From 9c9a3ef762522794bcc6722eeb1a6cbbd0f8a21e Mon Sep 17 00:00:00 2001
From: "ccf-lisa[bot]" <286799724+ccf-lisa[bot]@users.noreply.github.com>
Date: Wed, 28 Oct 2026 16:33:15 -0300
Subject: [PATCH 1/4] ci(deps): bump workflows to v1.9.0

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml             | 6 +++---
 .github/workflows/cut-prerelease.yml | 2 +-
 .github/workflows/preview.yml        | 2 +-
 .github/workflows/release-please.yml | 2 +-
 .github/workflows/release.yml        | 2 +-
 5 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1b6d4475..97babd99 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,7 +14,7 @@ permissions: {}
 
 jobs:
   ci:
-    uses: compliance-framework/workflows/.github/workflows/ci-go-service.yml@e85d35af2af2ddfcd4b92061d2063e665c1831f6 # v1.7.0
+    uses: compliance-framework/workflows/.github/workflows/ci-go-service.yml@1e188815a0e8036da1bea4e637a9973ecdc3ae1c # v1.9.0
     with:
       # Regenerate the Swagger docs (docs/) from the handler annotations before vet, the tests
       # and the make targets, as the old CI did before its tests.
@@ -32,14 +32,14 @@ jobs:
     secrets: inherit
 
   release-checks:
-    uses: compliance-framework/workflows/.github/workflows/release-checks.yml@e85d35af2af2ddfcd4b92061d2063e665c1831f6 # v1.7.0
+    uses: compliance-framework/workflows/.github/workflows/release-checks.yml@1e188815a0e8036da1bea4e637a9973ecdc3ae1c # v1.9.0
     permissions:
       contents: read
 
   notify:
     needs: [ci, release-checks]
     if: always()
-    uses: compliance-framework/workflows/.github/workflows/notify-failure.yml@e85d35af2af2ddfcd4b92061d2063e665c1831f6 # v1.7.0
+    uses: compliance-framework/workflows/.github/workflows/notify-failure.yml@1e188815a0e8036da1bea4e637a9973ecdc3ae1c # v1.9.0
     with:
       needs: ${{ toJSON(needs) }}
     permissions:
diff --git a/.github/workflows/cut-prerelease.yml b/.github/workflows/cut-prerelease.yml
index 437d754b..08f9fa37 100644
--- a/.github/workflows/cut-prerelease.yml
+++ b/.github/workflows/cut-prerelease.yml
@@ -7,7 +7,7 @@ permissions:
   contents: read
 jobs:
   cut:
-    uses: compliance-framework/workflows/.github/workflows/cut-prerelease.yml@e85d35af2af2ddfcd4b92061d2063e665c1831f6 # v1.7.0
+    uses: compliance-framework/workflows/.github/workflows/cut-prerelease.yml@1e188815a0e8036da1bea4e637a9973ecdc3ae1c # v1.9.0
     permissions:
       contents: read
     secrets: inherit
diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml
index 5fc15a16..57916c72 100644
--- a/.github/workflows/preview.yml
+++ b/.github/workflows/preview.yml
@@ -18,7 +18,7 @@ concurrency:
 
 jobs:
   preview:
-    uses: compliance-framework/workflows/.github/workflows/preview.yml@e85d35af2af2ddfcd4b92061d2063e665c1831f6 # v1.7.0
+    uses: compliance-framework/workflows/.github/workflows/preview.yml@1e188815a0e8036da1bea4e637a9973ecdc3ae1c # v1.9.0
     with:
       kind: image
       on-main: true
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index cd5373df..be52b87f 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -15,7 +15,7 @@ concurrency:
 
 jobs:
   release-please:
-    uses: compliance-framework/workflows/.github/workflows/release-please.yml@e85d35af2af2ddfcd4b92061d2063e665c1831f6 # v1.7.0
+    uses: compliance-framework/workflows/.github/workflows/release-please.yml@1e188815a0e8036da1bea4e637a9973ecdc3ae1c # v1.9.0
     permissions:
       contents: read
     secrets: inherit
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 54b26733..61331687 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   release:
-    uses: compliance-framework/workflows/.github/workflows/release-go-image.yml@e85d35af2af2ddfcd4b92061d2063e665c1831f6 # v1.7.0
+    uses: compliance-framework/workflows/.github/workflows/release-go-image.yml@1e188815a0e8036da1bea4e637a9973ecdc3ae1c # v1.9.0
     with:
       images: '[{"name":"api","dockerfile":"Dockerfile","context":"."}]'
     permissions:

From 26a3bbfe65b2234530d2f2aeff48066348441a3d Mon Sep 17 00:00:00 2001
From: "ccf-lisa[bot]" <286799724+ccf-lisa[bot]@users.noreply.github.com>
Date: Wed, 28 Oct 2026 16:45:32 -0300
Subject: [PATCH 2/4] chore(lint): match golangci-lint v2.15.0 from workflows
 v1.9.0

CI now runs golangci-lint v2.15.0, so make lint.install and AGENTS.md
use the same version. The ci.yml header notes the non-gating image check.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 3 ++-
 AGENTS.md                | 2 +-
 Makefile                 | 2 +-
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 97babd99..026d54b7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,6 +1,7 @@
 # Shared go-service CI from compliance-framework/workflows, pinned to a release commit that
 # ccf-bump moves. The status checks to require are `ci / required` and
-# `release-checks / release-checks` (skipped, so passing, on non-release PRs).
+# `release-checks / release-checks` (skipped, so passing, on non-release PRs). The image check
+# (fixable HIGH or CRITICAL vulnerabilities in the built image) runs outside them and gates nothing.
 name: ci
 
 on:
diff --git a/AGENTS.md b/AGENTS.md
index edf3cdc6..256297ef 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -31,7 +31,7 @@ Run these before calling a change done. They are what CI runs (`.github/workflow
 
 ```sh
 make swag                 # regenerate docs/ from handler annotations; commit any diff
-make lint                 # golangci-lint v2.11.4 (make lint.install), default linters
+make lint                 # golangci-lint v2.15.0 (make lint.install), default linters
 make test                 # unit tests only: files with the integration tag are not compiled
 make test-integration-single TEST_PATH=./internal/api/handler/... TEST_NAME=TestArtifactApi
 make test-integration     # everything; slow
diff --git a/Makefile b/Makefile
index 7e4063cf..13176616 100644
--- a/Makefile
+++ b/Makefile
@@ -133,7 +133,7 @@ lint.check: ## Check install of golanci-lint
 .PHONY: lint.install
 lint.install: ## Install golangci-lint to the go bin dir
 		@$(INFO) "Installing golangci-lint"; \
-		curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/main/install.sh | sh -s -- -b $(GOBIN) v2.11.4
+		curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/main/install.sh | sh -s -- -b $(GOBIN) v2.15.0
 
 .PHONY: lint
 lint: lint.check ## Run golangci-lint

From b9925bb381c7c6fd1eabb8e3652f04eb9833c5e6 Mon Sep 17 00:00:00 2001
From: "ccf-lisa[bot]" <286799724+ccf-lisa[bot]@users.noreply.github.com>
Date: Wed, 28 Oct 2026 16:57:30 -0300
Subject: [PATCH 3/4] ci(deps): bump workflows to v1.9.1

v1.9.1 verifies the golangci-lint config with the schema built into
golangci-lint v2.15.0 instead of passing --schema (workflows#166).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml             | 6 +++---
 .github/workflows/cut-prerelease.yml | 2 +-
 .github/workflows/preview.yml        | 2 +-
 .github/workflows/release-please.yml | 2 +-
 .github/workflows/release.yml        | 2 +-
 5 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 026d54b7..43fb3d78 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,7 +15,7 @@ permissions: {}
 
 jobs:
   ci:
-    uses: compliance-framework/workflows/.github/workflows/ci-go-service.yml@1e188815a0e8036da1bea4e637a9973ecdc3ae1c # v1.9.0
+    uses: compliance-framework/workflows/.github/workflows/ci-go-service.yml@aafa1649ac6f33c02c581486c50f9cf04cc0eb54 # v1.9.1
     with:
       # Regenerate the Swagger docs (docs/) from the handler annotations before vet, the tests
       # and the make targets, as the old CI did before its tests.
@@ -33,14 +33,14 @@ jobs:
     secrets: inherit
 
   release-checks:
-    uses: compliance-framework/workflows/.github/workflows/release-checks.yml@1e188815a0e8036da1bea4e637a9973ecdc3ae1c # v1.9.0
+    uses: compliance-framework/workflows/.github/workflows/release-checks.yml@aafa1649ac6f33c02c581486c50f9cf04cc0eb54 # v1.9.1
     permissions:
       contents: read
 
   notify:
     needs: [ci, release-checks]
     if: always()
-    uses: compliance-framework/workflows/.github/workflows/notify-failure.yml@1e188815a0e8036da1bea4e637a9973ecdc3ae1c # v1.9.0
+    uses: compliance-framework/workflows/.github/workflows/notify-failure.yml@aafa1649ac6f33c02c581486c50f9cf04cc0eb54 # v1.9.1
     with:
       needs: ${{ toJSON(needs) }}
     permissions:
diff --git a/.github/workflows/cut-prerelease.yml b/.github/workflows/cut-prerelease.yml
index 08f9fa37..a7084b5d 100644
--- a/.github/workflows/cut-prerelease.yml
+++ b/.github/workflows/cut-prerelease.yml
@@ -7,7 +7,7 @@ permissions:
   contents: read
 jobs:
   cut:
-    uses: compliance-framework/workflows/.github/workflows/cut-prerelease.yml@1e188815a0e8036da1bea4e637a9973ecdc3ae1c # v1.9.0
+    uses: compliance-framework/workflows/.github/workflows/cut-prerelease.yml@aafa1649ac6f33c02c581486c50f9cf04cc0eb54 # v1.9.1
     permissions:
       contents: read
     secrets: inherit
diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml
index 57916c72..c912e4b3 100644
--- a/.github/workflows/preview.yml
+++ b/.github/workflows/preview.yml
@@ -18,7 +18,7 @@ concurrency:
 
 jobs:
   preview:
-    uses: compliance-framework/workflows/.github/workflows/preview.yml@1e188815a0e8036da1bea4e637a9973ecdc3ae1c # v1.9.0
+    uses: compliance-framework/workflows/.github/workflows/preview.yml@aafa1649ac6f33c02c581486c50f9cf04cc0eb54 # v1.9.1
     with:
       kind: image
       on-main: true
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index be52b87f..f6eb7ebf 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -15,7 +15,7 @@ concurrency:
 
 jobs:
   release-please:
-    uses: compliance-framework/workflows/.github/workflows/release-please.yml@1e188815a0e8036da1bea4e637a9973ecdc3ae1c # v1.9.0
+    uses: compliance-framework/workflows/.github/workflows/release-please.yml@aafa1649ac6f33c02c581486c50f9cf04cc0eb54 # v1.9.1
     permissions:
       contents: read
     secrets: inherit
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 61331687..d06c2a1c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   release:
-    uses: compliance-framework/workflows/.github/workflows/release-go-image.yml@1e188815a0e8036da1bea4e637a9973ecdc3ae1c # v1.9.0
+    uses: compliance-framework/workflows/.github/workflows/release-go-image.yml@aafa1649ac6f33c02c581486c50f9cf04cc0eb54 # v1.9.1
     with:
       images: '[{"name":"api","dockerfile":"Dockerfile","context":"."}]'
     permissions:

From fa248826e12ce768946f59bb3dfacaf26128d946 Mon Sep 17 00:00:00 2001
From: "ccf-lisa[bot]" <286799724+ccf-lisa[bot]@users.noreply.github.com>
Date: Thu, 29 Oct 2026 05:37:11 -0300
Subject: [PATCH 4/4] ci(deps): bump workflows to v1.9.2

Pin every compliance-framework/workflows reusable workflow to v1.9.2
(dc7434879fbd0db1d1df9f590ed8bc13789bd320). golangci-lint stays at v2.15.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml             | 6 +++---
 .github/workflows/cut-prerelease.yml | 2 +-
 .github/workflows/preview.yml        | 2 +-
 .github/workflows/release-please.yml | 2 +-
 .github/workflows/release.yml        | 2 +-
 5 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 43fb3d78..b12a7ce5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,7 +15,7 @@ permissions: {}
 
 jobs:
   ci:
-    uses: compliance-framework/workflows/.github/workflows/ci-go-service.yml@aafa1649ac6f33c02c581486c50f9cf04cc0eb54 # v1.9.1
+    uses: compliance-framework/workflows/.github/workflows/ci-go-service.yml@dc7434879fbd0db1d1df9f590ed8bc13789bd320 # v1.9.2
     with:
       # Regenerate the Swagger docs (docs/) from the handler annotations before vet, the tests
       # and the make targets, as the old CI did before its tests.
@@ -33,14 +33,14 @@ jobs:
     secrets: inherit
 
   release-checks:
-    uses: compliance-framework/workflows/.github/workflows/release-checks.yml@aafa1649ac6f33c02c581486c50f9cf04cc0eb54 # v1.9.1
+    uses: compliance-framework/workflows/.github/workflows/release-checks.yml@dc7434879fbd0db1d1df9f590ed8bc13789bd320 # v1.9.2
     permissions:
       contents: read
 
   notify:
     needs: [ci, release-checks]
     if: always()
-    uses: compliance-framework/workflows/.github/workflows/notify-failure.yml@aafa1649ac6f33c02c581486c50f9cf04cc0eb54 # v1.9.1
+    uses: compliance-framework/workflows/.github/workflows/notify-failure.yml@dc7434879fbd0db1d1df9f590ed8bc13789bd320 # v1.9.2
     with:
       needs: ${{ toJSON(needs) }}
     permissions:
diff --git a/.github/workflows/cut-prerelease.yml b/.github/workflows/cut-prerelease.yml
index a7084b5d..eaa5038e 100644
--- a/.github/workflows/cut-prerelease.yml
+++ b/.github/workflows/cut-prerelease.yml
@@ -7,7 +7,7 @@ permissions:
   contents: read
 jobs:
   cut:
-    uses: compliance-framework/workflows/.github/workflows/cut-prerelease.yml@aafa1649ac6f33c02c581486c50f9cf04cc0eb54 # v1.9.1
+    uses: compliance-framework/workflows/.github/workflows/cut-prerelease.yml@dc7434879fbd0db1d1df9f590ed8bc13789bd320 # v1.9.2
     permissions:
       contents: read
     secrets: inherit
diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml
index c912e4b3..068afb68 100644
--- a/.github/workflows/preview.yml
+++ b/.github/workflows/preview.yml
@@ -18,7 +18,7 @@ concurrency:
 
 jobs:
   preview:
-    uses: compliance-framework/workflows/.github/workflows/preview.yml@aafa1649ac6f33c02c581486c50f9cf04cc0eb54 # v1.9.1
+    uses: compliance-framework/workflows/.github/workflows/preview.yml@dc7434879fbd0db1d1df9f590ed8bc13789bd320 # v1.9.2
     with:
       kind: image
       on-main: true
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index f6eb7ebf..a8b0fa89 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -15,7 +15,7 @@ concurrency:
 
 jobs:
   release-please:
-    uses: compliance-framework/workflows/.github/workflows/release-please.yml@aafa1649ac6f33c02c581486c50f9cf04cc0eb54 # v1.9.1
+    uses: compliance-framework/workflows/.github/workflows/release-please.yml@dc7434879fbd0db1d1df9f590ed8bc13789bd320 # v1.9.2
     permissions:
       contents: read
     secrets: inherit
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d06c2a1c..47eb586b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   release:
-    uses: compliance-framework/workflows/.github/workflows/release-go-image.yml@aafa1649ac6f33c02c581486c50f9cf04cc0eb54 # v1.9.1
+    uses: compliance-framework/workflows/.github/workflows/release-go-image.yml@dc7434879fbd0db1d1df9f590ed8bc13789bd320 # v1.9.2
     with:
       images: '[{"name":"api","dockerfile":"Dockerfile","context":"."}]'
     permissions: