chore(main): Release v9.27.0

[github-actions]

🤖 I have created a release beep boop

9.27.0 (2026-10-08)

Features

• auth: route the GET /api/v1/auth login to server-nestjs (cef4b7c)
• client: preload repository sync branch (d14064e)
• nginx-strangler: route /api/v1/admin/roles to server-nestjs (ae914db), closes #2781
• nginx-strangler: route healthz and version to server-nestjs (4169619), closes #1889
• nginx-strangler: router la connexion /api/v1/auth vers server-nestjs (2e04658)
• nginx-strangler: router les stages vers server-nestjs (703baff)
• server-nestjs: add Sécurité Plateforme admin role (e1e6074), closes #2792
• server-nestjs: consume adminRole events in keycloak and gitlab modules (c8323dc), closes #2723
• server-nestjs: migrate stages (febeee4)
• server-nestjs: persist repository sync branch (c44d5a2)
• server-nestjs: register AdminRoleModule (937c628), closes #1889
• server-nestjs: save branch before repository sync (6c90b94)
• shared: expose repository sync branch (cec1eac)
• skills: add cpn skill creation guide (3b5e3e4)

Bug Fixes

• admin-token: coerce contract expirationDate to Date at the service boundary (53e2616)
• admin-token: drop invalid guard metadata specs (dfcaef1)
• admin-token: optional withRevoked, service-level expiration check, module wiring (dfabc49), closes #1889
• admin-token: update fixture import after inlining (601f1e3)
• auth: return oidc-resolved admin role ids in the session payload (efa5d2a)
• avoid using docker compose --menu flag (43ddecc)
• ci: fix docker compose having the wrong OPENCDS_URL (6aa0e66)
• ci: fix opencds not having its url set up for server-nestjs (c72778d)
• ci: give opencds_mockoon container the same prefix as other services (d562063)
• ci: rename opencds-mockoon container (0424c57)
• let console and project admin view project deployments (785362e)
• project: reject already archived projects (b17a159), closes #2757
• project: reject archiving an already archived project (2ba94b8), closes #2757
• project: rejeter l'archivage au niveau du contrôleur (d8c607e), closes #2757
• rename opencds-mockoon container for non-ci docker environments (1613966)
• server-nestjs: fix Dockerfile setting wrong permissions (46db30d)
• server-nestjs: guard system settings upsert behind ManageSystem (7bf630f)
• server-nestjs: honor multi-path admin config and skip absent GitLab accounts on revoke (5b42e89)
• server-nestjs: provide UserPermissionService to StageModule (9ba8cda)
• server-nestjs: provide UserPermissionService to SystemSettingsModule (502a145)
• server-nestjs: resolve multi-path auditor groups in GitLab mapping (bf68401), closes #2792
• server-nestjs: return the refreshed admin role list on create (3c44126)
• server-nestjs: reuse Vault AppRole secret-id instead of minting on every sync (f58885d), closes #2622
• server-nestjs: use gitlab plugin name in gitlab health indicator (62e0cac)
• server-nestjs: wire AuthModule into StageModule (2052fe8)
• server-nestjs: wire AuthModule into SystemSettingsModule (3c17b60)
• server: backport role backfill migrations to the apps/server tree (c585483), closes #2812
• server: tighten role backfill anti-join to the role level (9eefb75)
• stage: drop invalid guard metadata specs and never casts (4d048d7)
• stage: drop the remaining guard metadata spec (45024aa)
• stage: restrict UserGuard to the protected routes (ae3ded5)
• stage: validate stage params as UUIDs before Prisma (ff8a96e)
• user: emit canonical AdminRoleEventPayload and type controller inputs (88f80c8)
• user: emit canonical AdminRoleEventPayload and type controller inputs (dd8e247)
• user: legacy 400 on unknown admin role, matching take:5, hook union semantics (ccc6db7)
• user: legacy 400 on unknown admin role, matching take:5, hook union semantics (d87dfae)
• user: purge dead create path and lock legacy parity (d5e0ec9)
• user: purge dead create path and lock legacy parity (4faf39e)
• user: restrict UserGuard to list and patch routes (a14eb1f)
• user: use the projectMembers relation key in memberOfIds filter (1fc04ab)
• user: use the projectMembers relation key in memberOfIds filter (84b7758)
• vault: avoid double slash in KV list path for Vault 2.0 (5eeccba)
• vault: drop non-tunable force_no_cache from mount tune (61a236d)
• vault: reconcile mount via sys/mounts list and tune force_no_cache (ada29f3), closes #2762
• zone: accept null log projectId and validate zone UUID params (1062929)

Miscellaneous Chores

• admin-token: drop tooling tag from test comment (750fdb4)
• main: Release v9.27.0-rc (b1abcef)
• main: Release v9.27.0-rc.1 (65ae135)
• main: Release v9.27.0-rc.2 (6076463)
• refine GitHub issue templates (b5d418e), closes #2239
• update GitHub issue and MR templates (f356cab), closes #2239
• user: drop section divider comments (9d487dc)
• user: drop section divider comments (aafa6c1)

Docs

• add cpn-release-notes skill (ca3925e), closes #2728
• add cpn-release-patch skill (28ac329), closes #2728
• add pi transition skill (64dfcc0)
• readapt cpn-release-patch skill to plain git (92e0dff), closes #2733
• release-patch: wrap lines over 80 columns (b6903cd)
• server-nestjs: drop dead method link, prune unused graph, date revision (c24a3dc), closes #1889
• server-nestjs: reconcile modularisation status (885847d), closes #1889
• udpate release notes skill (5da8106)

Refactoring

• admin-token: accept owner overrides in makeAdminToken (b203914)
• admin-token: align queries types with Record naming (c8fc77f)
• admin-token: assemble exposed token in controller (87a7aef)
• admin-token: extract makeAdminTokenOwner from makeAdminToken (dea84e3)
• admin-token: extract makeAdminTokenOwner from makeAdminToken (50a322d)
• admin-token: extract status filter into helper (5320207)
• admin-token: inline listed-token fixture at its single call site (e9804b6)
• admin-token: inline transaction client type (680806f)
• admin-token: move permissions mapping to controller (740938d)
• admin-token: name the token row fixture type (64612d6)
• admin-token: rename AdminTokenRow to AdminTokenRecordWithHash (7af2fee)
• admin-token: rename record type to AdminToken (d160220)
• admin-token: rename test factory to makeAdminToken (1ca89ea)
• admin-token: share spec factories in testing utils, drop ReturnType aliases (d4964f2)
• admin-token: simplify makeAdminTokenRecord overrides to Partial (78ebc6a)
• admin-token: split row and selected-payload token fixtures (668c42d)
• client: type request bodies via shared contract aliases (5729b71)
• server-nestjs: sync admin flags on revoke (2ea9860)
• shared: drop duplicate CreateAdminTokenBody export in favor of contract alias (cadd8e2)
• sonarqube: use DeepMockProxy instead of ReturnType alias (7efc86b)
• stage: aligner le module sur les remarques de revue (519e87c), closes #2493
• stage: drop redundant Query import aliases (d256868)
• stage: englober les écritures multi-requêtes dans une transaction (f26117b), closes #2493
• stage: migrate module from server (1de9ff6)
• stage: move record mappers to controller, service returns records (fc7923e)
• stage: remove unused StageRecord import (73b6932)
• stage: return records from service, map to contract in controller (5461b77)
• stage: reuse cluster and environment test factories (e80e46d)
• stage: reuse makeUser for the owner fixture (00eebae)
• user: batch AND filters into single pushes (0cd239c)
• user: move the letters filter inside its guard (1788a22)
• user: realigner structure et style du module (8d222f2), closes #2738
• user: realigner structure et style du module (358dbbf), closes #2738
• user: remove reflection-only permissions metadata check (efaa652)
• user: remove reflection-only permissions metadata check (d500398)
• user: retirer l'alias AllUsersQuery au profit du schéma (12f4b22), closes #1889
• user: retirer l'alias AllUsersQuery au profit du schéma (40025ca), closes #1889
• user: strangler offload routes to server-nestjs (37b9a19)
• vault: type sys/mounts response instead of unknown (b767306)
• zone: drop event-helper comment (58285b3)
• zone: map records to contract in controller (529c44a)
• zone: name the update body schema in shared (c296f95)
• zone: name the zone record type in service specs (9002da9)

---

This PR was generated with Release Please. See documentation.

[StephaneTrebel]

✨ Aucun écart relevé dans cette release générée : manifeste, versions des packages et changelog convergent vers 9.27.0. Les vérifications disponibles sont vertes.

[cloud-pi-native-sonarqube]

Quality Gate passed

Issues

• 0 New Issues
• 0 Fixed Issues
• 0 Accepted Issues

Measures

• 0 Security Hotspots
• No data about coverage (23.50% Estimated after merge)
• No data about duplications (3.80% Estimated after merge)

Project ID: cloud-pi-native_console_AYsa46O31ebDtzs-pYyZ

View in SonarQube