Weekly: Promote nightly to main (2026-08-17)

.claude/settings.json

@@ -10,5 +10,9 @@
   },
   "worktree": {
     "bgIsolation": "none"
+   },
+  "attribution": {
+    "commit": "",
+    "pr": ""
   }
 }

.github/renovate.json

@@ -244,6 +244,19 @@
       "datasourceTemplate": "golang-version",
       "versioningTemplate": "semver"
     },
+    {
+      "customType": "regex",
+      "description": "Track pinned Semgrep container image digest in the Semgrep CI workflow",
+      "managerFilePatterns": [
+        "/^\\.github/workflows/semgrep\\.yml$/"
+      ],
+      "matchStrings": [
+        "#\\s*renovate:\\s*datasource=docker\\s+depName=semgrep/semgrep\\s*\\n\\s*image:\\s*semgrep/semgrep:(?<currentValue>[^@\\s]+)@(?<currentDigest>sha256:[a-f0-9]+)"
+      ],
+      "depNameTemplate": "semgrep/semgrep",
+      "datasourceTemplate": "docker",
+      "versioningTemplate": "docker"
+    },
     {
       "customType": "regex",
       "description": "Track NODE_VERSION in Actions workflows",
@@ -275,11 +288,15 @@
       "description": "Track Syft version in workflows and scripts",
       "managerFilePatterns": [
         "/^\\.github/workflows/nightly-build\\.yml$/",
+        "/^\\.github/workflows/docker-build\\.yml$/",
+        "/^\\.github/workflows/supply-chain-pr\\.yml$/",
+        "/^\\.github/workflows/supply-chain-verify\\.yml$/",
         "/^\\.github/skills/security-scan-docker-image-scripts/run\\.sh$/"
       ],
       "matchStrings": [
         "SYFT_VERSION=\\\"v(?<currentValue>[^\\\"\\s]+)\\\"",
-        "set_default_env \\\"SYFT_VERSION\\\" \\\"v(?<currentValue>[^\\\"]+)\\\""
+        "set_default_env \\\"SYFT_VERSION\\\" \\\"v(?<currentValue>[^\\\"]+)\\\"",
+        "syft-version:\\s*v(?<currentValue>[^\\s]+)"
       ],
       "depNameTemplate": "anchore/syft",
       "datasourceTemplate": "github-releases",
@@ -396,6 +413,19 @@
       "datasourceTemplate": "go",
       "versioningTemplate": "semver"
     },
+    {
+      "customType": "regex",
+      "description": "Track github.com/klauspost/compress version ARG in Dockerfile",
+      "managerFilePatterns": [
+        "/^Dockerfile$/"
+      ],
+      "matchStrings": [
+        "#\\s*renovate:\\s*datasource=go\\s+depName=github\\.com/klauspost/compress\\s*\\nARG KLAUSPOST_COMPRESS_VERSION=(?<currentValue>[^\\s]+)"
+      ],
+      "depNameTemplate": "github.com/klauspost/compress",
+      "datasourceTemplate": "go",
+      "versioningTemplate": "semver"
+    },
     {
       "customType": "regex",
       "description": "Track golang-jwt/jwt v5 in go.mod via github-tags (workaround: Renovate go datasource no-result for /vN module paths)",

.github/skills/examples/gorm-scanner-ci-workflow.yml

@@ -25,7 +25,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
-          go-version: "1.26.5"
+          go-version: "1.26.6"
 
       - name: Run GORM Security Scanner
         id: gorm-scan

.github/skills/security-scan-docker-image-scripts/run.sh

@@ -35,7 +35,7 @@ fi
 # Check Grype
 if ! command -v grype >/dev/null 2>&1; then
     log_error "Grype not found - install from: https://github.com/anchore/grype"
-    log_error "Installation: curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin v0.116.1"
+    log_error "Installation: curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin v0.117.0"
     error_exit "Grype is required for vulnerability scanning" 2
 fi
 
@@ -50,8 +50,8 @@ SYFT_INSTALLED_VERSION=$(syft version | grep -oP 'Version:\s*\Kv?[0-9]+\.[0-9]+\
 GRYPE_INSTALLED_VERSION=$(grype version | grep -oP 'Version:\s*\Kv?[0-9]+\.[0-9]+\.[0-9]+' | head -1 || echo "unknown")
 
 # Set defaults matching CI workflow
-set_default_env "SYFT_VERSION" "v1.50.0"
-set_default_env "GRYPE_VERSION" "v0.116.1"
+set_default_env "SYFT_VERSION" "v1.51.0"
+set_default_env "GRYPE_VERSION" "v0.117.0"
 set_default_env "IMAGE_TAG" "charon:local"
 set_default_env "FAIL_ON_SEVERITY" "Critical,High"
 

.github/workflows/benchmark.yml

@@ -12,7 +12,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  GO_VERSION: '1.26.5'
+  GO_VERSION: '1.26.6'
   GOTOOLCHAIN: local
 
 # Minimal permissions at workflow level; write permissions granted at job level for push only

.github/workflows/codecov-upload.yml

@@ -28,7 +28,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  GO_VERSION: '1.26.5'
+  GO_VERSION: '1.26.6'
   NODE_VERSION: '24.19.0'
   GOTOOLCHAIN: local
 

.github/workflows/codeql.yml

@@ -15,7 +15,7 @@ concurrency:
 
 env:
   GOTOOLCHAIN: local
-  GO_VERSION: '1.26.5'
+  GO_VERSION: '1.26.6'
 
 permissions:
   contents: read
@@ -52,7 +52,7 @@ jobs:
         run: bash scripts/ci/check-codeql-parity.sh
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
+        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
         with:
           languages: ${{ matrix.language }}
           queries: security-and-quality
@@ -92,11 +92,11 @@ jobs:
         run: mkdir -p sarif-results
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
+        uses: github/codeql-action/autobuild@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
 
       - name: Perform CodeQL Analysis
         id: codeql_analyze
-        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
+        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
         with:
           category: "/language:${{ matrix.language }}"
           output: sarif-results/${{ matrix.language }}

.github/workflows/docker-build.yml

@@ -912,7 +912,7 @@ jobs:
           format: 'table'
           severity: 'CRITICAL,HIGH'
           exit-code: '0'
-          version: 'v0.73.0'
+          version: 'v0.74.0'
           trivyignores: '.trivyignore'
         continue-on-error: true
 
@@ -925,7 +925,7 @@ jobs:
           format: 'sarif'
           output: 'trivy-results.sarif'
           severity: 'CRITICAL,HIGH'
-          version: 'v0.73.0'
+          version: 'v0.74.0'
           trivyignores: '.trivyignore'
         continue-on-error: true
 
@@ -941,7 +941,7 @@ jobs:
 
       - name: Upload Trivy results
         if: env.TRIGGER_EVENT != 'pull_request' && steps.trivy-check.outputs.exists == 'true'
-        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           sarif_file: 'trivy-results.sarif'
           category: ${{ env.TRIVY_SARIF_CATEGORY }}
@@ -964,22 +964,68 @@ jobs:
 
       # Generate SBOM (Software Bill of Materials) for supply chain security
       # Only for production builds (main/development) - feature branches use downstream supply-chain-pr.yml
+      # anchore/sbom-action resolves the pinned syft release tag against the GitHub
+      # API at job runtime; transient upstream 5xx/rate-limit errors there fail the
+      # step even though the pin itself is valid, so continue-on-error + a
+      # deterministic pinned-Syft fallback (below) makes this resilient.
       - name: Generate SBOM
+        id: sbom_primary
+        continue-on-error: true
         uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
         if: env.TRIGGER_EVENT != 'pull_request' && needs.setup.outputs.is_feature_push != 'true'
         with:
           image: ${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.merge.outputs.digest }}
           format: cyclonedx-json
           output-file: sbom.cyclonedx.json
-          syft-version: v1.45.1
+          syft-version: v1.51.0
+
+      - name: Generate SBOM fallback with pinned Syft
+        if: env.TRIGGER_EVENT != 'pull_request' && needs.setup.outputs.is_feature_push != 'true' && always()
+        run: |
+          set -euo pipefail
+
+          if [[ "${{ steps.sbom_primary.outcome }}" == "success" ]] && [[ -s sbom.cyclonedx.json ]] && jq -e . sbom.cyclonedx.json >/dev/null 2>&1; then
+            echo "Primary SBOM generation succeeded with valid JSON; skipping fallback"
+            exit 0
+          fi
+
+          echo "Primary SBOM generation failed or produced missing/invalid output; using deterministic Syft fallback"
+
+          SYFT_VERSION="v1.51.0"
+          OS="$(uname -s | tr '[:upper:]' '[:lower:]')"
+          ARCH="$(uname -m)"
+          case "$ARCH" in
+            x86_64) ARCH="amd64" ;;
+            aarch64|arm64) ARCH="arm64" ;;
+            *) echo "Unsupported architecture: $ARCH"; exit 1 ;;
+          esac
+
+          TARBALL="syft_${SYFT_VERSION#v}_${OS}_${ARCH}.tar.gz"
+          BASE_URL="https://github.com/anchore/syft/releases/download/${SYFT_VERSION}"
+
+          curl -fsSLo "$TARBALL" "${BASE_URL}/${TARBALL}"
+          curl -fsSLo checksums.txt "${BASE_URL}/syft_${SYFT_VERSION#v}_checksums.txt"
+
+          grep "  ${TARBALL}$" checksums.txt > checksum_line.txt
+          sha256sum -c checksum_line.txt
+
+          tar -xzf "$TARBALL" syft
+          chmod +x syft
+
+          DIGEST="${{ steps.merge.outputs.digest }}"
+          if [[ -z "$DIGEST" ]]; then
+            echo "::error::Digest from merge step is empty; the merge step did not complete successfully"
+            exit 1
+          fi
+          ./syft "${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}@${DIGEST}" -o cyclonedx-json=sbom.cyclonedx.json
 
       # Create verifiable attestation for the SBOM
       # (actions/attest-sbom is deprecated; actions/attest supports sbom-path natively)
       # GitHub's OIDC token endpoint occasionally fails transiently
       # ("CI: no tokens available"), so retry once before failing the build
       - name: Attest SBOM
         id: attest-sbom
-        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         if: env.TRIGGER_EVENT != 'pull_request' && needs.setup.outputs.is_feature_push != 'true'
         continue-on-error: true
         with:
@@ -1152,7 +1198,7 @@ jobs:
           trivyignores: '.trivyignore'
           severity: 'CRITICAL,HIGH'
           exit-code: '0'
-          version: 'v0.73.0'
+          version: 'v0.74.0'
 
       - name: Run Trivy scan on PR image (SARIF - blocking)
         id: trivy-scan
@@ -1167,7 +1213,7 @@ jobs:
           # Keep scanning strict for CRITICAL/HIGH; fail is enforced explicitly
           # at the end so SARIF upload and summaries still run.
           exit-code: '1'
-          version: 'v0.73.0'
+          version: 'v0.74.0'
         continue-on-error: true
 
       - name: Check Trivy PR SARIF exists
@@ -1182,7 +1228,7 @@ jobs:
 
       - name: Upload Trivy scan results
         if: always() && steps.trivy-pr-check.outputs.exists == 'true'
-        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           sarif_file: 'trivy-pr-results.sarif'
           category: ${{ env.TRIVY_SARIF_CATEGORY }}
@@ -1285,15 +1331,15 @@ jobs:
                       $result.ruleId
                       // ($result.rule // {} | .id)
                       // (
-                        if ($result.ruleIndex != null and (($run.tool.driver.rules? // null) | type) == \"array\") then
-                          ($run.tool.driver.rules[$result.ruleIndex].id // \"unknown\")
+                        if ($result.ruleIndex != null and (($run.tool.driver.rules? // null) | type) == "array") then
+                          ($run.tool.driver.rules[$result.ruleIndex].id // "unknown")
                         else
-                          \"unknown\"
+                          "unknown"
                         end
                       )
                     )) | package: \((
-                      ($result.message.text // \"\")
-                      | (try capture(\"(?i)(?:Package|PkgName|Pkg|Library)\\\\s*[:=]\\\\s*`?(?<pkg>[A-Za-z0-9._+:+-]+)`?\").pkg catch \"n/a\")
+                      ($result.message.text // "")
+                      | (try capture("(?i)(?:Package|PkgName|Pkg|Library)\\s*[:=]\\s*`?(?<pkg>[A-Za-z0-9._+:/-]+)`?").pkg catch "n/a")
                     ))"
                 ' "${SARIF_PATH}"; then
                   echo "- unable to render parsed findings"

.github/workflows/e2e-tests-split.yml

@@ -83,7 +83,7 @@ on:
 
 env:
   NODE_VERSION: '24.19.0'
-  GO_VERSION: '1.26.5'
+  GO_VERSION: '1.26.6'
   GOTOOLCHAIN: local
   DOCKERHUB_REGISTRY: docker.io
   IMAGE_NAME: ${{ github.repository_owner }}/charon

.github/workflows/nightly-build.yml

@@ -15,7 +15,7 @@ on:
       default: "false"
 
 env:
-  GO_VERSION: '1.26.5'
+  GO_VERSION: '1.26.6'
   NODE_VERSION: '24.19.0'
   GOTOOLCHAIN: local
   GHCR_REGISTRY: ghcr.io
@@ -285,9 +285,9 @@ jobs:
         uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610  # v0.24.0
         with:
           image: ${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.resolve_digest.outputs.digest }}
-          format: cyclonedx-json
+          format: spdx-json
           output-file: sbom-nightly.json
-          syft-version: v1.45.1
+          syft-version: v1.51.0
 
       - name: Generate SBOM fallback with pinned Syft
         if: always()
@@ -301,7 +301,7 @@ jobs:
 
           echo "Primary SBOM generation failed or produced missing/invalid output; using deterministic Syft fallback"
 
-          SYFT_VERSION="v1.50.0"
+          SYFT_VERSION="v1.51.0"
           OS="$(uname -s | tr '[:upper:]' '[:lower:]')"
           ARCH="$(uname -m)"
           case "$ARCH" in
@@ -327,7 +327,7 @@ jobs:
             echo "::error::Digest from resolve_digest step is empty; the digest-resolution step did not complete successfully"
             exit 1
           fi
-          ./syft "${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}@${DIGEST}" -o cyclonedx-json=sbom-nightly.json
+          ./syft "${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}@${DIGEST}" -o spdx-json=sbom-nightly.json
 
       - name: Verify SBOM artifact
         if: always()
@@ -336,11 +336,9 @@ jobs:
           test -s sbom-nightly.json
           jq -e . sbom-nightly.json >/dev/null
           jq -e '
-            .bomFormat == "CycloneDX"
-            and (.specVersion | type == "string" and length > 0)
-            and has("version")
-            and has("metadata")
-            and (.components | type == "array")
+            (.spdxVersion | type == "string" and length > 0)
+            and has("SPDXID")
+            and (.packages | type == "array")
           ' sbom-nightly.json >/dev/null
 
       - name: Upload SBOM artifact
@@ -614,11 +612,11 @@ jobs:
           image-ref: ${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}:nightly@${{ needs.build-and-push-nightly.outputs.digest }}
           format: 'sarif'
           output: 'trivy-nightly.sarif'
-          version: 'v0.73.0'
+          version: 'v0.74.0'
           trivyignores: '.trivyignore'
 
       - name: Upload Trivy results
-        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3  # v4.37.6
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd  # v4.37.7
         with:
           sarif_file: 'trivy-nightly.sarif'
           category: 'trivy-nightly'

.github/workflows/orthrus-build.yml

@@ -29,7 +29,7 @@ env:
   GHCR_REGISTRY: ghcr.io
   DOCKERHUB_REGISTRY: docker.io
   IMAGE_NAME: wikid82/orthrus
-  GO_VERSION: '1.26.5'
+  GO_VERSION: '1.26.6'
 
 permissions:
   contents: read

.github/workflows/quality-checks.yml

@@ -16,7 +16,7 @@ permissions:
   checks: write
 
 env:
-  GO_VERSION: '1.26.5'
+  GO_VERSION: '1.26.6'
   NODE_VERSION: '24.19.0'
   GOTOOLCHAIN: local
 

.github/workflows/renovate.yml

@@ -16,7 +16,7 @@ permissions:
   issues: write
 
 env:
-  GO_VERSION: '1.26.5'
+  GO_VERSION: '1.26.6'
 
 jobs:
   renovate: