open-edge-platform · palade · Mar 27, 2026 · Mar 27, 2026 · Mar 27, 2026 · Mar 27, 2026
@@ -1,6 +1,6 @@
-# SPDX-FileCopyrightText: (C) 2025 Intel Corporation
+# SPDX-FileCopyrightText: (C) 2026 Intel Corporation
+#
 # SPDX-License-Identifier: Apache-2.0
-
 ---
 
 name: Auto Update PR
@@ -40,6 +40,6 @@ jobs:
           persist-credentials: false
 
       - name: Update pull requests
-        uses: open-edge-platform/orch-ci/.github/actions/pr_updater@b5930c48c1fcdb6b34ffbcd465cff96dabfbde70  # 2026.0.17
+        uses: open-edge-platform/orch-ci/.github/actions/pr_updater@d40dfda9598df896aa20cb1dc2c950d6444e8fa7  # 2026.0.19
         with:
           github_token: ${{ secrets.SYS_EMF_GH_TOKEN }}
@@ -1,7 +1,7 @@
-# SPDX-FileCopyrightText: (C) 2025 Intel Corporation
+# SPDX-FileCopyrightText: (C) 2026 Intel Corporation
+#
 # SPDX-License-Identifier: Apache-2.0
 ---
-
 name: Validate and Generate OpenAPI
 
 on:
@@ -30,7 +30,7 @@ jobs:
           persist-credentials: false
 
       - name: Bootstrap CI environment
-        uses: open-edge-platform/orch-ci/.github/actions/bootstrap@388f7e2aa884295786ed363fc97d3fd45e57e12a  # 2026.0.8
+        uses: open-edge-platform/orch-ci/.github/actions/bootstrap@d40dfda9598df896aa20cb1dc2c950d6444e8fa7  # 2026.0.19
         with:
           gh_token: ${{ secrets.SYS_EMF_GH_TOKEN }}
 

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: 2025 Intel Corporation
+# SPDX-FileCopyrightText: 2026 Intel Corporation
 #
 # SPDX-License-Identifier: Apache-2.0
 ---
@@ -36,7 +36,7 @@ jobs:
     if: github.event_name == 'pull_request'
     permissions:
       contents: read
-    uses: open-edge-platform/orch-ci/.github/workflows/pre-merge.yml@b5930c48c1fcdb6b34ffbcd465cff96dabfbde70  # 2026.0.17
+    uses: open-edge-platform/orch-ci/.github/workflows/pre-merge.yml@d40dfda9598df896aa20cb1dc2c950d6444e8fa7  # 2026.0.19
     with:
       run_version_check: false
       run_build: false
@@ -63,7 +63,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup asdf and install dependencies
-        uses: open-edge-platform/orch-ci/.github/actions/setup-asdf@main  # zizmor: ignore[unpinned-uses]
+        uses: open-edge-platform/orch-ci/.github/actions/setup-asdf@d40dfda9598df896aa20cb1dc2c950d6444e8fa7  # 2026.0.19
 
       - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7  # v5.0.4
         with:
@@ -97,7 +97,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup asdf and install dependencies
-        uses: open-edge-platform/orch-ci/.github/actions/setup-asdf@main  # zizmor: ignore[unpinned-uses]
+        uses: open-edge-platform/orch-ci/.github/actions/setup-asdf@d40dfda9598df896aa20cb1dc2c950d6444e8fa7  # 2026.0.19
 
       - name: Run lint
         run: mage lint:helm
@@ -120,7 +120,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup asdf and install dependencies
-        uses: open-edge-platform/orch-ci/.github/actions/setup-asdf@main  # zizmor: ignore[unpinned-uses]
+        uses: open-edge-platform/orch-ci/.github/actions/setup-asdf@d40dfda9598df896aa20cb1dc2c950d6444e8fa7  # 2026.0.19
 
       - name: Run lint
         run: mage lint:yaml
@@ -142,7 +142,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup asdf and install dependencies
-        uses: open-edge-platform/orch-ci/.github/actions/setup-asdf@main  # zizmor: ignore[unpinned-uses]
+        uses: open-edge-platform/orch-ci/.github/actions/setup-asdf@d40dfda9598df896aa20cb1dc2c950d6444e8fa7  # 2026.0.19
 
       - name: Lint Dockerfiles using hadolint
         run: mage lint:dockerfiles
@@ -232,7 +232,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup asdf and install dependencies
-        uses: open-edge-platform/orch-ci/.github/actions/setup-asdf@main  # zizmor: ignore[unpinned-uses]
+        uses: open-edge-platform/orch-ci/.github/actions/setup-asdf@d40dfda9598df896aa20cb1dc2c950d6444e8fa7  # 2026.0.19
 
       # TODO: This is a temporary solution for buildall script
       # We need to find a long term solution that leverages orch-ci workflow
@@ -290,7 +290,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup asdf and install dependencies
-        uses: open-edge-platform/orch-ci/.github/actions/setup-asdf@main  # zizmor: ignore[unpinned-uses]
+        uses: open-edge-platform/orch-ci/.github/actions/setup-asdf@d40dfda9598df896aa20cb1dc2c950d6444e8fa7  # 2026.0.19
 
       - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7  # v5.0.4
         with:
@@ -347,7 +347,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup asdf and install dependencies
-        uses: open-edge-platform/orch-ci/.github/actions/setup-asdf@main  # zizmor: ignore[unpinned-uses]
+        uses: open-edge-platform/orch-ci/.github/actions/setup-asdf@d40dfda9598df896aa20cb1dc2c950d6444e8fa7  # 2026.0.19
 
       - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7  # v5.0.4
         with:
@@ -411,7 +411,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup asdf and install dependencies
-        uses: open-edge-platform/orch-ci/.github/actions/setup-asdf@main  # zizmor: ignore[unpinned-uses]
+        uses: open-edge-platform/orch-ci/.github/actions/setup-asdf@d40dfda9598df896aa20cb1dc2c950d6444e8fa7  # 2026.0.19
 
       - name: Build Helm charts
         run: mage ChartsBuild
@@ -443,7 +443,7 @@ jobs:
       actions: read
       id-token: write
     if: github.event_name == 'push' && ( github.ref == 'refs/heads/main' || github.ref == 'refs/heads/main-pass-validation' )
-    uses: open-edge-platform/orch-ci/.github/workflows/post-merge.yml@b5930c48c1fcdb6b34ffbcd465cff96dabfbde70  # 2026.0.17
+    uses: open-edge-platform/orch-ci/.github/workflows/post-merge.yml@d40dfda9598df896aa20cb1dc2c950d6444e8fa7  # 2026.0.19
     with:
       run_build: false
       run_version_tag: true

@@ -1,7 +1,7 @@
----
-# SPDX-FileCopyrightText: (C) 2025 Intel Corporation
+# SPDX-FileCopyrightText: (C) 2026 Intel Corporation
+#
 # SPDX-License-Identifier: Apache-2.0
-
+---
 name: Post-Merge Scorecard CI
 
 on:
@@ -20,7 +20,7 @@ jobs:
       id-token: write
       contents: read
 
-    uses: open-edge-platform/orch-ci/.github/workflows/post-merge-scorecard.yml@b5930c48c1fcdb6b34ffbcd465cff96dabfbde70  # 2026.0.17
+    uses: open-edge-platform/orch-ci/.github/workflows/post-merge-scorecard.yml@d40dfda9598df896aa20cb1dc2c950d6444e8fa7  # 2026.0.19
     with:
       project_folder: "."
     secrets:

@@ -1,6 +1,6 @@
 ginkgo 2.23.4
-golang 1.25.7
-golangci-lint 2.8.0
+golang 1.26.1
+golangci-lint 2.11.4
 hadolint 2.12.0
 helm 3.17.0
 jq 1.7.1

@@ -2,7 +2,7 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
-FROM golang:1.25.8@sha256:dfae680962532eeea67ab297f1166c2c4e686edb9a8f05f9d02d96fc9191833e AS build
+FROM golang:1.26.1@sha256:595c7847cff97c9a9e76f015083c481d26078f961c9c8dca3923132f51fe12f1 AS build
 
 WORKDIR /workspace
 

@@ -4,7 +4,7 @@
 
 module github.com/open-edge-platform/orch-utils/auth-service
 
-go 1.25.7
+go 1.26.1
 
 require (
 	github.com/golang-jwt/jwt/v5 v5.2.3

@@ -2,7 +2,7 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
-FROM golang:1.25.8@sha256:dfae680962532eeea67ab297f1166c2c4e686edb9a8f05f9d02d96fc9191833e AS build
+FROM golang:1.26.1@sha256:595c7847cff97c9a9e76f015083c481d26078f961c9c8dca3923132f51fe12f1 AS build
 
 WORKDIR /workspace
 

@@ -38,7 +38,9 @@ func main() {
 	}
 
 	if proxy := os.Getenv("HTTPS_PROXY"); proxy != "" {
+		// #nosec G706 -- proxy values are from trusted environment configuration
 		log.Printf("https proxy value is: %s", proxy)
+		// #nosec G706 -- NO_PROXY is from trusted environment configuration
 		log.Printf("no proxy value is: %s", os.Getenv("NO_PROXY"))
 		cfg.HTTPClient = &http.Client{Timeout: 15 * time.Second}
 	}

@@ -29,6 +29,7 @@ func NewProxyAWSHandler(svc SecretsManagerAPI) func(w http.ResponseWriter, r *ht
 			fmt.Fprintln(w, "query param name empty")
 			return
 		}
+		// #nosec G706 -- secretName is validated before this point
 		log.Println("handling request for secret:", secretName)
 		input := &secretsmanager.GetSecretValueInput{
 			SecretId: &secretName,

@@ -2,7 +2,7 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
-FROM golang:1.25.8@sha256:dfae680962532eeea67ab297f1166c2c4e686edb9a8f05f9d02d96fc9191833e AS builder
+FROM golang:1.26.1@sha256:595c7847cff97c9a9e76f015083c481d26078f961c9c8dca3923132f51fe12f1 AS builder
 WORKDIR /src
 
 

@@ -4,7 +4,7 @@
 
 module r53restapi.com
 
-go 1.25.7
+go 1.26.1
 
 require (
 	github.com/aws/aws-sdk-go-v2 v1.36.6

@@ -17,9 +17,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 26.0.9
+version: 26.1.0
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "26.0.9"
+appVersion: "26.1.0"
@@ -17,9 +17,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 26.0.9
+version: 26.1.0
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "26.0.9"
+appVersion: "26.1.0"
@@ -6,5 +6,5 @@
 apiVersion: v2
 name: cert-synchronizer
 type: application
-version: 26.0.13
-appVersion: "26.0.13"
+version: 26.1.0
+appVersion: "26.1.0"
@@ -7,5 +7,5 @@ apiVersion: v2
 name: component-status
 description: A Helm chart for the Orchestrator Component Status Service
 type: application
-version: 26.0.4
-appVersion: "26.0.4"
+version: 26.1.0
+appVersion: "26.1.0"
@@ -19,9 +19,9 @@ type: application
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
 
-version: 26.0.21
+version: 26.1.0
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "26.0.21"
+appVersion: "26.1.0"
@@ -6,6 +6,6 @@ apiVersion: v2
 name: nexus-api-gw
 description: Multi Tenancy HTTP API GW
 type: application
-version: 26.0.9
-appVersion: "26.0.9"
+version: 26.1.0
+appVersion: "26.1.0"
 annotations: {}
@@ -6,6 +6,6 @@ apiVersion: v2
 name: tenancy-datamodel
 description: Tenancy Datamodel
 type: application
-version: 26.0.4
-appVersion: "26.0.4"
+version: 26.1.0
+appVersion: "26.1.0"
 annotations: {}
@@ -7,5 +7,5 @@ apiVersion: v2
 name: tenancy-init
 description: A Helm chart for bootstrapping the 'tenancy-init'
 type: application
-version: 26.0.5
-appVersion: "26.0.5"
+version: 26.1.0
+appVersion: "26.1.0"
@@ -6,6 +6,6 @@ apiVersion: v2
 name: tenancy-manager
 description: Multi Tenancy Manager
 type: application
-version: 26.0.4
-appVersion: "26.0.4"
+version: 26.1.0
+appVersion: "26.1.0"
 annotations: {}
@@ -18,9 +18,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 26.0.2
+version: 26.1.0
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "26.0.2"
+appVersion: "26.1.0"
@@ -2,7 +2,7 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
-FROM golang:1.25.7@sha256:931c889bca758a82fcbfcb1b6ed6ca1de30783e9e52e6093ad50060735cb99be AS build
+FROM golang:1.26.1@sha256:595c7847cff97c9a9e76f015083c481d26078f961c9c8dca3923132f51fe12f1 AS build
 
 WORKDIR /workspace
 

@@ -4,7 +4,7 @@
 
 module github.com/open-edge-platform/orch-utils/component-status
 
-go 1.25.7
+go 1.26.1
 
 require (
 	github.com/onsi/ginkgo/v2 v2.27.4

@@ -4,7 +4,7 @@
 
 module github.com/open-edge-platform/orch-utils
 
-go 1.25.7
+go 1.26.1
 
 require (
 	github.com/aws/aws-sdk-go-v2/config v1.27.43

@@ -4,7 +4,7 @@
 
 module github.com/open-edge-platform/orch-utils/keycloak-tenant-controller
 
-go 1.25.7
+go 1.26.1
 
 require (
 	github.com/Clarilab/gocloaksession v1.14.0

@@ -2,7 +2,7 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
-FROM golang:1.25.8@sha256:dfae680962532eeea67ab297f1166c2c4e686edb9a8f05f9d02d96fc9191833e AS builder
+FROM golang:1.26.1@sha256:595c7847cff97c9a9e76f015083c481d26078f961c9c8dca3923132f51fe12f1 AS builder
 ARG KTC_GIT_COMMIT
 
 # Set proxy environment variables using build arguments

@@ -2,7 +2,7 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
-FROM golang:1.25.8@sha256:dfae680962532eeea67ab297f1166c2c4e686edb9a8f05f9d02d96fc9191833e AS builder
+FROM golang:1.26.1@sha256:595c7847cff97c9a9e76f015083c481d26078f961c9c8dca3923132f51fe12f1 AS builder
 
 ARG API_GW_COMPONENT_NAME
 ARG HTTP_PROXY

@@ -4,7 +4,7 @@
 
 module github.com/open-edge-platform/orch-utils/nexus-api-gw
 
-go 1.25.7
+go 1.26.1
 
 require (
 	github.com/getkin/kin-openapi v0.131.0

@@ -4,7 +4,7 @@
 
 module github.com/vmware-tanzu/graph-framework-for-microservices/common-library
 
-go 1.25.7
+go 1.26.1
 
 require (
 	github.com/elliotchance/orderedmap v1.8.0