From 4c81691415220d97498de90572f607ef7147630c Mon Sep 17 00:00:00 2001
From: Emilien Escalle <emilien.escalle@escemi.com>
Date: Sun, 25 Oct 2026 22:25:56 +0100
Subject: [PATCH 1/2] feat(ci)!: upgrade actions and automate releases

Upgrade pinned action and reusable workflow dependencies and replace
removed local-action helpers with native repository references.

Add CI-gated internal release automation and release labeling, document
changelog generation, and regenerate affected component documentation.

BREAKING CHANGE: native action composition requires GitHub.com and
GitHub-hosted runners or self-hosted runners version 2.336.0 or newer.
---
 .github/workflows/__greetings.yml             |  2 +-
 .github/workflows/__main-ci.yml               |  5 +-
 .github/workflows/__need-fix-to-issue.yml     |  2 +-
 .github/workflows/__prepare-release.yml       | 16 ++++
 .github/workflows/__pull-request-ci.yml       |  3 +-
 .github/workflows/__release.yml               | 75 +++++++++++++++++++
 .github/workflows/__semantic-pull-request.yml |  2 +-
 .github/workflows/__shared-ci.yml             | 17 +++--
 .github/workflows/__stale.yml                 |  2 +-
 .../__test-action-dependencies-cache.yml      |  4 +-
 .../__test-action-get-package-manager.yml     |  2 +-
 ...test-action-has-installed-dependencies.yml |  4 +-
 .github/workflows/__test-action-package.yml   |  6 +-
 .github/workflows/__test-action-publish.yml   |  8 +-
 .../workflows/__test-action-setup-node.yml    |  2 +-
 ...__test-workflow-continuous-integration.yml | 18 +++--
 .github/workflows/continuous-integration.md   | 22 +++---
 .github/workflows/continuous-integration.yml  | 41 ++++------
 .github/workflows/release.md                  | 59 +++++++++++++--
 Dockerfile                                    |  4 +-
 README.md                                     |  4 +
 actions/build/action.yml                      | 12 +--
 actions/codecov/action.yml                    |  2 +-
 actions/dependencies-cache/action.yml         | 10 +--
 actions/get-package-manager/action.yml        |  2 +-
 actions/has-installed-dependencies/action.yml |  8 +-
 actions/lint/action.yml                       | 12 +--
 actions/package/README.md                     |  8 +-
 actions/package/action.yml                    | 12 +--
 actions/publish/action.yml                    |  4 +-
 actions/setup-node/action.yml                 | 12 +--
 actions/test/action.yml                       | 16 ++--
 32 files changed, 249 insertions(+), 147 deletions(-)
 create mode 100644 .github/workflows/__prepare-release.yml
 create mode 100644 .github/workflows/__release.yml

diff --git a/.github/workflows/__greetings.yml b/.github/workflows/__greetings.yml
index 4b83099..1f57744 100644
--- a/.github/workflows/__greetings.yml
+++ b/.github/workflows/__greetings.yml
@@ -10,7 +10,7 @@ permissions: {}
 
 jobs:
   greetings:
-    uses: hoverkraft-tech/ci-github-common/.github/workflows/greetings.yml@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
+    uses: hoverkraft-tech/ci-github-common/.github/workflows/greetings.yml@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1
     permissions:
       contents: read
       issues: write
diff --git a/.github/workflows/__main-ci.yml b/.github/workflows/__main-ci.yml
index 27a829d..a5cd44a 100644
--- a/.github/workflows/__main-ci.yml
+++ b/.github/workflows/__main-ci.yml
@@ -18,10 +18,11 @@ concurrency:
 
 jobs:
   ci:
-    uses: ./.github/workflows/__shared-ci.yml
+    uses: $/.github/workflows/__shared-ci.yml
     # jscpd:ignore-start
     permissions:
       actions: read
+      attestations: write
       contents: read
       packages: write
       pull-requests: write
@@ -34,7 +35,7 @@ jobs:
   release:
     needs: ci
     if: github.event_name != 'schedule'
-    uses: hoverkraft-tech/ci-github-publish/.github/workflows/release-actions.yml@a0a9d185c51c10710a5987822e78feb2b5ce1932 # 0.29.0
+    uses: hoverkraft-tech/ci-github-publish/.github/workflows/release-actions.yml@4d906685a32df3cfab9139296d49dd914a86bafd # 1.0.2
     permissions:
       contents: read
     with:
diff --git a/.github/workflows/__need-fix-to-issue.yml b/.github/workflows/__need-fix-to-issue.yml
index 216c09c..df58bce 100644
--- a/.github/workflows/__need-fix-to-issue.yml
+++ b/.github/workflows/__need-fix-to-issue.yml
@@ -18,7 +18,7 @@ permissions: {}
 
 jobs:
   main:
-    uses: hoverkraft-tech/ci-github-common/.github/workflows/need-fix-to-issue.yml@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
+    uses: hoverkraft-tech/ci-github-common/.github/workflows/need-fix-to-issue.yml@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1
     permissions:
       contents: read
       issues: write
diff --git a/.github/workflows/__prepare-release.yml b/.github/workflows/__prepare-release.yml
new file mode 100644
index 0000000..cc6013d
--- /dev/null
+++ b/.github/workflows/__prepare-release.yml
@@ -0,0 +1,16 @@
+name: Internal - Prepare release
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [opened, reopened, synchronize, edited]
+
+permissions: {}
+
+jobs:
+  release:
+    uses: hoverkraft-tech/ci-github-publish/.github/workflows/prepare-release.yml@4d906685a32df3cfab9139296d49dd914a86bafd # 1.0.2
+    permissions:
+      contents: read
+      pull-requests: write
diff --git a/.github/workflows/__pull-request-ci.yml b/.github/workflows/__pull-request-ci.yml
index fcc7c0c..d378eb5 100644
--- a/.github/workflows/__pull-request-ci.yml
+++ b/.github/workflows/__pull-request-ci.yml
@@ -14,9 +14,10 @@ concurrency:
 
 jobs:
   ci:
-    uses: ./.github/workflows/__shared-ci.yml
+    uses: $/.github/workflows/__shared-ci.yml
     permissions:
       actions: read
+      attestations: write
       contents: read
       packages: write
       pull-requests: write
diff --git a/.github/workflows/__release.yml b/.github/workflows/__release.yml
new file mode 100644
index 0000000..4f82994
--- /dev/null
+++ b/.github/workflows/__release.yml
@@ -0,0 +1,75 @@
+name: Internal - Release
+
+on:
+  workflow_dispatch:
+    # checkov:skip=CKV_GHA_7: force only bypasses the no-changes guard; source and build settings stay fixed.
+    inputs:
+      force:
+        description: Release even when no relevant changes are detected
+        type: boolean
+        required: false
+        default: false
+
+  schedule:
+    - cron: "25 8 * * 1"
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  ci:
+    if: github.ref_type == 'branch' && github.ref_name == github.event.repository.default_branch
+    uses: $/.github/workflows/__shared-ci.yml
+    permissions:
+      actions: read
+      attestations: write
+      contents: read
+      packages: write
+      pull-requests: write
+      id-token: write
+      issues: write
+      security-events: write
+      statuses: write
+
+  release:
+    name: Create and publish release
+    needs: ci
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      # Use the app token so publishing the tag triggers the main CI documentation jobs.
+      - id: generate-token
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        with:
+          client-id: ${{ vars.CI_BOT_APP_CLIENT_ID }}
+          private-key: ${{ secrets.CI_BOT_APP_PRIVATE_KEY }} # zizmor: ignore[secrets-outside-env] CI bot authentication is required to trigger tag workflows
+          permission-contents: write
+          permission-pull-requests: read
+
+      - name: Plan release
+        id: plan-release
+        uses: hoverkraft-tech/ci-github-publish/actions/release/plan@4d906685a32df3cfab9139296d49dd914a86bafd # 1.0.2
+        with:
+          target-sha: ${{ github.sha }}
+          github-token: ${{ steps.generate-token.outputs.token }}
+
+      - name: Create and publish release
+        if: (steps.plan-release.outputs.has-changes == 'true' || (github.event_name == 'workflow_dispatch' && inputs.force)) && steps.plan-release.outputs.tag != ''
+        uses: hoverkraft-tech/ci-github-publish/actions/release/create@4d906685a32df3cfab9139296d49dd914a86bafd # 1.0.2
+        env:
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} # zizmor: ignore[secrets-outside-env] repository secret is scoped to the release summary step
+        with:
+          tag: ${{ steps.plan-release.outputs.tag }}
+          target-sha: ${{ github.sha }}
+          publish: "true"
+          changelog-summary: |
+            {
+              "llmAuth": ${{ toJSON(env.OPENAI_API_KEY) }},
+              "llmProvider": "openai"
+            }
+          github-token: ${{ steps.generate-token.outputs.token }}
diff --git a/.github/workflows/__semantic-pull-request.yml b/.github/workflows/__semantic-pull-request.yml
index 3fefe3e..30bf08e 100644
--- a/.github/workflows/__semantic-pull-request.yml
+++ b/.github/workflows/__semantic-pull-request.yml
@@ -12,7 +12,7 @@ permissions: {}
 
 jobs:
   main:
-    uses: hoverkraft-tech/ci-github-common/.github/workflows/semantic-pull-request.yml@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
+    uses: hoverkraft-tech/ci-github-common/.github/workflows/semantic-pull-request.yml@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1
     permissions:
       contents: write
       pull-requests: write
diff --git a/.github/workflows/__shared-ci.yml b/.github/workflows/__shared-ci.yml
index 3167ff0..a164873 100644
--- a/.github/workflows/__shared-ci.yml
+++ b/.github/workflows/__shared-ci.yml
@@ -7,7 +7,7 @@ permissions: {}
 
 jobs:
   linter:
-    uses: hoverkraft-tech/ci-github-common/.github/workflows/linter.yml@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
+    uses: hoverkraft-tech/ci-github-common/.github/workflows/linter.yml@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1
     permissions:
       actions: read
       contents: read
@@ -20,42 +20,42 @@ jobs:
   test-action-dependencies-cache:
     name: Test action "dependencies-cache"
     needs: linter
-    uses: ./.github/workflows/__test-action-dependencies-cache.yml
+    uses: $/.github/workflows/__test-action-dependencies-cache.yml
     permissions:
       contents: read
 
   test-action-get-package-manager:
     name: Test action "get-package-manager"
     needs: linter
-    uses: ./.github/workflows/__test-action-get-package-manager.yml
+    uses: $/.github/workflows/__test-action-get-package-manager.yml
     permissions:
       contents: read
 
   test-action-has-installed-dependencies:
     name: Test action "has-installed-dependencies"
     needs: linter
-    uses: ./.github/workflows/__test-action-has-installed-dependencies.yml
+    uses: $/.github/workflows/__test-action-has-installed-dependencies.yml
     permissions:
       contents: read
 
   test-action-package:
     name: Test action "package"
     needs: linter
-    uses: ./.github/workflows/__test-action-package.yml
+    uses: $/.github/workflows/__test-action-package.yml
     permissions:
       contents: read
 
   test-action-setup-node:
     name: Test action "setup-node"
     needs: linter
-    uses: ./.github/workflows/__test-action-setup-node.yml
+    uses: $/.github/workflows/__test-action-setup-node.yml
     permissions:
       contents: read
 
   test-action-publish:
     name: Test action "publish"
     needs: linter
-    uses: ./.github/workflows/__test-action-publish.yml
+    uses: $/.github/workflows/__test-action-publish.yml
     permissions:
       actions: read
       contents: read
@@ -63,8 +63,9 @@ jobs:
   test-workflow-continuous-integration:
     name: Test workflow "continuous-integration"
     needs: linter
-    uses: ./.github/workflows/__test-workflow-continuous-integration.yml
+    uses: $/.github/workflows/__test-workflow-continuous-integration.yml
     permissions:
+      attestations: write
       contents: read
       packages: write
       pull-requests: write
diff --git a/.github/workflows/__stale.yml b/.github/workflows/__stale.yml
index bd5ede0..8f31024 100644
--- a/.github/workflows/__stale.yml
+++ b/.github/workflows/__stale.yml
@@ -8,7 +8,7 @@ permissions: {}
 
 jobs:
   main:
-    uses: hoverkraft-tech/ci-github-common/.github/workflows/stale.yml@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
+    uses: hoverkraft-tech/ci-github-common/.github/workflows/stale.yml@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1
     permissions:
       issues: write
       pull-requests: write
diff --git a/.github/workflows/__test-action-dependencies-cache.yml b/.github/workflows/__test-action-dependencies-cache.yml
index 0f5b267..477144b 100644
--- a/.github/workflows/__test-action-dependencies-cache.yml
+++ b/.github/workflows/__test-action-dependencies-cache.yml
@@ -35,7 +35,7 @@ jobs:
 
       - name: Arrange - Setup Node.js runtime
         id: arrange-setup-node
-        uses: ./actions/setup-node
+        uses: $/actions/setup-node
         with:
           working-directory: ${{ matrix.working-directory }}
 
@@ -54,7 +54,7 @@ jobs:
 
       - name: Act - Run "dependencies-cache" action
         id: act-get-dependencies-cache
-        uses: ./actions/dependencies-cache
+        uses: $/actions/dependencies-cache
         with:
           working-directory: ${{ matrix.working-directory }}
           dependencies: |
diff --git a/.github/workflows/__test-action-get-package-manager.yml b/.github/workflows/__test-action-get-package-manager.yml
index ebca18b..63a9c61 100644
--- a/.github/workflows/__test-action-get-package-manager.yml
+++ b/.github/workflows/__test-action-get-package-manager.yml
@@ -49,7 +49,7 @@ jobs:
 
       - name: Act - Run "get-package-manager" action
         id: act-get-package-manager
-        uses: ./actions/get-package-manager
+        uses: $/actions/get-package-manager
         with:
           working-directory: ${{ matrix.working-directory }}
 
diff --git a/.github/workflows/__test-action-has-installed-dependencies.yml b/.github/workflows/__test-action-has-installed-dependencies.yml
index 670a1c5..6d2b6d8 100644
--- a/.github/workflows/__test-action-has-installed-dependencies.yml
+++ b/.github/workflows/__test-action-has-installed-dependencies.yml
@@ -38,7 +38,7 @@ jobs:
 
       - name: Arrange - Setup Node.js runtime
         id: arrange-setup-node
-        uses: ./actions/setup-node
+        uses: $/actions/setup-node
         with:
           working-directory: ${{ matrix.working-directory }}
 
@@ -57,7 +57,7 @@ jobs:
           Act - Run "has-installed-dependencies" action
           # jscpd:ignore-end
         id: act-has-installed-dependencies
-        uses: ./actions/has-installed-dependencies
+        uses: $/actions/has-installed-dependencies
         with:
           working-directory: ${{ matrix.working-directory }}
           dependencies: |
diff --git a/.github/workflows/__test-action-package.yml b/.github/workflows/__test-action-package.yml
index f8b107f..d1383fa 100644
--- a/.github/workflows/__test-action-package.yml
+++ b/.github/workflows/__test-action-package.yml
@@ -35,7 +35,7 @@ jobs:
 
       - name: Act - Run "package" action
         id: act-package
-        uses: ./actions/package
+        uses: $/actions/package
         with:
           working-directory: ${{ matrix.working-directory }}
           artifact-name: package-tarball-${{ github.job }}-${{ matrix.artifact-suffix }}-${{ github.run_id }}-${{ github.run_attempt }}
@@ -104,7 +104,7 @@ jobs:
 
       - name: Arrange - Setup Node.js runtime
         id: arrange-setup-node
-        uses: ./actions/setup-node
+        uses: $/actions/setup-node
         with:
           working-directory: ${{ matrix.working-directory }}
 
@@ -119,7 +119,7 @@ jobs:
 
       - name: Assert - Download package tarball artifact by ID
         id: download-package-tarball
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ matrix.package-tarball-artifact-id }}
           path: ${{ runner.temp }}
diff --git a/.github/workflows/__test-action-publish.yml b/.github/workflows/__test-action-publish.yml
index 4531194..f555032 100644
--- a/.github/workflows/__test-action-publish.yml
+++ b/.github/workflows/__test-action-publish.yml
@@ -21,7 +21,7 @@ jobs:
 
       - id: package
         name: Arrange - Create package tarball
-        uses: ./actions/package
+        uses: $/actions/package
         with:
           working-directory: tests/npm
 
@@ -43,7 +43,7 @@ jobs:
           persist-credentials: false
 
       - name: Act - Run "publish" action
-        uses: ./actions/publish
+        uses: $/actions/publish
         with:
           package-tarball-artifact-id: ${{ needs.package.outputs.package-tarball-artifact-id }}
           tag: ${{ matrix.tag }}
@@ -54,7 +54,7 @@ jobs:
       - id: invalid-artifact
         name: Act - Reject multiple artifact IDs
         continue-on-error: true
-        uses: ./actions/publish
+        uses: $/actions/publish
         with:
           package-tarball-artifact-id: "1,2"
           dry-run: "true"
@@ -63,7 +63,7 @@ jobs:
       - id: invalid-dry-run
         name: Act - Reject invalid dry-run input
         continue-on-error: true
-        uses: ./actions/publish
+        uses: $/actions/publish
         with:
           package-tarball-artifact-id: ${{ needs.package.outputs.package-tarball-artifact-id }}
           dry-run: "yes"
diff --git a/.github/workflows/__test-action-setup-node.yml b/.github/workflows/__test-action-setup-node.yml
index 3463f70..12856c8 100644
--- a/.github/workflows/__test-action-setup-node.yml
+++ b/.github/workflows/__test-action-setup-node.yml
@@ -38,7 +38,7 @@ jobs:
 
       - name: Act - Run "setup-node" action
         id: act-setup-node
-        uses: ./actions/setup-node
+        uses: $/actions/setup-node
         with:
           working-directory: ${{ matrix.working-directory }}
       # jscpd:ignore-end
diff --git a/.github/workflows/__test-workflow-continuous-integration.yml b/.github/workflows/__test-workflow-continuous-integration.yml
index 6b9c63b..82862de 100644
--- a/.github/workflows/__test-workflow-continuous-integration.yml
+++ b/.github/workflows/__test-workflow-continuous-integration.yml
@@ -8,7 +8,7 @@ permissions: {}
 jobs:
   act-without-container:
     name: Act - Run the continuous integration workflow (without container)
-    uses: ./.github/workflows/continuous-integration.yml
+    uses: $/.github/workflows/continuous-integration.yml
     permissions:
       contents: read
       id-token: write
@@ -30,7 +30,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.act-without-container.outputs.build-artifact-id }}
           path: "/"
@@ -41,7 +41,7 @@ jobs:
   act-without-container-and-github-reports:
     # jscpd:ignore-start
     name: Act - Run the continuous integration workflow (without container and GitHub reports)
-    uses: ./.github/workflows/continuous-integration.yml
+    uses: $/.github/workflows/continuous-integration.yml
     permissions:
       contents: read
       id-token: write
@@ -61,14 +61,16 @@ jobs:
   arrange-with-container:
     name: Arrange - Build container image for CI workflow
     permissions:
+      attestations: write
       contents: read
       id-token: write
       issues: read
       packages: write
       pull-requests: read
-    uses: hoverkraft-tech/ci-github-container/.github/workflows/docker-build-images.yml@f8255a6a37eb141fa331527f5aed9b9e1d598c77 # 0.38.0
+    uses: hoverkraft-tech/ci-github-container/.github/workflows/docker-build-images.yml@5ffc3c81daacc57700a14bb91d67edbc67eedc1d # 0.39.0
     with:
       sign: false
+      attest: false
       images: |
         [{
           "name": "ci-npm",
@@ -83,7 +85,7 @@ jobs:
 
   act-with-container:
     name: Act - Run the continuous integration workflow (with container)
-    uses: ./.github/workflows/continuous-integration.yml
+    uses: $/.github/workflows/continuous-integration.yml
     needs: arrange-with-container
     permissions:
       contents: read
@@ -109,7 +111,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.act-with-container.outputs.build-artifact-id }}
           path: ${{ runner.temp }}
@@ -119,7 +121,7 @@ jobs:
 
   act-with-container-advanced:
     name: Act - Run the continuous integration workflow (with container and advanced options)
-    uses: ./.github/workflows/continuous-integration.yml
+    uses: $/.github/workflows/continuous-integration.yml
     needs: arrange-with-container
     permissions:
       contents: read
@@ -159,7 +161,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.act-with-container-advanced.outputs.build-artifact-id }}
           path: ${{ runner.temp }}
diff --git a/.github/workflows/continuous-integration.md b/.github/workflows/continuous-integration.md
index dc467aa..9dad4dc 100644
--- a/.github/workflows/continuous-integration.md
+++ b/.github/workflows/continuous-integration.md
@@ -3,7 +3,7 @@
 # GitHub Reusable Workflow: Node.js Continuous Integration
 
 <div align="center">
-  <img src="https://opengraph.githubassets.com/0985d9169d68b1e3b6128d321ac5b39cc163521568c33d9ad2724bb28994486b/hoverkraft-tech/ci-github-nodejs" width="60px" align="center" alt="Node.js Continuous Integration" />
+  <img src="https://opengraph.githubassets.com/1ac58f15a1475f04a818bff627181b3a0454f35bb5d19db4039e8e7ba79252cf/hoverkraft-tech/ci-github-nodejs" width="60px" align="center" alt="Node.js Continuous Integration" />
 </div>
 
 ---
@@ -58,7 +58,7 @@ on:
 permissions: {}
 jobs:
   continuous-integration:
-    uses: hoverkraft-tech/ci-github-nodejs/.github/workflows/continuous-integration.yml@df348077afa4e79725151d50606e9dc63f86dcb6 # 0.24.4
+    uses: hoverkraft-tech/ci-github-nodejs/.github/workflows/continuous-integration.yml@81a4bca8445b7b273455ff26a9a5c3c31c86b2a1 # 0.25.0
     permissions:
       contents: read
       id-token: write
@@ -335,7 +335,7 @@ For private container images, specify the username in the container input's `cre
 ```yaml
 jobs:
   continuous-integration:
-    uses: hoverkraft-tech/ci-github-nodejs/.github/workflows/continuous-integration.yml@main
+    uses: hoverkraft-tech/ci-github-nodejs/.github/workflows/continuous-integration.yml@81a4bca8445b7b273455ff26a9a5c3c31c86b2a1 # 0.25.0
     secrets:
       container-password: ${{ secrets.REGISTRY_PASSWORD }}
     with:
@@ -397,7 +397,7 @@ on:
 
 jobs:
   continuous-integration:
-    uses: hoverkraft-tech/ci-github-nodejs/.github/workflows/continuous-integration.yml@df348077afa4e79725151d50606e9dc63f86dcb6 # 0.24.4
+    uses: hoverkraft-tech/ci-github-nodejs/.github/workflows/continuous-integration.yml@81a4bca8445b7b273455ff26a9a5c3c31c86b2a1 # 0.25.0
     permissions:
       id-token: write
       security-events: write
@@ -414,13 +414,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup NodeJS
-        uses: hoverkraft-tech/ci-github-nodejs/actions/setup-node@0.2.2
+        uses: hoverkraft-tech/ci-github-nodejs/actions/setup-node@81a4bca8445b7b273455ff26a9a5c3c31c86b2a1 # 0.25.0
 
       - name: Download build artifact
-        uses: actions/download-artifact@v2
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.continuous-integration.outputs.build-artifact-id }}
           path: /
@@ -449,7 +449,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Build Docker image
         run: |
@@ -463,7 +463,7 @@ jobs:
   # Run CI checks inside the Docker container
   continuous-integration:
     needs: build-image
-    uses: hoverkraft-tech/ci-github-nodejs/.github/workflows/continuous-integration.yml@df348077afa4e79725151d50606e9dc63f86dcb6 # 0.24.4
+    uses: hoverkraft-tech/ci-github-nodejs/.github/workflows/continuous-integration.yml@81a4bca8445b7b273455ff26a9a5c3c31c86b2a1 # 0.25.0
     permissions:
       id-token: write
       security-events: write
@@ -487,7 +487,7 @@ on:
     branches: [main]
 jobs:
   continuous-integration:
-    uses: hoverkraft-tech/ci-github-nodejs/.github/workflows/continuous-integration.yml@df348077afa4e79725151d50606e9dc63f86dcb6 # 0.24.4
+    uses: hoverkraft-tech/ci-github-nodejs/.github/workflows/continuous-integration.yml@81a4bca8445b7b273455ff26a9a5c3c31c86b2a1 # 0.25.0
     permissions:
       id-token: write
       security-events: write
@@ -515,7 +515,7 @@ on:
 
 jobs:
   continuous-integration:
-    uses: hoverkraft-tech/ci-github-nodejs/.github/workflows/continuous-integration.yml@df348077afa4e79725151d50606e9dc63f86dcb6 # 0.24.4
+    uses: hoverkraft-tech/ci-github-nodejs/.github/workflows/continuous-integration.yml@81a4bca8445b7b273455ff26a9a5c3c31c86b2a1 # 0.25.0
     permissions:
       id-token: write
       security-events: write
diff --git a/.github/workflows/continuous-integration.yml b/.github/workflows/continuous-integration.yml
index 227fcfd..5b0c39d 100644
--- a/.github/workflows/continuous-integration.yml
+++ b/.github/workflows/continuous-integration.yml
@@ -293,11 +293,11 @@ jobs:
       security-events: write
     runs-on: *ci-runner
     steps:
-      - uses: hoverkraft-tech/ci-github-common/actions/checkout@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
-      - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+      - uses: hoverkraft-tech/ci-github-common/actions/checkout@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1
+      - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           languages: ${{ inputs.code-ql }}
-      - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+      - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
 
   dependency-review:
     name: 🛡️ Dependency Review
@@ -306,7 +306,7 @@ jobs:
       contents: read
     runs-on: *ci-runner
     steps:
-      - uses: hoverkraft-tech/ci-github-common/actions/checkout@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
+      - uses: hoverkraft-tech/ci-github-common/actions/checkout@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1
       - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
 
   setup:
@@ -332,10 +332,10 @@ jobs:
     steps:
       - name: Checkout repository
         if: inputs.container == ''
-        uses: hoverkraft-tech/ci-github-common/actions/checkout@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
+        uses: hoverkraft-tech/ci-github-common/actions/checkout@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1
 
       - id: working-directory
-        uses: hoverkraft-tech/ci-github-common/actions/working-directory@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
+        uses: hoverkraft-tech/ci-github-common/actions/working-directory@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1
         with:
           working-directory: ${{ inputs.working-directory }}
           enforce-path-in-workspace: ${{ inputs.container && 'false' || 'true' }}
@@ -441,14 +441,9 @@ jobs:
       contents: read
       packages: read
     steps:
-      - uses: hoverkraft-tech/ci-github-common/actions/checkout@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
+      - uses: hoverkraft-tech/ci-github-common/actions/checkout@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1
         if: inputs.container == ''
 
-      - id: local-workflow-actions
-        uses: hoverkraft-tech/ci-github-common/actions/local-workflow-actions@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
-        with:
-          actions-path: actions
-
       - id: preparel-lint-options
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
@@ -472,7 +467,7 @@ jobs:
             core.setOutput('report-file', lintOptions['report-file'] || '');
 
       - name: Run lint
-        uses: ./../self-workflow/actions/lint
+        uses: $/actions/lint
         with:
           working-directory: ${{ needs.setup.outputs.working-directory }}
           container: ${{ inputs.container != '' && 'true' || 'false' }}
@@ -494,17 +489,12 @@ jobs:
     outputs:
       artifact-id: ${{ steps.build.outputs.artifact-id }}
     steps:
-      - uses: hoverkraft-tech/ci-github-common/actions/checkout@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
+      - uses: hoverkraft-tech/ci-github-common/actions/checkout@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1
         if: needs.setup.outputs.build-commands && inputs.container == ''
 
-      - id: local-workflow-actions
-        uses: hoverkraft-tech/ci-github-common/actions/local-workflow-actions@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
-        with:
-          actions-path: actions
-
       - id: build
         if: needs.setup.outputs.build-commands
-        uses: ./../self-workflow/actions/build
+        uses: $/actions/build
         with:
           container: ${{ inputs.container != '' && 'true' || 'false' }}
           working-directory: ${{ needs.setup.outputs.working-directory }}
@@ -528,20 +518,15 @@ jobs:
       packages: read
       pull-requests: write
     steps:
-      - uses: hoverkraft-tech/ci-github-common/actions/checkout@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
+      - uses: hoverkraft-tech/ci-github-common/actions/checkout@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1
         if: inputs.container == ''
 
       - if: needs.build.outputs.artifact-id && inputs.container == ''
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.build.outputs.artifact-id }}
           path: "/"
 
-      - id: local-workflow-actions
-        uses: hoverkraft-tech/ci-github-common/actions/local-workflow-actions@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
-        with:
-          actions-path: actions
-
       - id: prepare-test-options
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
@@ -569,7 +554,7 @@ jobs:
             core.setOutput('command', testOptions.command || 'test:ci');
 
       - name: Run tests
-        uses: ./../self-workflow/actions/test
+        uses: $/actions/test
         with:
           working-directory: ${{ needs.setup.outputs.working-directory }}
           container: ${{ inputs.container != '' && 'true' || 'false' }}
diff --git a/.github/workflows/release.md b/.github/workflows/release.md
index 08cc6f2..d72b324 100644
--- a/.github/workflows/release.md
+++ b/.github/workflows/release.md
@@ -10,7 +10,7 @@ use [Commit the version before building](#commit-the-version-before-building).
 
 ## Set up
 
-1. Configure [release labels and version rules](https://github.com/hoverkraft-tech/ci-github-publish/blob/0.29.0/.github/workflows/prepare-release.md).
+1. Configure [release labels and version rules](https://github.com/hoverkraft-tech/ci-github-publish/blob/1.0.2/.github/workflows/prepare-release.md).
    These determine the version and release notes.
 2. Check the package's `package.json`: set `name`, `files`, and `repository.url`, and ensure `private` is not `true`.
 3. Configure [npm trusted publishing](../../actions/publish/README.md#npm-trusted-publishing) for your repository and workflow filename, `release.yml`.
@@ -18,7 +18,7 @@ use [Commit the version before building](#commit-the-version-before-building).
    For a new npm package, publish its first version before configuring the trusted publisher.
 4. Save the workflow below as `.github/workflows/release.yml` in your project. Before running it:
    - Replace every `<sha>` with the **same `ci-github-nodejs` commit containing `actions/publish`**.
-     The `ci-github-publish` actions are already pinned to `0.29.0`.
+     The `ci-github-publish` actions are already pinned to `1.0.2`.
    - Set the `build`, `lint:ci`, and `test:ci` script names and the `dist/` output path to match your project.
      See [CI options](continuous-integration.md) if you need a different setup.
 
@@ -58,7 +58,7 @@ jobs:
     steps:
       - name: Plan release
         id: plan
-        uses: hoverkraft-tech/ci-github-publish/actions/release/plan@a0a9d185c51c10710a5987822e78feb2b5ce1932 # 0.29.0
+        uses: hoverkraft-tech/ci-github-publish/actions/release/plan@4d906685a32df3cfab9139296d49dd914a86bafd # 1.0.2
 
       - id: version
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -117,7 +117,7 @@ jobs:
 
       # Wrap the raw .tgz in a ZIP artifact for release/create.
       - id: release-assets
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-assets
           path: ${{ steps.package.outputs.package-tarball-path }}
@@ -131,7 +131,7 @@ jobs:
           tag: latest
 
       - name: Create GitHub release
-        uses: hoverkraft-tech/ci-github-publish/actions/release/create@a0a9d185c51c10710a5987822e78feb2b5ce1932 # 0.29.0
+        uses: hoverkraft-tech/ci-github-publish/actions/release/create@4d906685a32df3cfab9139296d49dd914a86bafd # 1.0.2
         with:
           tag: ${{ needs.plan.outputs.tag }}
           target-sha: ${{ github.sha }}
@@ -144,6 +144,51 @@ and creates the tarball. [Publish](../../actions/publish/README.md) publishes th
 The package version is changed locally; it is not committed. GitHub's source archive therefore keeps the version from the source commit.
 If `package.json` already contains the planned version, omit the Package action's `version` input.
 
+## Generate the changelog
+
+`release/create` generates the GitHub release notes with Release Drafter from the merged pull requests since the previous matching release.
+No separate changelog command is needed for the workflow above. `release/plan` calculates the version without creating a release.
+
+Use the [prepare-release workflow](https://github.com/hoverkraft-tech/ci-github-publish/blob/1.0.2/.github/workflows/prepare-release.md)
+to label pull requests from their Conventional Commit titles. Its default rules select a major version for breaking changes,
+a minor version for features, and a patch version for other changes. Check the labels before merging.
+To customize categories, version rules, or the release-note template, add `.github/release-config.yml`.
+For monorepos, use the same `working-directory` and `include-paths` values in `release/plan` and `release/create`;
+an existing repository configuration takes precedence over those generated defaults.
+
+### Add an AI summary
+
+Store the provider credential as the `OPENAI_API_KEY` Actions secret, then add these entries to the **Create GitHub release** step.
+Merge `changelog-summary` into its existing `with` mapping:
+
+```yaml
+env:
+  OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+with:
+  changelog-summary: |
+    {
+      "llmAuth": ${{ toJSON(env.OPENAI_API_KEY) }},
+      "llmProvider": "openai"
+    }
+```
+
+The action drafts the changelog, generates a release summary and breaking-change section, and prepends them to the full changelog before publishing.
+The summary also uses GitHub evidence, so keep `contents: write` and `pull-requests: read` on the release job.
+Use `toJSON` to encode the credential safely. Omit `changelog-summary` to publish the generated notes without an AI summary.
+See [summarizer inputs](https://github.com/hoverkraft-tech/ci-github-publish/blob/1.0.2/actions/release/summarize-changelog/README.md)
+for `llmModel`, `llmConfig`, and custom summary templates.
+
+To review the notes before publication, set `publish: "false"`, review the draft, then publish it with `release/update`.
+If summary generation fails, the action does not publish the GitHub release. The npm package may already be published;
+follow [Recover a failed release](#recover-a-failed-release) instead of rerunning npm publication.
+
+### Keep a changelog in the repository
+
+Release notes are stored in the GitHub release body; these actions do not write or commit `CHANGELOG.md`.
+If the source archive or npm tarball must contain it, generate and review the changelog on the release branch,
+commit it with the version update, and build from that merged commit as described in [Commit the version before building](#commit-the-version-before-building).
+Keep the planned tag fixed through preparation and publication.
+
 ## Run a release
 
 In **Actions → Release → Run workflow**, select the default branch. The workflow also runs every Monday at 08:25 UTC.
@@ -175,7 +220,7 @@ and skip it when that version is already released.
 
 The Package action performs its own checkout of the workflow's source ref.
 Checking out the merged commit in an earlier step does not change that ref: start the packaging workflow at the merged commit.
-See the [release preparation example](https://github.com/hoverkraft-tech/ci-github-publish/blob/0.29.0/.github/workflows/release.md#example-3-validate-source-update-files-create-release-artifacts-and-release)
+See the [release preparation example](https://github.com/hoverkraft-tech/ci-github-publish/blob/1.0.2/.github/workflows/release.md#example-3-validate-source-update-files-create-release-artifacts-and-release)
 for automating the pull request and merge.
 
 ## Other setups
@@ -189,7 +234,7 @@ for automating the pull request and merge.
   For Package, set `working-directory` to the dependency installation root and `package-directory` to the package's relative path.
   Convert prefixed Git tags such as `my-package/v1.2.3` to npm versions, and use a separate concurrency group and artifact name per package.
 - **Drafts and signing:** create a draft with `publish: "false"`, then use `release/update` to attach assets and publish after npm publication succeeds.
-  See the [draft release example](https://github.com/hoverkraft-tech/ci-github-publish/blob/0.29.0/.github/workflows/release.md#example-2-validate-source-create-release-artifacts-and-release).
+  See the [draft release example](https://github.com/hoverkraft-tech/ci-github-publish/blob/1.0.2/.github/workflows/release.md#example-2-validate-source-create-release-artifacts-and-release).
   Use `release/delete` with `draft-only: "true"` to clean up a temporary draft on failure **only if the npm package has not been published**.
 
 ## Recover a failed release
diff --git a/Dockerfile b/Dockerfile
index 7fc7d9b..2cf267f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
-FROM ghcr.io/hoverkraft-tech/docker-base-images/super-linter:0.4.3
+FROM ghcr.io/hoverkraft-tech/docker-base-images/super-linter:2.0.0
 
 HEALTHCHECK --interval=5m --timeout=10s --start-period=30s --retries=3 CMD ["/bin/sh","-c","test -d /github/home"]
 ARG UID=1000
 ARG GID=1000
-USER ${UID}:${GID}
\ No newline at end of file
+USER ${UID}:${GID}
diff --git a/README.md b/README.md
index 2b72b23..007f1a3 100644
--- a/README.md
+++ b/README.md
@@ -17,6 +17,10 @@ This repository centralizes the Hoverkraft toolkit for building, testing, and sh
 - Composite actions that detect project tooling, manage dependencies, and bootstrap runtimes.
 - Reusable workflows that apply those actions to deliver consistent CI pipelines across repositories.
 
+## Prerequisites
+
+Use these actions and workflows on GitHub.com with GitHub-hosted runners or self-hosted runners version 2.336.0 or newer. Internal action composition uses GitHub's native `$/` references, which are unavailable on GitHub Enterprise Server.
+
 ## Actions
 
 ### CI Actions
diff --git a/actions/build/action.yml b/actions/build/action.yml
index e5e7326..8c6c339 100644
--- a/actions/build/action.yml
+++ b/actions/build/action.yml
@@ -67,19 +67,15 @@ runs:
   using: "composite"
   steps:
     # jscpd:ignore-start
-    - uses: hoverkraft-tech/ci-github-common/actions/local-actions@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
-      with:
-        source-path: ${{ github.action_path }}/..
-
     - id: working-directory
-      uses: hoverkraft-tech/ci-github-common/actions/working-directory@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
+      uses: hoverkraft-tech/ci-github-common/actions/working-directory@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1
       with:
         working-directory: ${{ inputs.working-directory }}
         enforce-path-in-workspace: ${{ inputs.container && 'false' || 'true' }}
 
     - id: setup-node
       if: inputs.container != 'true'
-      uses: ./../self-actions/setup-node
+      uses: $/actions/setup-node
       with:
         working-directory: ${{ steps.working-directory.outputs.absolute-path }}
         dependencies-cache: |
@@ -91,7 +87,7 @@ runs:
 
     - id: get-package-manager
       if: inputs.container == 'true'
-      uses: ./../self-actions/get-package-manager
+      uses: $/actions/get-package-manager
       with:
         working-directory: ${{ steps.working-directory.outputs.absolute-path }}
     # jscpd:ignore-end
@@ -165,7 +161,7 @@ runs:
 
     - id: build-artifact-id
       if: inputs.build-artifact != ''
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: ${{ fromJSON(inputs.build-artifact).name }}
         path: ${{ fromJSON(inputs.build-artifact).paths }}
diff --git a/actions/codecov/action.yml b/actions/codecov/action.yml
index 87f3464..7dbda82 100644
--- a/actions/codecov/action.yml
+++ b/actions/codecov/action.yml
@@ -32,7 +32,7 @@ runs:
   steps:
     # jscpd:ignore-start
     - id: working-directory
-      uses: hoverkraft-tech/ci-github-common/actions/working-directory@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
+      uses: hoverkraft-tech/ci-github-common/actions/working-directory@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1
       with:
         working-directory: ${{ inputs.working-directory }}
         enforce-path-in-workspace: "false"
diff --git a/actions/dependencies-cache/action.yml b/actions/dependencies-cache/action.yml
index 88f5f6d..4b325e1 100644
--- a/actions/dependencies-cache/action.yml
+++ b/actions/dependencies-cache/action.yml
@@ -33,26 +33,22 @@ runs:
   using: "composite"
   steps:
     # jscpd:ignore-start
-    - uses: hoverkraft-tech/ci-github-common/actions/local-actions@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
-      with:
-        source-path: ${{ github.action_path }}/..
-
     - id: working-directory
-      uses: hoverkraft-tech/ci-github-common/actions/working-directory@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
+      uses: hoverkraft-tech/ci-github-common/actions/working-directory@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1
       with:
         working-directory: ${{ inputs.working-directory }}
         enforce-path-in-workspace: "false"
 
     - id: has-installed-dependencies
       if: inputs.dependencies != ''
-      uses: ./../self-actions/has-installed-dependencies
+      uses: $/actions/has-installed-dependencies
       with:
         dependencies: ${{ inputs.dependencies }}
         working-directory: ${{ steps.working-directory.outputs.absolute-path }}
 
     - id: get-package-manager
       if: inputs.package-manager == ''
-      uses: ./../self-actions/get-package-manager
+      uses: $/actions/get-package-manager
       with:
         working-directory: ${{ steps.working-directory.outputs.absolute-path }}
     # jscpd:ignore-end
diff --git a/actions/get-package-manager/action.yml b/actions/get-package-manager/action.yml
index c86aea3..a0aa3ea 100644
--- a/actions/get-package-manager/action.yml
+++ b/actions/get-package-manager/action.yml
@@ -31,7 +31,7 @@ runs:
   using: "composite"
   steps:
     - id: working-directory
-      uses: hoverkraft-tech/ci-github-common/actions/working-directory@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
+      uses: hoverkraft-tech/ci-github-common/actions/working-directory@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1
       with:
         working-directory: ${{ inputs.working-directory }}
         enforce-path-in-workspace: "false"
diff --git a/actions/has-installed-dependencies/action.yml b/actions/has-installed-dependencies/action.yml
index 01d83e9..9b4d77e 100644
--- a/actions/has-installed-dependencies/action.yml
+++ b/actions/has-installed-dependencies/action.yml
@@ -25,19 +25,15 @@ runs:
   using: "composite"
   steps:
     # jscpd:ignore-start
-    - uses: hoverkraft-tech/ci-github-common/actions/local-actions@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
-      with:
-        source-path: ${{ github.action_path }}/..
-
     - id: working-directory
-      uses: hoverkraft-tech/ci-github-common/actions/working-directory@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
+      uses: hoverkraft-tech/ci-github-common/actions/working-directory@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1
       with:
         working-directory: ${{ inputs.working-directory }}
         enforce-path-in-workspace: "false"
 
     - id: get-package-manager
       if: inputs.package-manager == ''
-      uses: ./../self-actions/get-package-manager
+      uses: $/actions/get-package-manager
       with:
         working-directory: ${{ steps.working-directory.outputs.absolute-path }}
     # jscpd:ignore-end
diff --git a/actions/lint/action.yml b/actions/lint/action.yml
index db6ce60..27e28fe 100644
--- a/actions/lint/action.yml
+++ b/actions/lint/action.yml
@@ -46,19 +46,15 @@ runs:
   using: "composite"
   steps:
     # jscpd:ignore-start
-    - uses: hoverkraft-tech/ci-github-common/actions/local-actions@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
-      with:
-        source-path: ${{ github.action_path }}/..
-
     - id: working-directory
-      uses: hoverkraft-tech/ci-github-common/actions/working-directory@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
+      uses: hoverkraft-tech/ci-github-common/actions/working-directory@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1
       with:
         working-directory: ${{ inputs.working-directory }}
         enforce-path-in-workspace: ${{ inputs.container && 'false' || 'true' }}
 
     - id: setup-node
       if: inputs.container != 'true'
-      uses: ./../self-actions/setup-node
+      uses: $/actions/setup-node
       with:
         working-directory: ${{ steps.working-directory.outputs.absolute-path }}
         dependencies-cache: |
@@ -67,7 +63,7 @@ runs:
 
     - id: get-package-manager
       if: inputs.container == 'true'
-      uses: ./../self-actions/get-package-manager
+      uses: $/actions/get-package-manager
       with:
         working-directory: ${{ steps.working-directory.outputs.absolute-path }}
     # jscpd:ignore-end
@@ -109,7 +105,7 @@ runs:
 
     - name: 📊 Parse lint reports
       if: always()
-      uses: hoverkraft-tech/ci-github-common/actions/parse-ci-reports@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
+      uses: hoverkraft-tech/ci-github-common/actions/parse-ci-reports@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1
       with:
         working-directory: ${{ steps.working-directory.outputs.absolute-path }}
         report-paths: ${{ inputs.report-file || 'auto:lint' }}
diff --git a/actions/package/README.md b/actions/package/README.md
index 32923a9..2f987e3 100644
--- a/actions/package/README.md
+++ b/actions/package/README.md
@@ -3,7 +3,7 @@
 # ![Icon](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIyNCIgaGVpZ2h0PSIyNCIgdmlld0JveD0iMCAwIDI0IDI0IiBmaWxsPSJub25lIiBzdHJva2U9ImN1cnJlbnRDb2xvciIgc3Ryb2tlLXdpZHRoPSIyIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1saW5lam9pbj0icm91bmQiIGNsYXNzPSJmZWF0aGVyIGZlYXRoZXItcGFja2FnZSIgY29sb3I9ImJsdWUiPjxsaW5lIHgxPSIxNi41IiB5MT0iOS40IiB4Mj0iNy41IiB5Mj0iNC4yMSI+PC9saW5lPjxwYXRoIGQ9Ik0yMSAxNlY4YTIgMiAwIDAgMC0xLTEuNzNsLTctNGEyIDIgMCAwIDAtMiAwbC03IDRBMiAyIDAgMCAwIDMgOHY4YTIgMiAwIDAgMCAxIDEuNzNsNyA0YTIgMiAwIDAgMCAyIDBsNy00QTIgMiAwIDAgMCAyMSAxNnoiPjwvcGF0aD48cG9seWxpbmUgcG9pbnRzPSIzLjI3IDYuOTYgMTIgMTIuMDEgMjAuNzMgNi45NiI+PC9wb2x5bGluZT48bGluZSB4MT0iMTIiIHkxPSIyMi4wOCIgeDI9IjEyIiB5Mj0iMTIiPjwvbGluZT48L3N2Zz4=) GitHub Action: Package
 
 <div align="center">
-  <img src="https://opengraph.githubassets.com/fe78244ee4e7fcfcb2521a211f0029bce75b9857e6e280a0697b2812e32234d4/hoverkraft-tech/ci-github-nodejs" width="60px" align="center" alt="Package" />
+  <img src="https://opengraph.githubassets.com/1ac58f15a1475f04a818bff627181b3a0454f35bb5d19db4039e8e7ba79252cf/hoverkraft-tech/ci-github-nodejs" width="60px" align="center" alt="Package" />
 </div>
 
 ---
@@ -34,7 +34,7 @@ Action to create and upload an npm package tarball from a Node.js project
 ## Usage
 
 ```yaml
-- uses: hoverkraft-tech/ci-github-nodejs/actions/package@df348077afa4e79725151d50606e9dc63f86dcb6 # 0.24.4
+- uses: hoverkraft-tech/ci-github-nodejs/actions/package@81a4bca8445b7b273455ff26a9a5c3c31c86b2a1 # 0.25.0
   with:
     # Working directory where dependencies are installed for packaging.
     # Can be absolute or relative to the repository root.
@@ -114,14 +114,14 @@ jobs:
       package-tarball-artifact-id: ${{ steps.package.outputs.package-tarball-artifact-id }}
     steps:
       - id: package
-        uses: hoverkraft-tech/ci-github-nodejs/actions/package@df348077afa4e79725151d50606e9dc63f86dcb6 # 0.24.4
+        uses: hoverkraft-tech/ci-github-nodejs/actions/package@81a4bca8445b7b273455ff26a9a5c3c31c86b2a1 # 0.25.0
 
   consume:
     needs: package
     runs-on: ubuntu-latest
     steps:
       - name: Download package tarball by artifact ID
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ needs.package.outputs.package-tarball-artifact-id }}
           skip-decompress: true
diff --git a/actions/package/action.yml b/actions/package/action.yml
index 4eeb10e..f009de6 100644
--- a/actions/package/action.yml
+++ b/actions/package/action.yml
@@ -57,26 +57,22 @@ runs:
       with:
         persist-credentials: false
 
-    - uses: hoverkraft-tech/ci-github-common/actions/local-actions@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
-      with:
-        source-path: ${{ github.action_path }}/..
-
     # jscpd:ignore-start
     - id: working-directory
-      uses: hoverkraft-tech/ci-github-common/actions/working-directory@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
+      uses: hoverkraft-tech/ci-github-common/actions/working-directory@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1
       with:
         working-directory: ${{ inputs.working-directory }}
         enforce-path-in-workspace: "false"
 
     - id: setup-node
-      uses: ./../self-actions/setup-node
+      uses: $/actions/setup-node
       with:
         working-directory: ${{ steps.working-directory.outputs.absolute-path }}
     # jscpd:ignore-end
 
     - name: Download build artifacts
       if: inputs.build-artifact-id != ''
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
       with:
         artifact-ids: ${{ inputs.build-artifact-id }}
         path: ${{ inputs.build-artifact-path }}
@@ -196,7 +192,7 @@ runs:
 
     - name: Upload package tarball
       id: upload-package-tarball
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: ${{ steps.resolve-artifact-name.outputs.artifact-name }}
         path: ${{ steps.package.outputs.package-tarball-path }}
diff --git a/actions/publish/action.yml b/actions/publish/action.yml
index 06434e8..41ba68d 100644
--- a/actions/publish/action.yml
+++ b/actions/publish/action.yml
@@ -78,14 +78,14 @@ runs:
           core.setOutput('download-path', fs.mkdtempSync(path.join(process.env.RUNNER_TEMP, 'package-publish-')));
 
     - name: Setup Node.js
-      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
       with:
         registry-url: ${{ inputs.registry-url }}
         node-version: "lts/*"
 
     - name: Download package tarball
       id: download-package-tarball
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
       with:
         artifact-ids: ${{ inputs.package-tarball-artifact-id }}
         path: ${{ steps.validate.outputs.download-path }}
diff --git a/actions/setup-node/action.yml b/actions/setup-node/action.yml
index c20e0eb..f239613 100644
--- a/actions/setup-node/action.yml
+++ b/actions/setup-node/action.yml
@@ -31,12 +31,8 @@ runs:
   using: "composite"
   steps:
     # jscpd:ignore-start
-    - uses: hoverkraft-tech/ci-github-common/actions/local-actions@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
-      with:
-        source-path: ${{ github.action_path }}/..
-
     - id: working-directory
-      uses: hoverkraft-tech/ci-github-common/actions/working-directory@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
+      uses: hoverkraft-tech/ci-github-common/actions/working-directory@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1
       with:
         working-directory: ${{ inputs.working-directory }}
         enforce-path-in-workspace: "false"
@@ -44,7 +40,7 @@ runs:
 
     - id: get-package-manager
       if: inputs.package-manager == ''
-      uses: ./../self-actions/get-package-manager
+      uses: $/actions/get-package-manager
       with:
         working-directory: ${{ steps.working-directory.outputs.absolute-path }}
 
@@ -129,7 +125,7 @@ runs:
         package_json_file: ${{ steps.working-directory.outputs.workspace-relative-path }}/package.json
         run_install: false
 
-    - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+    - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
       with:
         node-version-file: ${{ steps.get-node-version-file.outputs.node-version-file }}
         cache: ${{ steps.get-package-manager.outputs.cache-dependency-path != '' && steps.get-package-manager.outputs.package-manager || '' }}
@@ -154,7 +150,7 @@ runs:
           await exec.exec(command, args, { cwd: workingDirectory });
 
     - if: inputs.dependencies-cache != ''
-      uses: ./../self-actions/dependencies-cache
+      uses: $/actions/dependencies-cache
       with:
         dependencies: ${{ inputs.dependencies-cache }}
         working-directory: ${{ steps.working-directory.outputs.absolute-path }}
diff --git a/actions/test/action.yml b/actions/test/action.yml
index dd7483c..688d584 100644
--- a/actions/test/action.yml
+++ b/actions/test/action.yml
@@ -72,13 +72,9 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - uses: hoverkraft-tech/ci-github-common/actions/local-actions@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
-      with:
-        source-path: ${{ github.action_path }}/..
-
     # jscpd:ignore-start
     - id: working-directory
-      uses: hoverkraft-tech/ci-github-common/actions/working-directory@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
+      uses: hoverkraft-tech/ci-github-common/actions/working-directory@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1
       with:
         working-directory: ${{ inputs.working-directory }}
         enforce-path-in-workspace: ${{ inputs.container && 'false' || 'true' }}
@@ -86,7 +82,7 @@ runs:
 
     - id: setup-node
       if: inputs.container != 'true'
-      uses: ./../self-actions/setup-node
+      uses: $/actions/setup-node
       with:
         working-directory: ${{ steps.working-directory.outputs.absolute-path }}
         dependencies-cache: |
@@ -96,7 +92,7 @@ runs:
 
     - id: get-package-manager
       if: inputs.container == 'true'
-      uses: ./../self-actions/get-package-manager
+      uses: $/actions/get-package-manager
       with:
         working-directory: ${{ steps.working-directory.outputs.absolute-path }}
 
@@ -138,7 +134,7 @@ runs:
     - name: 📊 Parse coverage reports
       if: always() && inputs.coverage == 'github'
       id: parse-coverage-reports
-      uses: hoverkraft-tech/ci-github-common/actions/parse-ci-reports@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
+      uses: hoverkraft-tech/ci-github-common/actions/parse-ci-reports@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1
       with:
         working-directory: ${{ steps.working-directory.outputs.absolute-path }}
         report-name: "Coverage Results"
@@ -148,13 +144,13 @@ runs:
 
     - name: 📊 Add coverage PR comment
       if: always() && inputs.coverage == 'github' && github.event_name == 'pull_request' && steps.parse-coverage-reports.outputs.markdown
-      uses: hoverkraft-tech/ci-github-common/actions/create-or-update-comment@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
+      uses: hoverkraft-tech/ci-github-common/actions/create-or-update-comment@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1
       with:
         title: "Code Coverage Report"
         body: ${{ steps.parse-coverage-reports.outputs.markdown }}
 
     - name: 📊 Upload coverage to Codecov
       if: always() && inputs.coverage == 'codecov'
-      uses: ./../self-actions/codecov
+      uses: $/actions/codecov
       with:
         working-directory: ${{ steps.working-directory.outputs.absolute-path }}

From fd5f2bbd38a3e1b5c40c6168083d69e40a4f196b Mon Sep 17 00:00:00 2001
From: Emilien Escalle <emilien.escalle@escemi.com>
Date: Sun, 25 Oct 2026 22:35:45 +0100
Subject: [PATCH 2/2] fix(ci): resolve lint failures after linter upgrade

Use the Conventional Commits preset so breaking-change headers parse.
Exclude generated action and workflow docs from clone detection while
retaining checks for source files and handwritten documentation.

Use the Node image's numeric user and an exec-form test healthcheck.
---
 .commitlintrc.json          | 3 +++
 .github/linters/.jscpd.json | 2 ++
 tests/npm/Dockerfile        | 6 +++---
 3 files changed, 8 insertions(+), 3 deletions(-)
 create mode 100644 .commitlintrc.json

diff --git a/.commitlintrc.json b/.commitlintrc.json
new file mode 100644
index 0000000..c30e5a9
--- /dev/null
+++ b/.commitlintrc.json
@@ -0,0 +1,3 @@
+{
+  "extends": ["@commitlint/config-conventional"]
+}
diff --git a/.github/linters/.jscpd.json b/.github/linters/.jscpd.json
index dbc1183..9ea13e8 100644
--- a/.github/linters/.jscpd.json
+++ b/.github/linters/.jscpd.json
@@ -1,6 +1,8 @@
 {
   "threshold": 5,
   "ignore": [
+    "**/actions/**/README.md",
+    "**/.github/workflows/continuous-integration.md",
     "**/node_modules/**",
     "**/.pnpm-store/**",
     "**/pnpm-workspace.yaml",
diff --git a/tests/npm/Dockerfile b/tests/npm/Dockerfile
index 62856ec..88cff12 100644
--- a/tests/npm/Dockerfile
+++ b/tests/npm/Dockerfile
@@ -1,6 +1,6 @@
 FROM node:24.14-bookworm-slim AS base
 
-USER node
+USER 1000:1000
 WORKDIR /usr/src/app
 
 FROM base AS build
@@ -19,6 +19,6 @@ FROM base AS ci
 
 COPY --chown=node:node --from=build /usr/src/app/ /usr/src/app/
 
-HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 CMD node -v >/dev/null 2>&1 || exit 1
+HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 CMD ["node", "--version"]
 
-CMD [ "tail", "-f", "/dev/null" ]
\ No newline at end of file
+CMD [ "tail", "-f", "/dev/null" ]