chore: promote consolidated dependency updates to master (#62)

.github/scripts/test_backend_runtime.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# Verify the loaded PR image on its declared JRE, including application startup.
+set -euo pipefail
+image="${1:?Expected the loaded candidate image}"
+[[ "$image" =~ ^[a-zA-Z0-9][a-zA-Z0-9_.:/@-]*$ ]] || exit 2
+root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)"
+expected="$(sed -nE 's/^FROM eclipse-temurin:([0-9]+)-jre([@[:space:]].*)?$/\1/p' "$root/docker/Dockerfile.backend")"
+[[ "$expected" =~ ^[0-9]+$ ]] || { echo 'Runtime JRE declaration is ambiguous.' >&2; exit 1; }
+state="$(mktemp -d "${RUNNER_TEMP:-${TMPDIR:-/tmp}}/vault-runtime.XXXXXX")"
+chmod 700 "$state"
+network_id=''
+database_id=''
+application_id=''
+cleanup() {
+  [[ -z "$application_id" ]] || docker rm -f "$application_id" >/dev/null 2>&1 || true
+  [[ -z "$database_id" ]] || docker rm -f "$database_id" >/dev/null 2>&1 || true
+  [[ -z "$network_id" ]] || docker network rm "$network_id" >/dev/null 2>&1 || true
+  rm -rf "$state"
+}
+trap cleanup EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
+docker run --rm --pull=never --network none "$image" \
+  java -XshowSettings:properties -version > "$state/java-version" 2>&1
+actual="$(awk '$1 == "java.specification.version" && $2 == "=" { print $3 }' "$state/java-version")"
+[[ "$actual" == "$expected" ]] || { echo 'Loaded candidate JRE differs from its Dockerfile.' >&2; exit 1; }
+echo "Candidate JRE $actual verified."
+
+scope="vault-smoke-${state##*/}"
+network_id="$(docker network create --label vypdev.verification=runtime "$scope")"
+database_id="$(docker run -d --network "$network_id" --network-alias database \
+  --memory 512m --cpus 1 -e POSTGRES_DB=runtime_test \
+  -e POSTGRES_USER=runtime_test -e POSTGRES_PASSWORD=runtime_test postgres:16-alpine)"
+ready=false
+for _ in $(seq 1 30); do
+  if docker exec "$database_id" pg_isready -U runtime_test -d runtime_test >/dev/null 2>&1; then ready=true; break; fi
+  sleep 2
+done
+[[ "$ready" == true ]] || { echo 'Private smoke database did not become ready.' >&2; docker logs --tail 100 "$database_id" >&2 || true; exit 1; }
+
+application_id="$(docker run -d --pull=never --network "$network_id" \
+  --memory 768m --cpus 2 \
+  -e DATABASE_URL=jdbc:postgresql://database:5432/runtime_test \
+  -e DATABASE_USER=runtime_test -e DATABASE_PASSWORD=runtime_test \
+  -e 'JAVA_OPTS=-Xms64m -Xmx384m' \
+  -e JWT_SECRET=runtime-smoke-only-not-a-production-secret "$image")"
+deadline=$(( $(date +%s) + 300 ))
+while (( $(date +%s) < deadline )); do
+  if docker exec "$application_id" curl --fail --silent --show-error --connect-timeout 1 --max-time 2 http://127.0.0.1:8080/health > "$state/health" 2>/dev/null; then
+    echo 'Candidate application started and passed its health endpoint on the declared JRE.'
+    exit 0
+  fi
+  if [[ "$(docker inspect --format '{{.State.Running}}' "$application_id" 2>/dev/null || true)" != true ]]; then break; fi
+  sleep 2
+done
+echo 'Candidate runtime application failed its startup/health smoke.' >&2
+docker logs --tail 100 "$application_id" >&2 || true
+exit 1

.github/workflows/agent-cli-provisioning.yml

@@ -18,7 +18,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 

.github/workflows/android-release.yml

@@ -33,7 +33,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up JDK
         uses: actions/setup-java@v4
@@ -105,7 +105,7 @@ jobs:
 
       - name: Upload to GitHub Release
         if: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') }}
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           files: |
             frontend/androidApp/build/outputs/apk/**/release/*.apk

.github/workflows/ci.yml

@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up JDK
         uses: actions/setup-java@v4
@@ -147,7 +147,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up JDK
         uses: actions/setup-java@v4
@@ -185,7 +185,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Download backend coverage reports
         uses: actions/download-artifact@v7
@@ -220,7 +220,7 @@ jobs:
           echo "Found coverage files: $FILES"
 
       - name: Upload to Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v7
         with:
           disable_search: true
           files: ${{ steps.coverage-files.outputs.list }}
@@ -238,7 +238,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up JDK
         uses: actions/setup-java@v4
@@ -270,7 +270,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up JDK
         uses: actions/setup-java@v4
@@ -312,7 +312,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up JDK
         uses: actions/setup-java@v4
@@ -367,7 +367,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Run Trivy vulnerability scanner
         uses: aquasecurity/trivy-action@master

.github/workflows/copilot_close_inactive_issues.yml

@@ -28,7 +28,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 

.github/workflows/copilot_commit.yml

@@ -27,7 +27,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
           fetch-depth: 0

.github/workflows/copilot_deployment_orchestration.yml

@@ -85,7 +85,7 @@ jobs:
       actions: write
     steps:
       - name: Checkout trusted base branch
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
           ref: ${{ github.event.pull_request.base.ref }}

.github/workflows/copilot_issue.yml

@@ -19,7 +19,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 

.github/workflows/copilot_pull_request.yml

@@ -24,7 +24,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
           fetch-depth: 0

.github/workflows/copilot_pull_request_review_state.yml

@@ -24,7 +24,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
           fetch-depth: 0

.github/workflows/docker.yml

@@ -14,6 +14,7 @@ on:
     paths:
       - .github/workflows/docker.yml
       - .github/actions/prepare-docker/**
+      - .github/scripts/test_backend_runtime.sh
       - backend/**
       - frontend/**
       - docker/**
@@ -39,7 +40,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Prepare private Docker client
         uses: ./.github/actions/prepare-docker
@@ -92,11 +93,30 @@ jobs:
           file: ./docker/Dockerfile.backend
           platforms: linux/amd64
           push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ steps.meta.outputs.tags }}
+          load: ${{ github.event_name == 'pull_request' }}
+          tags: |
+            ${{ steps.meta.outputs.tags }}
+            ${{ github.event_name == 'pull_request' && format('vaultstadio-runtime-test:{0}-{1}', github.run_id, github.run_attempt) || '' }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha,scope=vaultstadio-backend
           cache-to: type=gha,mode=max,scope=vaultstadio-backend
 
+      - name: Verify the candidate JRE and application startup
+        if: github.event_name == 'pull_request'
+        timeout-minutes: 8
+        env:
+          CANDIDATE_IMAGE: vaultstadio-runtime-test:${{ github.run_id }}-${{ github.run_attempt }}
+        run: bash .github/scripts/test_backend_runtime.sh "$CANDIDATE_IMAGE"
+
+      - name: Retire this job's local smoke tag
+        if: always() && github.event_name == 'pull_request'
+        env:
+          CANDIDATE_IMAGE: vaultstadio-runtime-test:${{ github.run_id }}-${{ github.run_attempt }}
+        run: |
+          if docker image inspect "$CANDIDATE_IMAGE" >/dev/null 2>&1; then
+            docker image rm "$CANDIDATE_IMAGE"
+          fi
+
   build-frontend:
     name: Build Frontend Image
     runs-on:
@@ -110,7 +130,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Prepare private Docker client
         uses: ./.github/actions/prepare-docker
@@ -180,7 +200,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up JDK
         uses: actions/setup-java@v4
@@ -198,7 +218,7 @@ jobs:
         run: ./gradlew :api:distZip -x test
 
       - name: Create Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           files: |
             backend/api/build/distributions/*.zip

.github/workflows/docker_client_contract.yml

@@ -25,7 +25,7 @@ jobs:
       labels: [self-hosted, macOS, ARM64]
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Test private credentials with native Docker and a fixture registry

.github/workflows/hotfix_workflow.yml

@@ -91,7 +91,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           persist-credentials: true
       # Add project-specific version, build, validation, smoke-test and generated-file steps here.
@@ -121,7 +121,7 @@ jobs:
       pull-requests: write
       actions: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Create or resume promotion PR
@@ -169,7 +169,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
           ref: ${{ vars.MAIN_BRANCH || 'master' }}

.github/workflows/release_workflow.yml

@@ -91,7 +91,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           persist-credentials: true
       # Add project-specific version, build, validation, smoke-test and generated-file steps here.
@@ -121,7 +121,7 @@ jobs:
       pull-requests: write
       actions: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: Create or resume promotion PR
@@ -169,7 +169,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
           ref: ${{ vars.MAIN_BRANCH || 'master' }}