[krusche]

Release v1.8.2 — promotes staging to main for the production release. Squash-merged to keep main history linear.

Highlights

• Deployment approvals no longer fail after ~8 hours (feat(auth): self-refreshing GitHub user tokens for deployment approvals #1199): Helios refreshes users' GitHub tokens itself (serialized per user, recovers after re-login) and shows an actionable message when a user has to sign in again.
• Renamed GitHub accounts keep deploy access, and the deploy race is fixed (fix: renamed GitHub accounts lose deploy access, plus deploy race #1230).
• Angular 22 and Java 25 (chore(deps): upgrade to Angular 22 and Java 25, retaining PrimeNG 21 #1217) and a combined dependency update (chore(deps): update all dependencies #1231, patches both minimatch Dependabot alerts).
• Pipeline "Last result" footer scoping (fix(pipeline): scope the "Last result" footer to the CI run, not a co-running workflow #1195) and a 90-day hard retention cap for workflow runs (feat(cleanup): 90-day hard retention cap + default-branch exemption for keep-N pruning #1197).

Deploy notes

• One new migration, V59__create_github_user_token.sql (a new empty table). Prod is currently at V58.
• Production secrets GH_CLIENT_SECRET and HELIOS_TOKEN_ENCRYPTION_KEY are set; the deploy workflow now passes them to the server.
• Keycloak: the broker/read-token role is already part of the helios realm's default roles on prod and staging, and the GitHub identity provider has "stored tokens readable" enabled.

Verified on staging (this exact commit)

Staging deployed from staging at 468eec4: all containers healthy, Flyway at V59, no errors in any service log, authenticated API calls for user permissions, environments and workflows return 200, webhooks flow through NATS. The refresh path itself can only be exercised on prod, because the staging GitHub app issues non-expiring tokens.

Full changelog: v1.8.1...v1.8.2

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[codacy-production]

Not up to standards ⛔

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}