bedatty · Jul 10, 2026 · Jul 6, 2026 · Jul 6, 2026 · Jul 10, 2026 · Jul 10, 2026
@@ -275,21 +275,21 @@ jobs:
 
       - name: Set up QEMU
         if: contains(needs.prepare.outputs.platforms, 'arm64')
-        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
 
       - name: Log in to DockerHub
         if: inputs.enable_dockerhub
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKERHUB_IMAGE_PUSH_TOKEN }}
 
       - name: Log in to GHCR
         if: inputs.enable_ghcr
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -407,7 +407,7 @@ jobs:
       - name: Docker metadata
         if: steps.preflight.outputs.should_build != 'false'
         id: meta
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
         with:
           images: ${{ steps.image-names.outputs.images }}
           tags: |
@@ -416,7 +416,7 @@ jobs:
       - name: Build and push Docker image
         if: steps.preflight.outputs.should_build != 'false'
         id: build-push
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
         with:
           context: ${{ inputs.build_context_from_working_dir == true && matrix.app.working_dir || inputs.build_context }}
           file: ${{ matrix.app.working_dir }}/${{ inputs.dockerfile_name }}

@@ -129,7 +129,7 @@ jobs:
     steps:
       - name: Log in to Docker Hub
         if: ${{ inputs.enable_docker_login }}
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKERHUB_IMAGE_PULL_TOKEN }}

@@ -301,7 +301,7 @@ jobs:
 
       - name: Upload Gosec SARIF
         if: always()
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+        uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
         with:
           sarif_file: gosec-${{ matrix.app.name }}.sarif
           category: gosec-${{ matrix.app.name }}

@@ -201,6 +201,32 @@ on:
         type: boolean
         default: true
 
+      # ----------------- Ungoliant Release Diff (ungoliant-release-diff composite) -----------------
+      enable_ungoliant_release_diff:
+        description: 'Fire the Ungoliant release-diff webhook on tag push after a successful gitops-update to trigger chaos/fuzz analysis for the release.'
+        type: boolean
+        default: false
+      ungoliant_app:
+        description: 'App slug sent to the Ungoliant controller. When empty, falls back to app_name, then app_name_prefix, then the repository name.'
+        type: string
+        default: ''
+      ungoliant_env_type:
+        description: 'Ungoliant environment/testing type — chaos | fuzzing.'
+        type: string
+        default: 'chaos'
+      ungoliant_tenancy:
+        description: 'Ungoliant tenancy — st (single-tenant) | mt (multi-tenant).'
+        type: string
+        default: 'st'
+      ungoliant_controller_url:
+        description: 'Ungoliant controller base URL (reachable over Tailscale).'
+        type: string
+        default: 'https://ungoliant-controller.anacleto.lerian.net'
+      ungoliant_runner_type:
+        description: 'Runner for the Ungoliant release-diff job. Needs Tailscale reach to the controller, so it defaults to eveo-anacleto-lxc-runners rather than the build runner.'
+        type: string
+        default: 'eveo-anacleto-lxc-runners'
+
       # ----------------- Shared -----------------
       shared_paths:
         description: 'Newline-separated path patterns that trigger a release/build for all components.'
@@ -232,6 +258,8 @@ on:
         required: false
       APIDOG_ENVIRONMENT_ID:
         required: false
+      UNGOLIANT_WEBHOOK_TOKEN:
+        required: false
 
 permissions:
   contents: read
@@ -533,8 +561,17 @@ jobs:
 
   # ----------------- API Dog E2E Tests (tag push, post-gitops, opt-in) -----------------
   api_dog_e2e_tests:
-    needs: [update_gitops]
-    if: github.ref_type == 'tag' && inputs.enable_apidog_e2e && needs.update_gitops.result == 'success'
+    needs: [build, update_gitops]
+    # See the note on ungoliant_release_diff: gate on build's has_builds output
+    # instead of the unreliable needs.update_gitops.result == 'success'.
+    if: >-
+      !cancelled()
+      && github.ref_type == 'tag'
+      && inputs.enable_apidog_e2e
+      && inputs.enable_gitops_update
+      && needs.build.outputs.has_builds == 'true'
+      && needs.update_gitops.result != 'failure'
+      && needs.update_gitops.result != 'cancelled'
     uses: ./.github/workflows/api-dog-e2e-tests.yml
     with:
       runner_type: ${{ inputs.apidog_runner_type }}
@@ -545,3 +582,62 @@ jobs:
       dev_environment_id: ${{ secrets.APIDOG_DEV_ENVIRONMENT_ID }}
       stg_environment_id: ${{ secrets.APIDOG_STG_ENVIRONMENT_ID }}
       environment_id: ${{ secrets.APIDOG_ENVIRONMENT_ID }}
+
+  # ----------------- Ungoliant Release Diff (tag push, post-gitops, opt-in) -----------------
+  # Runs only after a successful gitops-update (i.e. the release was deployed).
+  # The controller is reachable only over Tailscale, so the job runs on the
+  # eveo-anacleto-lxc-runners self-hosted runner. base-env/env are derived from
+  # the tag, which maps 1:1 to the source branch (beta<-develop, rc<-release-
+  # candidate, stable<-main) per .releaserc conventions.
+  ungoliant_release_diff:
+    name: Ungoliant Release Diff
+    needs: [build, update_gitops]
+    # Gate on build's has_builds output (which propagates reliably and proves a
+    # real deploy happened) rather than needs.update_gitops.result == 'success':
+    # update_gitops wraps a reusable workflow with a dynamic matrix, and its
+    # caller result does not reliably surface as 'success' to dependents.
+    if: >-
+      !cancelled()
+      && github.ref_type == 'tag'
+      && inputs.enable_ungoliant_release_diff
+      && inputs.enable_gitops_update
+      && needs.build.outputs.has_builds == 'true'
+      && needs.update_gitops.result != 'failure'
+      && needs.update_gitops.result != 'cancelled'
+    runs-on: ${{ vars.UNGOLIANT_RUNNERS || inputs.ungoliant_runner_type }}
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
+    steps:
+      - name: Resolve release channel and base env
+        id: target
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          if [[ "$REF_NAME" == *-beta.* ]]; then
+            RELEASE_ENV="beta"; BASE_ENV="dev"
+          elif [[ "$REF_NAME" == *-rc.* ]]; then
+            RELEASE_ENV="rc"; BASE_ENV="stg"
+          else
+            RELEASE_ENV="stable"; BASE_ENV="prd"
+          fi
+          {
+            echo "release_env=$RELEASE_ENV"
+            echo "base_env=$BASE_ENV"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Send release-diff webhook
+        uses: LerianStudio/github-actions-shared-workflows/src/validate/ungoliant-release-diff@v1
+        with:
+          app: ${{ inputs.ungoliant_app || inputs.app_name || inputs.app_name_prefix || github.event.repository.name }}
+          version: ${{ github.ref_name }}
+          env: ${{ steps.target.outputs.release_env }}
+          env-type: ${{ inputs.ungoliant_env_type }}
+          tenancy: ${{ inputs.ungoliant_tenancy }}
+          base-env: ${{ steps.target.outputs.base_env }}
+          controller-url: ${{ vars.UNGOLIANT_CONTROLLER_URL || inputs.ungoliant_controller_url }}
+          github-token: ${{ github.token }}
+          webhook-token: ${{ secrets.UNGOLIANT_WEBHOOK_TOKEN }}
+          dry-run: ${{ inputs.dry_run }}
@@ -105,7 +105,7 @@ jobs:
 
       - name: Upload Gosec SARIF
         if: always() && inputs.upload_sarif
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+        uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
         with:
           sarif_file: gosec-results.sarif
           category: gosec
@@ -175,7 +175,7 @@ jobs:
 
       - name: Upload Trivy SARIF
         if: always() && inputs.upload_sarif
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+        uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
         with:
           sarif_file: trivy-results.sarif
           category: trivy
@@ -192,7 +192,7 @@ jobs:
           fetch-depth: 0
 
       - name: TruffleHog OSS
-        uses: trufflesecurity/trufflehog@30d5bb91af1a771378349dbbb0c82129392acf70 # v3.95.6
+        uses: trufflesecurity/trufflehog@00155c9dc586f34d189adc83d3ac2698c2ec551f # v3.95.8
         with:
           path: ./
           base: ${{ github.event.repository.default_branch }}

@@ -200,6 +200,32 @@ on:
         type: string
         default: 'playwright-report'
 
+      # ----------------- Ungoliant Release Diff (ungoliant-release-diff composite) -----------------
+      enable_ungoliant_release_diff:
+        description: 'Fire the Ungoliant release-diff webhook on tag push after a successful gitops-update to trigger chaos/fuzz analysis for the release.'
+        type: boolean
+        default: false
+      ungoliant_app:
+        description: 'App slug sent to the Ungoliant controller. When empty, falls back to app_name_prefix, then the repository name.'
+        type: string
+        default: ''
+      ungoliant_env_type:
+        description: 'Ungoliant environment/testing type — chaos | fuzzing.'
+        type: string
+        default: 'chaos'
+      ungoliant_tenancy:
+        description: 'Ungoliant tenancy — st (single-tenant) | mt (multi-tenant).'
+        type: string
+        default: 'st'
+      ungoliant_controller_url:
+        description: 'Ungoliant controller base URL (reachable over Tailscale).'
+        type: string
+        default: 'https://ungoliant-controller.anacleto.lerian.net'
+      ungoliant_runner_type:
+        description: 'Runner for the Ungoliant release-diff job. Needs Tailscale reach to the controller, so it defaults to eveo-anacleto-lxc-runners rather than the build runner.'
+        type: string
+        default: 'eveo-anacleto-lxc-runners'
+
     secrets:
       MANAGE_TOKEN:
         required: false
@@ -208,6 +234,8 @@ on:
       AWS_E2E_ARTIFACTS_ROLE_ARN:
         description: 'IAM role ARN assumed via OIDC to upload the E2E (Playwright) report to the lerian-e2e-artifacts S3 bucket. Optional — when unset, the S3 upload step is skipped and only the GitHub Actions artifact is produced.'
         required: false
+      UNGOLIANT_WEBHOOK_TOKEN:
+        required: false
 
     outputs:
       has_e2e_s3_upload:
@@ -403,3 +431,63 @@ jobs:
       configmap_updates: ${{ inputs.configmap_updates }}
       enable_docker_login: ${{ inputs.enable_docker_login }}
     secrets: inherit
+
+  # ----------------- Ungoliant Release Diff (tag push, post-gitops, opt-in) -----------------
+  # Runs only after a successful gitops-update (i.e. the release was deployed).
+  # The controller is reachable only over Tailscale, so the job runs on the
+  # eveo-anacleto-lxc-runners self-hosted runner. base-env/env are derived from
+  # the tag, which maps 1:1 to the source branch (beta<-develop, rc<-release-
+  # candidate, stable<-main) per .releaserc conventions.
+  ungoliant_release_diff:
+    name: Ungoliant Release Diff
+    needs: [build, update_gitops]
+    # Gate on build's has_builds output (which propagates reliably and proves a
+    # real deploy happened) rather than needs.update_gitops.result == 'success':
+    # update_gitops wraps a reusable workflow with a dynamic matrix, and its
+    # caller result does not reliably surface as 'success' to dependents.
+    if: >-
+      !cancelled()
+      && github.ref_type == 'tag'
+      && inputs.enable_ungoliant_release_diff
+      && inputs.enable_gitops_update
+      && inputs.enable_gitops_artifacts
+      && needs.build.outputs.has_builds == 'true'
+      && needs.update_gitops.result != 'failure'
+      && needs.update_gitops.result != 'cancelled'
+    runs-on: ${{ vars.UNGOLIANT_RUNNERS || inputs.ungoliant_runner_type }}
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
+    steps:
+      - name: Resolve release channel and base env
+        id: target
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          if [[ "$REF_NAME" == *-beta.* ]]; then
+            RELEASE_ENV="beta"; BASE_ENV="dev"
+          elif [[ "$REF_NAME" == *-rc.* ]]; then
+            RELEASE_ENV="rc"; BASE_ENV="stg"
+          else
+            RELEASE_ENV="stable"; BASE_ENV="prd"
+          fi
+          {
+            echo "release_env=$RELEASE_ENV"
+            echo "base_env=$BASE_ENV"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Send release-diff webhook
+        uses: LerianStudio/github-actions-shared-workflows/src/validate/ungoliant-release-diff@v1
+        with:
+          app: ${{ inputs.ungoliant_app || inputs.app_name_prefix || github.event.repository.name }}
+          version: ${{ github.ref_name }}
+          env: ${{ steps.target.outputs.release_env }}
+          env-type: ${{ inputs.ungoliant_env_type }}
+          tenancy: ${{ inputs.ungoliant_tenancy }}
+          base-env: ${{ steps.target.outputs.base_env }}
+          controller-url: ${{ vars.UNGOLIANT_CONTROLLER_URL || inputs.ungoliant_controller_url }}
+          github-token: ${{ github.token }}
+          webhook-token: ${{ secrets.UNGOLIANT_WEBHOOK_TOKEN }}
+          dry-run: ${{ inputs.dry_run }}
@@ -133,7 +133,7 @@ jobs:
     steps:
       # ----------------- Setup -----------------
       - name: Login to Docker Registry
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
         with:
           registry: ${{ inputs.docker_registry }}
           username: ${{ secrets.DOCKER_USERNAME }}
@@ -175,7 +175,7 @@ jobs:
     steps:
       # ----------------- Setup -----------------
       - name: Login to Docker Registry
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
         with:
           registry: ${{ inputs.docker_registry }}
           username: ${{ secrets.DOCKER_USERNAME }}
@@ -186,7 +186,7 @@ jobs:
 
       - name: Set up Docker Buildx
         if: inputs.enable_docker_scan
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
 
       # ----------------- Filesystem Scanning (Secrets + Vulnerabilities) -----------------
       - name: Trivy Filesystem Scan
@@ -202,7 +202,7 @@ jobs:
       # ----------------- Docker Build -----------------
       - name: Build Docker Image for Scanning
         if: always() && inputs.enable_docker_scan
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
         with:
           # yamllint disable-line rule:line-length
           context: ${{ inputs.build_context_from_working_dir == true && matrix.working_dir || (inputs.monorepo_type == 'type2' && matrix.working_dir == inputs.frontend_folder && inputs.frontend_folder || '.') }}
@@ -245,6 +245,7 @@ jobs:
           app-name: ${{ env.APP_NAME }}
           target-branch: ${{ github.base_ref }}
           block-branches: ${{ inputs.prerelease_block_branches }}
+          prerelease-pattern: ${{ vars.PRERELEASE_PATTERN }}
 
       # ----------------- Results & Security Gate -----------------
       - name: Post Security Scan Results to PR
@@ -329,7 +330,7 @@ jobs:
 
       - name: Autobuild
         if: steps.codeql-config.outputs.skip != 'true'
-        uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+        uses: github/codeql-action/autobuild@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
 
       - name: Perform CodeQL Analysis
         if: steps.codeql-config.outputs.skip != 'true'