Propagate changes from main into development

.claude/settings.json

@@ -10,5 +10,9 @@
   },
   "worktree": {
     "bgIsolation": "none"
+   },
+  "attribution": {
+    "commit": "",
+    "pr": ""
   }
 }

.dockerignore

@@ -10,7 +10,6 @@
 .gitignore
 .github/
 codecov.yml
-.goreleaser.yaml
 .sourcery.yml
 .claude/
 
@@ -155,7 +154,7 @@ docker-compose*.yml
 docs/implementation/
 
 # -----------------------------------------------------------------------------
-# GoReleaser & dist artifacts
+# Build output directories (e.g. frontend/dist/)
 # -----------------------------------------------------------------------------
 dist/
 

.github/renovate.json

@@ -244,6 +244,19 @@
       "datasourceTemplate": "golang-version",
       "versioningTemplate": "semver"
     },
+    {
+      "customType": "regex",
+      "description": "Track pinned Semgrep container image digest in the Semgrep CI workflow",
+      "managerFilePatterns": [
+        "/^\\.github/workflows/semgrep\\.yml$/"
+      ],
+      "matchStrings": [
+        "#\\s*renovate:\\s*datasource=docker\\s+depName=semgrep/semgrep\\s*\\n\\s*image:\\s*semgrep/semgrep:(?<currentValue>[^@\\s]+)@(?<currentDigest>sha256:[a-f0-9]+)"
+      ],
+      "depNameTemplate": "semgrep/semgrep",
+      "datasourceTemplate": "docker",
+      "versioningTemplate": "docker"
+    },
     {
       "customType": "regex",
       "description": "Track NODE_VERSION in Actions workflows",
@@ -275,11 +288,15 @@
       "description": "Track Syft version in workflows and scripts",
       "managerFilePatterns": [
         "/^\\.github/workflows/nightly-build\\.yml$/",
+        "/^\\.github/workflows/docker-build\\.yml$/",
+        "/^\\.github/workflows/supply-chain-pr\\.yml$/",
+        "/^\\.github/workflows/supply-chain-verify\\.yml$/",
         "/^\\.github/skills/security-scan-docker-image-scripts/run\\.sh$/"
       ],
       "matchStrings": [
         "SYFT_VERSION=\\\"v(?<currentValue>[^\\\"\\s]+)\\\"",
-        "set_default_env \\\"SYFT_VERSION\\\" \\\"v(?<currentValue>[^\\\"]+)\\\""
+        "set_default_env \\\"SYFT_VERSION\\\" \\\"v(?<currentValue>[^\\\"]+)\\\"",
+        "syft-version:\\s*v(?<currentValue>[^\\s]+)"
       ],
       "depNameTemplate": "anchore/syft",
       "datasourceTemplate": "github-releases",
@@ -396,6 +413,19 @@
       "datasourceTemplate": "go",
       "versioningTemplate": "semver"
     },
+    {
+      "customType": "regex",
+      "description": "Track github.com/klauspost/compress version ARG in Dockerfile",
+      "managerFilePatterns": [
+        "/^Dockerfile$/"
+      ],
+      "matchStrings": [
+        "#\\s*renovate:\\s*datasource=go\\s+depName=github\\.com/klauspost/compress\\s*\\nARG KLAUSPOST_COMPRESS_VERSION=(?<currentValue>[^\\s]+)"
+      ],
+      "depNameTemplate": "github.com/klauspost/compress",
+      "datasourceTemplate": "go",
+      "versioningTemplate": "semver"
+    },
     {
       "customType": "regex",
       "description": "Track golang-jwt/jwt v5 in go.mod via github-tags (workaround: Renovate go datasource no-result for /vN module paths)",

.github/skills/README.md

@@ -69,7 +69,6 @@ Agent Skills are self-documenting, AI-discoverable task definitions that combine
 
 | Skill Name | Category | Description | Status |
 |------------|----------|-------------|--------|
-| [utility-version-check](./utility-version-check.SKILL.md) | utility | Validate version matches git tag | ✅ Active |
 | [utility-clear-go-cache](./utility-clear-go-cache.SKILL.md) | utility | Clear Go build and module caches | ✅ Active |
 | [utility-bump-beta](./utility-bump-beta.SKILL.md) | utility | Increment beta version number | ✅ Active |
 | [utility-db-recovery](./utility-db-recovery.SKILL.md) | utility | Database integrity check and recovery | ✅ Active |
@@ -264,7 +263,6 @@ python3 .github/skills/scripts/validate-skills.py --single .github/skills/{skill
   - `test-backend-coverage`
   - `integration-test-crowdsec`
   - `security-scan-trivy`
-  - `utility-version-check`
 
 ## Best Practices
 

.github/skills/examples/gorm-scanner-ci-workflow.yml

@@ -25,7 +25,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
-          go-version: "1.26.5"
+          go-version: "1.26.6"
 
       - name: Run GORM Security Scanner
         id: gorm-scan

.github/skills/security-scan-docker-image-scripts/run.sh

@@ -35,7 +35,7 @@ fi
 # Check Grype
 if ! command -v grype >/dev/null 2>&1; then
     log_error "Grype not found - install from: https://github.com/anchore/grype"
-    log_error "Installation: curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin v0.116.1"
+    log_error "Installation: curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin v0.117.0"
     error_exit "Grype is required for vulnerability scanning" 2
 fi
 
@@ -50,8 +50,8 @@ SYFT_INSTALLED_VERSION=$(syft version | grep -oP 'Version:\s*\Kv?[0-9]+\.[0-9]+\
 GRYPE_INSTALLED_VERSION=$(grype version | grep -oP 'Version:\s*\Kv?[0-9]+\.[0-9]+\.[0-9]+' | head -1 || echo "unknown")
 
 # Set defaults matching CI workflow
-set_default_env "SYFT_VERSION" "v1.50.0"
-set_default_env "GRYPE_VERSION" "v0.116.1"
+set_default_env "SYFT_VERSION" "v1.51.0"
+set_default_env "GRYPE_VERSION" "v0.117.0"
 set_default_env "IMAGE_TAG" "charon:local"
 set_default_env "FAIL_ON_SEVERITY" "Critical,High"
 

.github/skills/utility-bump-beta.SKILL.md

@@ -183,7 +183,6 @@ After running this skill:
 
 ## Related Skills
 
-- [utility-version-check](./utility-version-check.SKILL.md) - Validate version matches tags
 - [build-check-go](../build-check-go.SKILL.md) - Verify build after version bump
 
 ## Notes