Release 2025-11-25

.github/workflows/cd-cvat-exchange-oracle.yaml

@@ -3,6 +3,7 @@ name: Deploy CVAT Exchange Oracle
 on:
   push:
     branches: [ develop, main, cvat-milestone-2 ]
+    tags-ignore: '*'
     paths:
       - 'packages/examples/cvat/exchange-oracle/**'
   pull_request:
@@ -24,7 +25,7 @@ jobs:
     if: ${{ github.event_name == 'pull_request' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: PR check
         run: |
@@ -44,7 +45,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
 
     - uses: convictional/trigger-workflow-and-wait@v1.6.5
       with:

.github/workflows/cd-cvat-recording-oracle.yaml

@@ -3,6 +3,7 @@ name: Deploy CVAT Recording Oracle
 on:
   push:
     branches: [ develop, main, cvat-milestone-2 ]
+    tags-ignore: '*'
     paths:
       - 'packages/examples/cvat/recording-oracle/**'
   pull_request:
@@ -25,7 +26,7 @@ jobs:
     if: ${{ github.event_name == 'pull_request' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: PR check
         run: |
@@ -45,7 +46,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
 
     - uses: convictional/trigger-workflow-and-wait@v1.6.5
       with:

.github/workflows/cd-deploy-contracts.yaml

@@ -32,10 +32,10 @@ jobs:
       MOONSCAN_API_KEY: ${{ secrets.MOONSCAN_API_KEY }}
       AVALANCHE_API_KEY: ${{ secrets.AVALANCHE_API_KEY }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           token: ${{ secrets.GH_TOKEN_CD_CONTRACTS }}
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version-file: .nvmrc
           cache: yarn
@@ -126,7 +126,7 @@ jobs:
           git stash --include-untracked
       - name: Checkout develop
         if: always() && steps.check_changes.outputs.changes == 'true'
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           ref: develop
           token: ${{ secrets.GH_TOKEN_CD_CONTRACTS }}

.github/workflows/cd-gitbook-sdk-docs.yaml

@@ -13,8 +13,8 @@ jobs:
     name: Sync docs to GitBook
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version-file: .nvmrc
       - name: Publish docs

.github/workflows/cd-job-launcher-server.yaml

@@ -3,6 +3,7 @@ name: Deploy Job launcher server
 on:
   push:
     branches: [ develop, main ]
+    tags-ignore: '*'
     paths:
       - 'packages/apps/job-launcher/server/**'
   pull_request:
@@ -21,7 +22,7 @@ jobs:
     if: ${{ github.event_name == 'pull_request' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: PR check
         run: |
@@ -41,7 +42,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
 
     - uses: convictional/trigger-workflow-and-wait@v1.6.5
       with:

.github/workflows/cd-packages.yaml

@@ -5,9 +5,20 @@ permissions:
   contents: write # needed to push tags
 
 on:
+  workflow_dispatch:
+    inputs:
+      npm_tag:
+        description: "npm dist-tag to use when publishing manually (e.g., alpha, beta)"
+        required: false
+        default: "beta"
+      push_git_tags:
+        description: "Push git tags after publishing (true/false)"
+        required: false
+        default: "false"
   push:
     branches:
       - main
+    tags-ignore: '*'
     paths-ignore:
       - "docs/**"
       - "packages/apps/**"
@@ -18,15 +29,18 @@ jobs:
   publish:
     name: Publish packages to NPM
     runs-on: ubuntu-latest
+    env:
+      NPM_PUBLISH_TAG: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.npm_tag || 'latest' }}
+      PUSH_GIT_TAGS: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.push_git_tags || 'true' }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           token: ${{ secrets.GH_GITBOOK_TOKEN }}
       - name: Setup git identity
         run: |
           git config --global user.name "github-actions[bot]"
           git config --global user.email "github-actions[bot]@users.noreply.github.com"
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version-file: .nvmrc
           cache: yarn
@@ -45,10 +59,12 @@ jobs:
       - name: Build packages
         run: yarn workspaces foreach --all --no-private -pt run build
       - name: Publish packages
-        run: yarn workspaces foreach --all --no-private -pt npm publish --tolerate-republish --json | tee publish.log
+        run: yarn workspaces foreach --all --no-private -pt npm publish --tolerate-republish --tag ${NPM_PUBLISH_TAG} --json | tee publish.log
         env:
           SKIP_PREPACK: true
       - name: Tag published packages
+        if: ${{ env.PUSH_GIT_TAGS == 'true' }}
         run: node scripts/tag-published-packages.mjs publish.log
       - name: Push created tags
+        if: ${{ env.PUSH_GIT_TAGS == 'true' }}
         run: git push origin --tags

.github/workflows/cd-python-sdk.yaml

@@ -4,18 +4,27 @@ permissions:
   contents: write
 
 on:
+  workflow_dispatch:
+    inputs:
+      push_git_tags:
+        description: "Push git tags after publishing (true/false)"
+        required: false
+        default: "false"
   push:
     branches:
       - main
+    tags-ignore: '*'
     paths:
       - "packages/sdk/python/human-protocol-sdk/**"
 
 jobs:
   publish-python-sdk:
     name: Publish Python SDK
     runs-on: ubuntu-latest
+    env:
+      PUSH_GIT_TAGS: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.push_git_tags || 'true' }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           token: ${{ secrets.GH_GITBOOK_TOKEN }}
       - name: Setup git identity
@@ -51,6 +60,7 @@ jobs:
           TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
         run: make publish-package
       - name: Create and push tag
+        if: ${{ env.PUSH_GIT_TAGS == 'true' }}
         working-directory: ./packages/sdk/python/human-protocol-sdk
         run: |
           VERSION="${{ steps.read_version.outputs.version }}"

.github/workflows/cd-reputation-oracle.yaml

@@ -3,6 +3,7 @@ name: Deploy Reputation oracle
 on:
   push:
     branches: [ develop, main ]
+    tags-ignore: '*'
     paths:
       - 'packages/apps/reputation-oracle/server/**'
   pull_request:
@@ -21,7 +22,7 @@ jobs:
     if: ${{ github.event_name == 'pull_request' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: PR check
         run: |
@@ -41,7 +42,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
 
     - uses: convictional/trigger-workflow-and-wait@v1.6.5
       with:

.github/workflows/cd-subgraph.yaml

@@ -25,8 +25,8 @@ jobs:
       fail-fast: true
       max-parallel: 3
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version-file: .nvmrc
           cache: yarn

.github/workflows/ci-dependency-review.yaml

@@ -12,8 +12,8 @@ jobs:
   dependency-review:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - name: Dependency Review
-        uses: actions/dependency-review-action@v4.8.0
+        uses: actions/dependency-review-action@v4.8.2
         with:
           show-openssf-scorecard: false

.github/workflows/ci-lint-cvat-exchange-oracle.yaml

@@ -2,6 +2,7 @@ name: CVAT Exchange Oracle Lint
 
 on:
   push:
+    tags-ignore: '*'
     paths:
       - 'packages/examples/cvat/exchange-oracle/**'
       - '.github/workflows/ci-lint-cvat-exchange-oracle.yaml'
@@ -18,7 +19,7 @@ jobs:
     name: CVAT Exchange Oracle Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - name: Install Poetry
         uses: snok/install-poetry@v1
         with:

.github/workflows/ci-lint-cvat-recording-oracle.yaml

@@ -2,6 +2,7 @@ name: CVAT Recording Oracle Lint
 
 on:
   push:
+    tags-ignore: '*'
     paths:
       - 'packages/examples/cvat/recording-oracle/**'
       - '.github/workflows/ci-lint-cvat-recording-oracle.yaml'
@@ -18,7 +19,7 @@ jobs:
     name: CVAT Recording Oracle Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - name: Install Poetry
         uses: snok/install-poetry@v1
         with:

.github/workflows/ci-lint.yaml

@@ -2,6 +2,7 @@ name: Lint check
 
 on:
   push:
+    tags-ignore: '*'
     paths-ignore:
       - 'packages/examples/cvat/**'
 
@@ -10,8 +11,8 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version-file: .nvmrc
           cache: yarn

.github/workflows/ci-test-core.yaml

@@ -2,6 +2,7 @@ name: Protocol check
 
 on:
   push:
+    tags-ignore: '*'
     paths:
       - 'packages/core/**'
 
@@ -10,8 +11,8 @@ jobs:
     name: Core Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version-file: .nvmrc
           cache: yarn

.github/workflows/ci-test-cvat-exchange-oracle.yaml

@@ -2,6 +2,7 @@ name: CVAT Exchange Oracle Tests
 
 on:
   push:
+    tags-ignore: '*'
     paths:
       - 'packages/examples/cvat/exchange-oracle/**'
       - 'packages/sdk/python/human-protocol-sdk/**'
@@ -11,7 +12,7 @@ jobs:
     name: CVAT Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - name: CVAT Exchange Oracle tests
         working-directory: ./packages/examples/cvat/exchange-oracle
         run: docker compose -f docker-compose.test.yml up --attach test --exit-code-from test

.github/workflows/ci-test-cvat-recording-oracle.yaml

@@ -2,6 +2,7 @@ name: CVAT Recording Oracle Tests
 
 on:
   push:
+    tags-ignore: '*'
     paths:
       - 'packages/examples/cvat/recording-oracle/**'
       - 'packages/core/**'
@@ -11,7 +12,7 @@ jobs:
     name: CVAT Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - name: CVAT Recording Oracle tests
         working-directory: ./packages/examples/cvat/recording-oracle
         run: docker compose -f docker-compose.test.yml up --attach test --exit-code-from test

.github/workflows/ci-test-dashboard.yaml

@@ -2,6 +2,7 @@ name: Dashboard Check
 
 on:
   push:
+    tags-ignore: '*'
     paths:
       - "packages/core/**"
       - "packages/sdk/typescript/human-protocol-sdk/**"
@@ -12,8 +13,8 @@ jobs:
     name: Dashboard Server Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version-file: .nvmrc
           cache: yarn

.github/workflows/ci-test-faucet-server.yaml

@@ -2,6 +2,7 @@ name: Faucet server check
 
 on:
   push:
+    tags-ignore: '*'
     paths:
       - "packages/core/**"
       - "packages/sdk/typescript/human-protocol-sdk/**"
@@ -12,8 +13,8 @@ jobs:
     name: Faucet Server Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
           node-version-file: .nvmrc
           cache: yarn