backport of commit be62529

.changelog/13972.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+template: add script change_mode that allows scripts to be executed on template change
+```

.changelog/14224.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fixed a bug that caused the allocation details page to display the stats bar chart even if the task was pending.
+```

.changelog/14248.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+client: Fixed a bug where user lookups would hang or panic
+```

.changelog/14297.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+client/logmon: fixed a bug where logmon cannot find nomad executable
+```

.changelog/14298.txt

@@ -0,0 +1,7 @@
+```release-note:bug
+vault: Fixed a bug where changing the Vault configuration `namespace` field was not detected as a change during server configuration reload.
+```
+
+```release-note:bug
+vault: Fixed a bug where Vault clients were recreated when the server configuration was reloaded, even if there were no changes to the Vault configuration.
+```

.github/dependabot.yml

@@ -3,10 +3,7 @@ updates:
   - package-ecosystem: gomod
     directory: "/"
     schedule:
-      # Start the week with fresh deps
-      interval: "weekly"
-      day: "sunday"
-      time: "09:00"
+      interval: daily
     labels:
       - "theme/dependencies"
   - package-ecosystem: gomod
@@ -26,9 +23,7 @@ updates:
   - package-ecosystem: npm
     directory: "/website"
     schedule:
-      interval: weekly
-    assignees:
-      - "@hashicorp/web-platform"
+      interval: daily
     labels:
       - "theme/dependencies"
       - "theme/website"

.gitignore

@@ -55,14 +55,11 @@ ui/dist/
 website/.bundle
 website/vendor
 
-# Go work files
-go.work
-go.work.sum
-
 # init outputs
 example.nomad
 spec.hcl
 volume.hcl
+
 nomad_linux_amd64
 nomad_darwin_amd64
 TODO.md

.release/ci.hcl

@@ -2,15 +2,12 @@ schema = "1"
 
 project "nomad" {
   team = "nomad"
-
   slack {
     notification_channel = "C03B5EWFW01"
   }
-
   github {
     organization = "hashicorp"
     repository   = "nomad"
-
     release_branches = [
       "main",
       "release/**",
@@ -19,12 +16,12 @@ project "nomad" {
 }
 
 event "merge" {
-  // "entrypoint" to use if build is not run automatically  // i.e. send "merge" complete signal to orchestrator to trigger build
+  // "entrypoint" to use if build is not run automatically
+  // i.e. send "merge" complete signal to orchestrator to trigger build
 }
 
 event "build" {
   depends = ["merge"]
-
   action "build" {
     organization = "hashicorp"
     repository   = "nomad"
@@ -34,7 +31,6 @@ event "build" {
 
 event "upload-dev" {
   depends = ["build"]
-
   action "upload-dev" {
     organization = "hashicorp"
     repository   = "crt-workflows-common"
@@ -48,7 +44,6 @@ event "upload-dev" {
 
 event "security-scan-binaries" {
   depends = ["upload-dev"]
-
   action "security-scan-binaries" {
     organization = "hashicorp"
     repository   = "crt-workflows-common"
@@ -63,7 +58,6 @@ event "security-scan-binaries" {
 
 event "notarize-darwin-amd64" {
   depends = ["security-scan-binaries"]
-
   action "notarize-darwin-amd64" {
     organization = "hashicorp"
     repository   = "crt-workflows-common"
@@ -77,7 +71,6 @@ event "notarize-darwin-amd64" {
 
 event "notarize-darwin-arm64" {
   depends = ["notarize-darwin-amd64"]
-
   action "notarize-darwin-arm64" {
     organization = "hashicorp"
     repository   = "crt-workflows-common"
@@ -91,7 +84,6 @@ event "notarize-darwin-arm64" {
 
 event "notarize-windows-386" {
   depends = ["notarize-darwin-arm64"]
-
   action "notarize-windows-386" {
     organization = "hashicorp"
     repository   = "crt-workflows-common"
@@ -105,7 +97,6 @@ event "notarize-windows-386" {
 
 event "notarize-windows-amd64" {
   depends = ["notarize-windows-386"]
-
   action "notarize-windows-amd64" {
     organization = "hashicorp"
     repository   = "crt-workflows-common"
@@ -119,7 +110,6 @@ event "notarize-windows-amd64" {
 
 event "sign" {
   depends = ["notarize-windows-amd64"]
-
   action "sign" {
     organization = "hashicorp"
     repository   = "crt-workflows-common"
@@ -133,7 +123,6 @@ event "sign" {
 
 event "sign-linux-rpms" {
   depends = ["sign"]
-
   action "sign-linux-rpms" {
     organization = "hashicorp"
     repository   = "crt-workflows-common"
@@ -147,7 +136,6 @@ event "sign-linux-rpms" {
 
 event "verify" {
   depends = ["sign-linux-rpms"]
-
   action "verify" {
     organization = "hashicorp"
     repository   = "crt-workflows-common"
@@ -159,26 +147,16 @@ event "verify" {
   }
 }
 
-event "fossa-scan" {
-  depends = ["verify"]
-
-  action "fossa-scan" {
-    organization = "hashicorp"
-    repository   = "crt-workflows-common"
-    workflow     = "fossa-scan"
-  }
-}
-
 ## These are promotion and post-publish events
 ## they should be added to the end of the file after the verify event stanza.
 
 event "trigger-staging" {
-  // This event is dispatched by the bob trigger-promotion command  // and is required - do not delete.
+  // This event is dispatched by the bob trigger-promotion command
+  // and is required - do not delete.
 }
 
 event "promote-staging" {
   depends = ["trigger-staging"]
-
   action "promote-staging" {
     organization = "hashicorp"
     repository   = "crt-workflows-common"
@@ -192,12 +170,12 @@ event "promote-staging" {
 }
 
 event "trigger-production" {
-  // This event is dispatched by the bob trigger-promotion command  // and is required - do not delete.
+  // This event is dispatched by the bob trigger-promotion command
+  // and is required - do not delete.
 }
 
 event "promote-production" {
   depends = ["trigger-production"]
-
   action "promote-production" {
     organization = "hashicorp"
     repository   = "crt-workflows-common"
@@ -211,7 +189,6 @@ event "promote-production" {
 
 event "promote-production-packaging" {
   depends = ["promote-production"]
-
   action "promote-production-packaging" {
     organization = "hashicorp"
     repository   = "crt-workflows-common"

.semgrep/rpc_endpoint.yml

@@ -36,15 +36,6 @@ rules:
           if done, err := $A.$B.forward($METHOD, ...); done {
             return err
           }
-      # Pattern used by endpoints that support both normal ACLs and
-      # workload identity
-      - pattern-not-inside: |
-          if done, err := $A.$B.forward($METHOD, ...); done {
-            return err
-          }
-          ...
-          ... := $T.handleMixedAuthEndpoint(...)
-          ...
       # Pattern used by some Node endpoints.
       - pattern-not-inside: |
           if done, err := $A.$B.forward($METHOD, ...); done {