feat(APP-998): support chat side panel, email escape hatch, centralized copy

.changeset/app-998-assistant-issue-texts.md

@@ -0,0 +1,5 @@
+---
+"@aragon/assistant": patch
+---
+
+Move the static Linear ticket texts into chat/prompts/issueTexts.ts so all service copy lives under chat/prompts/

.changeset/app-998-chat-widget-copy-and-escape-hatches.md

@@ -0,0 +1,5 @@
+---
+"@aragon/assistant-chat": minor
+---
+
+Chat escape hatches point to support@aragon.org instead of the support portal; all widget copy is centralized in a single copy module

.changeset/app-998-support-chat-side-panel.md

@@ -0,0 +1,5 @@
+---
+"@aragon/app": minor
+---
+
+Support chat opens as a side panel the layout resizes around (toggled from the navigation bar) instead of a blur overlay

.github/actions/changeset-version/action.yml

@@ -1,9 +1,9 @@
 name: Changeset Version
-description: Runs `pnpm changeset version` scoped to the given packages and formats the changed CHANGELOG files (idempotent when no changesets).
+description: Runs `pnpm changeset version` scoped to a release scope from .github/release-scopes.yml and formats the changed CHANGELOG files (idempotent when no changesets).
 
 inputs:
   scope:
-    description: Space-separated package names this flow versions; all other workspace packages are passed to changesets as --ignore. Empty = version everything.
+    description: Name of a release scope in .github/release-scopes.yml; all workspace packages outside that scope are passed to changesets as --ignore. Empty = version everything.
     required: false
     default: ""
   prettier_changelog:
@@ -25,12 +25,14 @@ runs:
         PRETTIER_CHANGELOG: ${{ inputs.prettier_changelog }}
       run: |
         set -euo pipefail
-        # Workflows declare the packages they own (scope); the inversion into changesets
-        # --ignore flags happens here, in one place, so flows stay declarative.
+        # Workflows name the release scope they own; the central mapper resolves it to packages
+        # and the inversion into changesets --ignore flags happens here, in one place, so flows
+        # stay declarative.
         IGNORE_FLAGS=()
         if [ -n "$SCOPE" ]; then
+          SCOPE_PACKAGES=$(node -e "console.log(require('./.github/workflows/scripts/releaseScopes.js').resolveReleaseScope(process.argv[1]).join(' '))" "$SCOPE")
           while IFS= read -r PACKAGE; do
-            case " $SCOPE " in
+            case " $SCOPE_PACKAGES " in
               *" $PACKAGE "*) ;;
               *) IGNORE_FLAGS+=(--ignore "$PACKAGE") ;;
             esac

.github/actions/generate-version-summary/action.yml

@@ -0,0 +1,23 @@
+name: Generate Version Summary
+description: Generates a per-package bump summary (new version + changelog section) for the scoped packages; run after `changeset version`, before committing.
+
+inputs:
+  scope:
+    description: Name of a release scope in .github/release-scopes.yml whose packages are inspected for uncommitted version bumps
+    required: true
+
+outputs:
+  summary:
+    description: Generated summary markdown (one section per bumped package)
+    value: ${{ steps.summary.outputs.summary }}
+
+runs:
+  using: composite
+  steps:
+    - id: summary
+      shell: bash
+      env:
+        SCOPE: ${{ inputs.scope }}
+      run: |
+        set -euo pipefail
+        node .github/workflows/scripts/generateVersionSummary.js

.github/actions/read-changelog/action.yml

@@ -25,6 +25,6 @@ runs:
         path: ${{ inputs.path }}
       with:
         script: |
-          const readChangelog = require('./.github/workflows/scripts/readChangelog.js');
+          const { readChangelog } = require('./.github/workflows/scripts/readChangelog.js');
           await readChangelog({ github, context, core });
 

.github/release-scopes.yml

@@ -0,0 +1,13 @@
+# Central package→release-scope mapper: each scope lists the packages one release flow versions
+# together (the `scope` input of the changeset-version action names an entry here). A changeset
+# must never mix packages from different scopes — `changeset version --ignore` refuses mixed
+# changesets, which breaks every scoped flow. CI enforces this via `pnpm validate:changesets`.
+# When a new workspace lands, add it to a scope HERE — flows and validation read this file.
+
+app:
+  - "@aragon/app"
+
+assistant:
+  - "@aragon/assistant"
+  - "@aragon/assistant-contracts"
+  - "@aragon/assistant-chat"

.github/workflows/app-release-start.yml

@@ -74,13 +74,13 @@ jobs:
           path_filter: "app"
           linear_api_token: ${{ steps.load-secrets.outputs.LINEAR_API_TOKEN }}
 
-      # Per-package release model: this flow versions only @aragon/app; other workspaces are
-      # versioned by their own release flows (e.g. assistant-release-version.yml), which
-      # symmetrically scope to their packages.
+      # Per-package release model: this flow owns the "app" release scope (see
+      # .github/release-scopes.yml); other workspaces are versioned by their own release flows
+      # (e.g. assistant-release-start.yml), which symmetrically own their scopes.
       - name: Update version and changelog
         uses: ./.github/actions/changeset-version
         with:
-          scope: "@aragon/app"
+          scope: app
           prettier_changelog: "true"
           github_token: ${{ steps.load-secrets.outputs.ARABOT_PAT }}
 

.github/workflows/assistant-release-finalize.yml → .github/workflows/assistant-release-pr-finalize.yml

@@ -1,9 +1,11 @@
-# The "Assistant Release Finalize" workflow runs when the "Version Packages: assistant" PR merges:
-# it tags the merged commit with the changesets-native per-package tag (@aragon/assistant@x.y.z) and
-# creates the GitHub Release with the changelog as notes. Publishing the release triggers the
-# production deploy (assistant-production.yml).
+# The "Assistant Release PR Finalize" workflow runs when a release/assistant/* PR merges: it tags
+# the merge commit with the changesets-native per-package tag (@aragon/assistant@x.y.z) and creates
+# the GitHub Release with the changelog as notes. Publishing the release triggers the production
+# deploy (assistant-production.yml). Unlike the app flow (which tags the staging-tested head SHA),
+# the merge commit is tagged here: the assistant release PR has no staging ceremony, and production
+# builds from the tag, which must include the merge.
 
-name: Assistant Release Finalize
+name: Assistant Release PR Finalize
 
 on:
   pull_request:
@@ -22,7 +24,7 @@ jobs:
   finalize:
     if: >
       github.event.pull_request.merged == true &&
-      github.event.pull_request.head.ref == 'changeset-release/assistant'
+      startsWith(github.event.pull_request.head.ref, 'release/assistant/')
     runs-on: ubuntu-latest
     steps:
       - name: Load secrets

.github/workflows/assistant-release-start.yml

@@ -0,0 +1,123 @@
+# The "Assistant Release Start" workflow prepares the assistant release pull request ON DEMAND
+# (trunk-based: merging to main never starts a release by itself). Dispatching it applies
+# `changeset version` scoped to the assistant domain packages, pushes the bump to a timestamped
+# release/assistant/* branch and opens a "Release @aragon/assistant@x.y.z" PR whose description
+# lists every bumped package with its new changelog. Merging that PR is the release act — the
+# finalize workflow (assistant-release-pr-finalize.yml) tags the merge commit and the tag triggers
+# the production deploy.
+
+name: Assistant Release Start
+
+on:
+  workflow_dispatch:
+    inputs:
+      base_commit:
+        description: 'Commit SHA to start release from (default: main HEAD)'
+        required: false
+        type: string
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  prepare-release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Load secrets
+        id: load-secrets
+        uses: 1password/load-secrets-action@3a12b0ab99d9cd590a3e9b5a90ea017210ed9556 # v4.0.0 (https://github.com/1Password/load-secrets-action/releases/tag/v4.0.0)
+        with:
+          export-env: false
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: '${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}'
+          GPG_PASSPHRASE: op://kv_app_infra/arabot-1_SIGN_CERTS/credential
+          GPG_PRIVATE_KEY: op://kv_app_infra/arabot-1_SIGN_CERTS/private_key
+          ARABOT_PAT: op://kv_app_infra/ARABOT_PAT/credential
+
+      - name: Checkout actions
+        uses: actions/checkout@v7.0.0
+        with:
+          fetch-depth: 1
+          sparse-checkout: |
+            .github/actions/setup
+
+      - name: Setup
+        uses: ./.github/actions/setup
+        with:
+          token: ${{ steps.load-secrets.outputs.ARABOT_PAT }}
+          fetch-depth: 0
+          ref: ${{ inputs.base_commit || 'main' }}
+
+      - name: Import GPG key
+        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0 (https://github.com/crazy-max/ghaction-import-gpg/releases/tag/v7.0.0)
+        with:
+          gpg_private_key: ${{ steps.load-secrets.outputs.GPG_PRIVATE_KEY }}
+          passphrase: ${{ steps.load-secrets.outputs.GPG_PASSPHRASE }}
+          git_user_signingkey: true
+          git_commit_gpgsign: true
+
+      # This flow owns the "assistant" release scope (see .github/release-scopes.yml): the
+      # service plus its version-only packages. App-scoped packages are versioned by the app
+      # release flow (app-release-start.yml), which symmetrically owns the "app" scope.
+      - name: Update version and changelog
+        uses: ./.github/actions/changeset-version
+        with:
+          scope: assistant
+          prettier_changelog: "true"
+          github_token: ${{ steps.load-secrets.outputs.ARABOT_PAT }}
+
+      # Versioning runs before the release branch exists so a dispatch without pending
+      # changesets exits here without leaving an empty branch or PR behind.
+      - name: Detect version changes
+        id: changes
+        run: echo "dirty=$([ -n "$(git status --porcelain)" ] && echo true || echo false)" >> $GITHUB_OUTPUT
+
+      - name: Get package version
+        if: steps.changes.outputs.dirty == 'true'
+        id: package-version
+        uses: martinbeentjes/npm-get-version-action@3cf273023a0dda27efcd3164bdfb51908dd46a5b # v1.3.1 (https://github.com/martinbeentjes/npm-get-version-action/releases/tag/v1.3.1)
+        with:
+          path: apps/assistant
+
+      # Per-package tag in the changesets-native format: @aragon/assistant@0.2.0. The tag anchors
+      # on the deployable service; the version-only packages ship inside their consumers untagged.
+      - name: Compute release tag
+        if: steps.changes.outputs.dirty == 'true'
+        id: release-tag
+        run: echo "name=@aragon/assistant@${{ steps.package-version.outputs.current-version }}" >> $GITHUB_OUTPUT
+
+      - name: Generate version summary
+        if: steps.changes.outputs.dirty == 'true'
+        id: version-summary
+        uses: ./.github/actions/generate-version-summary
+        with:
+          scope: assistant
+
+      - name: Generate release branch name
+        if: steps.changes.outputs.dirty == 'true'
+        id: branch-name
+        run: echo "name=release/assistant/$(date +'%Y-%m-%d_%H-%M')" >> $GITHUB_OUTPUT
+
+      - name: Commit and push release branch
+        if: steps.changes.outputs.dirty == 'true'
+        run: |
+          git checkout -b ${{ steps.branch-name.outputs.name }}
+          git add --all
+          git commit -m "Release ${{ steps.release-tag.outputs.name }}"
+          git push origin ${{ steps.branch-name.outputs.name }}
+
+      - name: Ensure Pull Request
+        if: steps.changes.outputs.dirty == 'true'
+        uses: ./.github/actions/gh-ensure-pr
+        with:
+          base: main
+          head: ${{ steps.branch-name.outputs.name }}
+          title: Release ${{ steps.release-tag.outputs.name }}
+          body: |
+            Merging this PR releases `${{ steps.release-tag.outputs.name }}`: the merge commit is
+            tagged and the tag triggers the production deploy to assistant.aragon.org. The
+            version-only packages below ship inside their consumers and get no tag of their own.
+
+            ${{ steps.version-summary.outputs.summary }}
+          token: ${{ steps.load-secrets.outputs.ARABOT_PAT }}