - name: Run ci-unit
+        run: mise run ci-unit
+
  cli-unit-tests-win:
    name: Unit Test CLI (Windows)
    needs: pre-job
@@ -169,26 +139,33 @@ jobs:
        with:
          persist-credentials: false
          token: ${{ steps.token.outputs.token }}
+
      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+
      - name: Setup Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
-          node-version-file: './cli/.nvmrc'
+          node-version-file: '.nvmrc'
          cache: 'pnpm'
          cache-dependency-path: '**/pnpm-lock.yaml'
      - name: Setup typescript-sdk
        run: pnpm install --frozen-lockfile && pnpm build
        working-directory: ./open-api/typescript-sdk
+
      - name: Install deps
        run: pnpm install --frozen-lockfile
+
      # Skip linter & formatter in Windows test.
+
      - name: Run tsc
        run: pnpm check
        if: ${{ !cancelled() }}
+
      - name: Run unit tests & coverage
        run: pnpm test
        if: ${{ !cancelled() }}
+
  web-lint:
    name: Lint Web
    needs: pre-job
@@ -211,28 +188,22 @@ jobs:
        with:
          persist-credentials: false
          token: ${{ steps.token.outputs.token }}
-      - name: Setup pnpm
-        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
-      - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+
+      - name: Setup Mise
+        uses: immich-app/devtools/actions/use-mise@01a4d354b70f99a6baf4a1b72827f6d4922e4978 # use-mise-action-v2.0.0
        with:
-          node-version-file: './web/.nvmrc'
-          cache: 'pnpm'
-          cache-dependency-path: '**/pnpm-lock.yaml'
+          github_token: ${{ steps.token.outputs.token }}
+
      - name: Run setup typescript-sdk
-        run: pnpm install --frozen-lockfile && pnpm build
-        working-directory: ./open-api/typescript-sdk
+        run: mise run //:sdk:install && mise run //:sdk:build
+
      - name: Run pnpm install
-        run: pnpm rebuild && pnpm install --frozen-lockfile
+        run: pnpm install --frozen-lockfile
+
      - name: Run linter
        run: pnpm lint
        if: ${{ !cancelled() }}
-      - name: Run formatter
-        run: pnpm format
-        if: ${{ !cancelled() }}
-      - name: Run svelte checks
-        run: pnpm check:svelte
-        if: ${{ !cancelled() }}
+
  web-unit-tests:
    name: Test Web
    needs: pre-job
@@ -255,25 +226,15 @@ jobs:
        with:
          persist-credentials: false
          token: ${{ steps.token.outputs.token }}
-      - name: Setup pnpm
-        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
-      - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+
+      - name: Setup Mise
+        uses: immich-app/devtools/actions/use-mise@01a4d354b70f99a6baf4a1b72827f6d4922e4978 # use-mise-action-v2.0.0
        with:
-          node-version-file: './web/.nvmrc'
-          cache: 'pnpm'
-          cache-dependency-path: '**/pnpm-lock.yaml'
-      - name: Run setup typescript-sdk
-        run: pnpm install --frozen-lockfile && pnpm build
-        working-directory: ./open-api/typescript-sdk
-      - name: Run npm install
-        run: pnpm install --frozen-lockfile
-      - name: Run tsc
-        run: pnpm check:typescript
-        if: ${{ !cancelled() }}
-      - name: Run unit tests & coverage
-        run: pnpm test
-        if: ${{ !cancelled() }}
+          github_token: ${{ steps.token.outputs.token }}
+
+      - name: Run ci-unit
+        run: mise run ci-unit
+
  i18n-tests:
    name: Test i18n
    needs: pre-job
@@ -293,24 +254,25 @@ jobs:
        with:
          persist-credentials: false
          token: ${{ steps.token.outputs.token }}
-      - name: Setup pnpm
-        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
-      - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+
+      - name: Setup Mise
+        uses: immich-app/devtools/actions/use-mise@01a4d354b70f99a6baf4a1b72827f6d4922e4978 # use-mise-action-v2.0.0
        with:
-          node-version-file: './web/.nvmrc'
-          cache: 'pnpm'
-          cache-dependency-path: '**/pnpm-lock.yaml'
+          github_token: ${{ steps.token.outputs.token }}
+
      - name: Install dependencies
        run: pnpm --filter=immich-i18n install --frozen-lockfile
+
      - name: Format
        run: pnpm --filter=immich-i18n format:fix
+
      - name: Find file changes
        uses: tj-actions/verify-changed-files@a1c6acee9df209257a246f2cc6ae8cb6581c1edf # v20.0.4
        id: verify-changed-files
        with:
          files: |
            i18n/**
+
      - name: Verify files have not changed
        if: steps.verify-changed-files.outputs.files_changed == 'true'
        env:
@@ -319,6 +281,7 @@ jobs:
          echo "ERROR: i18n files not up to date!"
          echo "Changed files: ${CHANGED_FILES}"
          exit 1
+
  e2e-tests-lint:
    name: End-to-End Lint
    needs: pre-job
@@ -341,30 +304,16 @@ jobs:
        with:
          persist-credentials: false
          token: ${{ steps.token.outputs.token }}
-      - name: Setup pnpm
-        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
-      - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+
+      - name: Setup Mise
+        uses: immich-app/devtools/actions/use-mise@01a4d354b70f99a6baf4a1b72827f6d4922e4978 # use-mise-action-v2.0.0
        with:
-          node-version-file: './e2e/.nvmrc'
-          cache: 'pnpm'
-          cache-dependency-path: '**/pnpm-lock.yaml'
-      - name: Run setup typescript-sdk
-        run: pnpm install --frozen-lockfile && pnpm build
-        working-directory: ./open-api/typescript-sdk
-        if: ${{ !cancelled() }}
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-        if: ${{ !cancelled() }}
-      - name: Run linter
-        run: pnpm lint
-        if: ${{ !cancelled() }}
-      - name: Run formatter
-        run: pnpm format
-        if: ${{ !cancelled() }}
-      - name: Run tsc
-        run: pnpm check
+          github_token: ${{ steps.token.outputs.token }}
+
+      - name: Run ci-unit
+        run: mise run ci-unit
        if: ${{ !cancelled() }}
+
  server-medium-tests:
    name: Medium Tests (Server)
    needs: pre-job
@@ -388,23 +337,16 @@ jobs:
          persist-credentials: false
          submodules: 'recursive'
          token: ${{ steps.token.outputs.token }}
-      - name: Setup pnpm
-        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
-      - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version-file: './server/.nvmrc'
-          cache: 'pnpm'
-          cache-dependency-path: '**/pnpm-lock.yaml'
+
      - name: Setup Mise
        uses: immich-app/devtools/actions/use-mise@01a4d354b70f99a6baf4a1b72827f6d4922e4978 # use-mise-action-v2.0.0
        with:
          github_token: ${{ steps.token.outputs.token }}
-      - name: Run pnpm install
-        run: SHARP_IGNORE_GLOBAL_LIBVIPS=true pnpm install --frozen-lockfile
-      - name: Run medium tests
-        run: pnpm test:medium
+
+      - name: Run ci-medium
+        run: mise run ci-medium
        if: ${{ !cancelled() }}
+
  e2e-tests-server-cli:
    name: End-to-End Tests (Server & CLI)
    needs: pre-job
@@ -431,52 +373,63 @@ jobs:
          persist-credentials: false
          submodules: 'recursive'
          token: ${{ steps.token.outputs.token }}
+
      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+
      - name: Setup Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
-          node-version-file: './e2e/.nvmrc'
+          node-version-file: '.nvmrc'
          cache: 'pnpm'
          cache-dependency-path: '**/pnpm-lock.yaml'
-      - name: Run setup typescript-sdk
+
+      - name: Setup typescript-sdk
        run: pnpm install --frozen-lockfile && pnpm build
        working-directory: ./open-api/typescript-sdk
-        if: ${{ !cancelled() }}
+
      - name: Run setup web
        run: pnpm install --frozen-lockfile && pnpm exec svelte-kit sync
        working-directory: ./web
        if: ${{ !cancelled() }}
+
      - name: Run setup cli
        run: pnpm install --frozen-lockfile && pnpm build
        working-directory: ./cli
        if: ${{ !cancelled() }}
+
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
        if: ${{ !cancelled() }}
+
      - name: Start Docker Compose
        run: docker compose up -d --build --renew-anon-volumes --force-recreate --remove-orphans --wait --wait-timeout 300
        if: ${{ !cancelled() }}
+
      - name: Run e2e tests (api & cli)
        env:
          VITEST_DISABLE_DOCKER_SETUP: true
        run: pnpm test
        if: ${{ !cancelled() }}
+
      - name: Run e2e tests (maintenance)
        env:
          VITEST_DISABLE_DOCKER_SETUP: true
        run: pnpm test:maintenance
        if: ${{ !cancelled() }}
+
      - name: Capture Docker logs
        if: always()
        run: docker compose logs --no-color > docker-compose-logs.txt
        working-directory: ./e2e
+
      - name: Archive Docker logs
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: e2e-server-docker-logs-${{ matrix.runner }}
          path: e2e/docker-compose-logs.txt
+
  e2e-tests-web:
    name: End-to-End Tests (Web)
    needs: pre-job
@@ -503,70 +456,85 @@ jobs:
          persist-credentials: false
          submodules: 'recursive'
          token: ${{ steps.token.outputs.token }}
+
      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+
      - name: Setup Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
-          node-version-file: './e2e/.nvmrc'
+          node-version-file: '.nvmrc'
          cache: 'pnpm'
          cache-dependency-path: '**/pnpm-lock.yaml'
+
      - name: Run setup typescript-sdk
        run: pnpm install --frozen-lockfile && pnpm build
        working-directory: ./open-api/typescript-sdk
+
        if: ${{ !cancelled() }}
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
        if: ${{ !cancelled() }}
+
      - name: Install Playwright Browsers
        run: pnpm exec playwright install chromium --only-shell
        if: ${{ !cancelled() }}
+
      - name: Docker build
        run: docker compose up -d --build --renew-anon-volumes --force-recreate --remove-orphans --wait --wait-timeout 300
        if: ${{ !cancelled() }}
+
      - name: Run e2e tests (web)
        env:
          PLAYWRIGHT_DISABLE_WEBSERVER: true
        run: pnpm test:web
        if: ${{ !cancelled() }}
+
      - name: Archive e2e test (web) results
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: success() || failure()
        with:
          name: e2e-web-test-results-${{ matrix.runner }}
          path: e2e/playwright-report/
+
      - name: Run ui tests (web)
        env:
          PLAYWRIGHT_DISABLE_WEBSERVER: true
        run: pnpm test:web:ui
        if: ${{ !cancelled() }}
+
      - name: Archive ui test (web) results
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: success() || failure()
        with:
          name: e2e-ui-test-results-${{ matrix.runner }}
          path: e2e/playwright-report/
+
      - name: Run maintenance tests
        env:
          PLAYWRIGHT_DISABLE_WEBSERVER: true
        run: pnpm test:web:maintenance
        if: ${{ !cancelled() }}
+
      - name: Archive maintenance tests (web) results
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: success() || failure()
        with:
          name: e2e-maintenance-isolated-test-results-${{ matrix.runner }}
          path: e2e/playwright-report/
+
      - name: Capture Docker logs
        if: always()
        run: docker compose logs --no-color > docker-compose-logs.txt
        working-directory: ./e2e
+
      - name: Archive Docker logs
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: e2e-web-docker-logs-${{ matrix.runner }}
          path: e2e/docker-compose-logs.txt
+
  success-check-e2e:
    name: End-to-End Tests Success
    needs: [e2e-tests-server-cli, e2e-tests-web]
@@ -613,9 +581,6 @@ jobs:
    runs-on: ubuntu-latest
    permissions:
      contents: read
-    env:
-      MISE_CEILING_PATHS: ${{ github.workspace }}
-      MISE_TRUSTED_CONFIG_PATHS: ${{ github.workspace }}/machine-learning/mise.toml
    defaults:
      run:
        working-directory: ./machine-learning
@@ -635,18 +600,10 @@ jobs:
        uses: immich-app/devtools/actions/use-mise@01a4d354b70f99a6baf4a1b72827f6d4922e4978 # use-mise-action-v2.0.0
        with:
          github_token: ${{ steps.token.outputs.token }}
-          working_directory: ./machine-learning

-      - name: Install dependencies
-        run: mise run install --extra cpu
-      - name: Lint code
-        run: mise run lint --output-format=github
-      - name: Format code
-        run: mise run format
-      - name: Run type checking
-        run: mise run check
-      - name: Run tests and coverage
-        run: mise run test
+      - name: Run ci-unit
+        run: mise run ci-unit
+
  github-files-formatting:
    name: .github Files Formatting
    needs: pre-job
@@ -669,19 +626,19 @@ jobs:
        with:
          persist-credentials: false
          token: ${{ steps.token.outputs.token }}
-      - name: Setup pnpm
-        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
-      - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+
+      - name: Setup Mise
+        uses: immich-app/devtools/actions/use-mise@01a4d354b70f99a6baf4a1b72827f6d4922e4978 # use-mise-action-v2.0.0
        with:
-          node-version-file: './.github/.nvmrc'
-          cache: 'pnpm'
-          cache-dependency-path: '**/pnpm-lock.yaml'
+          github_token: ${{ steps.token.outputs.token }}
+
      - name: Run pnpm install
        run: pnpm install --frozen-lockfile
+
      - name: Run formatter
        run: pnpm format
        if: ${{ !cancelled() }}
+
  shellcheck:
    name: ShellCheck
    runs-on: ubuntu-latest
@@ -720,21 +677,22 @@ jobs:
        with:
          persist-credentials: false
          token: ${{ steps.token.outputs.token }}
-      - name: Setup pnpm
-        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
-      - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+
+      - name: Setup Mise
+        uses: immich-app/devtools/actions/use-mise@01a4d354b70f99a6baf4a1b72827f6d4922e4978 # use-mise-action-v2.0.0
        with:
-          node-version-file: './server/.nvmrc'
-          cache: 'pnpm'
-          cache-dependency-path: '**/pnpm-lock.yaml'
+          github_token: ${{ steps.token.outputs.token }}
+
      - name: Install server dependencies
        run: SHARP_IGNORE_GLOBAL_LIBVIPS=true pnpm --filter immich install --frozen-lockfile
+
      - name: Build the app
        run: pnpm --filter immich build
+
      - name: Run API generation
        run: ./bin/generate-open-api.sh
        working-directory: open-api
+
      - name: Find file changes
        uses: tj-actions/verify-changed-files@a1c6acee9df209257a246f2cc6ae8cb6581c1edf # v20.0.4
        id: verify-changed-files
@@ -743,6 +701,7 @@ jobs:
            mobile/openapi
            open-api/typescript-sdk
            open-api/immich-openapi-specs.json
+
      - name: Verify files have not changed
        if: steps.verify-changed-files.outputs.files_changed == 'true'
        env:
@@ -751,6 +710,7 @@ jobs:
          echo "ERROR: Generated files not up to date!"
          echo "Changed files: ${CHANGED_FILES}"
          exit 1
+
  sql-schema-up-to-date:
    name: SQL Schema Checks
    runs-on: ubuntu-latest
@@ -782,31 +742,35 @@ jobs:
        with:
          persist-credentials: false
          token: ${{ steps.token.outputs.token }}
-      - name: Setup pnpm
-        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
-      - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+
+      - name: Setup Mise
+        uses: immich-app/devtools/actions/use-mise@01a4d354b70f99a6baf4a1b72827f6d4922e4978 # use-mise-action-v2.0.0
        with:
-          node-version-file: './server/.nvmrc'
-          cache: 'pnpm'
-          cache-dependency-path: '**/pnpm-lock.yaml'
+          github_token: ${{ steps.token.outputs.token }}
+
      - name: Install server dependencies
        run: SHARP_IGNORE_GLOBAL_LIBVIPS=true pnpm install --frozen-lockfile
+
      - name: Build the app
        run: pnpm build
+
      - name: Run existing migrations
        run: pnpm migrations:run
+
      - name: Test npm run schema:reset command works
        run: pnpm schema:reset
+
      - name: Generate new migrations
        continue-on-error: true
        run: pnpm migrations:generate src/TestMigration
+
      - name: Find file changes
        uses: tj-actions/verify-changed-files@a1c6acee9df209257a246f2cc6ae8cb6581c1edf # v20.0.4
        id: verify-changed-files
        with:
          files: |
            server/src
+
      - name: Verify migration files have not changed
        if: steps.verify-changed-files.outputs.files_changed == 'true'
        env:
@@ -816,16 +780,19 @@ jobs:
          echo "Changed files: ${CHANGED_FILES}"
          cat ./src/*-TestMigration.ts
          exit 1
+
      - name: Run SQL generation
        run: pnpm sync:sql
        env:
          DB_URL: postgres://postgres:postgres@localhost:5432/immich
+
      - name: Find file changes
        uses: tj-actions/verify-changed-files@a1c6acee9df209257a246f2cc6ae8cb6581c1edf # v20.0.4
        id: verify-changed-sql-files
        with:
          files: |
            server/src/queries
+
      - name: Verify SQL files have not changed
        if: steps.verify-changed-sql-files.outputs.files_changed == 'true'
        env:
@@ -1 +0,0 @@
-24.15.0
@@ -7,7 +7,7 @@ run = "vite build"

 [tasks.test]
 env._.path = "./node_modules/.bin"
-run = "vite"
+run = "vitest"

 [tasks.lint]
 env._.path = "./node_modules/.bin"
@@ -27,3 +27,26 @@ run = "prettier --write ."
 [tasks.check]
 env._.path = "./node_modules/.bin"
 run = "tsc --noEmit"
+
+[tasks.ci-publish]
+depends = ["//:sdk:install", "//:sdk:build"]
+run = [
+  { task = ":install" },
+  { task = ":build" },
+  "pnpm publish --provenance --no-git-checks",
+]
+
+[tasks.ci-unit]
+depends = ["//:sdk:install", "//:sdk:build"]
+run = [
+  { task = ":install" },
+  { task = ":format" },
+  { task = ":lint" },
+  { task = ":check" },
+  { task = ":test --run" },
+]
+
+[tasks.checklist]
+run = [
+ { task = ":ci-unit" },
+]
@@ -66,8 +66,5 @@
    "fastq": "^1.17.1",
    "lodash-es": "^4.17.21",
    "micromatch": "^4.0.8"
-  },
-  "volta": {
-    "node": "24.15.0"
  }
 }
@@ -1 +0,0 @@
-24.15.0
@@ -264,4 +264,4 @@ volumes:
  - ./configuration.yml:${IMMICH_CONFIG_FILE}
 ```

-::
+:::
@@ -56,8 +56,5 @@
  },
  "engines": {
    "node": ">=20"
-  },
-  "volta": {
-    "node": "24.15.0"
  }
 }
@@ -1 +0,0 @@
-24.15.0
@@ -27,3 +27,18 @@ run = { task = "lint --fix" }
 [tasks.check]
 env._.path = "./node_modules/.bin"
 run = "tsc --noEmit"
+
+
+[tasks.ci-setup]
+depends = ["//:sdk:install", "//:sdk:build", "//cli:install", "//cli:build"]
+run = { task = ":install" }
+
+
+[tasks.ci-unit]
+depends = ["//:sdk:install", "//:sdk:build"]
+run = [
+  { task = ":install" },
+  { task = ":format" },
+  { task = ":lint" },
+  { task = ":check" },
+]
@@ -56,8 +56,5 @@
    "utimes": "^5.2.1",
    "vite-tsconfig-paths": "^6.1.1",
    "vitest": "^4.0.0"
-  },
-  "volta": {
-    "node": "24.15.0"
  }
 }
@@ -17,6 +17,15 @@ run = "uv run ruff format immich_ml"
 [tasks.check]
 run = "uv run mypy --strict immich_ml/"

+[tasks.ci-unit]
+run = [
+  { task = ":install --extra cpu" },
+  { task = ":format" },
+  { task = ":lint --output-format=github" },
+  { task = ":check" },
+  { task = ":test" },
+]
+
 [tasks.checklist]
 run = [
  { task = ":install" },
@@ -25,4 +34,3 @@ run = [
  { task = ":check" },
  { task = ":test" },
 ]
-
@@ -64,8 +64,15 @@ android {
    }

    release {
-      signingConfig signingConfigs.release
+      def hasKeystore = file("../key.jks").exists() && file("../key.jks").length() > 0
+      signingConfig hasKeystore ? signingConfigs.release : signingConfigs.debug
      proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
+
+      def prNumber = System.getenv("PR_NUMBER")
+      if (prNumber) {
+        applicationIdSuffix ".pr${prNumber}"
+        versionNameSuffix "-pr${prNumber}"
+      }
    }
  }
  namespace 'app.alextran.immich'
@@ -56,6 +56,8 @@ class TimelineFactory {
  TimelineService localAlbum({required String albumId}) =>
      TimelineService(_timelineRepository.localAlbum(albumId, groupBy));

+  TimelineService allLocal() => TimelineService(_timelineRepository.allLocal(groupBy));
+
  TimelineService remoteAlbum({required String albumId}) =>
      TimelineService(_timelineRepository.remoteAlbum(albumId, groupBy));

@@ -118,6 +118,40 @@ class DriftTimelineRepository extends DriftDatabaseRepository {
    origin: TimelineOrigin.localAlbum,
  );

+  TimelineQuery allLocal(GroupAssetsBy groupBy) => (
+    bucketSource: () => _watchAllLocalBucket(groupBy: groupBy),
+    assetSource: (offset, count) => _getAllLocalAssets(offset: offset, count: count),
+    origin: TimelineOrigin.localAlbum,
+  );
+
+  Stream<List<Bucket>> _watchAllLocalBucket({GroupAssetsBy groupBy = GroupAssetsBy.day}) {
+    if (groupBy == GroupAssetsBy.none) {
+      return _db.localAssetEntity.count().map(_generateBuckets).watchSingle();
+    }
+
+    final assetCountExp = _db.localAssetEntity.id.count();
+    final dateExp = _db.localAssetEntity.createdAt.dateFmt(groupBy, toLocal: true);
+
+    final query = _db.localAssetEntity.selectOnly()
+      ..addColumns([assetCountExp, dateExp])
+      ..groupBy([dateExp])
+      ..orderBy([OrderingTerm.desc(dateExp)]);
+
+    return query.map((row) {
+      final timeline = row.read(dateExp)!.truncateDate(groupBy);
+      final assetCount = row.read(assetCountExp)!;
+      return TimeBucket(date: timeline, assetCount: assetCount);
+    }).watch();
+  }
+
+  Future<List<BaseAsset>> _getAllLocalAssets({required int offset, required int count}) {
+    final query = _db.localAssetEntity.select()
+      ..orderBy([(row) => OrderingTerm.desc(row.createdAt)])
+      ..limit(count, offset: offset);
+
+    return query.map((row) => row.toDto()).get();
+  }
+
  Stream<List<Bucket>> _watchLocalAlbumBucket(String albumId, {GroupAssetsBy groupBy = GroupAssetsBy.day}) {
    if (groupBy == GroupAssetsBy.none) {
      return _db.localAlbumAssetEntity
@@ -244,17 +278,21 @@ class DriftTimelineRepository extends DriftDatabaseRepository {

    final isAscending = albumData.order == AlbumAssetOrder.asc;

-    final query = _db.remoteAssetEntity.select().addColumns([_db.localAssetEntity.id]).join([
+    // Correlated subquery picks the first matching local asset by checksum,
+    // avoiding fan-out when the same photo exists in multiple device albums (#23273).
+    final localId = subqueryExpression<String>(
+      _db.localAssetEntity.selectOnly()
+        ..addColumns([_db.localAssetEntity.id])
+        ..where(_db.localAssetEntity.checksum.equalsExp(_db.remoteAssetEntity.checksum))
+        ..limit(1),
+    );
+
+    final query = _db.remoteAssetEntity.select().addColumns([localId]).join([
      innerJoin(
        _db.remoteAlbumAssetEntity,
        _db.remoteAlbumAssetEntity.assetId.equalsExp(_db.remoteAssetEntity.id),
        useColumns: false,
      ),
-      leftOuterJoin(
-        _db.localAssetEntity,
-        _db.remoteAssetEntity.checksum.equalsExp(_db.localAssetEntity.checksum),
-        useColumns: false,
-      ),
    ])..where(_db.remoteAssetEntity.deletedAt.isNull() & _db.remoteAlbumAssetEntity.albumId.equals(albumId));

    if (isAscending) {
@@ -265,9 +303,7 @@ class DriftTimelineRepository extends DriftDatabaseRepository {

    query.limit(count, offset: offset);

-    return query
-        .map((row) => row.readTable(_db.remoteAssetEntity).toDto(localId: row.read(_db.localAssetEntity.id)))
-        .get();
+    return query.map((row) => row.readTable(_db.remoteAssetEntity).toDto(localId: row.read(localId))).get();
  }

  TimelineQuery fromAssets(List<BaseAsset> assets, TimelineOrigin origin) => (
@@ -422,23 +458,22 @@ class DriftTimelineRepository extends DriftDatabaseRepository {
  }

  Stream<List<Bucket>> _watchPersonBucket(String userId, String personId, {GroupAssetsBy groupBy = GroupAssetsBy.day}) {
+    final idQuery = _db.assetFaceEntity.selectOnly()
+      ..addColumns([_db.assetFaceEntity.assetId])
+      ..where(
+        _db.assetFaceEntity.personId.equals(personId) &
+            _db.assetFaceEntity.isVisible.equals(true) &
+            _db.assetFaceEntity.deletedAt.isNull(),
+      );
+
    if (groupBy == GroupAssetsBy.none) {
      final query = _db.remoteAssetEntity.selectOnly()
        ..addColumns([_db.remoteAssetEntity.id.count()])
-        ..join([
-          innerJoin(
-            _db.assetFaceEntity,
-            _db.assetFaceEntity.assetId.equalsExp(_db.remoteAssetEntity.id),
-            useColumns: false,
-          ),
-        ])
        ..where(
-          _db.remoteAssetEntity.deletedAt.isNull() &
+          _db.remoteAssetEntity.id.isInQuery(idQuery) &
+              _db.remoteAssetEntity.deletedAt.isNull() &
              _db.remoteAssetEntity.ownerId.equals(userId) &
-              _db.remoteAssetEntity.visibility.equalsValue(AssetVisibility.timeline) &
-              _db.assetFaceEntity.personId.equals(personId) &
-              _db.assetFaceEntity.isVisible.equals(true) &
-              _db.assetFaceEntity.deletedAt.isNull(),
+              _db.remoteAssetEntity.visibility.equalsValue(AssetVisibility.timeline),
        );

      return query.map((row) {
@@ -452,20 +487,11 @@ class DriftTimelineRepository extends DriftDatabaseRepository {

    final query = _db.remoteAssetEntity.selectOnly()
      ..addColumns([assetCountExp, dateExp])
-      ..join([
-        innerJoin(
-          _db.assetFaceEntity,
-          _db.assetFaceEntity.assetId.equalsExp(_db.remoteAssetEntity.id),
-          useColumns: false,
-        ),
-      ])
      ..where(
-        _db.remoteAssetEntity.deletedAt.isNull() &
+        _db.remoteAssetEntity.id.isInQuery(idQuery) &
            _db.remoteAssetEntity.ownerId.equals(userId) &
            _db.remoteAssetEntity.visibility.equalsValue(AssetVisibility.timeline) &
-            _db.assetFaceEntity.personId.equals(personId) &
-            _db.assetFaceEntity.isVisible.equals(true) &
-            _db.assetFaceEntity.deletedAt.isNull(),
+            _db.remoteAssetEntity.deletedAt.isNull(),
      )
      ..groupBy([dateExp])
      ..orderBy([OrderingTerm.desc(dateExp)]);
@@ -483,26 +509,26 @@ class DriftTimelineRepository extends DriftDatabaseRepository {
    required int offset,
    required int count,
  }) {
-    final query =
-        _db.remoteAssetEntity.select().join([
-            innerJoin(
-              _db.assetFaceEntity,
-              _db.assetFaceEntity.assetId.equalsExp(_db.remoteAssetEntity.id),
-              useColumns: false,
-            ),
-          ])
-          ..where(
-            _db.remoteAssetEntity.deletedAt.isNull() &
-                _db.remoteAssetEntity.ownerId.equals(userId) &
-                _db.remoteAssetEntity.visibility.equalsValue(AssetVisibility.timeline) &
-                _db.assetFaceEntity.personId.equals(personId) &
-                _db.assetFaceEntity.isVisible.equals(true) &
-                _db.assetFaceEntity.deletedAt.isNull(),
-          )
-          ..orderBy([OrderingTerm.desc(_db.remoteAssetEntity.createdAt)])
-          ..limit(count, offset: offset);
+    final idQuery = _db.assetFaceEntity.selectOnly()
+      ..addColumns([_db.assetFaceEntity.assetId])
+      ..where(
+        _db.assetFaceEntity.personId.equals(personId) &
+            _db.assetFaceEntity.isVisible.equals(true) &
+            _db.assetFaceEntity.deletedAt.isNull(),
+      );

-    return query.map((row) => row.readTable(_db.remoteAssetEntity).toDto()).get();
+    final query = _db.remoteAssetEntity.select()
+      ..where(
+        (row) =>
+            row.id.isInQuery(idQuery) &
+            row.deletedAt.isNull() &
+            row.ownerId.equals(userId) &
+            row.visibility.equalsValue(AssetVisibility.timeline),
+      )
+      ..orderBy([(row) => OrderingTerm.desc(row.createdAt)])
+      ..limit(count, offset: offset);
+
+    return query.map((row) => row.toDto()).get();
  }

  TimelineQuery map(List<String> userIds, TimelineMapOptions options, GroupAssetsBy groupBy) => (
@@ -355,9 +355,9 @@ class SplashScreenPageState extends ConsumerState<SplashScreenPage> {
        ),
      );
    } else {
-      log.severe('Missing crucial offline login info - Logging out completely');
+      log.info('No stored credentials - showing local gallery in guest mode');
      unawaited(ref.read(authProvider.notifier).logout());
-      unawaited(context.replaceRoute(const LoginRoute()));
+      unawaited(context.replaceRoute(const GuestGalleryRoute()));
      return;
    }

@@ -0,0 +1,32 @@
+import 'package:auto_route/auto_route.dart';
+import 'package:flutter/material.dart';
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:immich_mobile/presentation/widgets/timeline/timeline.widget.dart';
+import 'package:immich_mobile/providers/infrastructure/timeline.provider.dart';
+import 'package:immich_mobile/routing/router.dart';
+
+@RoutePage()
+class GuestGalleryPage extends StatelessWidget {
+  const GuestGalleryPage({super.key});
+
+  @override
+  Widget build(BuildContext context) {
+    return ProviderScope(
+      overrides: [timelineServiceProvider.overrideWith((ref) => ref.watch(localOnlyTimelineServiceProvider))],
+      child: Timeline(
+        appBar: SliverAppBar(
+          title: const Text('On this device'),
+          floating: true,
+          actions: [
+            TextButton.icon(
+              onPressed: () => context.replaceRoute(const LoginRoute()),
+              icon: const Icon(Icons.login),
+              label: const Text('Sign in'),
+            ),
+          ],
+        ),
+        showStorageIndicator: false,
+      ),
+    );
+  }
+}
@@ -65,26 +65,37 @@ class ViewerBottomBar extends ConsumerWidget {
                  labelLarge: context.themeData.textTheme.labelLarge?.copyWith(color: Colors.white),
                ),
              ),
-              child: Container(
-                decoration: const BoxDecoration(
-                  gradient: LinearGradient(
-                    begin: Alignment.bottomCenter,
-                    end: Alignment.topCenter,
-                    colors: [Colors.black45, Colors.black12, Colors.transparent],
-                    stops: [0.0, 0.7, 1.0],
+              child: Stack(
+                children: [
+                  const Positioned.fill(
+                    child: IgnorePointer(
+                      child: DecoratedBox(
+                        decoration: BoxDecoration(
+                          gradient: LinearGradient(
+                            begin: Alignment.bottomCenter,
+                            end: Alignment.topCenter,
+                            colors: [Colors.black45, Colors.black12, Colors.transparent],
+                            stops: [0.0, 0.7, 1.0],
+                          ),
+                        ),
+                      ),
+                    ),
                  ),
-                ),
-                child: SafeArea(
-                  top: false,
-                  child: Column(
-                    mainAxisSize: MainAxisSize.min,
-                    children: [
-                      if (asset.isVideo) VideoControls(videoPlayerName: asset.heroTag),
-                      if (!isReadonlyModeEnabled)
-                        Row(mainAxisAlignment: MainAxisAlignment.spaceEvenly, children: actions),
-                    ],
+                  SafeArea(
+                    top: false,
+                    child: Padding(
+                      padding: const EdgeInsets.only(top: 16),
+                      child: Column(
+                        mainAxisSize: MainAxisSize.min,
+                        children: [
+                          if (asset.isVideo) VideoControls(videoPlayerName: asset.heroTag),
+                          if (!isReadonlyModeEnabled)
+                            Row(mainAxisAlignment: MainAxisAlignment.spaceEvenly, children: actions),
+                        ],
+                      ),
+                    ),
                  ),
-                ),
+                ],
              ),
            ),
    );
@@ -75,29 +75,41 @@ class ViewerTopAppBar extends ConsumerWidget implements PreferredSizeWidget {
      child: AnimatedOpacity(
        opacity: opacity,
        duration: Durations.short2,
-        child: DecoratedBox(
-          decoration: BoxDecoration(
-            gradient: showingDetails
-                ? null
-                : const LinearGradient(
-                    begin: Alignment.topCenter,
-                    end: Alignment.bottomCenter,
-                    colors: [Colors.black45, Colors.black12, Colors.transparent],
-                    stops: [0.0, 0.7, 1.0],
+        child: Stack(
+          children: [
+            Positioned.fill(
+              child: IgnorePointer(
+                child: DecoratedBox(
+                  decoration: BoxDecoration(
+                    gradient: showingDetails
+                        ? null
+                        : const LinearGradient(
+                            begin: Alignment.topCenter,
+                            end: Alignment.bottomCenter,
+                            colors: [Colors.black45, Colors.black12, Colors.transparent],
+                            stops: [0.0, 0.7, 1.0],
+                          ),
                  ),
-          ),
-          child: AppBar(
-            backgroundColor: Colors.transparent,
-            leading: const _AppBarBackButton(),
-            iconTheme: const IconThemeData(size: 22, color: Colors.white),
-            actionsIconTheme: const IconThemeData(size: 22, color: Colors.white),
-            shape: const Border(),
-            actions: showingDetails || isReadonlyModeEnabled
-                ? null
-                : isInLockedView
-                ? lockedViewActions
-                : actions,
-          ),
+                ),
+              ),
+            ),
+            SafeArea(
+              bottom: false,
+              child: SizedBox.square(
+                child: Theme(
+                  data: context.themeData.copyWith(iconTheme: const IconThemeData(size: 22, color: Colors.white)),
+                  child: Row(
+                    children: [
+                      const _AppBarBackButton(),
+                      const Spacer(),
+                      if (!showingDetails && !isReadonlyModeEnabled)
+                        if (isInLockedView) ...lockedViewActions else ...actions,
+                    ],
+                  ),
+                ),
+              ),
+            ),
+          ],
        ),
      ),
    );
@@ -113,20 +125,17 @@ class _AppBarBackButton extends ConsumerWidget {
  @override
  Widget build(BuildContext context, WidgetRef ref) {
    final showingDetails = ref.watch(assetViewerProvider.select((state) => state.showingDetails));
-    return Padding(
-      padding: const EdgeInsets.only(left: 12.0),
-      child: ElevatedButton(
-        style: ElevatedButton.styleFrom(
-          backgroundColor: showingDetails ? context.colorScheme.surface : Colors.transparent,
-          shape: const CircleBorder(),
-          iconSize: 22,
-          iconColor: showingDetails ? context.colorScheme.onSurface : Colors.white,
-          padding: EdgeInsets.zero,
-          elevation: showingDetails ? 4 : 0,
-        ),
-        onPressed: context.maybePop,
-        child: const Icon(Icons.arrow_back_rounded),
+    return ElevatedButton(
+      style: ElevatedButton.styleFrom(
+        backgroundColor: showingDetails ? context.colorScheme.surface : Colors.transparent,
+        shape: const CircleBorder(),
+        iconSize: 22,
+        iconColor: showingDetails ? context.colorScheme.onSurface : Colors.white,
+        padding: const EdgeInsets.all(10.0),
+        elevation: showingDetails ? 4 : 0,
      ),
+      onPressed: context.maybePop,
+      child: const Icon(Icons.arrow_back_rounded),
    );
  }
 }
@@ -26,6 +26,12 @@ final timelineServiceProvider = Provider<TimelineService>(
  dependencies: [],
 );

+final localOnlyTimelineServiceProvider = Provider<TimelineService>((ref) {
+  final timelineService = ref.watch(timelineFactoryProvider).allLocal();
+  ref.onDispose(timelineService.dispose);
+  return timelineService;
+});
+
 final timelineFactoryProvider = Provider<TimelineFactory>(
  (ref) => TimelineFactory(
    timelineRepository: ref.watch(timelineRepositoryProvider),
@@ -63,6 +63,7 @@ import 'package:immich_mobile/presentation/pages/drift_trash.page.dart';
 import 'package:immich_mobile/presentation/pages/drift_user_selection.page.dart';
 import 'package:immich_mobile/presentation/pages/drift_video.page.dart';
 import 'package:immich_mobile/presentation/pages/edit/drift_edit.page.dart';
+import 'package:immich_mobile/presentation/pages/guest_gallery.page.dart';
 import 'package:immich_mobile/presentation/pages/local_timeline.page.dart';
 import 'package:immich_mobile/presentation/pages/profile/profile_picture_crop.page.dart';
 import 'package:immich_mobile/presentation/pages/search/drift_search.page.dart';
@@ -114,6 +115,7 @@ class AppRouter extends RootStackRouter {
  @override
  late final List<AutoRoute> routes = [
    AutoRoute(page: SplashScreenRoute.page, initial: true),
+    AutoRoute(page: GuestGalleryRoute.page),
    AutoRoute(page: LoginRoute.page),
    AutoRoute(page: ChangePasswordRoute.page),
    AutoRoute(
@@ -1224,6 +1224,22 @@ class FolderRouteArgs {
  int get hashCode => key.hashCode ^ folder.hashCode;
 }

+/// generated route for
+/// [GuestGalleryPage]
+class GuestGalleryRoute extends PageRouteInfo<void> {
+  const GuestGalleryRoute({List<PageRouteInfo>? children})
+    : super(GuestGalleryRoute.name, initialChildren: children);
+
+  static const String name = 'GuestGalleryRoute';
+
+  static PageInfo page = PageInfo(
+    name,
+    builder: (data) {
+      return const GuestGalleryPage();
+    },
+  );
+}
+
 /// generated route for
 /// [HeaderSettingsPage]
 class HeaderSettingsRoute extends PageRouteInfo<void> {
@@ -119,13 +119,15 @@ class _VideoControlsState extends ConsumerState<VideoControls> {
                onPressed: () => _toggle(isCasting),
              ),
              const Spacer(),
-              Text(
-                "${position.format()} / ${duration.format()}",
-                style: const TextStyle(
-                  color: Colors.white,
-                  fontWeight: FontWeight.w500,
-                  fontFeatures: [FontFeature.tabularFigures()],
-                  shadows: VideoControls._controlShadows,
+              IgnorePointer(
+                child: Text(
+                  "${position.format()} / ${duration.format()}",
+                  style: const TextStyle(
+                    color: Colors.white,
+                    fontWeight: FontWeight.w500,
+                    fontFeatures: [FontFeature.tabularFigures()],
+                    shadows: VideoControls._controlShadows,
+                  ),
                ),
              ),
              const SizedBox(width: 12),
@@ -74,6 +74,7 @@ class _AlbumSyncActionButtonState extends ConsumerState<_AlbumSyncActionButton>
    } catch (_) {
    } finally {
      Future.delayed(const Duration(seconds: 1), () {
+        if (!mounted) return;
        setState(() {
          isAlbumSyncInProgress = false;
        });
@@ -0,0 +1,41 @@
+import 'package:flutter_test/flutter_test.dart';
+import 'package:immich_mobile/domain/models/asset/base_asset.model.dart';
+import 'package:immich_mobile/domain/models/timeline.model.dart';
+import 'package:immich_mobile/infrastructure/repositories/timeline.repository.dart';
+
+import '../repository_context.dart';
+
+void main() {
+  late MediumRepositoryContext ctx;
+  late DriftTimelineRepository sut;
+
+  setUp(() {
+    ctx = MediumRepositoryContext();
+    sut = DriftTimelineRepository(ctx.db);
+  });
+
+  tearDown(() async {
+    await ctx.dispose();
+  });
+
+  group('remoteAlbum assets', () {
+    test('no duplicate assets when identical checksum appears in multiple local asset rows', () async {
+      // Regression check for #23273: a LEFT OUTER JOIN on checksum would fan out and create duplicates
+      // happens when same photo exists in multiple albums on device
+      final user = await ctx.newUser();
+      final checksum = 'yolo';
+      final album = await ctx.newRemoteAlbum(ownerId: user.id);
+      final remoteAsset = await ctx.newRemoteAsset(ownerId: user.id, checksum: checksum);
+      await ctx.insertRemoteAlbumAsset(albumId: album.id, assetId: remoteAsset.id);
+
+      final localAsset1 = await ctx.newLocalAsset(checksum: checksum);
+      final localAsset2 = await ctx.newLocalAsset(checksum: checksum);
+
+      final assets = await sut.remoteAlbum(album.id, GroupAssetsBy.day).assetSource(0, 10);
+
+      expect(assets, hasLength(1));
+      expect((assets.first as RemoteAsset).id, remoteAsset.id);
+      expect([localAsset1.id, localAsset2.id], contains((assets.first as RemoteAsset).localId));
+    });
+  });
+}
@@ -1 +0,0 @@
-24.15.0
@@ -2,6 +2,11 @@
  "name": "@immich/sdk",
  "version": "2.7.5",
  "description": "Auto-generated TypeScript SDK for the Immich API",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/immich-app/immich.git",
+    "directory": "open-api/typescript-sdk"
+  },
  "type": "module",
  "main": "./build/index.js",
  "types": "./build/index.d.ts",
@@ -21,13 +26,5 @@
  "devDependencies": {
    "@types/node": "^24.12.2",
    "typescript": "^6.0.0"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/immich-app/immich.git",
-    "directory": "open-api/typescript-sdk"
-  },
-  "volta": {
-    "node": "24.15.0"
  }
 }
@@ -1 +0,0 @@
-24.15.0
@@ -55,12 +55,23 @@ run = [
 env._.path = "./node_modules/.bin"
 run = "email dev -p 3050 --dir src/emails"

-[tasks.checklist]
+[tasks.ci-unit]
 run = [
  { task = ":install" },
  { task = ":format" },
  { task = ":lint" },
  { task = ":check" },
-  { task = ":test-medium --run" },
  { task = ":test --run" },
 ]
+
+[tasks.ci-medium]
+run = [
+  { task = ":install" },
+  { task = ":test-medium --run" },
+]
+
+[tasks.checklist]
+run = [
+  { task = ":ci-unit" },
+  { task = ":ci-medium" },
+]
@@ -167,9 +167,6 @@
    "vite-tsconfig-paths": "^6.0.0",
    "vitest": "^3.0.0"
  },
-  "volta": {
-    "node": "24.15.0"
-  },
  "overrides": {
    "sharp": "^0.34.5"
  }
@@ -1 +0,0 @@
-24.15.0
@@ -42,11 +42,17 @@ run = "pnpm run check:svelte"
 [tasks.check]
 run = { tasks = [":check-typescript", ":check-svelte"] }

-[tasks.checklist]
+[tasks.ci-unit]
+depends = ["//:sdk:install", "//:sdk:build"]
 run = [
  { task = ":install" },
  { task = ":format" },
  { task = ":check" },
  { task = ":test --run" },
+]
+
+[tasks.checklist]
+run = [
+  { task = ":ci-unit" },
  { task = ":lint" },
 ]
@@ -14,7 +14,7 @@
    "check:watch": "pnpm run check:svelte --watch",
    "check:code": "pnpm run format && pnpm run lint && pnpm run check:svelte && pnpm run check:typescript",
    "check:all": "pnpm run check:code && pnpm run test:cov",
-    "lint": "eslint . --max-warnings 0 --concurrency 4",
+    "lint": "eslint . --max-warnings 0 --concurrency 6",
    "lint:fix": "pnpm run lint --fix",
    "format": "prettier --cache --check .",
    "format:fix": "prettier --cache --write --list-different .",
@@ -111,8 +111,5 @@
    "typescript-eslint": "^8.45.0",
    "vite": "^8.0.0",
    "vitest": "^4.0.0"
-  },
-  "volta": {
-    "node": "24.15.0"
  }
 }
Author	SHA1	Message	Date
Alex	34777a811b	Merge branch 'main' into plan-local-image-display	2026-05-09 07:49:21 -05:00
Alex	8b3c9bf9c3	feat(ci): publish PR Android APK to comment (#28283 ) * feat(ci): publish PR Android APK to R2 with installable links Adds a universal debug APK to PR builds and uploads it to a public R2 bucket alongside the existing GitHub Actions artifact. Posts a sticky PR comment with tap-to-install links and a QR code so testers can install directly on their device without unzipping artifacts. Required setup: - Secrets: R2_APK_ACCESS_KEY_ID, R2_APK_SECRET_ACCESS_KEY, R2_APK_ACCOUNT_ID, R2_APK_BUCKET - Optional repo variable: APK_PUBLIC_HOST (defaults to apk.immich.app) - R2 bucket configured with a public custom domain matching APK_PUBLIC_HOST * chore(ci): drop R2 upload, link directly to GitHub artifact Surfaces the existing release-apk-signed artifact in a sticky PR comment with a QR code. Avoids new infra and secrets — the trade-off is GitHub login and a zip wrapper instead of tap-to-install. * feat(ci): build PR APK as release and publish to GitHub Release PR builds now produce a release APK signed with the release keystore. The universal APK is published as a GitHub Release asset under tag 'pr-<num>' (prerelease), giving testers a direct, unzipped, tap-to- install URL plus a QR code in the PR comment. The release-apk-signed artifact is unchanged. * chore(ci): drop GitHub Release, publish universal APK as own artifact Reverts the prerelease publish. Uploads the universal release APK as a separate single-file artifact so its download URL gives a zip containing only that APK — no extra files to dig through. The QR in the PR comment points at this universal-only artifact. * chore(ci): build only universal APK for PR, drop split artifact PR builds skip the arm64-only split — release-apk-signed now contains just the universal app-release.apk, so the download zip is a single file. Removes the redundant separate universal artifact and points the PR comment QR at the main artifact URL. * feat(mobile): suffix PR APK applicationId so it installs alongside production Each PR build now becomes app.alextran.immich.pr<num> via PR_NUMBER env read in build.gradle, so testers can install multiple PR builds and the Play Store version on the same device without uninstalling. Also tags the version with -pr<num> for visibility. * feat(ci): allow PR APK build to run on forks Forks can now run the Android build job. Steps that need repo secrets (create-workflow-token, Create Keystore) are skipped when the PR is from a fork, the checkout falls back to GITHUB_TOKEN, and build.gradle falls back to debug signing if the release keystore isn't materialised. The PR comment still requires write access, so it's gated to non-fork PRs — fork APKs are reachable from the workflow run's artifact tab.	2026-05-09 07:46:40 -05:00
Yaros	41f285aa3e	feat(mobile): increased tap area on video player overlay (#27269 ) * fix(mobile): improved tap area on video player * fix: back button padding * chore: use sizedbox.square & button padding * chore: fixed padding	2026-05-09 10:47:41 +07:00
Sandro	fdac6c8bc4	fix(docs): missing colon in config file doc (#28313 ) Fix missing colon	2026-05-09 09:44:41 +07:00
Thorsten Winkler	d7f05d2510	fix(mobile): Deduplicate assets in person view timeline (#26723 ) fix(mobile): deduplicate assets in person view timeline Previously, assets with multiple face records for the same person (e.g., manual Digikam imports and Immich ML detections) appeared multiple times in the person timeline. This was caused by an inner join on the assetFaceEntity without proper deduplication. This commit refactors the timeline queries to use a subquery approach instead of joins and grouping. This ensures: - _getPersonBucketAssets: Only unique assets are fetched, even if multiple face records exist for a single asset. - _watchPersonBucket: Asset counts in timeline headers are accurate and represent unique assets. - Performance: Database overhead is reduced by avoiding complex joins and explicit groupBy operations on large result sets. Signed-off-by: thowdev <12428285+thowdev@users.noreply.github.com>	2026-05-09 01:53:18 +00:00
stfn	3100bd5eed	fix(mobile): avoid duplicate assets in album view (#28152 ) fix(mobile): avoid duplicate assets in remote album timeline Co-authored-by: Stefan Friedli <stefan@stefanfriedli.ch>	2026-05-09 08:24:54 +07:00
Jason Rasmussen	8a024e2b50	chore: faster web linting (#28303 )	2026-05-08 16:55:14 -04:00
Jason Rasmussen	25a6a38b30	chore: use mise (#28298 )	2026-05-08 15:21:33 -04:00
Santo Shakil	7c6750941e	fix(mobile): mounted check before setState in album sync action (#28300 ) _manualSyncAlbums fires a setState 1s after sync via Future.delayed with no mounted check. if the widget is gone by then, setState throws null check and the global error logger logs it severe.	2026-05-08 18:55:03 +00:00
alextran1502	13446022d9	feat(mobile): show local gallery in guest mode before login	2026-05-07 15:21:20 +00:00