[RELEASE] Promote dev to main

.github/workflows/code-metrics.yml

@@ -45,7 +45,7 @@ jobs:
           dir: ${{ './' }}
 
       - name: Create pull request
-        uses: peter-evans/create-pull-request@v8.1.0
+        uses: peter-evans/create-pull-request@v8.1.1
         if: ${{ steps.dotnet-code-metrics.outputs.updated-metrics }} == 'true'
         with:
           title: '${{ steps.dotnet-code-metrics.outputs.summary-title }}'

.github/workflows/codeql-analysis.yml

@@ -38,21 +38,21 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v5
         with:
           dotnet-version: '10.0.x'
           dotnet-quality: 'ga'
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
         with:
           languages: ${{ matrix.language }}
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3
+        uses: github/codeql-action/autobuild@v4
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4

.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,155 @@
+name: Dependabot Auto-Merge
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review
+    branches:
+      - dev
+  push:
+    branches:
+      - dev
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: dependabot-auto-merge-${{ github.event.pull_request.number || github.ref_name || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  enable-auto-merge:
+    name: Enable auto-merge on Dependabot PRs
+    if: >-
+      github.event_name == 'pull_request_target' &&
+      github.event.pull_request.user.login == 'dependabot[bot]' &&
+      github.event.pull_request.base.ref == 'dev' &&
+      github.event.pull_request.draft == false
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Enable auto-merge
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const pullRequestId = context.payload.pull_request.node_id;
+            const pullNumber = context.payload.pull_request.number;
+
+            try {
+              await github.graphql(
+                `
+                  mutation EnableAutoMerge($pullRequestId: ID!) {
+                    enablePullRequestAutoMerge(
+                      input: {
+                        pullRequestId: $pullRequestId
+                        mergeMethod: SQUASH
+                      }
+                    ) {
+                      pullRequest {
+                        number
+                      }
+                    }
+                  }
+                `,
+                { pullRequestId }
+              );
+
+              core.info(`Enabled auto-merge for PR #${pullNumber}.`);
+            } catch (error) {
+              const message = error.message ?? String(error);
+              if (message.includes('already enabled')) {
+                core.info(`Auto-merge is already enabled for PR #${pullNumber}.`);
+                return;
+              }
+
+              throw error;
+            }
+
+  refresh-open-prs:
+    name: Refresh open Dependabot PR branches
+    if: github.event_name != 'pull_request_target'
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Update open Dependabot PRs
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+
+            const openPullRequests = await github.paginate(
+              github.rest.pulls.list,
+              {
+                owner,
+                repo,
+                state: 'open',
+                base: 'dev',
+                per_page: 100,
+              }
+            );
+
+            const dependabotPullRequests = openPullRequests.filter(
+              pullRequest =>
+                pullRequest.user?.login === 'dependabot[bot]' &&
+                pullRequest.draft === false
+            );
+
+            if (dependabotPullRequests.length === 0) {
+              core.info('No open Dependabot PRs target dev.');
+              return;
+            }
+
+            for (const pullRequest of dependabotPullRequests) {
+              try {
+                await github.rest.pulls.updateBranch({
+                  owner,
+                  repo,
+                  pull_number: pullRequest.number,
+                });
+
+                core.info(`Queued branch update for PR #${pullRequest.number}.`);
+              } catch (error) {
+                if (error.status === 409 || error.status === 422) {
+                  core.info(
+                    `No branch update queued for PR #${pullRequest.number}: ${error.message}`
+                  );
+                } else {
+                  throw error;
+                }
+              }
+
+              try {
+                await github.graphql(
+                  `
+                    mutation EnableAutoMerge($pullRequestId: ID!) {
+                      enablePullRequestAutoMerge(
+                        input: {
+                          pullRequestId: $pullRequestId
+                          mergeMethod: SQUASH
+                        }
+                      ) {
+                        pullRequest {
+                          number
+                        }
+                      }
+                    }
+                  `,
+                  { pullRequestId: pullRequest.node_id }
+                );
+
+                core.info(`Ensured auto-merge for PR #${pullRequest.number}.`);
+              } catch (error) {
+                const message = error.message ?? String(error);
+                if (message.includes('already enabled')) {
+                  core.info(`Auto-merge already enabled for PR #${pullRequest.number}.`);
+                } else {
+                  core.warning(`Could not enable auto-merge for PR #${pullRequest.number}: ${message}`);
+                }
+              }
+            }

.github/workflows/milestone-blog.yml

@@ -40,13 +40,15 @@ jobs:
           PUBLISH_DATE=$(date -d "${CLOSED_AT}" '+%Y-%m-%d' 2>/dev/null || date '+%Y-%m-%d')
           LAST_TAG=$(gh api "repos/${{ github.repository }}/releases?per_page=1" --jq '.[0].tag_name // "none"')
 
-          echo "issues<<EOF" >> "$GITHUB_OUTPUT"
-          echo "$ISSUES" >> "$GITHUB_OUTPUT"
-          echo "EOF" >> "$GITHUB_OUTPUT"
-          echo "count=$ISSUE_COUNT" >> "$GITHUB_OUTPUT"
-          echo "feature_count=$FEATURE_COUNT" >> "$GITHUB_OUTPUT"
-          echo "publish_date=$PUBLISH_DATE" >> "$GITHUB_OUTPUT"
-          echo "last_tag=$LAST_TAG" >> "$GITHUB_OUTPUT"
+          {
+            echo "issues<<EOF"
+            echo "$ISSUES"
+            echo "EOF"
+            echo "count=$ISSUE_COUNT"
+            echo "feature_count=$FEATURE_COUNT"
+            echo "publish_date=$PUBLISH_DATE"
+            echo "last_tag=$LAST_TAG"
+          } >> "$GITHUB_OUTPUT"
 
       - name: Create Ralph review issue
         env:
@@ -103,6 +105,7 @@ jobs:
           *Triggered by milestone close at ${PUBLISH_DATE}. Workflow: \`milestone-blog.yml\`*"
 
           gh issue create \
+            --repo "${{ github.repository }}" \
             --title "📋 Milestone Review: ${MILESTONE_TITLE} — release or blog?" \
             --body "$BODY" \
             --label "squad:ralph,pending-review"

.github/workflows/milestone-release-decision.yml

@@ -41,18 +41,19 @@ jobs:
           BUMP=$(echo "$ISSUE_BODY" | grep -oE 'bump[: ]+(major|minor|patch)' | grep -oE '(major|minor|patch)' | head -1)
           BUMP=${BUMP:-minor}
 
-          echo "milestone_title=$MILESTONE_TITLE" >> "$GITHUB_OUTPUT"
-          echo "bump=$BUMP" >> "$GITHUB_OUTPUT"
-          echo "issue_number=${{ github.event.issue.number }}" >> "$GITHUB_OUTPUT"
+          {
+            echo "milestone_title=$MILESTONE_TITLE"
+            echo "bump=$BUMP"
+          } >> "$GITHUB_OUTPUT"
 
       - name: Trigger release workflow
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           BUMP: ${{ steps.info.outputs.bump }}
         run: |
           gh workflow run squad-milestone-release.yml \
-            --field bump="${BUMP}" \
-            --field milestone_number="${{ github.event.issue.number }}"
+            --repo "${{ github.repository }}" \
+            --field bump="${BUMP}"
           echo "✅ Triggered squad-milestone-release.yml (bump: ${BUMP})"
 
       - name: Add release-triggered comment and close review issue
@@ -61,7 +62,7 @@ jobs:
           ISSUE_NUMBER: ${{ github.event.issue.number }}
           BUMP: ${{ steps.info.outputs.bump }}
         run: |
-          gh issue comment "$ISSUE_NUMBER" --body "✅ **Release flow triggered.**
+          gh issue comment "$ISSUE_NUMBER" --repo "${{ github.repository }}" --body "✅ **Release flow triggered.**
 
           - Version bump: \`${BUMP}\`
           - \`squad-milestone-release.yml\` dispatched — this will create the tag, push it, and publish a GitHub Release.
@@ -70,7 +71,7 @@ jobs:
 
           Closing this review issue."
 
-          gh issue close "$ISSUE_NUMBER" --reason completed
+          gh issue close "$ISSUE_NUMBER" --repo "${{ github.repository }}" --reason completed
 
   # ─────────────────────────────────────────────────────────────────────────────
   # PATH B: Blog Only
@@ -91,12 +92,11 @@ jobs:
           PUBLISH_DATE=$(date '+%Y-%m-%d')
           SLUG=$(echo "$MILESTONE_TITLE" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9]/-/g' | sed 's/--*/-/g' | sed 's/^-\|-$//g')
 
-          # Pull closed issues list from the review issue body
-          ISSUES_BLOCK=$(echo "${{ github.event.issue.body }}" | sed -n '/### Closed Issues/,/---/p' | head -50)
-
-          echo "milestone_title=$MILESTONE_TITLE" >> "$GITHUB_OUTPUT"
-          echo "publish_date=$PUBLISH_DATE" >> "$GITHUB_OUTPUT"
-          echo "slug=$SLUG" >> "$GITHUB_OUTPUT"
+          {
+            echo "milestone_title=$MILESTONE_TITLE"
+            echo "publish_date=$PUBLISH_DATE"
+            echo "slug=$SLUG"
+          } >> "$GITHUB_OUTPUT"
 
       - name: Create Bilbo blog brief issue
         env:
@@ -130,6 +130,7 @@ jobs:
           - Close both this issue and the review issue (#${REVIEW_ISSUE_NUMBER}) in the PR description"
 
           gh issue create \
+            --repo "${{ github.repository }}" \
             --title "Blog post: ${MILESTONE_TITLE} — milestone recap" \
             --body "$BODY" \
             --label "squad:bilbo"
@@ -139,12 +140,12 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           ISSUE_NUMBER: ${{ github.event.issue.number }}
         run: |
-          gh issue comment "$ISSUE_NUMBER" --body "📝 **Blog-only path selected.**
+          gh issue comment "$ISSUE_NUMBER" --repo "${{ github.repository }}" --body "📝 **Blog-only path selected.**
 
           A \`squad:bilbo\` blog brief issue has been created. Once Bilbo's PR merges:
           - \`docs/blog/index.md\` will be updated (the blog page)
           - \`blog-readme-sync.yml\` will update \`README.md\` (the Page)
 
           Closing this review issue."
 
-          gh issue close "$ISSUE_NUMBER" --reason completed
+          gh issue close "$ISSUE_NUMBER" --repo "${{ github.repository }}" --reason completed

.github/workflows/release-blog.yml

@@ -30,9 +30,11 @@ jobs:
           PREV_TAG=$(gh api "repos/${{ github.repository }}/releases" \
             --jq '[.[] | select(.tag_name != "'"${TAG}"'")] | sort_by(.published_at) | reverse | .[0].tag_name // "HEAD~50"')
 
-          echo "publish_date=$PUBLISH_DATE" >> "$GITHUB_OUTPUT"
-          echo "slug=$SLUG" >> "$GITHUB_OUTPUT"
-          echo "prev_tag=$PREV_TAG" >> "$GITHUB_OUTPUT"
+          {
+            echo "publish_date=$PUBLISH_DATE"
+            echo "slug=$SLUG"
+            echo "prev_tag=$PREV_TAG"
+          } >> "$GITHUB_OUTPUT"
 
       - name: Create Bilbo blog brief issue
         env:
@@ -73,6 +75,7 @@ jobs:
           - Close this issue in the PR description with \`Closes #<this-issue>\`"
 
           gh issue create \
+            --repo "${{ github.repository }}" \
             --title "Blog post: ${RELEASE_NAME} — release recap" \
             --body "$BODY" \
             --label "squad:bilbo"

.github/workflows/squad-ci.yml

@@ -18,10 +18,10 @@ jobs:
     timeout-minutes: 20
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v5
         with:
           global-json-file: global.json
 

.github/workflows/squad-label-enforce.yml

@@ -13,7 +13,7 @@ jobs:
   enforce:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Enforce mutual exclusivity
         uses: actions/github-script@v9

.github/workflows/squad-preview.yml

@@ -15,7 +15,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v5
         with:
           global-json-file: global.json
 
@@ -28,5 +28,6 @@ jobs:
       - name: Run unit tests
         run: |
           dotnet test tests/Architecture.Tests --configuration Release --no-build --verbosity normal
+          dotnet test tests/Domain.Tests --configuration Release --no-build --verbosity normal
           dotnet test tests/Web.Tests --configuration Release --no-build --verbosity normal
           dotnet test tests/Web.Tests.Integration --configuration Release --no-build --verbosity normal

.github/workflows/squad-promote.yml

@@ -29,7 +29,7 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v5
         with:
           global-json-file: global.json