chore(main): Release v9.20.0

[github-actions]

🤖 I have created a release beep boop

9.20.0 (2026-07-15)

Features

• allow ci run on draft PR (d3771a2)
• client: add deployment management UI (08e212d)
• fix the permission policy engine from AND to OR between admin and projectpermissions (4147cc9)
• migrate project to PNPM v11.8.0 (6143d5c)
• migrate service infos descriptor from server plugin manager (20e725c)
• server-nestjs: capture plugin handler outcomes as structured results (e635708)
• server-nestjs: introduce AppEventsService for project events (1cf6dfa)
• server-nestjs: secure deployment API with project permission guards (1ea4d32)

Bug Fixes

• configuration may be flaky depending on runner env vars (ff5c62a)
• disable NestJS reconciler loop to avoid conflicts (51b5488)
• fetch JWKS URI using internal domain (590b92d)
• GitLab can't find the template files in dist (a878bba)
• jj: resolve conflict in registry.service.spec.ts test (2c65fb0)
• JWKS fetching rule are flaky (7faee14)
• keycloak: skip group sync for system:external admin roles (9000139)
• keycloak: skip group sync for system:external admin roles (4254929)
• keyloak-secret-provider: url is not routed to the correct protocol (1e79d01)
• launch.json to read envfiles (5a56ad5)
• nestjs/gitlab: build project group public URLs with URL constructor to avoid double slashes (425b16b)
• nexus: remove missing components in new versions (58b894a)
• nginx strangler is failling to resolve host in local mode (78d5c6c)
• server-nestjs/events: update project status after events (7515912)
• server-nestjs/keycloak: refresh admin client token before it expires (cf26176)
• server-nestjs/keycloak: resolve base role type for system-prefixed roles (4c8cf98)
• server-nestjs/keycloak: tolerate concurrent subgroup creation conflicts (87cd136)
• server-nestjs/nexus: delete group repos before their hosted members (c505db0)
• server-nestjs/nexus: tolerate platform role failures when syncing platform roles (caef46d)
• server-nestjs/vault: build ArgoCD Vault values from AppRole creds and config (9ce5916)
• server-nestjs: add missing healthcheck for local dev (61de70c)
• server-nestjs: harden sonarqube reconciliation with strict key matching and idempotent init (2686a59)
• server-nestjs: migrate system-config route (20ae55e)
• server-nestjs: satisfy Prisma payload types in deployment spec mocks (e7e9eaa)
• server-nestjs: silence successful healthz request logs (7d2514b)
• vscode launch dotenv path (26d9419)

Miscellaneous Chores

• align local Keycloak realm name (5711c1b)
• backport server-nestjs missing migrations (8c2288c)
• improve auth logging (b7393d2)
• keycloak: update local realm to use publicly facing KC URL (2fbac4e)
• nginx-strangler: allow custom (Rancher Desktop) host config in local dev context (908c252)
• package.json docker delete commands should actually delete the related images (b32d71c)
• playwright: generalize checkbox helper to avoid inconsistencies (6c839ef)
• playwright: improve tests resilience (ad95b2c)
• tag integ container images with integ instead of dev (41c51ad)

Refactoring

• Keycloak server provider should use openid-configuration URLs instead of rebuilding (bc2199f)
• server-nestjs: migrate logs (f05e04f)
• server-nestjs: migrate project bulk route (e9fd130)
• server-nestjs: migrate project hook (459c60a)
• server-nestjs: migrate project members (796f2a9)
• server-nestjs: migrate project role (0764a2f)
• server-nestjs: migrate project route (1740bc8)
• server-nestjs: migrate project secrets routes (0626157)
• server-nestjs: migrate project services route (bf9d09a)
• server-nestjs: refactor deployment to use strong typing using mockDeep for refactoring resiliency (934d9a0)
• server-nestjs: rename permission services to disambiguate (0de7c34)
• shared: add RoleType constant and use it across keycloak services (3933b15)

---

This PR was generated with Release Please. See documentation.

[github-actions]

🤖 Hey !

The security scan report for the current pull request is available here.

[cloud-pi-native-sonarqube]

Quality Gate passed

Issues

• 0 New Issues
• 0 Fixed Issues
• 0 Accepted Issues

Measures

• 0 Security Hotspots
• No data about coverage (36.60% Estimated after merge)
• No data about duplications (4.80% Estimated after merge)

Project ID: cloud-pi-native_console_AYsa46O31ebDtzs-pYyZ

View in SonarQube