fix: keep presence avatars visible across note view modes

.github/workflows/bake-windows-image.yml

@@ -61,12 +61,12 @@ jobs:
           test -f "$HOME/relay-harness/infra/windows-setup.ps1"
 
       - name: Auth to GCP
-        uses: google-github-actions/auth@v2
+        uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2.1.13
         with:
           credentials_json: ${{ secrets.GCP_SA_KEY_TACTILE }}
 
       - name: Setup gcloud
-        uses: google-github-actions/setup-gcloud@v2
+        uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f # v2.2.1
 
       - name: Generate build SSH key and startup script
         shell: bash

.github/workflows/e2e-burnin.yml

@@ -112,12 +112,12 @@ jobs:
         plan: ${{ fromJSON(needs.prepare.outputs.matrix) }}
     steps:
       - name: Auth to GCP
-        uses: google-github-actions/auth@v2
+        uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2.1.13
         with:
           credentials_json: ${{ secrets.GCP_SA_KEY_TACTILE }}
 
       - name: Setup gcloud
-        uses: google-github-actions/setup-gcloud@v2
+        uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f # v2.2.1
 
       - name: Lease a user pool by creating its VM
         id: lease
@@ -481,7 +481,7 @@ jobs:
 
       - name: Upload shard metadata
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: testplans-burnin-${{ matrix.plan }}-metadata
           path: |
@@ -491,7 +491,7 @@ jobs:
 
       - name: Generate job summary
         if: always()
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         env:
           PLAN_NAME: ${{ matrix.plan }}
         with:
@@ -628,7 +628,7 @@ jobs:
             || { echo "No existing ledger; starting fresh"; : > ledger.jsonl; }
 
       - name: Append tonight's verdicts and compute flake rates
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         env:
           PRODUCT_SHA: ${{ needs.prepare.outputs.product_sha }}
           SOAK_REF: ${{ needs.prepare.outputs.ref }}

.github/workflows/e2e-multinode.yml

@@ -145,12 +145,12 @@ jobs:
           esac
 
       - name: Auth to GCP
-        uses: google-github-actions/auth@v2
+        uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2.1.13
         with:
           credentials_json: ${{ secrets.GCP_SA_KEY_TACTILE }}
 
       - name: Setup gcloud
-        uses: google-github-actions/setup-gcloud@v2
+        uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f # v2.2.1
 
       - name: Lease a user pool by creating its VM
         if: github.event.inputs.slots == 'linux,linux'
@@ -505,7 +505,7 @@ jobs:
 
       - name: Upload shard metadata
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: testplans-mn-metadata
           path: |
@@ -516,7 +516,7 @@ jobs:
 
       - name: Generate job summary
         if: always()
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const fs = require('fs');

.github/workflows/e2e-parallel-lane.yml

@@ -131,12 +131,12 @@ jobs:
           echo "Uploaded s3://${CI_R2_BUCKET}/${MANIFEST_KEY}"
 
       - name: Auth to GCP
-        uses: google-github-actions/auth@v2
+        uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2.1.13
         with:
           credentials_json: ${{ secrets.GCP_SA_KEY_TACTILE }}
 
       - name: Setup gcloud
-        uses: google-github-actions/setup-gcloud@v2
+        uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f # v2.2.1
 
       - name: Lease a user pool by creating its VM
         id: lease
@@ -487,7 +487,7 @@ jobs:
 
       - name: Upload lane metadata
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: testplans-lane-metadata
           path: |
@@ -541,7 +541,7 @@ jobs:
 
       - name: Generate job summary
         if: always()
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const fs = require('fs');

.github/workflows/e2e-test-plans.yml

@@ -43,7 +43,7 @@ jobs:
         shard:
           - name: scripted-all
             slug: all
-            tests: tp000,tp001,tp002,tp003,tp004,tp006,tp007,tp008,tp010,tp011,tp012,tp013,tp014,tp015,tp016,tp017,tp018,tp019,tp020,tp021,tp022,tp023,tp024,tp025,tp028,tp029,tp030,tp031,tp032,tp033,tp034
+            tests: default
     env:
       VM_NAME: ${{ format('{0}-tp-{1}', secrets.GCP_VM_NAME, matrix.shard.slug) }}
       SHARD_NAME: ${{ matrix.shard.name }}
@@ -54,47 +54,25 @@ jobs:
 
     steps:
       - name: Auth to GCP
-        uses: google-github-actions/auth@v2
+        uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2.1.13
         with:
           credentials_json: ${{ secrets.GCP_SA_KEY }}
 
       - name: Setup gcloud
-        uses: google-github-actions/setup-gcloud@v2
+        uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f # v2.2.1
 
       - name: Select tests for shard
         id: select-tests
         run: |
           TARGETED_TESTS="${{ github.event.inputs.tests || '' }}"
           SHARD_TESTS="${{ matrix.shard.tests }}"
 
-          select_tests() {
-            local available="$1"
-            local wanted="$2"
-            local filtered=""
-            local test match
-
-            IFS=',' read -r -a available_tests <<< "$available"
-            IFS=',' read -r -a wanted_tests <<< "$wanted"
-
-            for test in "${available_tests[@]}"; do
-              test="${test//[[:space:]]/}"
-              [ -n "$test" ] || continue
-              for match in "${wanted_tests[@]}"; do
-                match="${match//[[:space:]]/}"
-                [ -n "$match" ] || continue
-                if [ "$test" = "$match" ]; then
-                  filtered="${filtered:+$filtered,}$test"
-                  break
-                fi
-              done
-            done
-
-            printf '%s' "$filtered"
-          }
-
+          # The suite runner resolves ids against the harness manifest and
+          # fails loudly on unknown ids, so targeted dispatches pass through;
+          # a roster intersection here would silently skip unknown ids.
           SELECTED_TESTS="$SHARD_TESTS"
           if [ -n "$TARGETED_TESTS" ]; then
-            SELECTED_TESTS="$(select_tests "$SHARD_TESTS" "$TARGETED_TESTS")"
+            SELECTED_TESTS="$TARGETED_TESTS"
           fi
 
           if [ -n "$SELECTED_TESTS" ]; then
@@ -476,7 +454,7 @@ jobs:
 
       - name: Upload shard metadata
         if: always() && steps.select-tests.outputs.should_run == 'true'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: testplans-${{ matrix.shard.slug }}-metadata
           path: |
@@ -503,7 +481,7 @@ jobs:
 
       - name: Generate job summary
         if: always()
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const fs = require('fs');

.github/workflows/pre-release.yml

@@ -10,7 +10,7 @@ jobs:
     outputs:
       should_release: ${{ steps.check.outputs.should_release }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
     - name: Check if tag does not match manifest version
       id: check
       run: |
@@ -31,9 +31,9 @@ jobs:
       id-token: write
       attestations: write
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
     - name: Use Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:
         node-version: '20.x'
     - run: npm ci
@@ -46,13 +46,13 @@ jobs:
         mv "$tmp" manifest.json
         jq -e --arg version "$TAG" '.version == $version' manifest.json
     - name: Generate artifact attestations
-      uses: actions/attest@v4
+      uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
       with:
         subject-path: |
           main.js
           styles.css
           manifest.json
-    - uses: ncipollo/release-action@v1
+    - uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
       with:
         artifacts: "main.js,styles.css,manifest.json"
         immutableCreate: true

.github/workflows/release.yaml

@@ -10,7 +10,7 @@ jobs:
     outputs:
       should_release: ${{ steps.check.outputs.should_release }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
     - name: Check if tag matches manifest version
       id: check
       run: |
@@ -31,21 +31,21 @@ jobs:
       id-token: write
       attestations: write
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
     - name: Use Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:
         node-version: '20.x'
     - run: npm ci
     - run: npm run release
     - name: Generate artifact attestations
-      uses: actions/attest@v4
+      uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
       with:
         subject-path: |
           main.js
           styles.css
           manifest.json
-    - uses: ncipollo/release-action@v1
+    - uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
       with:
         artifacts: "main.js,styles.css,manifest.json"
         draft: true

.github/workflows/unit-tests.yaml

@@ -33,12 +33,12 @@ jobs:
 
     steps:
       - name: Auth to GCP
-        uses: google-github-actions/auth@v2
+        uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2.1.13
         with:
           credentials_json: ${{ secrets.GCP_SA_KEY }}
 
       - name: Setup gcloud
-        uses: google-github-actions/setup-gcloud@v2
+        uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f # v2.2.1
 
       - name: Clone relay-harness
         run: |
@@ -513,7 +513,7 @@ jobs:
 
       - name: Generate job summary
         if: always()
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const fs = require('fs');