fix(ci): repair broken gates and enforce CI contracts

[FelixTJDietrich]

Description

Repairs CI paths that were failing, silently doing no work, or not running at all, then adds a repository contract to prevent the same drift from returning.

This change:

• fixes the invalid artifact-action SHA and pins the remaining mutable reusable-workflow reference;
• makes cache setup reject unknown types before any conditional cache steps run;
• routes the complete tooling suite, release-image inventory, and runtime-pin checks through hosted CI;
• bounds every runnable workflow job with timeout-minutes;
• replaces the unsupported preview queue key with documented concurrency groups: preview admission remains globally serialized for capacity enforcement, while cleanup and reconciliation are isolated per pull request;
• skips unnecessary Spring Boot executable-JAR repackaging in package-based server test commands; and
• adds a node:test CI contract covering gate reachability, cache-type handling, and immutable external action pins.

The contract also checks that every accepted cache type activates a real setup branch, so a newly recognized value cannot silently become another no-op. No shipped application behavior or operator configuration changes, so this PR intentionally has no changeset.

Fixes #1588

How to test

CI covers the hosted workflow behavior. The local equivalents are:

bun run format
bun run check
bun run test:webapp
cd server && ./mvnw -pl application -am test \
  -Dspring-boot.repackage.skip=true \
  -Dsurefire.includedGroups=unit \
  -T 2C --batch-mode -q

Workflow syntax was also validated with:

go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 -shellcheck=

Checklist

• No changeset is required because this changes CI and repository tooling only, not shipped behavior.
• No operator action, environment change, or migration is required.

[coderabbitai]

Warning

Review limit reached

Next included review available in 50 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 90de6b5f-25a2-4062-985e-59438a241785

📥 Commits

Reviewing files that changed from the base of the PR and between 4bce941 and 1a3efe2.

📒 Files selected for processing (21)

• .github/actionlint.yaml
• .github/actions/setup-caches/action.yml
• .github/workflows/cd-docs-teardown.yml
• .github/workflows/cd-docs.yml
• .github/workflows/ci-compose-validate.yml
• .github/workflows/ci-docker-build.yml
• .github/workflows/ci-quality-gates.yml
• .github/workflows/ci-server-clean-reference.yml
• .github/workflows/cicd.yml
• .github/workflows/cleanup-preview.yml
• .github/workflows/deploy-locked-compose.yml
• .github/workflows/deploy-preview.yml
• .github/workflows/deploy-with-helios.yml
• .github/workflows/openapi-autocommit.yml
• .github/workflows/pull-request.yml
• .github/workflows/reconcile-previews.yml
• .github/workflows/release.yml
• .github/workflows/reusable-docker-build.yml
• .github/workflows/version-pr.yml
• package.json
• scripts/ci-contract.test.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

📚 Documentation Preview

Preview has been removed (PR closed)

[github-actions]

🧩 Storybook Preview

Preview has been removed (PR closed)