Merge ulmo.3 into release-ulmo

.github/CODEOWNERS

@@ -21,7 +21,11 @@ openedx/core/djangoapps/user_api/                                   @openedx/com
 openedx/core/djangoapps/user_authn/                                 @openedx/committers-edx-platform-2u-infinity
 openedx/core/djangoapps/verified_track_content/                     @openedx/committers-edx-platform-2u-infinity
 openedx/features/course_experience/
-xmodule/
+# The Aximprovements team is working on extracting all built-in XBlocks
+# to the external repository (xblocks-contrib). They need to be notified
+# about any changes within xmodule to stay aligned with this effort.
+# Ticket: https://github.com/openedx/edx-platform/issues/34827
+xmodule/                                                            @farhan @irtazaakram @salman2013
 
 # Core Extensions
 lms/djangoapps/discussion/

.github/workflows/check-consistent-dependencies.yml

@@ -19,26 +19,31 @@ jobs:
     runs-on: ubuntu-24.04
 
     steps:
+      # Always checkout the code because we don't always have a PR url.
+      - uses: actions/checkout@v5
+
       # Only run remaining steps if there are changes to requirements/**
+      # We do this instead of using path based short-circuiting.
+      # see https://stackoverflow.com/questions/77996177/how-can-i-handle-a-required-check-that-isnt-always-triggered
+      # for some more details.
       - name: "Decide whether to short-circuit"
-        env:
-          GH_TOKEN: "${{ github.token }}"
-          PR_URL: "${{ github.event.pull_request.html_url }}"
         run: |
-          paths=$(gh pr diff "$PR_URL" --name-only)
-          echo $'Paths touched in PR:\n'"$paths"
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            BASE_SHA="${{ github.event.pull_request.base.sha }}"
+          else
+            BASE_SHA="${{ github.event.merge_group.base_sha }}"
+          fi
+
+          # Fetch the base sha so we can compare to it. It's not checked out by
+          # default.
+          git fetch origin "$BASE_SHA"
 
           # The ^"? is because git may quote weird file paths
-          matched="$(echo "$paths" | grep -P '^"?((requirements/)|(scripts/.*?/requirements/))' || true)"
-          echo $'Relevant paths:\n'"$matched"
-          if [[ -n "$matched" ]]; then
-              echo "RELEVANT=true" >> "$GITHUB_ENV"
+          if git diff --name-only "$BASE_SHA" | grep -P '^"?((requirements/)|(scripts/.*?/requirements/))'; then
+            echo "RELEVANT=true" >> "$GITHUB_ENV"
           fi
 
-      - uses: actions/checkout@v5
-        if: ${{ env.RELEVANT == 'true' }}
-
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         if: ${{ env.RELEVANT == 'true' }}
         with:
           python-version: '3.11'

.github/workflows/check-for-tutorial-prs.yml

@@ -26,7 +26,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Comment PR
-        uses: thollander/actions-comment-pull-request@v2
+        uses: thollander/actions-comment-pull-request@v3
         with:
           message: |
             Thank you for your pull request! Congratulations on completing the Open edX tutorial! A team member will be by to take a look shortly.

.github/workflows/check_python_dependencies.yml

@@ -17,7 +17,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
 

.github/workflows/ci-static-analysis.yml

@@ -17,7 +17,7 @@ jobs:
     steps:
       - uses: actions/checkout@v5
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
 

.github/workflows/compile-python-requirements.yml

@@ -24,7 +24,7 @@ jobs:
           ref: "${{ inputs.branch }}"
 
       - name: Set up Python environment
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.11"
 

.github/workflows/js-tests.yml

@@ -24,7 +24,7 @@ jobs:
         run: git fetch --depth=1 origin master
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'
@@ -44,7 +44,7 @@ jobs:
         run: sudo apt-get update && sudo apt-get install libxmlsec1-dev ubuntu-restricted-extras xvfb
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
 

.github/workflows/lint-imports.yml

@@ -17,7 +17,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.11"
 

.github/workflows/migrations-check.yml

@@ -74,7 +74,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Setup Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
 

.github/workflows/pylint-checks.yml

@@ -38,7 +38,7 @@ jobs:
         run: sudo apt-get update && sudo apt-get install libxmlsec1-dev
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: 3.11
 

.github/workflows/quality-checks.yml

@@ -30,12 +30,12 @@ jobs:
         run: sudo apt-get update && sudo apt-get install libxmlsec1-dev
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: ${{ matrix.node-version }}
 

.github/workflows/semgrep.yml

@@ -27,7 +27,7 @@ jobs:
         with:
           fetch-depth: 1
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "${{ matrix.python-version }}"
 

.github/workflows/static-assets-check.yml

@@ -39,7 +39,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Setup Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -49,7 +49,7 @@ jobs:
           sudo apt-get install libxmlsec1-dev pkg-config
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: ${{ matrix.node-version }}
 

.github/workflows/unit-test-shards.json

@@ -239,7 +239,6 @@
       "cms/djangoapps/course_creators/",
       "cms/djangoapps/export_course_metadata/",
       "cms/djangoapps/modulestore_migrator/",
-      "cms/djangoapps/maintenance/",
       "cms/djangoapps/models/",
       "cms/djangoapps/pipeline_js/",
       "cms/djangoapps/xblock_config/",

.github/workflows/unit-tests.yml

@@ -1,4 +1,6 @@
 name: unit-tests
+permissions:
+  contents: read
 
 on:
   pull_request:
@@ -23,7 +25,6 @@ jobs:
           - "3.11"
         django-version:
           - "pinned"
-          - "5.2"
         # When updating the shards, remember to make the same changes in
         # .github/workflows/unit-tests-gh-hosted.yml
         shard_name:
@@ -96,7 +97,7 @@ jobs:
           docker ps
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -159,7 +160,7 @@ jobs:
     steps:
       - uses: actions/checkout@v5
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: 3.11
 
@@ -289,7 +290,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Setup Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
 

.github/workflows/units-test-scripts-structures-pruning.yml

@@ -21,7 +21,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
 

.github/workflows/units-test-scripts-user-retirement.yml

@@ -21,7 +21,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
 

.github/workflows/upgrade-one-python-dependency.yml

@@ -37,7 +37,7 @@ jobs:
           ref: "${{ inputs.branch }}"
 
       - name: Set up Python environment
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.11"
 

.readthedocs.yaml

@@ -10,6 +10,10 @@ sphinx:
 
 python:
   install:
+    # Need to install this to set the correct version of setuptools for now
+    # because it is needed by fs
+    # See https://github.com/openedx/openedx-platform/issues/38068 for details.
+  - requirements: "requirements/pip.txt"
   - requirements: "requirements/edx/doc.txt"
   - method: pip
     path: .

Makefile

@@ -118,7 +118,7 @@ $(COMMON_CONSTRAINTS_TXT):
 	printf "$(COMMON_CONSTRAINTS_TEMP_COMMENT)" | cat - $(@) > temp && mv temp $(@)
 
 compile-requirements: export CUSTOM_COMPILE_COMMAND=make upgrade
-compile-requirements: pre-requirements $(COMMON_CONSTRAINTS_TXT) ## Re-compile *.in requirements to *.txt
+compile-requirements: pre-requirements ## Re-compile *.in requirements to *.txt
 	@# Bootstrapping: Rebuild pip and pip-tools first, and then install them
 	@# so that if there are any failures we'll know now, rather than the next
 	@# time someone tries to use the outputs.
@@ -141,7 +141,7 @@ compile-requirements: pre-requirements $(COMMON_CONSTRAINTS_TXT) ## Re-compile *
 		export REBUILD=''; \
 	done
 
-upgrade:  ## update the pip requirements files to use the latest releases satisfying our constraints
+upgrade:  $(COMMON_CONSTRAINTS_TXT) ## update the pip requirements files to use the latest releases satisfying our constraints
 	$(MAKE) compile-requirements COMPILE_OPTS="--upgrade"
 
 upgrade-package: ## update just one package to the latest usable release

cms/djangoapps/cms_user_tasks/signals.py

@@ -12,6 +12,7 @@
 
 from cms.djangoapps.contentstore.toggles import bypass_olx_failure_enabled
 from cms.djangoapps.contentstore.utils import course_import_olx_validation_is_enabled
+from openedx.core.djangoapps.content_libraries.api import is_library_backup_task, is_library_restore_task
 
 from .tasks import send_task_complete_email
 
@@ -64,6 +65,28 @@ def get_olx_validation_from_artifact():
         if olx_artifact and not bypass_olx_failure_enabled():
             return olx_artifact.text
 
+    def should_skip_end_of_task_email(task_name) -> bool:
+        """
+        Studio tasks generally send an email when finished, but not always.
+
+        Some tasks can last many minutes, e.g. course import/export. For these
+        tasks, there is a high chance that the user has navigated away and will
+        want to check back in later. Yet email notification is unnecessary and
+        distracting for things like the Library restore task, which is
+        relatively quick and cannot be resumed (i.e. if you navigate away, you
+        have to upload again).
+
+        The task_name passed in will be lowercase.
+        """
+        # We currently have to pattern match on the name to differentiate
+        # between tasks. A better long term solution would be to add a separate
+        # task type identifier field to Django User Tasks.
+        return (
+            is_library_content_update(task_name) or
+            is_library_backup_task(task_name) or
+            is_library_restore_task(task_name)
+        )
+
     status = kwargs['status']
 
     # Only send email when the entire task is complete, should only send when
@@ -72,7 +95,7 @@ def get_olx_validation_from_artifact():
         task_name = status.name.lower()
 
         # Also suppress emails on library content XBlock updates (too much like spam)
-        if is_library_content_update(task_name):
+        if should_skip_end_of_task_email(task_name):
             LOGGER.info(f"Suppressing end-of-task email on task {task_name}")
             return
 

cms/djangoapps/contentstore/admin.py

@@ -100,6 +100,7 @@ class ComponentLinkAdmin(admin.ModelAdmin):
         "upstream_context_key",
         "downstream_usage_key",
         "downstream_context_key",
+        "top_level_parent",
         "version_synced",
         "version_declined",
         "created",
@@ -139,6 +140,7 @@ class ContainerLinkAdmin(admin.ModelAdmin):
         "upstream_context_key",
         "downstream_usage_key",
         "downstream_context_key",
+        "top_level_parent",
         "version_synced",
         "version_declined",
         "created",