lint

This reverts commit 4427908340.

This should not have been committed to `develop`.

changelog.d/19079.bugfix

@@ -0,0 +1 @@
+Fix the `oidc_session_no_samesite` cookie to have the `Secure` attribute, so the only difference between it and the paired `oidc_session` cookie, is the configuration of the `SameSite` attribute as described in the comments / cookie names. Contributed by @kieranlane.

changelog.d/19084.misc

@@ -0,0 +1 @@
+Warn the developer when they are releasing Synapse if a release workflow has been queued for over 15 minutes.

scripts-dev/release.py

@@ -596,6 +596,16 @@ def _wait_for_actions(gh_token: Optional[str]) -> None:
         if len(resp["workflow_runs"]) == 0:
             continue
 
+        # Warn the user if any workflows are still queued. They might need to fix something.
+        if any(workflow["status"] == "queued" for workflow in resp["workflow_runs"]):
+            _notify("Warning: at least one release workflow is still queued...")
+            if not click.confirm("Continue waiting for queued assets?", default=True):
+                click.echo(
+                    "Continuing on with the release. Note that you may need to upload missing assets manually later."
+                )
+                break
+            continue
+
         if all(
             workflow["status"] != "in_progress" for workflow in resp["workflow_runs"]
         ):

synapse/handlers/oidc.py

@@ -96,7 +96,7 @@ logger = logging.getLogger(__name__)
 # Here we have the names of the cookies, and the options we use to set them.
 _SESSION_COOKIES = [
     (b"oidc_session", b"HttpOnly; Secure; SameSite=None"),
-    (b"oidc_session_no_samesite", b"HttpOnly"),
+    (b"oidc_session_no_samesite", b"HttpOnly; Secure"),
 ]