[rmcdaniel]

Selects native Server 3.8.0 and Helm chart 1.6.0 as the stable releases, and documents the 3.8.0 upgrade. Modelled on #516.

• docs/deployment.md: new section "Upgrading to Server 3.8.0" (#native-schema-upgrade-3-8):

  • a schema upgrade on every backend (SQLite 11→12, PostgreSQL 12→13, MariaDB 12→13, MySQL 13→14) that only creates the empty dw_task_queue_pauses table;
  • the Compose steps;
  • several Servers on one database;
  • resume and transaction behavior per backend;
  • backup-only rollback (native_schema_newer_than_binary);
  • the earlier steps the same run applies;
  • the MySQL prepared-statement budget;
  • one sentence each on the activity dispatch pause and redrive.

  There's also a Chart 1.6.0 paragraph, with the image.digest pin for change-controlled installs that Security recommended.

• docs/failures-and-recovery.md: what native redrive does from 3.8.0: it reuses side effects and version markers, and returns the new refusal codes.

• All seven translations have the same changes, with source-hashes.json refreshed.

• static/stable-releases.json: server 3.8.0 and helm-chart 1.6.0. helm_chart is read back from the published OCI chart:

  • manifest sha256:a031c661…: the registry's Docker-Content-Digest, which matches the sha256 of the fetched bytes;
  • package layer sha256:84435607…;
  • dev.durable-workflow.source-revision 257d0af5: the Security-reviewed head of server#1180;
  • qualification is the Helm Chart Release run 43331170106: lint, kind install, publish and verify.

• tests/kubernetes-workers/artifacts.json: Server 3.8.0 at index sha256:7988a235…, the qualified and promoted index.

Server 3.8.0: https://github.com/durable-workflow/server/releases/tag/3.8.0. cli stays at 2.6.0 until CLI 2.7.0's release run is verified.

Checks run locally:

• npm run build passed;
• the translation check passed: 108 guides, all hashes current;
• npm test gave 17/17;
• the helm pairing test gave 4/4;
• the public-boundary scan passed.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security: PASS (head 8fd9e5ab), conditional on CI being green. Every digest in the PR matches what I read independently from the registries:

• Server 3.8.0: ghcr.io/durable-workflow/server:3.8.0 and docker.io/durableworkflow/server:3.8.0 both resolve to index sha256:7988a23525d9e50e997a9f6f02e801300ed4f626de3cf6977033657ae7e9f58e, the qualified and promoted build. That's the digest the 3.8.0 upgrade section gives for image.digest in all 8 languages, and the one tests/kubernetes-workers/artifacts.json pins.
• Chart 1.6.0: an anonymous read of oci://ghcr.io/durable-workflow/charts/durable-workflow:1.6.0 returns Docker-Content-Digest: sha256:a031c661…dc96, and the fetched manifest bytes hash to the same value. Its single Helm content layer is sha256:84435607…87de, and its dev.durable-workflow.source-revision is 257d0af5, the server#1180 head I reviewed. All three match static/stable-releases.json. The qualification URL is the green Helm Chart Release run 43331170106.

Also in scope: the stable versions move to server 3.8.0 / chart 1.6.0 consistently, and source-hashes.json is updated for each translated page. Thanks for adding the digest-pin guidance.