Changelog - Dev - 07.22.2026

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog.

[Unreleased] - 2026-07-22

Fixed

Implement server-signed trust model for admin metrics: Admin metrics now count only server-signed lantern and wave events, preventing browsers from manipulating venue rankings or overview counts. The forge now accepts SERVICE-ATTRIBUTED user events with both userId and serviceId, ensuring lanterns-api events are properly attributed and distinguishable from client-generated rows. (#693) bug

Added

Actionlint workflow gate: CI and npm run validate now lint .github/workflows with a pinned actionlint (v1.7.12), catching invalid Actions expressions (the empty $ class that previously broke workflow parsing on dev). Version pin is enforced in CI, installs are checksum-verified via the Go module proxy, and a pre-existing invalid empty choice option in the release workflow was fixed. (#698) devops

Update - 2026-07-22 19:39 UTC

Fixed

Add actionlint validation gate for GitHub Actions workflows: Introduces pinned actionlint (v1.7.12) validation to catch valid YAML but invalid GitHub Actions expression bugs in workflows. Prevents issues like empty $ literals in run comments that cause workflows to parse with zero jobs. Available via npm script, validate orchestrator, and CI step. (#698) devops