diff --git a/.github/workflows/release-nightly-snapcraft.yml b/.github/workflows/release-nightly-snapcraft.yml
index 7afca350c2e..f89654e40ba 100644
--- a/.github/workflows/release-nightly-snapcraft.yml
+++ b/.github/workflows/release-nightly-snapcraft.yml
@@ -22,6 +22,10 @@ jobs:
       - name: Install snapcraft
         run: sudo snap install snapcraft --classic
 
+      - name: Authenticate snapcraft
+        shell: bash
+        run: snapcraft login --with <(printf '%s' "$SNAPCRAFT_STORE_CREDENTIALS")
+
       - name: Remote build
         run: |
           snapcraft remote-build \
diff --git a/.github/workflows/release-nightly.yml b/.github/workflows/release-nightly.yml
index d982dd525bc..e3997c81235 100644
--- a/.github/workflows/release-nightly.yml
+++ b/.github/workflows/release-nightly.yml
@@ -13,6 +13,7 @@ jobs:
     runs-on: namespace-profile-gitea-release-binary
     permissions:
       contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       # fetch all commits instead of only the last as some branches are long lived and could have many between versions
@@ -33,6 +34,8 @@ jobs:
       - run: make release
         env:
           TAGS: bindata
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
       - name: import gpg key
         id: import_gpg
         uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
@@ -45,6 +48,7 @@ jobs:
           GPG_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
         run: |
           for f in dist/release/*; do
+            cosign sign-blob "$f" --bundle "$f.sigstore.json" --yes
             echo "$GPG_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u "$GPG_FINGERPRINT" --output "$f.asc" "$f"
           done
       # clean branch name to get the folder name in S3
diff --git a/.github/workflows/release-tag-rc.yml b/.github/workflows/release-tag-rc.yml
index 9e796c47d47..03f17e8c23d 100644
--- a/.github/workflows/release-tag-rc.yml
+++ b/.github/workflows/release-tag-rc.yml
@@ -14,6 +14,7 @@ jobs:
     runs-on: namespace-profile-gitea-release-binary
     permissions:
       contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       # fetch all commits instead of only the last as some branches are long lived and could have many between versions
@@ -34,6 +35,8 @@ jobs:
       - run: make release
         env:
           TAGS: bindata
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
       - name: import gpg key
         id: import_gpg
         uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
@@ -46,6 +49,7 @@ jobs:
           GPG_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
         run: |
           for f in dist/release/*; do
+            cosign sign-blob "$f" --bundle "$f.sigstore.json" --yes
             echo "$GPG_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u "$GPG_FINGERPRINT" --output "$f.asc" "$f"
           done
       # clean branch name to get the folder name in S3
diff --git a/.github/workflows/release-tag-version.yml b/.github/workflows/release-tag-version.yml
index 81a309757b0..09f9a739714 100644
--- a/.github/workflows/release-tag-version.yml
+++ b/.github/workflows/release-tag-version.yml
@@ -17,6 +17,7 @@ jobs:
     permissions:
       contents: read
       packages: write # to publish to ghcr.io
+      id-token: write
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       # fetch all commits instead of only the last as some branches are long lived and could have many between versions
@@ -37,6 +38,8 @@ jobs:
       - run: make release
         env:
           TAGS: bindata
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
       - name: import gpg key
         id: import_gpg
         uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
@@ -49,6 +52,7 @@ jobs:
           GPG_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
         run: |
           for f in dist/release/*; do
+            cosign sign-blob "$f" --bundle "$f.sigstore.json" --yes
             echo "$GPG_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u "$GPG_FINGERPRINT" --output "$f.asc" "$f"
           done
       # clean branch name to get the folder name in S3
diff --git a/modules/gitrepo/commit.go b/modules/gitrepo/commit.go
index 38785dcb978..24df90c015c 100644
--- a/modules/gitrepo/commit.go
+++ b/modules/gitrepo/commit.go
@@ -32,6 +32,14 @@ func CommitsCount(ctx context.Context, repo Repository, opts CommitsCountOptions
 		cmd.AddOptionValues("--not", opts.Not)
 	}
 
+	if opts.Since != "" {
+		cmd.AddOptionFormat("--since=%s", opts.Since)
+	}
+
+	if opts.Until != "" {
+		cmd.AddOptionFormat("--until=%s", opts.Until)
+	}
+
 	if len(opts.RelPath) > 0 {
 		cmd.AddDashesAndList(opts.RelPath...)
 	}
diff --git a/modules/gitrepo/commit_test.go b/modules/gitrepo/commit_test.go
index 05cedc39efd..638795a9855 100644
--- a/modules/gitrepo/commit_test.go
+++ b/modules/gitrepo/commit_test.go
@@ -34,6 +34,37 @@ func TestCommitsCountWithoutBase(t *testing.T) {
 	assert.Equal(t, int64(2), commitsCount)
 }
 
+func TestCommitsCountWithSinceUntil(t *testing.T) {
+	bareRepo1 := &mockRepository{path: "repo1_bare"}
+	revision := []string{"8006ff9adbf0cb94da7dad9e537e53817f9fa5c0"}
+
+	// The three commits on this revision are dated 2018-04-18, 2017-12-19 and 2017-12-19.
+	cases := []struct {
+		name     string
+		since    string
+		until    string
+		expected int64
+	}{
+		{name: "no filter", expected: 3},
+		{name: "since keeps newer commits", since: "2018-01-01", expected: 1},
+		{name: "until keeps older commits", until: "2018-01-01", expected: 2},
+		{name: "since and until bound the range", since: "2017-12-19T22:16:00-08:00", until: "2018-01-01", expected: 1},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			commitsCount, err := CommitsCount(t.Context(), bareRepo1,
+				CommitsCountOptions{
+					Revision: revision,
+					Since:    tc.since,
+					Until:    tc.until,
+				})
+
+			assert.NoError(t, err)
+			assert.Equal(t, tc.expected, commitsCount)
+		})
+	}
+}
+
 func TestGetLatestCommitTime(t *testing.T) {
 	bareRepo1 := &mockRepository{path: "repo1_bare"}
 	lct, err := GetLatestCommitTime(t.Context(), bareRepo1)
diff --git a/options/locale/locale_cs-CZ.json b/options/locale/locale_cs-CZ.json
index 3ee280dff48..1b563c085a0 100644
--- a/options/locale/locale_cs-CZ.json
+++ b/options/locale/locale_cs-CZ.json
@@ -3238,6 +3238,9 @@
   "actions.workflow.enable": "Povolit pracovní postup",
   "actions.workflow.enable_success": "Pracovní postup „%s“ byl úspěšně aktivován.",
   "actions.workflow.disabled": "Pracovní postup je zakázán.",
+  "actions.workflow.scope_owner": "Vlastník",
+  "actions.workflow.scope_global": "Globální",
+  "actions.workflow.required": "Požadováno",
   "actions.workflow.run": "Spustit pracovní postup",
   "actions.workflow.not_found": "Pracovní postup „%s“ nebyl nalezen.",
   "actions.workflow.run_success": "Pracovní postup „%s“ proběhl úspěšně.",
diff --git a/options/locale/locale_de-DE.json b/options/locale/locale_de-DE.json
index 64ec247ddeb..643634cfce8 100644
--- a/options/locale/locale_de-DE.json
+++ b/options/locale/locale_de-DE.json
@@ -3832,6 +3832,9 @@
   "actions.workflow.enable": "Workflow aktivieren",
   "actions.workflow.enable_success": "Workflow '%s' erfolgreich aktiviert.",
   "actions.workflow.disabled": "Workflow ist deaktiviert.",
+  "actions.workflow.scope_owner": "Besitzer",
+  "actions.workflow.scope_global": "Global",
+  "actions.workflow.required": "Erforderlich",
   "actions.workflow.run": "Workflow ausführen",
   "actions.workflow.not_found": "Workflow '%s' wurde nicht gefunden.",
   "actions.workflow.run_success": "Workflow '%s' erfolgreich ausgeführt.",
diff --git a/options/locale/locale_el-GR.json b/options/locale/locale_el-GR.json
index a24635258c8..ad0012c7a48 100644
--- a/options/locale/locale_el-GR.json
+++ b/options/locale/locale_el-GR.json
@@ -2951,6 +2951,9 @@
   "actions.workflow.enable": "Ενεργοποίηση Ροής Εργασίας",
   "actions.workflow.enable_success": "Η ροή εργασίας '%s' ενεργοποιήθηκε επιτυχώς.",
   "actions.workflow.disabled": "Η ροή εργασιών είναι απενεργοποιημένη.",
+  "actions.workflow.scope_owner": "Ιδιοκτήτης",
+  "actions.workflow.scope_global": "Γενικό",
+  "actions.workflow.required": "Απαιτείται",
   "actions.need_approval_desc": "Πρέπει να εγκριθεί η εκτέλεση ροών εργασίας για pull request από fork.",
   "actions.variables": "Μεταβλητές",
   "actions.variables.management": "Διαχείριση Μεταβλητών",
diff --git a/options/locale/locale_es-ES.json b/options/locale/locale_es-ES.json
index ae3d7f2120a..6dc1065cdbf 100644
--- a/options/locale/locale_es-ES.json
+++ b/options/locale/locale_es-ES.json
@@ -2910,6 +2910,8 @@
   "actions.workflow.enable": "Activar flujo de trabajo",
   "actions.workflow.enable_success": "Flujo de trabajo '%s' habilitado con éxito.",
   "actions.workflow.disabled": "El flujo de trabajo está deshabilitado.",
+  "actions.workflow.scope_owner": "Propietario",
+  "actions.workflow.required": "Obligatorio",
   "actions.need_approval_desc": "Necesita aprobación para ejecutar flujos de trabajo para el pull request del fork.",
   "actions.variables.management": "Gestión de variables",
   "actions.variables.creation": "Añadir variable",
diff --git a/options/locale/locale_fa-IR.json b/options/locale/locale_fa-IR.json
index 2b48c0038b2..5c0b9c30fa2 100644
--- a/options/locale/locale_fa-IR.json
+++ b/options/locale/locale_fa-IR.json
@@ -2201,5 +2201,7 @@
   "actions.runners.version": "نسخه",
   "actions.runs.commit": "کامیت",
   "actions.runs.summary": "چکیده",
+  "actions.workflow.scope_owner": "مالک",
+  "actions.workflow.required": "الزامی",
   "actions.general.token_permissions.mode.restricted": "محصور"
 }
diff --git a/options/locale/locale_fi-FI.json b/options/locale/locale_fi-FI.json
index f3dc847897d..78f29f5d20b 100644
--- a/options/locale/locale_fi-FI.json
+++ b/options/locale/locale_fi-FI.json
@@ -1463,5 +1463,6 @@
   "actions.runners.version": "Versio",
   "actions.runs.branch": "Haara",
   "actions.runs.summary": "Yhteenveto",
+  "actions.workflow.scope_owner": "Omistaja",
   "actions.general.token_permissions.mode.restricted": "Rajoitettu"
 }
diff --git a/options/locale/locale_fr-FR.json b/options/locale/locale_fr-FR.json
index 51506c6dbe7..de8ac24cc01 100644
--- a/options/locale/locale_fr-FR.json
+++ b/options/locale/locale_fr-FR.json
@@ -3814,6 +3814,9 @@
   "actions.workflow.enable": "Activer le flux de travail",
   "actions.workflow.enable_success": "Le flux de travail « %s » a bien été activé.",
   "actions.workflow.disabled": "Le flux de travail est désactivé.",
+  "actions.workflow.scope_owner": "Propriétaire",
+  "actions.workflow.scope_global": "Global",
+  "actions.workflow.required": "Requis",
   "actions.workflow.run": "Exécuter le flux de travail",
   "actions.workflow.not_found": "Flux de travail « %s » introuvable.",
   "actions.workflow.run_success": "Le flux de travail « %s » s’est correctement exécuté.",
diff --git a/options/locale/locale_ga-IE.json b/options/locale/locale_ga-IE.json
index c1e11779d10..436f9ba416c 100644
--- a/options/locale/locale_ga-IE.json
+++ b/options/locale/locale_ga-IE.json
@@ -3832,6 +3832,9 @@
   "actions.workflow.enable": "Cumasaigh sreabhadh oibre",
   "actions.workflow.enable_success": "Cumasaíodh sreabhadh oibre '%s' go rathúil.",
   "actions.workflow.disabled": "Tá sreabhadh oibre díchumasaithe",
+  "actions.workflow.scope_owner": "Úinéir",
+  "actions.workflow.scope_global": "Domhanda",
+  "actions.workflow.required": "Riachtanach",
   "actions.workflow.run": "Rith Sreabhadh Oibre",
   "actions.workflow.not_found": "Níor aimsíodh sreabhadh oibre '%s'.",
   "actions.workflow.run_success": "Ritheann sreabhadh oibre '%s' go rathúil.",
diff --git a/options/locale/locale_hu-HU.json b/options/locale/locale_hu-HU.json
index 95b32580fee..a811901a1e1 100644
--- a/options/locale/locale_hu-HU.json
+++ b/options/locale/locale_hu-HU.json
@@ -1371,5 +1371,6 @@
   "actions.runners.status.active": "Aktív",
   "actions.runners.version": "Verzió",
   "actions.runs.summary": "Összefoglaló",
+  "actions.workflow.scope_owner": "Tulajdonos",
   "actions.general.token_permissions.mode.restricted": "Korlátozott"
 }
diff --git a/options/locale/locale_id-ID.json b/options/locale/locale_id-ID.json
index 4f675c04a03..a3d7b76d6ea 100644
--- a/options/locale/locale_id-ID.json
+++ b/options/locale/locale_id-ID.json
@@ -1180,6 +1180,7 @@
   "actions.workflow.enable": "Aktifkan Alur Kerja",
   "actions.workflow.enable_success": "Alur kerja '%s' berhasil diaktifkan.",
   "actions.workflow.disabled": "Alur kerja dinonaktifkan.",
+  "actions.workflow.scope_owner": "Pemilik",
   "actions.need_approval_desc": "Butuh persetujuan untuk menjalankan alur kerja untuk pull request fork.",
   "actions.variables": "Variabel",
   "actions.variables.management": "Managemen Variabel",
diff --git a/options/locale/locale_is-IS.json b/options/locale/locale_is-IS.json
index 81971d6866b..b64cfecca3c 100644
--- a/options/locale/locale_is-IS.json
+++ b/options/locale/locale_is-IS.json
@@ -1111,5 +1111,7 @@
   "actions.runners.version": "Útgáfa",
   "actions.runs.commit": "Framlag",
   "actions.runs.branch": "Grein",
-  "actions.runs.summary": "Yfirlit"
+  "actions.runs.summary": "Yfirlit",
+  "actions.workflow.scope_owner": "Eigandi",
+  "actions.workflow.required": "Nauðsynlegt"
 }
diff --git a/options/locale/locale_it-IT.json b/options/locale/locale_it-IT.json
index b9de3c0beef..c8106f1ce24 100644
--- a/options/locale/locale_it-IT.json
+++ b/options/locale/locale_it-IT.json
@@ -2352,5 +2352,7 @@
   "actions.runners.version": "Versione",
   "actions.runs.branch": "Ramo",
   "actions.runs.summary": "Riepilogo",
+  "actions.workflow.scope_owner": "Proprietario",
+  "actions.workflow.required": "Richiesto",
   "actions.general.token_permissions.mode.restricted": "Limitato"
 }
diff --git a/options/locale/locale_ja-JP.json b/options/locale/locale_ja-JP.json
index 9df9a0dd124..81b01d6d2e6 100644
--- a/options/locale/locale_ja-JP.json
+++ b/options/locale/locale_ja-JP.json
@@ -2867,8 +2867,11 @@
   "org.teams.all_repositories_admin_permission_desc": "このチームは<strong>すべてのリポジトリ</strong>の<strong>管理者</strong>アクセス権を持ちます: メンバーはリポジトリの読み取り、プッシュ、共同作業者の追加が可能です。",
   "org.teams.visibility": "公開/非公開",
   "org.teams.visibility_private": "プライベート",
+  "org.teams.visibility_private_helper": "チームメンバーと組織のオーナーにのみ表示されます。",
   "org.teams.visibility_limited": "限定",
+  "org.teams.visibility_limited_helper": "この組織のすべてのメンバーに表示されます。",
   "org.teams.visibility_public": "公開",
+  "org.teams.visibility_public_helper": "サインインしているすべてのユーザーに表示されます。",
   "org.teams.invite.title": "あなたは組織 <strong>%[2]s</strong> 内のチーム <strong>%[1]s</strong> への参加に招待されました。",
   "org.teams.invite.by": "%s からの招待",
   "org.teams.invite.description": "下のボタンをクリックしてチームに参加してください。",
@@ -3828,6 +3831,9 @@
   "actions.workflow.enable": "ワークフローを有効にする",
   "actions.workflow.enable_success": "ワークフロー '%s' が有効になりました。",
   "actions.workflow.disabled": "ワークフローは無効です。",
+  "actions.workflow.scope_owner": "オーナー",
+  "actions.workflow.scope_global": "グローバル",
+  "actions.workflow.required": "必須",
   "actions.workflow.run": "ワークフローを実行",
   "actions.workflow.not_found": "ワークフロー '%s' が見つかりません。",
   "actions.workflow.run_success": "ワークフロー '%s' は正常に実行されました。",
diff --git a/options/locale/locale_ko-KR.json b/options/locale/locale_ko-KR.json
index e09eca7b3d9..9fae3f6985d 100644
--- a/options/locale/locale_ko-KR.json
+++ b/options/locale/locale_ko-KR.json
@@ -3817,6 +3817,9 @@
   "actions.workflow.enable": "워크플로 활성화",
   "actions.workflow.enable_success": "워크플로 '%s'가 성공적으로 활성화되었습니다.",
   "actions.workflow.disabled": "워크플로가 비활성화되었습니다.",
+  "actions.workflow.scope_owner": "소유자",
+  "actions.workflow.scope_global": "글로벌",
+  "actions.workflow.required": "필수 항목",
   "actions.workflow.run": "워크플로 실행",
   "actions.workflow.not_found": "워크플로 '%s'를 찾을 수 없습니다.",
   "actions.workflow.run_success": "워크플로 '%s'가 성공적으로 실행되었습니다.",
diff --git a/options/locale/locale_lv-LV.json b/options/locale/locale_lv-LV.json
index a151050e63c..bfc3efc8edf 100644
--- a/options/locale/locale_lv-LV.json
+++ b/options/locale/locale_lv-LV.json
@@ -2991,6 +2991,9 @@
   "actions.workflow.enable": "Iespējot darbplūsmu",
   "actions.workflow.enable_success": "Darbplūsma '%s' ir veiksmīgi iespējota.",
   "actions.workflow.disabled": "Darbplūsma ir atspējota.",
+  "actions.workflow.scope_owner": "Īpašnieks",
+  "actions.workflow.scope_global": "Globāls",
+  "actions.workflow.required": "Obligāts",
   "actions.need_approval_desc": "Nepieciešams apstiprinājums, lai izpildītu izmaiņu pieprasījumu darbaplūsmas no atdalītiem repozitorijiem.",
   "actions.variables": "Mainīgie",
   "actions.variables.management": "Mainīgo pārvaldība",
diff --git a/options/locale/locale_nl-NL.json b/options/locale/locale_nl-NL.json
index f79e66e924d..cc2f26cdd8f 100644
--- a/options/locale/locale_nl-NL.json
+++ b/options/locale/locale_nl-NL.json
@@ -2070,5 +2070,7 @@
   "actions.runners.status.active": "Actief",
   "actions.runners.version": "Versie",
   "actions.runs.summary": "Overzicht",
+  "actions.workflow.scope_owner": "Eigenaar",
+  "actions.workflow.required": "Vereist",
   "actions.general.token_permissions.mode.restricted": "Beperkt"
 }
diff --git a/options/locale/locale_pl-PL.json b/options/locale/locale_pl-PL.json
index f6906c31f43..bdaac8d8989 100644
--- a/options/locale/locale_pl-PL.json
+++ b/options/locale/locale_pl-PL.json
@@ -2085,5 +2085,7 @@
   "actions.runners.status.active": "Aktywne",
   "actions.runners.version": "Wersja",
   "actions.runs.summary": "Podsumowanie",
+  "actions.workflow.scope_owner": "Właściciel",
+  "actions.workflow.required": "Wymagane",
   "actions.general.token_permissions.mode.restricted": "Ograniczone"
 }
diff --git a/options/locale/locale_pt-BR.json b/options/locale/locale_pt-BR.json
index 08ce9b45ca7..8d42a84e5c6 100644
--- a/options/locale/locale_pt-BR.json
+++ b/options/locale/locale_pt-BR.json
@@ -3228,6 +3228,8 @@
   "actions.workflow.enable": "Habilitar Workflow",
   "actions.workflow.enable_success": "Workflow '%s' habilitado com sucesso.",
   "actions.workflow.disabled": "Workflow está desativado.",
+  "actions.workflow.scope_owner": "Proprietário",
+  "actions.workflow.required": "Obrigatário",
   "actions.need_approval_desc": "Precisa de aprovação para executar workflows para pull request do fork.",
   "actions.variables": "Variáveis",
   "actions.variables.management": "Gerenciamento de Variáveis",
diff --git a/options/locale/locale_pt-PT.json b/options/locale/locale_pt-PT.json
index 6393abe4a7b..3d3627cf580 100644
--- a/options/locale/locale_pt-PT.json
+++ b/options/locale/locale_pt-PT.json
@@ -639,6 +639,7 @@
   "user.block.blocked": "Bloqueou este utilizador.",
   "user.block.title": "Bloquear um utilizador",
   "user.block.info": "Bloquear um utilizador impede que este interaja com os repositórios, tal como abrir ou comentar um pedido de integração ou uma questão.",
+  "user.block.info.docs": "Saiba mais sobre como bloquear um utilizador.",
   "user.block.user_to_block": "Utilizador a bloquear",
   "user.block.note": "Nota",
   "user.block.note.title": "Nota opcional:",
@@ -3828,7 +3829,13 @@
   "actions.workflow.enable": "Habilitar sequência de trabalho",
   "actions.workflow.enable_success": "A sequência de trabalho '%s' foi habilitada com sucesso.",
   "actions.workflow.disabled": "A sequência de trabalho está desabilitada.",
+  "actions.workflow.scope_owner": "Proprietário(a)",
+  "actions.workflow.scope_global": "Global",
+  "actions.workflow.required": "Obrigatório",
   "actions.workflow.run": "Executar sequência de trabalho",
+  "actions.workflow.create_status_badge": "Criar distintivo de estado",
+  "actions.workflow.status_badge": "Distintivo de estado",
+  "actions.workflow.status_badge_url": "URL do distintivo",
   "actions.workflow.not_found": "A sequência de trabalho '%s' não foi encontrada.",
   "actions.workflow.run_success": "A sequência de trabalho '%s' foi executada com sucesso.",
   "actions.workflow.from_ref": "Usar sequência de trabalho de",
diff --git a/options/locale/locale_ru-RU.json b/options/locale/locale_ru-RU.json
index 1eceaa73e54..8850172d0b9 100644
--- a/options/locale/locale_ru-RU.json
+++ b/options/locale/locale_ru-RU.json
@@ -2934,6 +2934,9 @@
   "actions.workflow.enable": "Включить рабочий поток",
   "actions.workflow.enable_success": "Рабочий поток «%s» успешно включен.",
   "actions.workflow.disabled": "Рабочий поток выключен.",
+  "actions.workflow.scope_owner": "Владелец",
+  "actions.workflow.scope_global": "Глобально",
+  "actions.workflow.required": "Требуется",
   "actions.need_approval_desc": "Требуется одобрение, чтобы запустить рабочие потоки для запроса на слияние.",
   "actions.variables": "Переменные",
   "actions.variables.management": "Управление переменными",
diff --git a/options/locale/locale_si-LK.json b/options/locale/locale_si-LK.json
index 3f793758235..42e60aed11d 100644
--- a/options/locale/locale_si-LK.json
+++ b/options/locale/locale_si-LK.json
@@ -2162,5 +2162,7 @@
   "actions.runners.version": "අනුවාදය",
   "actions.runs.commit": "කැප",
   "actions.runs.summary": "සාරාංශය",
+  "actions.workflow.scope_owner": "හිමිකරු",
+  "actions.workflow.required": "ඇවැසිය",
   "actions.general.token_permissions.mode.restricted": "සීමා"
 }
diff --git a/options/locale/locale_sk-SK.json b/options/locale/locale_sk-SK.json
index e4e548591b2..263c4180bfb 100644
--- a/options/locale/locale_sk-SK.json
+++ b/options/locale/locale_sk-SK.json
@@ -1149,5 +1149,7 @@
   "actions.runners.task_list.repository": "Repozitár",
   "actions.runners.status.unspecified": "Neznámy",
   "actions.runners.version": "Verzia",
-  "actions.runs.branch": "Vetva"
+  "actions.runs.branch": "Vetva",
+  "actions.workflow.scope_owner": "Vlastník",
+  "actions.workflow.scope_global": "Globálne"
 }
diff --git a/options/locale/locale_sv-SE.json b/options/locale/locale_sv-SE.json
index 08520a9ee92..3da29e3dc71 100644
--- a/options/locale/locale_sv-SE.json
+++ b/options/locale/locale_sv-SE.json
@@ -1720,5 +1720,6 @@
   "actions.runners.task_list.run": "Kör",
   "actions.runners.task_list.repository": "Utvecklingskatalog",
   "actions.runners.status.active": "Aktiv",
-  "actions.runs.summary": "Översikt"
+  "actions.runs.summary": "Översikt",
+  "actions.workflow.scope_owner": "Ägare"
 }
diff --git a/options/locale/locale_tr-TR.json b/options/locale/locale_tr-TR.json
index c758d253408..d1aeed537b8 100644
--- a/options/locale/locale_tr-TR.json
+++ b/options/locale/locale_tr-TR.json
@@ -3665,6 +3665,9 @@
   "actions.workflow.enable": "İş Akışını Etkinleştir",
   "actions.workflow.enable_success": "'%s' iş akışı başarıyla etkinleştirildi.",
   "actions.workflow.disabled": "İş akışı devre dışı.",
+  "actions.workflow.scope_owner": "Sahibi",
+  "actions.workflow.scope_global": "Genel",
+  "actions.workflow.required": "Gerekli",
   "actions.workflow.run": "İş Akışını Çalıştır",
   "actions.workflow.not_found": "'%s' iş akışı bulunamadı.",
   "actions.workflow.run_success": "'%s' iş akışı başarıyla çalıştırıldı.",
diff --git a/options/locale/locale_uk-UA.json b/options/locale/locale_uk-UA.json
index 0006b069d0d..0371ea91fe5 100644
--- a/options/locale/locale_uk-UA.json
+++ b/options/locale/locale_uk-UA.json
@@ -3115,6 +3115,8 @@
   "actions.workflow.enable": "Увімкнути робочий процес",
   "actions.workflow.enable_success": "Робочий процес '%s' успішно ввімкнено.",
   "actions.workflow.disabled": "Робочий процес вимкнений.",
+  "actions.workflow.scope_owner": "Власник",
+  "actions.workflow.required": "Обов'язково",
   "actions.workflow.run": "Запустити робочий процес",
   "actions.workflow.not_found": "Робочий процес '%s' не знайдено.",
   "actions.workflow.run_success": "Робочий процес '%s' завершився успішно.",
diff --git a/options/locale/locale_zh-CN.json b/options/locale/locale_zh-CN.json
index 7c3d45f5286..5a124266396 100644
--- a/options/locale/locale_zh-CN.json
+++ b/options/locale/locale_zh-CN.json
@@ -3832,6 +3832,9 @@
   "actions.workflow.enable": "启用工作流",
   "actions.workflow.enable_success": "工作流「%s」已成功启用。",
   "actions.workflow.disabled": "工作流已禁用。",
+  "actions.workflow.scope_owner": "拥有者",
+  "actions.workflow.scope_global": "全局",
+  "actions.workflow.required": "必须",
   "actions.workflow.run": "运行工作流",
   "actions.workflow.not_found": "未找到工作流「%s」。",
   "actions.workflow.run_success": "工作流「%s」已成功运行。",
diff --git a/options/locale/locale_zh-TW.json b/options/locale/locale_zh-TW.json
index 00e40b74fe9..ef25bbe25d8 100644
--- a/options/locale/locale_zh-TW.json
+++ b/options/locale/locale_zh-TW.json
@@ -3233,6 +3233,9 @@
   "actions.workflow.enable": "啟用工作流程",
   "actions.workflow.enable_success": "已成功啟用工作流程「%s」。",
   "actions.workflow.disabled": "工作流程已停用。",
+  "actions.workflow.scope_owner": "擁有者",
+  "actions.workflow.scope_global": "全域",
+  "actions.workflow.required": "必要",
   "actions.workflow.run": "執行工作流程",
   "actions.workflow.not_found": "找不到工作流程「%s」。",
   "actions.workflow.run_success": "工作流程「%s」執行成功。",
diff --git a/web_src/css/easymde.css b/web_src/css/easymde.css
index 9de6a1d431d..0d513cb8e2a 100644
--- a/web_src/css/easymde.css
+++ b/web_src/css/easymde.css
@@ -441,25 +441,12 @@
   padding: 5px;
 }
 
-.EasyMDEContainer .CodeMirror .cm-keyword { color: var(--color-syntax-keyword); }
-.EasyMDEContainer .CodeMirror .cm-atom { color: var(--color-syntax-keyword); }
-.EasyMDEContainer .CodeMirror .cm-number { color: var(--color-syntax-number); }
-.EasyMDEContainer .CodeMirror .cm-def { color: var(--color-syntax-name); }
-.EasyMDEContainer .CodeMirror .cm-variable-2 { color: var(--color-syntax-name); }
-.EasyMDEContainer .CodeMirror .cm-variable-3 { color: var(--color-syntax-type); }
-.EasyMDEContainer .CodeMirror .cm-property { color: var(--color-syntax-name); }
-.EasyMDEContainer .CodeMirror .cm-comment { color: var(--color-syntax-comment); }
-.EasyMDEContainer .CodeMirror .cm-string { color: var(--color-syntax-string); }
-.EasyMDEContainer .CodeMirror .cm-string-2 { color: var(--color-syntax-regexp); }
-.EasyMDEContainer .CodeMirror .cm-meta { color: var(--color-syntax-control); }
-.EasyMDEContainer .CodeMirror .cm-qualifier { color: var(--color-syntax-control); }
-.EasyMDEContainer .CodeMirror .cm-builtin { color: var(--color-syntax-keyword); }
-.EasyMDEContainer .CodeMirror .cm-bracket { color: var(--color-syntax-operator); }
-.EasyMDEContainer .CodeMirror .cm-tag { color: var(--color-syntax-type); }
 .EasyMDEContainer .CodeMirror .cm-attribute { color: var(--color-syntax-name); }
-.EasyMDEContainer .CodeMirror .cm-header { color: var(--color-syntax-type); }
-.EasyMDEContainer .CodeMirror .cm-quote { color: var(--color-syntax-comment); }
-.EasyMDEContainer .CodeMirror .cm-hr { color: var(--color-syntax-operator); }
-.EasyMDEContainer .CodeMirror .cm-url { color: var(--color-syntax-link); }
-.EasyMDEContainer .CodeMirror .cm-link { color: var(--color-syntax-link); }
+.EasyMDEContainer .CodeMirror .cm-bracket { color: var(--color-syntax-operator); }
+.EasyMDEContainer .CodeMirror .cm-comment { color: var(--color-syntax-comment); }
 .EasyMDEContainer .CodeMirror .cm-error { color: var(--color-syntax-invalid); }
+.EasyMDEContainer .CodeMirror .cm-hr { color: var(--color-syntax-operator); }
+.EasyMDEContainer .CodeMirror .cm-link { color: var(--color-syntax-link); }
+.EasyMDEContainer .CodeMirror .cm-quote { color: var(--color-syntax-comment); }
+.EasyMDEContainer .CodeMirror .cm-tag { color: var(--color-syntax-type); }
+.EasyMDEContainer .CodeMirror .cm-url { color: var(--color-syntax-link); }
diff --git a/web_src/css/modules/codeeditor.css b/web_src/css/modules/codeeditor.css
index 3212c04c830..d4be96845b9 100644
--- a/web_src/css/modules/codeeditor.css
+++ b/web_src/css/modules/codeeditor.css
@@ -17,6 +17,11 @@
   border: 1px solid var(--color-secondary);
 }
 
+.code-editor-container {
+  position: relative;
+  min-height: 90vh;
+}
+
 /* editor layout */
 .code-editor-container .cm-editor {
   color: var(--color-text);
@@ -24,8 +29,6 @@
   font-family: var(--fonts-monospace);
   font-size: 12px;
   max-height: 90vh;
-  flex: 1;
-  min-height: 0;
 }
 
 .code-editor-container .cm-editor,
@@ -33,20 +36,8 @@
   border-radius: 0 0 var(--border-radius) var(--border-radius);
 }
 
-.code-editor-container .cm-scroller {
-  overflow: auto;
-  line-height: var(--line-height-code);
-  flex: 1;
-  min-height: 0;
-}
-
 .code-editor-container .cm-content {
-  align-self: stretch;
-  padding: 0;
-}
-
-.code-editor-container .cm-content * {
-  caret-color: inherit;
+  caret-color: var(--color-caret);
 }
 
 .code-editor-container .cm-cursor,
@@ -54,10 +45,6 @@
   border-left-color: var(--color-caret);
 }
 
-.code-editor-container .cm-editor.cm-focused {
-  outline: none;
-}
-
 .code-editor-container .cm-editor.cm-focused > .cm-scroller > .cm-selectionLayer .cm-selectionBackground,
 .code-editor-container .cm-selectionBackground {
   background-color: var(--color-primary-alpha-30);
@@ -336,12 +323,6 @@
 }
 
 /* command palette */
-.code-editor-container {
-  position: relative;
-  min-height: 90vh;
-  display: flex;
-  flex-direction: column;
-}
 
 .cm-command-palette {
   position: absolute;