chore(ci): modernize release build pipeline

Author: Kris Armstrong

.clang-format

@@ -1,11 +1,10 @@
 ---
-# clang-format configuration for C23 (NOT C++)
-# This project uses pure C with C23 standard features.
+# clang-format configuration for C23 (NOT C++).
+# clang-format uses its C++ parser for C-family languages; keep the C standard
+# in compiler flags and avoid unsupported Language/Standard values here.
 # Reference: https://clang.llvm.org/docs/ClangFormatStyleOptions.html
 
-Language: C
 BasedOnStyle: LLVM
-Standard: c23
 
 # Basic formatting
 IndentWidth: 4
@@ -99,13 +98,7 @@ SortIncludes: CaseSensitive
 SpaceAfterCStyleCast: false
 SpaceAfterLogicalNot: false
 SpaceBeforeAssignmentOperators: true
-SpaceBeforeParens:
-  AfterControlStatements: true
-  AfterForeachMacros: true
-  AfterFunctionDeclarationName: false
-  AfterFunctionDefinitionName: false
-  AfterIfMacros: true
-  BeforeNonEmptyParentheses: false
+SpaceBeforeParens: ControlStatements
 SpaceBeforeSquareBrackets: false
 SpaceInEmptyBlock: false
 SpaceInEmptyParentheses: false
@@ -128,4 +121,3 @@ PenaltyBreakString: 1000
 PenaltyExcessCharacter: 1000000
 PenaltyReturnTypeOnItsOwnLine: 60
 ...
-

.github/workflows/ci.yml

@@ -24,10 +24,12 @@ jobs:
     name: Backend (Go)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
+        with:
+          fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v6.4.0
         with:
           go-version-file: go.mod
           cache: true
@@ -38,11 +40,11 @@ jobs:
       - name: Verify dependencies
         run: go mod verify
 
+      - name: Install golangci-lint
+        run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.1
+
       - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@v9
-        with:
-          version: v2.7.2
-          args: --timeout=5m
+        run: golangci-lint run --timeout=5m --new-from-rev=HEAD~1
 
       - name: Run tests
         run: go test -v -race -coverprofile=coverage.out -covermode=atomic ./...
@@ -75,10 +77,10 @@ jobs:
       run:
         working-directory: ui
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v6.4.0
         with:
           node-version: '25'
           cache: 'npm'
@@ -97,7 +99,7 @@ jobs:
         run: npm run build
 
       - name: Upload frontend build
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: frontend-dist
           path: ui/dist/
@@ -110,7 +112,7 @@ jobs:
     name: C Lint (C23)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
 
       - name: Install C23 tools (clang-tidy, cppcheck, bear)
         run: |
@@ -215,10 +217,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v6.4.0
         with:
           go-version-file: go.mod
           cache: true
@@ -240,7 +242,7 @@ jobs:
           sarif_file: gosec-results.sarif
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v6.4.0
         with:
           node-version: '25'
           cache: 'npm'
@@ -280,7 +282,7 @@ jobs:
     name: Quality Checks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
 
       - name: Check for sensitive files
         run: |
@@ -339,7 +341,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
 
       - name: Check for locale files
         id: check-locales
@@ -419,16 +421,16 @@ jobs:
             goos: darwin
             goarch: arm64
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v6.4.0
         with:
           go-version-file: go.mod
           cache: true
 
       - name: Download frontend build
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8.0.1
         with:
           name: frontend-dist
           path: ui/dist/
@@ -462,7 +464,7 @@ jobs:
           ./bin/stem-${{ matrix.os }}-${{ matrix.arch }} version || true
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: stem-${{ matrix.os }}-${{ matrix.arch }}
           path: bin/stem-${{ matrix.os }}-${{ matrix.arch }}
@@ -478,23 +480,23 @@ jobs:
     timeout-minutes: 15
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v6.4.0
         with:
           go-version-file: go.mod
           cache: true
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v6.4.0
         with:
           node-version: '25'
           cache: 'npm'
           cache-dependency-path: ui/package-lock.json
 
       - name: Download frontend build
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8.0.1
         with:
           name: frontend-dist
           path: ui/dist/
@@ -536,23 +538,23 @@ jobs:
     timeout-minutes: 30
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v6.4.0
         with:
           go-version-file: go.mod
           cache: true
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v6.4.0
         with:
           node-version: '25'
           cache: 'npm'
           cache-dependency-path: ui/package-lock.json
 
       - name: Download frontend build
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8.0.1
         with:
           name: frontend-dist
           path: ui/dist/
@@ -594,15 +596,15 @@ jobs:
         run: npx playwright test --project=chromium --reporter=html
 
       - name: Upload Playwright report
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7.0.1
         if: always()
         with:
           name: playwright-report
           path: ui/playwright-report/
           retention-days: 7
 
       - name: Upload server logs on failure
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7.0.1
         if: failure()
         with:
           name: e2e-server-logs

.github/workflows/codeql.yml

@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4

.github/workflows/container.yml

@@ -13,7 +13,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6.0.2
 
       - name: Install Pack CLI
         run: |

.github/workflows/dead-code.yml

@@ -33,10 +33,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v6.4.0
         with:
           go-version-file: go.mod
           cache: true
@@ -91,10 +91,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v6.4.0
         with:
           node-version: "25.2.1"
           cache: npm
@@ -152,7 +152,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
 
       - name: Check for orphaned files
         run: |

.github/workflows/docker-publish.yml

@@ -28,10 +28,10 @@ jobs:
       packages: write
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4.0.0
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3

.github/workflows/label-sync.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
 
       - name: Sync labels
         uses: crazy-max/ghaction-github-labeler@v5

.github/workflows/license-check.yml

@@ -20,16 +20,16 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v6.4.0
         with:
           go-version-file: go.mod
           cache: true
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v6.4.0
         with:
           node-version: "25.2.1"
           cache: npm
@@ -104,7 +104,7 @@ jobs:
           echo ""
 
       - name: Upload license reports
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7.0.1
         if: always()
         with:
           name: license-reports