chore(main): Release v9.25.0

[github-actions]

🤖 I have created a release beep boop

9.25.0 (2026-09-02)

Features

• ci: add a prerelease process alongside the release one (1cad1ef)
• ci: add hotfixes alongside (pre)releases with separate worflows/jobs (7d9205e)
• client: add a script to generate src/icon-collections.ts (ecf8550)
• environment: warn about linked deployments before environment deletion (ce12aaf)
• sonarqube: provision SONAR_TOKEN as GitLab group CI variable (71632fe)

Bug Fixes

• ci: change how hotfixes or main branch are detected for release-please (20cb79a)
• ci: correct keycloak healthcheck flag typo (fsS -> -fsS) (0983043)
• ci: ensure update-charts is not called when simply pushing to main (2af9f8b)
• ci: fix package versions bumps not being done for hotfixes (31dc7bb)
• ci: fix release workflow boolean-as-string error (7e9aff1)
• ci: grant permissions to top-level release workflow (c0ee291)
• ci: query keycloak health endpoint on management port 9000 (e3e7008)
• ci: surface keycloak boot logs on Playwright failure (393c6ce)
• client: avoid footer link icon appearing over snackbar (66be551)
• client: fix currently used icons (803e86e)
• client: map footer version label and link to pr/sha/tag (96a48c4)
• client: map footer version link to release tag or PR instead of 404 (b63a005), closes #2566
• delete Keycloak subgroups before the parent to avoid HTTP 500 on delete (94c49bf)
• deps: resolve 17 dependabot alerts via pnpm overrides (aea614d)
• gitlab: return existing user on 409 instead of failing sync (50c9c79)
• gitlab: set ci_config_path only on externally mirrored repos (0d4a0db)
• group missing full path (00e259a)
• Keycloak group null check (0a36ead)
• keycloak: add project owner to the maintainer role group (62fd5de), closes #2644
• keycloak: preserve full path when creating role groups (b243721)
• missing observability icon (ec767f4)
• missing stage in observability (13d9866)
• observability hprod and prod icon not displayed (0f0b377)
• observability: scope repository url by project slug with .git suffix (869e318)
• observability: skip Grafana group add for users with no Keycloak account (1d303c2)
• project-secrets: honor Nexus global repo defaults (39a81f4)
• project-secrets: restore GitLab CURL COMMAND trigger hint (f21cb93)
• registry: point ensureProjectQuota at ensureProject client method (d93bd75)
• registry: rewire service layer to idempotent ensure* client methods (66aa9a3)
• remove Keycloak project groups on delete (f69ee86)
• server-nestjs: assert group full_path before permanent removal (5a947fa)
• server-nestjs: broken di on systemconfig (75ebe51)
• server-nestjs: carry the mirror repo id with the pipeline trigger token (07f7e3a)
• server-nestjs: delete GitLab repos immediately on cleanup (7e794cc)
• server-nestjs: delete Keycloak subgroups before the parent group (42848bc), closes #2500
• server-nestjs: delete owned GitLab repos on explicit repository deletion (a47e7b0)
• server-nestjs: guard createUser against non-string GitLab error descriptions (9986fae)
• server-nestjs: import AuthModule in SystemConfigModule to resolve UserGuard dep (dd61154)
• server-nestjs: include projectsRootDir in vault techRO policy path (a947e17)
• server-nestjs: make GitLab CI variable provisioning idempotent (1d38746)
• server-nestjs: make Keycloak root group creation idempotent (409 race) (2f3aee9), closes #2618
• server-nestjs: match GitLab validation errors with object descriptions (4bb2f25), closes #2544
• server-nestjs: never purge system GitLab repos (infra-apps, mirror) on reconciliation (dbe4d7b)
• server-nestjs: permanently remove GitLab groups and repos on cleanup (a1ca829)
• server-nestjs: permanently remove GitLab groups and repos on cleanup (87d2343)
• server-nestjs: purge argocd values files on project delete (108caf5)
• server-nestjs: purge Harbor repositories before deleting project (9c627fb), closes #2516
• server-nestjs: reconcile single Harbor retention policy on re-sync (49ae7af), closes #2620
• server-nestjs: register SystemConfigModule to unblock system/plugins routes (6431d6d)
• server-nestjs: resolve CondensedGroupSchema vs GroupSchemaWith type mismatch (183bfb5)
• server-nestjs: resolve Keycloak root group by path, not name (3fdb90b)
• server-nestjs: restore accidentally deleted GitLab client tests (a835e6e)
• server-nestjs: surface GitLab error details in serialized errors (6ca31e9)
• server-nestjs: surface post-creation repository sync failure (3ccc052)
• server-nestjs: tolerate Harbor create races (400 CONFLICT / 409) in ensure paths (d853e96), closes #2620
• server-nestjs: use full path for repo permanent removal (9cc6614), closes #2636
• server-nestjs: use if guard for group full_path type check (4315f0a)
• server-nestjs: use optional chaining in GitLab variable reconcile guards (899b4be)
• server-nestjs: use per-project cloud-pi-native.fr email for sonarqube robot account (d55564f)
• server-nestjs: use POST for SystemSettings upsert to match contract (fd71f58)
• server-nestjs: use value import for PrismaService in SystemConfigService (8ac74ee)

Miscellaneous Chores

• add a CODEOWNERS (b3f6dd2)
• ci: do not use versioning-strategy on release-please GHA (6af01cb)
• ci: dump every container docker compose state on Playwright startup failure (c7161b6)
• ci: ensure Playwright tests are executed in Merge Queue when a docker-compose is updated (d8e150a)
• ci: fix release-please versioning strategy (3759ffe)
• client: bump vue-dsfr to 8.19.0 (5cfe304)
• client: refresh icons (with icons generation script) (e5cab81)
• client: remove (apparently) useless script (0a30ba2)
• client: remove useless chown/chmod from Dockerfile (93b1690)
• client: use new icons generation script (419399c)
• docker: migrate keycloak to official quay.io image (2eadcff)
• docker: replace deprecated KEYCLOAK_ADMIN_* with KC_BOOTSTRAP_ADMIN_* (2bf1769)
• fix health-checks in local docker-compose (802e043)
• harmonize quotes in local docker-compose (f836f6e)
• ignore agents tasks directories (28eb1a0)
• ignore local worktrees (2094d60)
• main: Release v9.25.0-rc (0293423)
• main: Release v9.25.0-rc.1 (f52faad)
• main: Release v9.25.0-rc.2 (3d9f2e1)
• registry: make create paths idempotent and clean up comments (d373c27)
• registry: trim redundant JSDoc on ensure* methods (2868d7a)
• server-nestjs: align gitlab constants comment style (09dd4fc)

Docs

• ci: describe prerelease release cycle (4d7b9f1)
• ci: finalize release doc with lessons learned around prereleases and releases (ae0b57f)
• update RELEASE for quick RC test (16b1b2a)

Refactoring

• keycloak: parse group representations at the client boundary (e9f2501)
• registry: rename createProjectRobot alias to ensureProjectRobot (e7c9286)
• server-nestjs: add upsertProjectGroupSystemRepo wrapper (39344ef)
• server-nestjs: name gitlab purge e2e timeout constant (9e8e206)
• server-nestjs: rename isInternalRepo to isDeclaredRepo (b71f8d3)
• server-nestjs: reuse VAULT_PROVISION_TIMEOUT, rename e2e-timeout to constants (b268e81)
• server-nestjs: specialize e2e timeouts per service (d0735b2)
• server-nestjs: split isSystemRepo into isSystemRepo and isInternalRepo (a7cf22c)
• server-nestjs: uniformize error type guards in module utils (ff8eb1b)

Reverted commits

• docker: replace deprecated KEYCLOAK_ADMIN_* with KC_BOOTSTRAP_ADMIN_* (f8b73bf)
• remove useless chown/chmod from Dockerfile" (893f751)
• restrict deployment visibility to console admins (8045954)

---

This PR was generated with Release Please. See documentation.

[cloud-pi-native-sonarqube]

Quality Gate passed

Issues

• 0 New Issues
• 0 Fixed Issues
• 0 Accepted Issues

Measures

• 0 Security Hotspots
• No data about coverage (35.70% Estimated after merge)
• No data about duplications (4.00% Estimated after merge)

Project ID: cloud-pi-native_console_AYsa46O31ebDtzs-pYyZ

View in SonarQube

[github-actions]

🤖 Created releases:

• v9.25.0

🌻