Merge remote-tracking branch 'origin/release/v3.8.50' into feat/8468-bun-windows-ci-coverage

# Conflicts:
#	CLAUDE.md

.github/workflows/build.yml

@@ -0,0 +1,57 @@
+name: Build App
+
+on:
+  workflow_dispatch:
+  push:
+    branches: ["**"]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Fast Production Build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Expand Virtual Memory (Native 10GB Swap)
+        run: |
+          sudo swapoff -a || true
+          sudo rm -f /mnt/swapfile /swapfile
+          sudo fallocate -l 10G /mnt/swapfile || sudo dd if=/dev/zero of=/mnt/swapfile bs=1M count=10240
+          sudo chmod 600 /mnt/swapfile
+          sudo mkswap /mnt/swapfile
+          sudo swapon /mnt/swapfile
+          free -h
+
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: "24"
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build Next.js app & CLI bundle
+        run: |
+          npm run build:release
+        env:
+          NODE_OPTIONS: "--max-old-space-size=12288"
+          OMNIROUTE_BUILD_MEMORY_MB: "12288"
+          OMNIROUTE_USE_TURBOPACK: "1"
+
+      - name: Archive build outputs
+        run: |
+          tar -czf omniroute-build.tar.gz .build dist
+
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: omniroute-build
+          path: omniroute-build.tar.gz
+          retention-days: 7

.github/workflows/ci.yml

@@ -1227,8 +1227,10 @@ jobs:
           cache: npm
       - uses: ./.github/actions/npm-ci-retry
       - run: npm run check:node-runtime
-      # (tsx/esm = QW-b; o alinhamento de ESCOPO do integration com o npm script fica p/ follow-up)
-      - run: node --import tsx/esm --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit --test-concurrency=1 --test-shard=${{ matrix.shard }}/2 tests/integration/*.test.ts
+      - name: Integration tests (shard ${{ matrix.shard }}/2)
+        env:
+          TEST_SHARD: ${{ matrix.shard }}/2
+        run: npm run test:integration:ci
 
   test-security:
     name: Security Tests

.github/workflows/codeql.yml

@@ -22,10 +22,10 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+      - uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           languages: javascript-typescript
           queries: security-extended
-      - uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+      - uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           category: "/language:javascript-typescript"

.github/workflows/docker-publish.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - main
+      - "release/v*"
     tags:
       - "v*"
     paths-ignore:
@@ -57,39 +58,20 @@ jobs:
           REF_TYPE: ${{ github.ref_type }}
           INPUT_VERSION: ${{ inputs.version }}
           PROMOTE_INPUT: ${{ inputs.promote_latest }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
         run: |
           set -euo pipefail
 
-          # 1) Resolve version string from the trigger (all inputs come via env).
-          case "$EVENT_NAME" in
-            workflow_dispatch)
-              VERSION="${INPUT_VERSION#v}"
-              ;;
-            push)
-              if [ "$REF_TYPE" = "tag" ]; then
-                VERSION="${REF_NAME#v}"
-              else
-                # Push to main → build & tag as `main` only. Never touch :latest.
-                VERSION="main"
-              fi
-              ;;
-            release)
-              VERSION="${REF_NAME#v}"
-              ;;
-            *)
-              VERSION="${REF_NAME#v}"
-              ;;
-          esac
-          # Sanity-check: only allow [A-Za-z0-9._-] in VERSION (defense in depth).
-          if ! printf '%s' "$VERSION" | grep -qE '^[A-Za-z0-9._-]+$'; then
-            echo "Refusing to use unsafe VERSION value: $VERSION" >&2
-            exit 1
-          fi
+          # 1) Resolve version/channel from the trigger. Only the current default
+          # release branch publishes the mutable `next` channel; main keeps `main`.
+          VERSION=$(bash scripts/ci/resolve-docker-publish-version.sh \
+            "$EVENT_NAME" "$REF_TYPE" "$REF_NAME" "$INPUT_VERSION" "$DEFAULT_BRANCH")
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
-          # 2) Decide whether to promote :latest.
+          # 2) Decide whether to promote :latest. Floating channels are never
+          # eligible, and the helper independently fails closed for non-semver.
           PROMOTE="false"
-          if [ "$VERSION" = "main" ]; then
+          if [ "$VERSION" = "main" ] || [ "$VERSION" = "next" ]; then
             PROMOTE="false"
           elif printf '%s' "$VERSION" | grep -qE -- '-(rc|alpha|beta|pre|next)'; then
             echo "Pre-release identifier detected — skipping :latest."
@@ -109,10 +91,10 @@ jobs:
           fi
           echo "promote_latest=$PROMOTE" >> "$GITHUB_OUTPUT"
 
-          # 3) Skip if this exact version is already published in Docker Hub.
-          #    `main` is always rebuilt (mutable floating tag).
+          # 3) Skip immutable version tags that already exist. Floating `main`
+          # and `next` channels are intentionally rebuilt on every matching push.
           SKIP="false"
-          if [ "$VERSION" != "main" ]; then
+          if [ "$VERSION" != "main" ] && [ "$VERSION" != "next" ]; then
             if docker manifest inspect "diegosouzapw/omniroute:${VERSION}" >/dev/null 2>&1; then
               echo "Image diegosouzapw/omniroute:${VERSION} already exists on Docker Hub — skipping rebuild."
               SKIP="true"
@@ -155,13 +137,13 @@ jobs:
         uses: docker/setup-buildx-action@v4
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v4.5.2
+        uses: docker/login-action@v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4.5.2
+        uses: docker/login-action@v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -255,13 +237,13 @@ jobs:
         uses: docker/setup-buildx-action@v4
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v4.5.2
+        uses: docker/login-action@v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4.5.2
+        uses: docker/login-action@v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -390,14 +372,14 @@ jobs:
       - name: Upload Trivy SARIF to Security tab
         if: needs.prepare.outputs.version != 'main'
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@v4.37.3
+        uses: github/codeql-action/upload-sarif@v4.37.4
         with:
           sarif_file: trivy-results.sarif
           category: trivy-image
 
       - name: Update Docker Hub description
         # Only refresh README/description when we actually promote :latest
-        # (avoids overwriting from main pushes or back-fill builds).
+        # (avoids overwriting from main, next, or back-fill builds).
         if: needs.prepare.outputs.promote_latest == 'true'
         uses: peter-evans/dockerhub-description@v5
         with:

.github/workflows/nightly-release-green.yml

@@ -193,7 +193,7 @@ jobs:
             gh issue comment "$EXISTING" --repo "$GITHUB_REPOSITORY" --body-file issue-body.md
             echo "Updated existing issue #$EXISTING"
           else
-            gh issue create --repo "$GITHUB_REPOSITORY" --title "$TITLE" --body-file issue-body.md
+            gh issue create --repo "$GITHUB_REPOSITORY" --title "$TITLE" --label base-red --body-file issue-body.md
           fi
 
       - name: Upload report artifact
@@ -291,7 +291,7 @@ jobs:
             gh issue comment "$EXISTING" --repo "$GITHUB_REPOSITORY" --body-file issue-body.md
             echo "Updated existing issue #$EXISTING"
           else
-            gh issue create --repo "$GITHUB_REPOSITORY" --title "$TITLE" --body-file issue-body.md
+            gh issue create --repo "$GITHUB_REPOSITORY" --title "$TITLE" --label base-red --body-file issue-body.md
           fi
 
       - name: Upload report artifact

.github/workflows/quality.yml

@@ -151,63 +151,6 @@ jobs:
           key: eslint-${{ runner.os }}-${{ hashFiles('eslint.config.mjs', 'eslint.complexity-ratchets.config.mjs', 'config/quality/eslint-suppressions.json', 'package-lock.json') }}
           restore-keys: |
             eslint-${{ runner.os }}-
-      - run: npm run check:provider-consistency
-      - run: npm run check:fetch-targets
-      # docs-all / openapi-routes / docs-symbols live in docs-gates (path-filtered).
-      - run: npm run check:deps
-      # #8522: --base-ref mode for PR events — compare against max(frozen, base) so
-      # inherited drift (base already over frozen cap) doesn't red an innocent PR.
-      # workflow_dispatch (no PR base) falls back to absolute comparison.
-      - name: File-size ratchet (base-relative on PR)
-        env:
-          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
-        run: |
-          if [ -n "$PR_BASE_SHA" ]; then
-            npm run check:file-size -- --base-ref "$PR_BASE_SHA"
-          else
-            npm run check:file-size
-          fi
-      - run: npm run check:error-helper
-      - run: npm run check:migration-numbering
-      - run: npm run check:public-creds
-      - run: npm run check:db-rules
-      - run: npm run check:known-symbols
-      - run: npm run check:route-guard-membership
-      - run: npm run check:test-discovery
-      - run: npm run check:test-runner-api
-      # Guards tap.testFiles drift: a covering unit test absent from stryker.conf.json
-      # tap.testFiles makes its module's mutants survive on a cold nightly-mutation run,
-      # false-failing the blocking mutationScore ratchet. See check-mutation-test-coverage.mjs.
-      - run: npm run check:mutation-test-coverage
-      - run: npm run check:any-budget:t11
-      # Build-scope guard: fails if worktrees/cruft leak into the tsconfig include
-      # scope (would OOM `next build`). Instant. See incident 2026-06-25 / #5031.
-      - run: npm run check:build-scope
-      # Pack-policy (unexpected-files allowlist) WITHOUT a build — catches a stray file
-      # leaking into the npm tarball (v3.8.36: 6 ops bin/*.sh) per-PR instead of only on
-      # the release PR's heavy Package Artifact job.
-      - run: npm run check:pack-policy
-      # Complexity + cognitive-complexity: ONE ESLint walk (both baselines still
-      # enforced separately by ruleId). Avoids two cold tree walks on fast-path.
-      - run: npm run check:complexity-ratchets
-      # ── G0 (trilho .50): gates do trilho A que faltavam no trilho B ──────────────
-      # The god-file refactor happens in PRs→release/**; without these, the release
-      # rail never sees a new import cycle, dead code, duplication or a security
-      # regression until the release PR to main. Deliberately NOT brought here:
-      # bundle-size (self-skips without a build — this rail's build job is advisory
-      # and uploads nothing, so it would be dead configuration) and the coverage
-      # run (fast-unit already runs the full suite; the coverage ratchet stays on
-      # the main rail via --allow-missing in lint-guard).
-      - run: npm run check:cycles
-      - run: npm run check:lockfile
-      - name: Duplication ratchet
-        run: npm run check:duplication
-      - name: Dead-code ratchet (knip)
-        run: npm run check:dead-code
-      - name: Type coverage ratchet
-        run: npm run check:type-coverage
-      - name: Compression budget ratchet
-        run: npm run check:compression-budget
       # Security scanners — same hardened install as ci.yml quality-extended
       # (gh release download = authenticated, 5000 req/hr; curl to api.github.com
       # is rate-limited to 60/hr and silently no-ops when throttled). The blocking
@@ -251,26 +194,63 @@ jobs:
           "$HOME/.local/bin/osv-scanner" --version || true
           "$HOME/.local/bin/oasdiff" --version || true
           zizmor --version || true
-      - name: Secret scan (gitleaks, ratchet, blocking)
-        run: npm run check:secrets -- --ratchet
-      - name: Vulnerability ratchet (osv-scanner, ratchet, blocking)
-        run: npm run check:vuln-ratchet -- --ratchet
-      - name: Workflow lint (actionlint+zizmor, ratchet, blocking)
-        run: npm run check:workflows -- --ratchet
-      # BASE_REF is read by the script from the env (never interpolated into a
-      # shell body) — workflow-injection-safe. actions/checkout fetches remote
-      # refs, not a local branch named github.base_ref, so prefix origin/ or this
-      # gate self-skips every PR with reason=base-unresolved.
-      - name: OpenAPI breaking-change (oasdiff, ratchet, blocking)
+      # Quality gates (all, non-fail-fast) — #8542: replaces 17 bare check:* steps,
+      # 6 G0 gates, 4 ratchet gates, and 3 typecheck steps with a single aggregation
+      # step. Each gate runs in a loop with ::group::; failures are collected and
+      # reported at the end. set -uo pipefail (NOT set -e) so one failing gate does
+      # not abort the job and mask every later gate. Release-added gates are folded
+      # in: open-sse typecheck (#8781) and file-size base-relative mode (#8522).
+      - name: Quality gates (all, non-fail-fast)
         env:
+          # #8522: base-relative file-size mode on PR events — inherited drift (base
+          # already over frozen cap) must not red an innocent PR. Unset on
+          # workflow_dispatch (no PR base) → absolute comparison.
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
           BASE_REF: ${{ github.base_ref && format('origin/{0}', github.base_ref) || '' }}
-        run: npm run check:openapi-breaking -- --ratchet
-      - name: Typecheck (core)
-        run: npm run typecheck:core
-      # #7033: dashboard-scoped typecheck gate — src/app/(dashboard) TSX is not
-      # covered by typecheck:core's curated allowlist. See check-dashboard-typecheck.mjs.
-      - name: Typecheck (dashboard)
-        run: npm run check:dashboard-typecheck
+        run: |
+          set -uo pipefail
+          gates=(
+            provider-consistency fetch-targets deps file-size error-helper
+            migration-numbering public-creds db-rules known-symbols
+            route-guard-membership test-discovery test-runner-api
+            mutation-test-coverage any-budget:t11 build-scope pack-policy
+            complexity-ratchets
+            cycles lockfile duplication dead-code type-coverage compression-budget
+            # #8781: open-sse workspace typecheck gate — the workspace imports @/ which
+            # escapes to src/ via undeclared path aliases. See check-open-sse-typecheck.mjs.
+            open-sse-typecheck
+          )
+          ratchet_gates=(
+            secrets vuln-ratchet workflows openapi-breaking
+          )
+          failed=()
+          for g in "${gates[@]}"; do
+            echo "::group::check:$g"
+            # #8522: file-size is base-relative on PR events (compare against
+            # max(frozen, base)) so inherited drift doesn't red an innocent PR;
+            # workflow_dispatch (no PR base) falls back to absolute comparison.
+            if [ "$g" = "file-size" ] && [ -n "${PR_BASE_SHA:-}" ]; then
+              npm run "check:$g" -- --base-ref "$PR_BASE_SHA" || failed+=("$g")
+            else
+              npm run "check:$g" || failed+=("$g")
+            fi
+            echo "::endgroup::"
+          done
+          for g in "${ratchet_gates[@]}"; do
+            echo "::group::check:$g (ratchet)"
+            npm run "check:$g" -- --ratchet || failed+=("$g")
+            echo "::endgroup::"
+          done
+          echo "::group::typecheck:core"
+          npm run typecheck:core || failed+=("typecheck:core")
+          echo "::endgroup::"
+          echo "::group::check:dashboard-typecheck"
+          npm run check:dashboard-typecheck || failed+=("check:dashboard-typecheck")
+          echo "::endgroup::"
+          if (( ${#failed[@]} )); then
+            printf '::error::%d gate(s) failed: %s\n' "${#failed[@]}" "${failed[*]}"
+            exit 1
+          fi
       # WS4.2 (v3.8.49 plan): TypeScript 7 native-compiler SHADOW — advisory only.
       # TS7 went GA 2026-07-08 with 8-12x type-check speedups; its Compiler API only
       # arrives in 7.1, so typescript-eslint / type-coverage / Stryker stay on 6.x