Address stable release review findings; retire extern-contrib

[boomzero]

What does this PR aim to accomplish?:

Address the valid automated review findings on the stable release PR #1052 (cubic, Codex, GitHub code quality), so they land in dev before dev is merged into master. This PR does not touch XMOJ.user.js, so it does not trigger a version bump.

It also makes the release version PR (actions/temp → dev, e.g. #1054) auto-merge without a maintainer approving its workflow runs, and retires extern-contrib: fork PRs now target dev directly.

How does this PR accomplish the above?:

Fixed:

• Mobile navbar hides section headings (site.js): on phones, the expanded menu is part of the sticky navbar, so tapping 功能/安装/常见问题 scrolled the heading underneath the open menu. Section links now close the menu first and scroll once it has collapsed. Checked headless at 390×800: before, the menu stayed open (bottom 353px) with the heading at 80px, hidden; after, the menu closes and each heading sits at 80px below the 65px bar.
• Privacy notice (privacy.html): script settings live in xmoj.tech's localStorage (UtilityEnabled), not in the userscript manager, and can be cloud-synced. The section heading no longer claims everything stays on-device, and it notes that the messages.html session is sent with API requests.
• Child protection (child-protection.html): no longer says administrators cannot see messages. It now matches the privacy notice: messages are encrypted in the database, but this is not end-to-end encryption.
• Language test (tests/chinese-language.test.cjs): the "classic English page" case passed english: true, which only stubbed querySelector. English is detected from the XMOJ_LANG=en cookie, so the test now sets that cookie, and the unused option is removed.
• Profile fixture (tests/fixtures/profile.html, tests/profile-page.test.cjs): the native history script counted runs only when jQuery was present, and the test never loads jQuery, so re-execution could never be detected. It now counts every evaluation, and the test asserts the count is exactly 1, meaning only the page's own load ran it.
• 3.8.8 notes (Update.json): the update dialog inserts Notes with innerHTML, so the Markdown bullets showed up as literal hyphens. They are now an HTML list.

Not changed:

• "3.8.8 is marked prerelease" (cubic, Codex): UpdateToRelease already added a stable 3.9.0 entry (Update to release 3.9.0 #1054), and site.js / the update check pick it up.
• 404 page relative paths and #Install anchors (Codex): 404.html inserts <base href="/"> (/XMOJ-Script/ on github.io) before any resource. Every later relative URL, including fragment-only #Install, resolves against the site root, so these already load the root stylesheet and go to the homepage sections.
• document.write in the profile fixture (code quality): the fixture copies the native xmoj.tech profile markup on purpose. It is test-only and never shipped.

Release workflow (.github/workflows/UpdateToRelease.yml):

• UpdateToRelease created the version PR with GITHUB_TOKEN, so its workflow runs waited for manual approval and gh pr merge --auto never finished by itself. It now gets a GitHub App token (APP_ID / APP_PRIVATE_KEY, as UpdateVersion, Prerelease, Release and Daily already do) and uses it for checkout, gh pr create and gh pr merge.
• No loop: UpdateVersion skips actors ending in [bot], which includes the app, and UpdateToRelease only runs on PRs to master.

Second review round (f117fe9):

• Navbar handler: / and /index.html count as the same page; Cmd/Ctrl/Shift/Alt and non-primary clicks pass through; clicks during the close animation are still intercepted, so the last tapped link wins.
• 「就」 and 「用户名和会话 ID」 wording fixes.
• UpdateToRelease skips fork PRs (they can't mint the app token), and the app token is scoped to contents / pull-requests.

Retiring extern-contrib (eab4141, 5685b2a):

• Removes sync-to-extern-contrib.yml and merge.yml. The latter never ran: it triggered on pushes to dev, but its job required the extern-contrib ref.
• UpdateVersion passes the PR title through env instead of pasting ${{ github.event.pull_request.title }} into the shell.
• Prerelease skips a version that already has a release. Without this, merging a PR that doesn't bump the version (e.g. from a fork) would re-publish onto the existing tag and overwrite that release's XMOJ.user.js.
• Removes the retired Qodana workflow (main.yml, already disabled on GitHub).
• README, CONTRIBUTING, the homepage and CLAUDE.md now send external contributors to dev. Docs site: Send external contributors to dev; extern-contrib is retired docs#11.
• Repository side, already done: the fork PR approval policy is now first_time_contributors, sync: dev to extern-contrib #1053 is closed, and the extern-contrib branch is deleted (it was at d8aa02f, with no content that isn't on dev).
• Per convention, the workflow commits were cherry-picked to master (1d9bc7c).

Fork version bumps (581153a):

• New UpdateVersionFork workflow. It runs on pushes to dev that touch XMOJ.user.js, which is a trusted event, so no fork event ever gets secrets and no fork code is checked out. It finds the PR whose merge_commit_sha is the pushed commit. If that PR came from a fork (including a deleted one), it runs UpdateVersion.js in the new fork-merged mode: bump on actions/version-<PR> from dev, then open an auto-merging PR as the app. Prerelease skips the fork merge itself (version unchanged) and publishes when the bump PR merges.
• Lookup checked against real merges: it returns 修复部分题目状态页没有运行编号 #155 for a fork merge whose fork was deleted, and nothing for the same-repo Fix #1004 #1006. A dry run with a stubbed gh and a local remote produced matching 3.9.1 versions, pushed actions/version-4242, and opened the auto-merge PR; a title containing "…" $(…) and backticks was stored as plain text, never executed.
• Review follow-up (461e194): each run now processes every merged fork PR to dev since 2026-10-06 that has no Update.json entry, oldest first, each from the latest dev. It waits for each version PR to merge before the next and reuses an open version PR on a rerun. workflow_dispatch is available for manual reruns. Prerelease now skips only when the version is already a stable release. Dry run with two fork PRs and simulated merges: consecutive versions, and a second pass skipped both.
• Labels for fork PRs aren't covered: labeling needs write access during the PR, which fork events don't get without pull_request_target.

npm test: 99/99 pass locally. The UpdateToRelease change can only be verified on the next dev → master release PR.

---

By submitting this pull request, I confirm the following:

1. I have read and understood the contributor's guide, as well as this entire template. I understand which branch to base my commits and Pull Requests against.
2. I have commented on my proposed changes within the code.
3. I have tested my changes.
4. I am willing to help maintain this change if there are issues with it later.
5. It is compatible with the GNU General Public License v3.0
6. I have squashed any insignificant commits. (git rebase)
7. I have checked that another pull request for this purpose does not exist.
8. I have considered and confirmed that this submission will be valuable to others.
9. I accept that this submission may not be used, and the pull request can be closed at the will of the maintainer.
10. I give this submission freely and claim no ownership to its content.
11. I have verified that my changes work correctly in both the new UI and the old/classic UI.

---

• I have read the above and my PR is ready for review. Check this box to confirm

🤖 Generated with Claude Code

https://claude.ai/code/session_01E5dr7XTsCeoamqLSiT9rLp

Summary by Sourcery

Address stable-release review findings and streamline contribution and version-release automation around the dev branch.

New Features:

• Add automated post-merge version bumping for merged fork pull requests while preserving sequential releases.

Bug Fixes:

• Correct mobile section navigation, privacy and child-protection messaging, release notes formatting, and language/profile regression tests.

Enhancements:

• Retire the extern-contrib workflow and direct fork contributions to dev.
• Prevent prerelease publication from overwriting an existing stable release.
• Improve release automation by using scoped GitHub App tokens and safer pull-request metadata handling.

CI:

• Remove obsolete synchronization, merge, and Qodana workflows and add fork version-update automation.

Documentation:

• Update contributor guidance and privacy-related user-facing documentation.

Tests:

• Fix language and profile regression coverage to reflect actual browser behavior.

[sourcery-ai]

Sorry @boomzero, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 4 days and 12 hours by commenting @sourcery-ai review. Upgrade to get a review now.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-06T02:02:44.404842Z	da5b1c7	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[sourcery-ai]

Reviewer's Guide

Addresses selected automated review findings from the stable release PR by fixing mobile navbar scrolling, correcting privacy and encryption disclosures, making language/profile regression tests reflect real behavior, and formatting release notes for the update dialog; unrelated findings were intentionally left unchanged.

Sequence diagram for mobile navbar section navigation

sequenceDiagram
    participant User
    participant SiteNav
    participant Bootstrap
    participant Browser
    User->>SiteNav: click section link
    SiteNav->>Bootstrap: Collapse.getOrCreateInstance(siteNav).hide()
    Bootstrap-->>SiteNav: hidden.bs.collapse
    SiteNav->>Browser: history.pushState(null, "", link.hash)
    SiteNav->>Browser: target.scrollIntoView()

Loading

File-Level Changes

Change	Details	Files
Corrected privacy and child-safety documentation to accurately describe storage, synchronization, server-side message handling, and encryption limitations.	Updated privacy wording for localStorage, optional cloud sync, and session data sent with message requests. Clarified that messages are database-encrypted but not end-to-end encrypted and can be decrypted server-side.	privacy.html child-protection.html
Fixed mobile in-page navigation so expanded navbar state does not obscure section headings.	Intercepted same-page section links while the mobile collapse is open. Collapsed the navbar before updating the URL and scrolling to the target section.	site.js
Aligned regression tests and fixtures with actual language detection and profile-script execution behavior.	Switched the classic-English test to use the XMOJ_LANG cookie instead of an unused query-selector stub. Counted native profile history script evaluations independently of jQuery and asserted exactly one execution.	tests/chinese-language.test.cjs tests/fixtures/profile.html tests/profile-page.test.cjs
Fixed stable release update notes to render as HTML rather than literal Markdown syntax.	Converted the 3.8.8 notes bullets to an HTML list for innerHTML-based rendering.	Update.json

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[cloudflare-workers-and-pages]

Deploying xmoj-script-dev-channel with    Cloudflare Pages

Latest commit:	0f68da7
Status:	✅  Deploy successful!
Preview URL:	https://98d258d0.xmoj-script-dev-channel.pages.dev
Branch Preview URL:	https://fix-release-review.xmoj-script-dev-channel.pages.dev

View logs

[cubic-dev-ai]

Review completed against the latest diff

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 8 files

<sub>Requires human review: Auto-approval blocked because this review re-detected 1 unresolved issue already reported by Cubic.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 9 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 3 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>