Weekly: Promote nightly to main (2026-06-29)

.claude/settings.json

@@ -0,0 +1,14 @@
+{
+  "enabledPlugins": {
+    "frontend-design@claude-plugins-official": true,
+    "superpowers@claude-plugins-official": true,
+    "github@claude-plugins-official": true,
+    "playwright@claude-plugins-official": true,
+    "typescript-lsp@claude-plugins-official": true,
+    "semgrep@claude-plugins-official": true,
+    "pr-review-toolkit@claude-plugins-official": true
+  },
+  "worktree": {
+    "bgIsolation": "none"
+  }
+}

.github/renovate.json

@@ -27,7 +27,8 @@
 
   "ignoreDeps": [
     "github.com/gorilla/websocket",
-    "github.com/golang-jwt/jwt/v5"
+    "github.com/golang-jwt/jwt/v5",
+    "js-yaml"
   ],
 
   "minimumReleaseAge": null,
@@ -413,16 +414,6 @@
     ]
   },
   "packageRules": [
-    {
-      "description": "Pin js-yaml to v4.x — transitive dependents (@eslint/eslintrc, markdownlint-cli2) use v4 API internally; v5 is a breaking rewrite incompatible with their pinned calls",
-      "matchDatasources": [
-        "npm"
-      ],
-      "matchPackageNames": [
-        "js-yaml"
-      ],
-      "allowedVersions": "<5.0.0"
-    },
     {
       "description": "Group GitHub Actions non-major updates into one PR",
       "matchManagers": [
@@ -753,6 +744,23 @@
         "github.com/gin-contrib/sse"
       ],
       "sourceUrl": "https://github.com/gin-contrib/sse"
+    },
+    {
+      "description": "Fix Renovate lookup for prometheus/client_golang",
+      "matchDatasources": [
+        "go"
+      ],
+      "matchPackageNames": [
+        "github.com/prometheus/client_golang"
+      ],
+      "sourceUrl": "https://github.com/prometheus/client_golang"
+    },
+    {
+      "description": "Disable js-yaml updates — pinned in overrides for security; managed manually",
+      "matchPackageNames": [
+        "js-yaml"
+      ],
+      "enabled": false
     }
   ]
 }

.github/skills/examples/gorm-scanner-ci-workflow.yml

@@ -23,7 +23,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version: "1.26.4"
 

.github/skills/security-scan-docker-image-scripts/run.sh

@@ -35,7 +35,7 @@ fi
 # Check Grype
 if ! command -v grype >/dev/null 2>&1; then
     log_error "Grype not found - install from: https://github.com/anchore/grype"
-    log_error "Installation: curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin v0.114.0"
+    log_error "Installation: curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin v0.115.0"
     error_exit "Grype is required for vulnerability scanning" 2
 fi
 
@@ -50,8 +50,8 @@ SYFT_INSTALLED_VERSION=$(syft version | grep -oP 'Version:\s*\Kv?[0-9]+\.[0-9]+\
 GRYPE_INSTALLED_VERSION=$(grype version | grep -oP 'Version:\s*\Kv?[0-9]+\.[0-9]+\.[0-9]+' | head -1 || echo "unknown")
 
 # Set defaults matching CI workflow
-set_default_env "SYFT_VERSION" "v1.45.1"
-set_default_env "GRYPE_VERSION" "v0.114.0"
+set_default_env "SYFT_VERSION" "v1.46.0"
+set_default_env "GRYPE_VERSION" "v0.115.0"
 set_default_env "IMAGE_TAG" "charon:local"
 set_default_env "FAIL_ON_SEVERITY" "Critical,High"
 

.github/workflows/auto-changelog.yml

@@ -24,6 +24,6 @@ jobs:
         with:
           ref: ${{ github.event.workflow_run.head_sha || github.sha }}
       - name: Draft Release
-        uses: release-drafter/release-drafter@ed4bc48ec97379be2258e7b7ac2624a3e26ab809 # v7
+        uses: release-drafter/release-drafter@4d75298e00d9e34c483e5ff8c68d0ea1c1940c1e # v7
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/benchmark.yml

@@ -39,7 +39,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha || github.event.workflow_run.head_sha || github.sha }}
 
       - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version-file: backend/go.mod
 

.github/workflows/codecov-upload.yml

@@ -24,7 +24,7 @@ concurrency:
 
 env:
   GO_VERSION: '1.26.4'
-  NODE_VERSION: '24.17.0'
+  NODE_VERSION: '24.18.0'
   GOTOOLCHAIN: local
 
 permissions:
@@ -45,7 +45,7 @@ jobs:
           ref: ${{ github.sha }}
 
       - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version-file: backend/go.mod
 

.github/workflows/codeql.yml

@@ -63,7 +63,7 @@ jobs:
 
       - name: Setup Go
         if: matrix.language == 'go'
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version-file: backend/go.mod
           cache-dependency-path: backend/go.sum

.github/workflows/docs-to-issues.yml

@@ -23,7 +23,7 @@ concurrency:
   cancel-in-progress: false
 
 env:
-  NODE_VERSION: '24.17.0'
+  NODE_VERSION: '24.18.0'
 
 permissions:
   contents: write

.github/workflows/docs.yml

@@ -18,7 +18,7 @@ concurrency:
   cancel-in-progress: false
 
 env:
-  NODE_VERSION: '24.17.0'
+  NODE_VERSION: '24.18.0'
 
 jobs:
   build:

.github/workflows/e2e-tests-split.yml

@@ -82,7 +82,7 @@ on:
   pull_request:
 
 env:
-  NODE_VERSION: '24.17.0'
+  NODE_VERSION: '24.18.0'
   GO_VERSION: '1.26.4'
   GOTOOLCHAIN: local
   DOCKERHUB_REGISTRY: docker.io
@@ -142,7 +142,7 @@ jobs:
 
       - name: Set up Go
         if: steps.resolve-image.outputs.image_source == 'build'
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version-file: backend/go.mod
 
@@ -158,7 +158,7 @@ jobs:
 
       - name: Cache npm dependencies
         if: steps.resolve-image.outputs.image_source == 'build'
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: ~/.npm
           key: npm-${{ hashFiles('package-lock.json') }}

.github/workflows/nightly-build.yml

@@ -16,7 +16,7 @@ on:
 
 env:
   GO_VERSION: '1.26.4'
-  NODE_VERSION: '24.17.0'
+  NODE_VERSION: '24.18.0'
   GOTOOLCHAIN: local
   GHCR_REGISTRY: ghcr.io
   DOCKERHUB_REGISTRY: docker.io
@@ -298,7 +298,7 @@ jobs:
 
           echo "Primary SBOM generation failed or produced missing/invalid output; using deterministic Syft fallback"
 
-          SYFT_VERSION="v1.45.1"
+          SYFT_VERSION="v1.46.0"
           OS="$(uname -s | tr '[:upper:]' '[:lower:]')"
           ARCH="$(uname -m)"
           case "$ARCH" in

.github/workflows/propagate-changes.yml

@@ -11,7 +11,7 @@ concurrency:
   cancel-in-progress: false
 
 env:
-  NODE_VERSION: '24.17.0'
+  NODE_VERSION: '24.18.0'
 
 permissions:
   contents: write

.github/workflows/quality-checks.yml

@@ -17,7 +17,7 @@ permissions:
 
 env:
   GO_VERSION: '1.26.4'
-  NODE_VERSION: '24.17.0'
+  NODE_VERSION: '24.18.0'
   GOTOOLCHAIN: local
 
 jobs:
@@ -31,7 +31,7 @@ jobs:
           ref: ${{ github.sha }}
 
       - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: backend/go.mod
 
@@ -138,7 +138,7 @@ jobs:
           } >> "$GITHUB_ENV"
 
       - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: backend/go.mod
 

.github/workflows/release-goreleaser.yml

@@ -11,7 +11,7 @@ concurrency:
 
 env:
   GO_VERSION: '1.26.4'
-  NODE_VERSION: '24.17.0'
+  NODE_VERSION: '24.18.0'
   GOTOOLCHAIN: local
 
 permissions:
@@ -45,7 +45,7 @@ jobs:
           fi
 
       - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version-file: backend/go.mod
 

.github/workflows/renovate.yml

@@ -28,12 +28,12 @@ jobs:
           fetch-depth: 1
 
       - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version-file: backend/go.mod
 
       - name: Run Renovate
-        uses: renovatebot/github-action@8217b3fc286df088d7c27f3255fe8414463bc0fd # v46.1.15
+        uses: renovatebot/github-action@6d859fc95779be83a0335ca704879b47e5d79641 # v46.1.16
         with:
           configurationFile: .github/renovate.json
           token: ${{ secrets.RENOVATE_TOKEN || secrets.GITHUB_TOKEN }}

.github/workflows/supply-chain-pr.yml

@@ -288,7 +288,7 @@ jobs:
       - name: Install Grype
         if: steps.set-target.outputs.image_name != ''
         run: |
-          curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin v0.114.0
+          curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin v0.115.0
 
       - name: Scan for vulnerabilities
         if: steps.set-target.outputs.image_name != ''

.github/workflows/weekly-nightly-promotion.yml

@@ -25,7 +25,7 @@ concurrency:
   cancel-in-progress: false
 
 env:
-  NODE_VERSION: '24.17.0'
+  NODE_VERSION: '24.18.0'
   SOURCE_BRANCH: 'nightly'
   TARGET_BRANCH: 'main'
 
@@ -339,7 +339,7 @@ jobs:
 
             1. **Review** the commit summary above
             2. **Approve** if changes look correct
-            3. **Merge** using "Merge commit" to preserve history
+            3. **Merge** using "Squash merge" or "Rebase merge" — do **NOT** use "Merge commit" (merge commits cause divergence that breaks the next weekly promotion)
 
             ---
 
@@ -430,6 +430,8 @@ jobs:
     steps:
       - name: Dispatch missing required workflows on nightly head
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
+        env:
+          PR_NUMBER: ${{ needs.create-promotion-pr.outputs.pr_number }}
         with:
           script: |
             const owner = context.repo.owner;
@@ -443,7 +445,7 @@ jobs:
             const nightlyHeadSha = nightlyBranch.commit.sha;
             core.info(`Current nightly HEAD for dispatch fallback: ${nightlyHeadSha}`);
 
-            const prNumber = '${{ needs.create-promotion-pr.outputs.pr_number }}';
+            const prNumber = process.env.PR_NUMBER;
             const requiredWorkflows = [
               { id: 'e2e-tests-split.yml' },
               { id: 'codeql.yml' },

.gitignore

@@ -332,3 +332,4 @@ backend/***_cov.txt
 charon-scan.tar
 .claude/scheduled_tasks.lock
 .claude/worktrees/
+scripts/tempCodeRunnerFile.sh