Merge branch 'main' into keys_dir

Author: V02460

.github/CODEOWNERS

@@ -0,0 +1 @@
+*   @element-hq/mas-maintainers

.github/actions/build-frontend/action.yml

@@ -10,9 +10,9 @@ runs:
   using: composite
   steps:
     - name: Install Node
-      uses: actions/setup-node@v4.2.0
+      uses: actions/setup-node@v6.0.0
       with:
-        node-version: "22"
+        node-version: "24"
 
     - name: Install dependencies
       run: npm ci

.github/actions/build-policies/action.yml

@@ -12,7 +12,8 @@ runs:
     - name: Install Open Policy Agent
       uses: open-policy-agent/[email protected]
       with:
-        version: 1.1.0
+        # Keep in sync with the Dockerfile and policies/Makefile
+        version: 1.8.0
 
     - name: Build the policies
       run: make

.github/workflows/build.yaml

@@ -84,7 +84,7 @@ jobs:
           chmod -R u=rwX,go=rX assets-dist/
 
       - name: Upload assets
-        uses: actions/upload-artifact@v4.6.2
+        uses: actions/upload-artifact@v5.0.0
         with:
           name: assets
           path: assets-dist
@@ -143,7 +143,7 @@ jobs:
             -p mas-cli
 
       - name: Upload binary artifact
-        uses: actions/upload-artifact@v4.6.2
+        uses: actions/upload-artifact@v5.0.0
         with:
           name: binary-${{ matrix.target }}
           path: target/${{ matrix.target }}/release/mas-cli
@@ -162,19 +162,19 @@ jobs:
 
     steps:
       - name: Download assets
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v6
         with:
           name: assets
           path: assets-dist
 
       - name: Download binary x86_64
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v6
         with:
           name: binary-x86_64-unknown-linux-gnu
           path: binary-x86_64
 
       - name: Download binary aarch64
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v6
         with:
           name: binary-aarch64-unknown-linux-gnu
           path: binary-aarch64
@@ -192,13 +192,13 @@ jobs:
           done
 
       - name: Upload aarch64 archive
-        uses: actions/upload-artifact@v4.6.2
+        uses: actions/upload-artifact@v5.0.0
         with:
           name: mas-cli-aarch64-linux
           path: mas-cli-aarch64-linux.tar.gz
 
       - name: Upload x86_64 archive
-        uses: actions/upload-artifact@v4.6.2
+        uses: actions/upload-artifact@v5.0.0
         with:
           name: mas-cli-x86_64-linux
           path: mas-cli-x86_64-linux.tar.gz
@@ -226,7 +226,7 @@ jobs:
     steps:
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5.8.0
+        uses: docker/metadata-action@v5.9.0
         with:
           images: "${{ env.IMAGE }}"
           bake-target: docker-metadata-action
@@ -242,7 +242,7 @@ jobs:
 
       - name: Docker meta (debug variant)
         id: meta-debug
-        uses: docker/metadata-action@v5.8.0
+        uses: docker/metadata-action@v5.9.0
         with:
           images: "${{ env.IMAGE }}"
           bake-target: docker-metadata-action-debug
@@ -258,7 +258,7 @@ jobs:
             type=sha
 
       - name: Setup Cosign
-        uses: sigstore/cosign-installer@v3.9.2
+        uses: sigstore/cosign-installer@v4.0.0
 
       - name: Set up Docker Buildx
         uses: docker/[email protected]
@@ -268,7 +268,7 @@ jobs:
               mirrors = ["mirror.gcr.io"]
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3.5.0
+        uses: docker/login-action@v3.6.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -320,14 +320,14 @@ jobs:
       - build-image
     steps:
       - name: Download the artifacts from the previous job
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v6
         with:
           pattern: mas-cli-*
           path: artifacts
           merge-multiple: true
 
       - name: Prepare a release
-        uses: softprops/action-gh-release@v2.3.2
+        uses: softprops/action-gh-release@v2.4.2
         with:
           generate_release_notes: true
           body: |
@@ -382,21 +382,21 @@ jobs:
             .github/scripts
 
       - name: Download the artifacts from the previous job
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v6
         with:
           pattern: mas-cli-*
           path: artifacts
           merge-multiple: true
 
       - name: Update unstable git tag
-        uses: actions/github-script@v7.0.1
+        uses: actions/github-script@v8.0.0
         with:
           script: |
             const script = require('./.github/scripts/update-unstable-tag.cjs');
             await script({ core, github, context });
 
       - name: Update unstable release
-        uses: softprops/action-gh-release@v2.3.2
+        uses: softprops/action-gh-release@v2.4.2
         with:
           name: "Unstable build"
           tag_name: unstable
@@ -460,7 +460,7 @@ jobs:
             .github/scripts
 
       - name: Remove label and comment
-        uses: actions/github-script@v7.0.1
+        uses: actions/github-script@v8.0.0
         env:
           BUILD_IMAGE_MANIFEST: ${{ needs.build-image.outputs.metadata }}
         with:

.github/workflows/ci.yaml

@@ -41,7 +41,8 @@ jobs:
       - name: Setup Regal
         uses: StyraInc/setup-regal@v1
         with:
-          version: 0.29.2
+          # Keep in sync with policies/Makefile
+          version: 0.36.1
 
       - name: Lint policies
         working-directory: ./policies
@@ -63,9 +64,9 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Install Node
-        uses: actions/setup-node@v4.4.0
+        uses: actions/setup-node@v6.0.0
         with:
-          node-version: 22
+          node-version: 24
 
       - name: Install Node dependencies
         working-directory: ./frontend
@@ -87,9 +88,9 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Install Node
-        uses: actions/setup-node@v4.4.0
+        uses: actions/setup-node@v6.0.0
         with:
-          node-version: 22
+          node-version: 24
 
       - name: Install Node dependencies
         working-directory: ./frontend
@@ -111,9 +112,9 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Install Node
-        uses: actions/setup-node@v4.4.0
+        uses: actions/setup-node@v6.0.0
         with:
-          node-version: 20
+          node-version: 24
 
       - name: Install Node dependencies
         working-directory: ./frontend
@@ -256,7 +257,7 @@ jobs:
           SQLX_OFFLINE: "1"
 
       - name: Upload archive to workflow
-        uses: actions/upload-artifact@v4.6.2
+        uses: actions/upload-artifact@v5.0.0
         with:
           name: nextest-archive
           path: nextest-archive.tar.zst
@@ -304,7 +305,7 @@ jobs:
       - uses: ./.github/actions/build-policies
 
       - name: Download archive
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v6
         with:
           name: nextest-archive
 

.github/workflows/coverage.yaml

@@ -38,7 +38,7 @@ jobs:
         run: make coverage
 
       - name: Upload to codecov.io
-        uses: codecov/[email protected].0
+        uses: codecov/[email protected].1
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: policies/coverage.json
@@ -65,7 +65,7 @@ jobs:
         run: npm run coverage
 
       - name: Upload to codecov.io
-        uses: codecov/[email protected].0
+        uses: codecov/[email protected].1
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           directory: frontend/coverage/
@@ -132,7 +132,7 @@ jobs:
           grcov . --binary-path ./target/debug/deps/ -s . -t lcov --branch --ignore-not-existing --ignore '../*' --ignore "/*" -o target/coverage/tests.lcov
 
       - name: Upload to codecov.io
-        uses: codecov/[email protected].0
+        uses: codecov/[email protected].1
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: target/coverage/*.lcov

.github/workflows/docs.yaml

@@ -39,9 +39,9 @@ jobs:
           tool: mdbook
 
       - name: Install Node
-        uses: actions/setup-node@v4.4.0
+        uses: actions/setup-node@v6.0.0
         with:
-          node-version: 22
+          node-version: 24
 
       - name: Build the documentation
         run: sh misc/build-docs.sh

.github/workflows/merge-back.yaml

@@ -30,7 +30,7 @@ jobs:
             .github/scripts
 
       - name: Push branch and open a PR
-        uses: actions/github-script@v7.0.1
+        uses: actions/github-script@v8.0.0
         env:
           SHA: ${{ inputs.sha }}
         with:

.github/workflows/release-branch.yaml

@@ -64,9 +64,9 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Install Node
-        uses: actions/setup-node@v4.4.0
+        uses: actions/setup-node@v6.0.0
         with:
-          node-version: 22
+          node-version: 24
 
       - name: Install Localazy CLI
         run: npm install -g @localazy/cli
@@ -112,7 +112,7 @@ jobs:
             .github/scripts
 
       - name: Create a new release branch
-        uses: actions/github-script@v7.0.1
+        uses: actions/github-script@v8.0.0
         env:
           BRANCH: release/v${{ needs.compute-version.outputs.short }}
           SHA: ${{ needs.tag.outputs.sha }}

.github/workflows/release-bump.yaml

@@ -82,7 +82,7 @@ jobs:
             .github/scripts
 
       - name: Update the release branch
-        uses: actions/github-script@v7.0.1
+        uses: actions/github-script@v8.0.0
         env:
           BRANCH: "${{ github.ref_name }}"
           SHA: ${{ needs.tag.outputs.sha }}