chore(main): Release v9.20.0

[github-actions]

🤖 I have created a release beep boop

9.20.0 (2026-07-03)

Features

• allow ci run on draft PR (d3771a2)
• fix the permission policy engine from AND to OR between admin and projectpermissions (4147cc9)
• migrate project to PNPM v11.8.0 (6143d5c)
• migrate service infos descriptor from server plugin manager (20e725c)

Bug Fixes

• configuration may be flaky depending on runner env vars (ff5c62a)
• disable NestJS reconciler loop to avoid conflicts (51b5488)
• fetch JWKS URI using internal domain (590b92d)
• GitLab can't find the template files in dist (a878bba)
• JWKS fetching rule are flaky (7faee14)
• keycloak: skip group sync for system:external admin roles (9000139)
• keycloak: skip group sync for system:external admin roles (4254929)
• launch.json to read envfiles (5a56ad5)
• nestjs/gitlab: build project group public URLs with URL constructor to avoid double slashes (425b16b)
• nginx strangler is failling to resolve host in local mode (78d5c6c)
• server-nestjs/vault: build ArgoCD Vault values from AppRole creds and config (9ce5916)
• server-nestjs: add missing healthcheck for local dev (61de70c)
• server-nestjs: migrate system-config route (20ae55e)
• vscode launch dotenv path (26d9419)

Miscellaneous Chores

• backport server-nestjs missing migrations (8c2288c)
• improve auth logging (b7393d2)
• playwright: generalize checkbox helper to avoid inconsistencies (6c839ef)

Refactoring

• Keycloak server provider should use openid-configuration URLs instead of rebuilding (bc2199f)
• server-nestjs: migrate logs (f05e04f)
• server-nestjs: migrate project hook (459c60a)
• server-nestjs: migrate project members (796f2a9)
• server-nestjs: migrate project role (0764a2f)
• server-nestjs: migrate project route (1740bc8)
• server-nestjs: migrate project secrets routes (0626157)
• server-nestjs: migrate project services route (bf9d09a)
• server-nestjs: refactor deployment to use strong typing using mockDeep for refactoring resiliency (934d9a0)
• shared: add RoleType constant and use it across keycloak services (3933b15)

---

This PR was generated with Release Please. See documentation.

[github-actions]

🤖 Hey !

The security scan report for the current pull request is available here.

[cloud-pi-native-sonarqube]

Quality Gate passed

Issues

• 0 New Issues
• 0 Fixed Issues
• 0 Accepted Issues

Measures

• 0 Security Hotspots
• No data about coverage (36.60% Estimated after merge)
• No data about duplications (4.80% Estimated after merge)

Project ID: cloud-pi-native_console_AYsa46O31ebDtzs-pYyZ

View in SonarQube