release: promote develop to main

.dockerignore

@@ -0,0 +1,65 @@
+# Source control and worktrees
+.git
+.git/**
+.worktrees/
+
+# Graphify artifacts
+.graphify/
+.graphifyignore
+graphify-out/
+
+# Dependency environments
+**/.venv/
+**/venv/
+**/env/
+**/ENV/
+**/node_modules/
+
+# Coverage, caches, and generated Python files
+**/.coverage
+**/.coverage.*
+**/coverage/
+**/htmlcov/
+**/.cache/
+**/.npm/
+**/.nox/
+**/.tox/
+**/.mypy_cache/
+**/.pytest_cache/
+**/.ruff_cache/
+**/.vite/
+**/.eslintcache
+**/__pycache__/
+**/*.py[cod]
+
+# Build outputs
+**/build/
+**/dist/
+**/out/
+**/.next/
+**/*.egg-info/
+**/wheels/
+
+# Secrets and local configuration
+**/.env
+**/.env.*
+!**/.env.example
+**/.npmrc
+**/.pypirc
+**/.secrets/
+**/secrets/
+**/*credentials*.json
+**/*.key
+**/*.pem
+**/id_ed25519*
+**/id_rsa*
+
+# Local application data and logs
+/backups/
+/data/
+/backend/data/
+**/*.db
+**/*.sqlite
+**/*.sqlite3
+**/*.log
+**/logs/

.github/workflows/release.yml

@@ -24,7 +24,7 @@ jobs:
     steps:
       - name: Wait for Tests workflow
         id: check
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             // Wait up to 10 minutes for Tests workflow to complete
@@ -222,6 +222,9 @@ jobs:
         with:
           ref: ${{ github.event.workflow_run.head_sha || github.sha }}
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
@@ -236,7 +239,7 @@ jobs:
         uses: docker/build-push-action@v7
         with:
           context: .
-          platforms: linux/amd64
+          platforms: linux/amd64,linux/arm64
           push: true
           tags: ${{ needs.prepare.outputs.docker_tags }}
           labels: ${{ needs.prepare.outputs.docker_labels }}
@@ -365,7 +368,7 @@ jobs:
           cat release_notes.md
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ startsWith(github.ref, 'refs/tags/') && github.ref_name || format('v{0}', needs.prepare.outputs.version) }}
           target_commitish: ${{ github.sha }}

.github/workflows/security-scan.yml

@@ -15,7 +15,7 @@ permissions:
 
 jobs:
   # ──────────────────────────────────────────────
-  # Python SAST — Bandit
+  # Python SAST - Bandit
   # ──────────────────────────────────────────────
   bandit:
     name: Bandit (Python SAST)
@@ -25,20 +25,22 @@ jobs:
 
       - uses: actions/setup-python@v6
         with:
-          python-version: '3.14'
+          python-version-file: '.python-version'
 
       - name: Install Bandit
-        run: pip install bandit[toml]
+        run: |
+          python -m pip install --upgrade pip==25.3
+          pip install bandit[toml]
 
       - name: Run Bandit scan
+        continue-on-error: true
         run: |
           bandit -r backend/app \
             -f json \
             -o bandit-results.json \
             --severity-level medium \
             --confidence-level medium \
-            -x 'backend/app/__pycache__' \
-            || true
+            -x 'backend/app/__pycache__'
 
       - name: Display results
         if: always()
@@ -56,7 +58,7 @@ jobs:
           retention-days: 30
 
   # ──────────────────────────────────────────────
-  # Python dependency audit — pip-audit
+  # Python dependency audit - pip-audit
   # ──────────────────────────────────────────────
   pip-audit:
     name: pip-audit (Python Dependencies)
@@ -66,18 +68,20 @@ jobs:
 
       - uses: actions/setup-python@v6
         with:
-          python-version: '3.14'
+          python-version-file: '.python-version'
 
       - name: Install pip-audit
-        run: pip install pip-audit
+        run: |
+          python -m pip install --upgrade pip==25.3
+          pip install pip-audit
 
       - name: Run pip-audit
+        continue-on-error: true
         run: |
           pip-audit \
             -r backend/requirements.txt \
             --format json \
-            --output pip-audit-results.json \
-            || true
+            --output pip-audit-results.json
 
       - name: Display results
         if: always()
@@ -95,7 +99,7 @@ jobs:
           retention-days: 30
 
   # ──────────────────────────────────────────────
-  # JavaScript dependency audit — npm audit
+  # JavaScript dependency audit - npm audit
   # ──────────────────────────────────────────────
   npm-audit:
     name: npm audit (JS Dependencies)
@@ -105,18 +109,22 @@ jobs:
 
       - uses: actions/setup-node@v6
         with:
-          node-version: '24'
+          node-version-file: '.node-version'
           cache: 'npm'
           cache-dependency-path: frontend/package-lock.json
 
+      - name: Install pinned npm
+        working-directory: frontend
+        run: npm install --global "$(node -p "require('./package.json').packageManager")"
+
       - name: Install dependencies
         working-directory: frontend
         run: npm ci
 
       - name: Run npm audit
         working-directory: frontend
-        run: |
-          npm audit --json > npm-audit-results.json 2>&1 || true
+        continue-on-error: true
+        run: npm audit --json > npm-audit-results.json 2>&1
 
       - name: Display results
         if: always()
@@ -135,7 +143,7 @@ jobs:
           retention-days: 30
 
   # ──────────────────────────────────────────────
-  # Container image scanning — Trivy
+  # Container image scanning - Trivy
   # ──────────────────────────────────────────────
   trivy:
     name: Trivy (Container Scan)
@@ -172,7 +180,7 @@ jobs:
           exit-code: '0'
 
   # ──────────────────────────────────────────────
-  # Dockerfile linting — Hadolint
+  # Dockerfile linting - Hadolint
   # ──────────────────────────────────────────────
   hadolint:
     name: Hadolint (Dockerfile Lint)
@@ -196,7 +204,7 @@ jobs:
           category: 'hadolint'
 
   # ──────────────────────────────────────────────
-  # Secret scanning — Gitleaks
+  # Secret scanning - Gitleaks
   # ──────────────────────────────────────────────
   gitleaks:
     name: Gitleaks (Secret Detection)