Merge branch 'ory:master' into master

Author: wei840222

.github/workflows/ci.yml

@@ -18,23 +18,21 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: ory/ci/checkout@master
-      - uses: actions/cache@v4
-        with:
-          path: internal/httpclient
-          key: ${{ needs.sdk-generate.outputs.sdk-cache-key }}
       - uses: actions/setup-go@v6
         with:
           go-version: "1.25"
       - run: go list -json > go.list
       - name: Run nancy
         uses: sonatype-nexus-community/[email protected]
       - name: Run golangci-lint
+        if: ${{ github.ref_type != 'tag' }}
         uses: golangci/golangci-lint-action@v8
         env:
           GOGC: 100
         with:
           args: --timeout 10m0s
           version: latest
+          only-new-issues: "true"
       - name: Run go-acc (tests)
         run: |
           make .bin/go-acc
@@ -71,26 +69,13 @@ jobs:
         with:
           go-version: "1.25"
 
-  changelog:
-    name: Generate changelog
-    runs-on: ubuntu-latest
-    if: ${{ github.ref_type == 'tag' || github.ref_name == 'master' }}
-    needs:
-      - test
-      - validate
-    steps:
-      - uses: ory/ci/changelog@master
-        with:
-          token: ${{ secrets.ORY_BOT_PAT }}
-
   release:
     name: Generate release
     runs-on: ubuntu-latest
     if: ${{ github.ref_type == 'tag' }}
     needs:
       - test
       - validate
-      - changelog
     steps:
       - uses: ory/ci/releaser@master
         with:
@@ -100,18 +85,6 @@ jobs:
           docker_username: ${{ secrets.DOCKERHUB_USERNAME }}
           docker_password: ${{ secrets.DOCKERHUB_PASSWORD }}
 
-  render-version-schema:
-    name: Render version schema
-    runs-on: ubuntu-latest
-    if: ${{ github.ref_type == 'tag' }}
-    needs:
-      - release
-    steps:
-      - uses: ory/ci/releaser/render-version-schema@master
-        with:
-          schema-path: .schema/config.schema.json
-          token: ${{ secrets.ORY_BOT_PAT }}
-
   newsletter-draft:
     name: Draft newsletter
     runs-on: ubuntu-latest

.github/workflows/closed_references.yml

@@ -20,7 +20,7 @@ jobs:
     name: Find closed references
     steps:
       - uses: actions/checkout@v5
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v6
         with:
           node-version: "22"
       - uses: ory/closed-reference-notifier@v1

.github/workflows/codeql-analysis.yml

@@ -43,7 +43,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@v4
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -54,7 +54,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v2
+        uses: github/codeql-action/autobuild@v4
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -68,4 +68,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2
+        uses: github/codeql-action/analyze@v4

.github/workflows/conventional_commits.yml

@@ -46,7 +46,7 @@ jobs:
             deps
             docs
           default_require_scope: false
-      - uses: amannn/action-semantic-pull-request@v4
+      - uses: amannn/action-semantic-pull-request@v6
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/cve-scan.yaml

@@ -60,12 +60,12 @@ jobs:
 
       - name: Configure Trivy
         run: |
-          mkdir -p $HOME/.cache/trivy
-          echo "TRIVY_USERNAME=${{ github.actor }}" >> $GITHUB_ENV
-          echo "TRIVY_PASSWORD=${{ secrets.GITHUB_TOKEN }}" >> $GITHUB_ENV
+          mkdir -p "$HOME/.cache/trivy"
+          echo "TRIVY_USERNAME=${{ github.actor }}" >> "$GITHUB_ENV"
+          echo "TRIVY_PASSWORD=${{ secrets.GITHUB_TOKEN }}" >> "$GITHUB_ENV"
 
       - name: Anchore Scanner
-        uses: anchore/scan-action@v5
+        uses: anchore/scan-action@v7
         id: grype-scan
         with:
           image: ${{ env.IMAGE_NAME }}
@@ -81,7 +81,7 @@ jobs:
           echo "::endgroup::"
       - name: Anchore upload scan SARIF report
         if: always()
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: ${{ steps.grype-scan.outputs.sarif }}
       - name: Kubescape scanner

.github/workflows/licenses.yml

@@ -24,7 +24,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           outputFile: docs/docs/milestones.md
       - name: Commit Milestone Documentation
-        uses: EndBug/add-and-commit@v4.4.0
+        uses: EndBug/add-and-commit@v9.1.4
         with:
           message: "autogen(docs): update milestone document"
           author_name: aeneasr

.github/workflows/milestone.yml

@@ -16,14 +16,15 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: ory-corp/planning-automation-action@v0.1
+      - uses: ory-corp/planning-automation-action@v0.2
         with:
           organization: ory-corp
           project: 5
           token: ${{ secrets.ORY_BOT_PAT }}
           todoLabel: "Needs Triage"
           statusName: Status
-          statusValue: "Needs Triage"
+          prStatusValue: "Needs Triage"
+          issueStatusValue: "Needs Triage"
           includeEffort: "false"
           monthlyMilestoneName: Roadmap Monthly
           quarterlyMilestoneName: Roadmap