…o release/2.34) (#28169)

Backport of #28087 to `release/2.34` (ESR).

Cherry-picked `5b97d99a4867` from `main` via `git cherry-pick -x`.
Docs-only change; applied cleanly with no conflicts.

The `backport` label on the original merged PR did not produce a 2.34
backport, so this is created by hand. 2.34 is listed in
`scripts/release_channels/esr_versions.txt`, so it is a valid backport
target.

- Original PR: #28087
- Tracking: DOCS-651

> This PR was created with AI assistance (Coder Agents).

…rt to release/2.34) (#28170)

Backport of #28101 to `release/2.34` (ESR).

Cherry-picked `1d189cc204f9` from `main` via `git cherry-pick -x`.
Docs-only change; applied cleanly with no conflicts.

The `backport` label on the original merged PR did not produce a 2.34
backport, so this is created by hand. 2.34 is listed in
`scripts/release_channels/esr_versions.txt`, so it is a valid backport
target.

- Original PR: #28101
- Tracking: DOCS-651

> This PR was created with AI assistance (Coder Agents).

…lavor (backport to release/2.34) (#28171)

Backport of #28086 to `release/2.34` (ESR).

Cherry-picked `b0e93b6e3b59` from `main` via `git cherry-pick -x`.
Docs-only change; applied cleanly with no conflicts.

The `backport` label on the original merged PR did not produce a 2.34
backport, so this is created by hand. 2.34 is listed in
`scripts/release_channels/esr_versions.txt`, so it is a valid backport
target.

- Original PR: #28086
- Tracking: DOCS-651

> This PR was created with AI assistance (Coder Agents).

…romote` (backport to release/2.34) (#28172)

Backport of #28084 to `release/2.34` (ESR).

Cherry-picked `f3fd4c4a77f2` from `main` via `git cherry-pick -x`.
Docs-only change; applied cleanly with no conflicts.

The `backport` label on the original merged PR did not produce a 2.34
backport, so this is created by hand. 2.34 is listed in
`scripts/release_channels/esr_versions.txt`, so it is a valid backport
target.

- Original PR: #28084
- Tracking: DOCS-651

> This PR was created with AI assistance (Coder Agents).

…ckport to release/2.34) (#28173)

Backport of #28098 to `release/2.34` (ESR).

Cherry-picked `58de9ab8f87e` from `main` via `git cherry-pick -x`. Three
of the five files applied cleanly.

**Conflicts resolved manually:**
`docs/admin/integrations/dx-data-cloud.md` and
`docs/admin/users/index.md`. On `release/2.34` both blocks use a `
```shell ` fence where `main` uses ` ```sh `; that fence difference is
an unrelated cross-branch divergence. This backport keeps 2.34's
existing `shell` fence (which also matches the neighboring code blocks
in those files) and applies #28098's intended change: replacing the
broken `coder users list > users.csv` with the `coder users list
--output json | jq ... | @csv > users.csv` pipeline. The resulting
commit touches the same five files with the same insertion/deletion
counts as the original squash.

The `backport` label on the original merged PR did not produce a 2.34
backport, so this is created by hand. 2.34 is listed in
`scripts/release_channels/esr_versions.txt`, so it is a valid backport
target.

- Original PR: #28098
- Tracking: DOCS-651

> This PR was created with AI assistance (Coder Agents).

…kport to release/2.34) (#28174)

Backport of #28085 to `release/2.34` (ESR).

Cherry-picked `3145cc8386f9` from `main` via `git cherry-pick -x`.
`prometheus.md` applied cleanly.

**Conflict resolved manually:**
`docs/admin/monitoring/notifications/slack.md`. On `release/2.34` the
fence is ` ```bash ` where `main` uses ` ```sh `; that fence difference
is an unrelated cross-branch divergence. This backport keeps 2.34's
existing `bash` fence and applies only #28085's intended change:
removing the stray trailing backtick from the
`CODER_NOTIFICATIONS_WEBHOOK_ENDPOINT` export.

The `backport` label on the original merged PR did not produce a 2.34
backport, so this is created by hand. 2.34 is listed in
`scripts/release_channels/esr_versions.txt`, so it is a valid backport
target.

- Original PR: #28085
- Tracking: DOCS-651

> This PR was created with AI assistance (Coder Agents).

…4) [ESR] (#28590)

Backport of #28553 to `release/2.34`.

Use a dedicated GitHub App token (`secrets.RELEASE_APP_ID` /
`secrets.RELEASE_APP_PRIVATE_KEY`) for the `Publish release` step
instead of the default `GITHUB_TOKEN`.

`gh release create` targets a release-branch commit that modifies files
under `.github/workflows/` relative to the default branch. The
create-release API requires the authenticating token to be authorized to
modify workflows; the default `GITHUB_TOKEN` is not, so it fails with
`HTTP 403: Resource not accessible by integration`. The
`coder-release-publisher` App token has code + workflows write.

Requires `RELEASE_APP_ID` / `RELEASE_APP_PRIVATE_KEY` to be configured
(already set on `coder/coder`).

Refs coder/security-automation#297.

Backport of #28340

Original PR: #28340 — fix: prevent markdown injection in notifications
Merge commit: 9e8075d
Requested by: @BobbyHo

---------

Co-authored-by: Bobby Ho <bobby@coder.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

) (#28646)

Backport of #28397

Original PR: #28397 — fix(coderd/notifications): HTML-escape the email
template values
Merge commit: 2236710
Requested by: @BobbyHo

Opened manually because the Backport workflow run for `release/2.34`
failed:
https://github.com/coder/coder/actions/runs/32985803559/job/98231735640

## Why the automatic backport failed

Two separate things went wrong in that run, and only one of them is
about conflicts.

The cherry-pick hit nine `modify/delete` conflicts (below). That alone
is not fatal — the same happened for `release/2.36` and `release/2.37`,
where the job still pushed a placeholder branch and opened a PR for
manual resolution.

What actually failed the job was the push:

```
! [remote rejected] backport/28397-to-2.34 -> backport/28397-to-2.34
  (Unable to determine if workflow can be created or updated due to timeout; `workflows` scope may be required.)
```

This cherry-pick touches no files under `.github/workflows/`, so this is
GitHub timing out while determining scope rather than a genuine
permission gap. The push was retried by hand for this PR and succeeded
unchanged. The net effect of the failure was that no branch and no PR
were created for 2.34 at all, so this one is opened from scratch rather
than fixed up in place. The `release/2.35` job (#28644) failed the same
way.

## Manual resolution: 9 golden files dropped

`release/2.34` already carries #28606 (the 2.34 backport of #28340), so
the `notifier.go` hunk applies cleanly. What remains is a genuine
`modify/delete` conflict on nine golden files:

```
TemplateAIBudgetLimitReachedUser.html.golden
TemplateAIBudgetWarningUser.html.golden
TemplateUserAccountActivatedServiceAccount.html.golden
TemplateUserAccountCreatedServiceAccount.html.golden
TemplateUserAccountCreatedWithoutAccountType.html.golden
TemplateUserAccountDeletedServiceAccount.html.golden
TemplateUserAccountSuspendedServiceAccount.html.golden
TemplateWorkspaceAutostopReminder.html.golden
TemplateWorkspaceDormant_NoAutoDelete.html.golden
```

These are fixtures for notification templates and test cases that
postdate the 2.34 branch point — AI budgets, service accounts, the
autostop reminder, and the no-auto-delete variant of the dormancy
notice. `coderd/notifications/` on `release/2.34` contains no reference
to `AIBudget`, `BudgetLimitReached`, `BudgetWarning`, `ServiceAccount`,
`AccountType`, `AutostopReminder` or `NoAutoDelete`, so there is no
template to render them and no test case that reads them. **All nine
were removed rather than added**; carrying them over would leave orphan
fixtures.

Note that `TemplateWorkspaceDormant.html.golden` does exist on 2.34 and
is updated normally by this PR. Only the `_NoAutoDelete` variant of that
test case is dropped.

This is the only deviation from the original PR. Verified with a
diff-of-diffs: excluding those nine paths, this commit matches #28397
line for line. The only textual differences are blob hashes and hunk
line offsets — `notifier.go` sits one line higher on this branch, so the
hunk header reads `@@ -252` instead of `@@ -253`. The escaping changes
to `html.gotmpl`, `notifier.go` and `smtp_internal_test.go` are fully
intact.

Net: 30 files, +226/−71 (upstream: 39 files, +244/−89 — the delta is
exactly the nine goldens). The smtp golden directory holds 36 files
before and after, so nothing was added or lost.

## Verification

- `go vet ./coderd/notifications/...` — clean
- `go test ./coderd/notifications/dispatch/...` — pass, including the
three new `TestSMTPHTMLTemplateEscapes*` tests
- `go test ./coderd/notifications/ -run
TestNotificationTemplates_Golden` — pass across all affected goldens

## Related backports

- #28603 — `release/2.37`
- #28604 — `release/2.36`
- #28644 — `release/2.35`
- #28643 — `release/2.29` (still needs manual resolution)

…8652)

Backport of #28513

Original PR: #28513 — fix(coderd): reject agent requests from suspended
owners
Merge commit: 2f50b2d
Requested by: @hwang251

Co-authored-by: Hank Hwang <hwang251@gmail.com>
Co-authored-by: Marcin Tojek <mtojek@users.noreply.github.com>

Backport of #28494

Original PR: #28494 — fix: enable Copilot HTTP transport fallback
Merge commit: 849543d
Requested by: @ssncferreira

> [!NOTE]
> This pull request was generated by Coder Agents on behalf of
@ssncferreira.

Cherry-pick of [#28802](#28802)
(`e2a856d42b`), matching
[#28810](#28810) for `release/2.37`.

Deletes cached Terraform module archives ingested during the identified
window and clears the template version references to them. Runs from
`dbpurge` rather than a migration, because migrations cannot be
backported: the version table records a single high-water mark, so a
migration cherry-picked here would cause later upgrades to skip every
migration in between.

## Conflict resolution

The commit did not apply cleanly. This branch predates the chat search
work on `main`, so the incoming hunks carried unrelated context that was
dropped:

- `dbpurge.go`: took only the module cache block, the
`ranModuleCachePurge` latch, the window constants, the
`identified_module_files` log field and metric, and the
`identifiedModuleCachePurged` instance field. Dropped the
`chat_messages.search_tsv` backfill and stale reindex, along with
`staleDrained` and the `chatSearch*` fields, none of which exist on this
branch.
- `dbpurge_test.go`: took `TestDeleteIdentifiedModuleCacheFiles` and the
`awaitDoTicks` helper it depends on. Dropped
`TestBackfillChatMessagesSearchTsv`. In the two `TestMetrics` mock
setups, added only the `DeleteCachedModuleFilesCreatedBetween`
expectation.
- Generated files (`querier.go`, `queries.sql.go`, `dbmetrics`,
`dbmock`, and the `dbauthz` stub) were reset to the branch state and
regenerated from `queries/files.sql`, rather than taking the diff from
`main`. Taking `main`'s versions would have introduced methods for
queries that do not exist on this branch.

Additionally on this branch, `dbpurge.New` takes an auditor argument
that `main` does not, so the test call was adjusted to pass
`nopAuditorPtr(t)`.

## Testing

`coderd/database/dbpurge` and `TestMethodTestSuite` in
`coderd/database/dbauthz` pass against Postgres. `make gen` is clean and
pre-commit hooks pass.

---

Opened by Coder Agents on behalf of @Emyrk.