feat(release): develop to main

.agents/skills/workflow/SKILL.md

@@ -211,6 +211,21 @@ The two modes have opposite goals — design them accordingly:
 
 **Real run (`false`):** no extra `echo`, no debug flags, let failures surface via exit codes, one `::notice::` summary on success at most.
 
+**Exception — `continue-on-error` steps must annotate their own failures.** The
+rule above leans on the exit code to carry a failure. A step that deliberately
+swallows its exit code has no such channel, so a failure there is invisible: the
+job reports success and nobody looks at the log. Emit `::warning::` on the
+failure path.
+
+This is not hypothetical. `pr-validation.yml`'s breaking-change comment took a
+403 on every run from 2026-08-06 and reported success each time, because the
+step was `continue-on-error` and said nothing. The comment it posts explains to
+an author what to add; for two months it never arrived, and the only symptom was
+a blocking check failing with no explanation.
+
+Gate the annotation on the failure itself (`if: steps.<id>.outcome == 'failure'`)
+so a successful run stays silent.
+
 ## Step section titles
 
 When a job has more than one logical group of steps, separate each group with a titled section comment:

.github/labels.yml

@@ -82,6 +82,10 @@
   color: "b60205"
   description: Callers must update their workflow configuration after this change
 
+- name: awaiting-breaking-approval
+  color: "fbca04"
+  description: A breaking change on this PR is waiting on a human decision
+
 # ── Capabilities ──────────────────────────────────────────────────────────────
 
 - name: build

.github/workflows/api-dog-e2e-tests.yml

@@ -55,7 +55,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
           node-version: ${{ inputs.node_version }}
 
@@ -131,7 +131,7 @@ jobs:
 
       - name: Upload Test Reports
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: apidog-e2e-test-reports-${{ env.TAG_TYPE }}
           path: ./apidog-reports

.github/workflows/build.yml

@@ -1057,7 +1057,7 @@ jobs:
 
       - name: Upload GitOps tag artifact
         if: inputs.enable_gitops_artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: gitops-tags-${{ matrix.app.name }}
           path: gitops-tags/
@@ -1087,7 +1087,7 @@ jobs:
 
       - name: Upload Helm component artifact
         if: inputs.emit_component_artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: helm-components-${{ matrix.app.name }}
           path: helm-components/

.github/workflows/dispatch-helm.yml

@@ -193,7 +193,7 @@ jobs:
       # the run instead and they are reassembled here, after every build finished.
       - name: Download component artifacts
         if: inputs.components_artifact_pattern != ''
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           pattern: ${{ inputs.components_artifact_pattern }}
           path: .helm-components

.github/workflows/end-to-end-tests.yml

@@ -106,7 +106,7 @@ jobs:
           go-version: ${{ inputs.go_version }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
           node-version: ${{ inputs.node_version }}
 
@@ -142,7 +142,7 @@ jobs:
 
       - name: Upload Allure reports (GitHub artifact)
         if: always() && steps.plan.outputs.has_modules == 'true' && !inputs.dry_run
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: e2e-allure-reports
           path: reports/allure-report-*

.github/workflows/frontend-pr-analysis.yml

@@ -441,7 +441,7 @@ jobs:
 
       - name: Upload coverage artifact
         if: inputs.enable_coverage
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: coverage-${{ matrix.app.name }}
           path: |
@@ -467,7 +467,7 @@ jobs:
           persist-credentials: false
 
       - name: Download coverage artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: coverage-${{ matrix.app.name }}
           path: ${{ matrix.app.working_dir }}/coverage
@@ -940,7 +940,7 @@ jobs:
 
       - name: Upload visual regression report
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: visual-regression-report-${{ matrix.app.name }}
           path: |

.github/workflows/gitops-update.yml

@@ -428,7 +428,7 @@ jobs:
 
       - name: Download GitOps tag artifacts (pattern-based)
         id: download-pattern
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           pattern: ${{ steps.setup.outputs.artifact_pattern }}
           path: .gitops-tags
@@ -439,7 +439,7 @@ jobs:
 
       - name: Fallback to legacy artifact name
         if: steps.download-pattern.outcome == 'failure'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: gitops-tags
           path: .gitops-tags
@@ -1204,7 +1204,7 @@ jobs:
 
       - name: Upload sync result artifact
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v5
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v5
         with:
           name: argocd-sync-result-${{ matrix.target.server }}-${{ steps.record.outputs.safe_env }}
           path: /tmp/argocd-sync-result/
@@ -1225,7 +1225,7 @@ jobs:
       anacleto_sync_ok: ${{ steps.aggregate.outputs.anacleto_sync_ok }}
     steps:
       - name: Download all sync result artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           pattern: argocd-sync-result-anacleto-*
           path: .sync-results

.github/workflows/go-ci.yml

@@ -145,7 +145,7 @@ jobs:
 
       - name: Upload coverage artifact
         if: inputs.enable_coverage_comment && matrix.os == 'ubuntu-latest' && matrix.go == inputs.go_version_lint
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: coverage-report
           path: coverage.txt
@@ -165,7 +165,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Download coverage artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8
         with:
           name: coverage-report
 
@@ -244,7 +244,7 @@ jobs:
           done
 
       - name: Upload build artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: binaries
           path: build/

.github/workflows/go-fuzz.yml

@@ -77,10 +77,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version: ${{ inputs.go_version }}
 
@@ -104,7 +104,7 @@ jobs:
 
       - name: Upload Fuzz Artifacts
         if: ${{ !inputs.dry_run && steps.fuzz.outcome == 'failure' }}
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: fuzz-failures
           path: ${{ inputs.fuzz_artifacts_path }}

.github/workflows/go-pr-analysis.yml

@@ -401,7 +401,7 @@ jobs:
 
       - name: Upload Gosec SARIF
         if: always()
-        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           sarif_file: gosec-${{ matrix.app.name }}.sarif
           category: gosec-${{ matrix.app.name }}
@@ -618,7 +618,7 @@ jobs:
           fi
 
       - name: Upload coverage artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: coverage-${{ matrix.app.name }}
           path: ${{ matrix.app.working_dir }}/coverage.txt
@@ -652,7 +652,7 @@ jobs:
           cache: true
 
       - name: Download coverage artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: coverage-${{ matrix.app.name }}
           path: ${{ matrix.app.working_dir }}
@@ -791,7 +791,7 @@ jobs:
           fi
 
       - name: Upload coverage report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: coverage-report-${{ matrix.app.name }}
           path: |

.github/workflows/go-pr-coverage-comment.yml

@@ -64,7 +64,7 @@ jobs:
       has_comments: ${{ steps.post.outputs.has_comments }}
     steps:
       - name: Download coverage-report artifacts from the source run
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           github-token: ${{ secrets.token || github.token }}
           run-id: ${{ inputs.source_run_id }}

.github/workflows/go-security.yml

@@ -124,7 +124,7 @@ jobs:
 
       - name: Upload Gosec SARIF
         if: always() && inputs.upload_sarif
-        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           sarif_file: gosec-results.sarif
           category: gosec
@@ -220,7 +220,7 @@ jobs:
 
       - name: Upload Trivy SARIF
         if: always() && inputs.upload_sarif
-        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           sarif_file: trivy-results.sarif
           category: trivy
@@ -307,7 +307,7 @@ jobs:
           cat licenses.txt
 
       - name: Upload license report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: license-report
           path: licenses.txt
@@ -335,7 +335,7 @@ jobs:
           output-file: sbom.spdx.json
 
       - name: Upload SBOM
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: sbom
           path: sbom.spdx.json

.github/workflows/js-alpha-preview.yml

@@ -189,7 +189,7 @@ jobs:
       # ----------------- Build -----------------
       - name: Setup Node.js
         if: steps.resolve.outputs.has-product == 'true'
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
           node-version: '20'
 

.github/workflows/js-release.yml

@@ -448,7 +448,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
           node-version: ${{ inputs.node_version }}
           cache: 'npm'
@@ -467,7 +467,7 @@ jobs:
 
       - name: Upload Playwright report
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: playwright-report
           path: playwright-report/

.github/workflows/pr-security-scan.yml

@@ -421,7 +421,7 @@ jobs:
       # autobuild with whatever `v1` points at today (issue #866).
       - name: Initialize CodeQL
         if: steps.codeql-config.outputs.skip != 'true'
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           languages: ${{ inputs.codeql_languages }}
           queries: security-extended
@@ -437,11 +437,11 @@ jobs:
 
       - name: Autobuild
         if: steps.codeql-config.outputs.skip != 'true'
-        uses: github/codeql-action/autobuild@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/autobuild@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
 
       - name: Perform CodeQL Analysis
         if: steps.codeql-config.outputs.skip != 'true'
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           category: '/language:${{ inputs.codeql_languages }}'
           output: '../results'