Backport GCP Cloud Run scaling options to release/1.8.x (#1144)

## Related issues

Backports #1103 and #1135.

## What changed?

Backports GCP Cloud Run Worker Deployment Version support and its
min/max/initial instance and utilization-target scaling options to
`release/1.8.x`. PR #1103 is included as the direct prerequisite for
#1135.

## Validation

- `go test ./...`
- Regenerated `internal/temporalcli/commands.gen.go` and confirmed it is
unchanged
- Confirmed module files are unchanged

## Risk

This adds experimental Worker Deployment compute-configuration flags to
the 1.8 release branch.

---------

Co-authored-by: gcristea-temporal <[email protected]>
Co-authored-by: Zain Awais <[email protected]>

backport server-independent compute patches to v1.8 release (#1127)

Ports server-independent fixes for compute-related CLI code to the 1.8
branch.

Two PRs that did not affect the temporal server or SDK Go mod dependency
were left out of the [PR that backported server-independent changes to
v1.8](#1104). This PR cherry-picks
those PRs to the v1.8.x release branch.

---------

Signed-off-by: Jay Pipes <[email protected]>
Co-authored-by: Alex Stanfield <[email protected]>

Enable SANO for pre-release

Backport to 1.8.x: MDX docs fixes, server v1.31.2, extension exit code (

#1112, #1115, #1116) (#1118)

Backports the following PRs from `main` to `release/1.8.x`:

- #1112 — ci/docs: escape MDX-incompatible patterns and add `-subdir` to
gen-docs
- #1115 — Bump `go.temporal.io/server` to v1.31.2 (originally merged
into `release/1.7.x`)
- #1116 — When delegating to an extension, exit with the same code the
extension used

Cherry-picked in merge order with `-x`.

### Notes
- #1115 conflicted on `go.mod`/`go.sum` because `release/1.8.x` was on
`go.temporal.io/server v1.31.0`. Resolved by taking `v1.31.2` and
regenerating `go.sum` via `go mod tidy`.
- `go build ./...` passes; tests for `internal/commandsgen`,
`cmd/gen-docs`, and the extension delegation tests pass locally.

---------

Co-authored-by: Lina Jodoin <[email protected]>
Co-authored-by: Jeri Lane <[email protected]>

Merge branch 'main' into release/1.7.x-standalone-nexus-operations

Bump go.temporal.io/server to v1.31.2 (#1115)

- Bumps server version for an OSS security release
- Dockerfile's Alpine is already up-to-date

Add one-time move versioning override CLI support (#1093)

## Related issues

<!-- Closes #123 -->

## What changed?
- WISOTT
- For more information, you can also view the relevant PR's:
1. Server PR: temporalio/temporal#10763
2. API PR: temporalio/api#808

## Checklist

<!-- Your PR should satisfy all these requirements. However, feel free
to remove items that don't apply to the PR. Consider giving this
checklist to an AI agent before opening your PR. -->

**Stability**
- [ ] Breaking changes are marked with 💥 in the PR title and release
notes
- [ ] Changes to JSON output (`-o json` / `-o jsonl`) are treated as
breaking changes

**Design**
- [ ] This feature does not depend on Cloud-only APIs or behavior (it
works against an OSS server)
- [x] New commands follow `temporal <noun> <verb>` structure (e.g.
`temporal workflow start`)
- [x] New flags are named after the API concept, not the implementation
mechanism (good: `--search-attribute`, bad: `--index-field`)
- [x] New flags don't duplicate an existing flag that serves the same
purpose
- [x] New flags do not have short aliases without strong justification
- [ ] Experimental features are marked with `(Experimental)` in
`commands.yaml`

**Help text** (see style guide at the top of `commands.yaml`)
- [ ] All flags shown in help text and examples are implemented and
functional
- [ ] Summaries use sentence case and have no trailing period
- [ ] Long descriptions end with a period and include at least one
example invocation
- [ ] Examples use long flags (`--namespace`, not `-n`), one flag per
line
- [ ] Placeholder values use `YourXxx` form (`YourWorkflowId`,
`YourNamespace`)

**Behavior**
- [x] Results go to stdout; errors and warnings go to stderr
- [x] Error messages are lowercase with no trailing punctuation

**Tests**
- [x] Added functional test(s) (`SharedServerSuite`)
- [ ] Added unit test(s) (`func TestXxx`) where applicable

## Manual tests

**Setup**

Requires a server that includes temporalio/temporal#10763 and a workflow
whose Task Queue is present in the target Worker Deployment Version.

```bash
temporal server start-dev --headless

temporal workflow start \
    --type YourWorkflowType \
    --task-queue YourTaskQueue \
    --workflow-id YourWorkflowId
```

Use an existing Worker Deployment Version for the target:

```text
Deployment name: YourDeploymentName
Build ID: YourBuildId
```

**Happy path**

```bash
temporal workflow update-options \
    --workflow-id YourWorkflowId \
    --versioning-override-behavior one_time \
    --versioning-override-deployment-name YourDeploymentName \
    --versioning-override-build-id YourBuildId
```

Expected output:

```text
Update workflow options succeeded
```

Verify table output:

```bash
temporal workflow describe \
    --workflow-id YourWorkflowId
```

Expected: `OverrideBehavior` is `OneTime`, with
`OverrideTargetVersionDeploymentName` and `OverrideTargetVersionBuildId`
set.

Verify JSON output:

```bash
temporal workflow describe \
    --workflow-id YourWorkflowId \
    --output json
```

Expected:
`versioningInfo.versioningOverride.oneTime.targetDeploymentVersion`
contains the deployment name and build ID.

**Error case**

```bash
temporal workflow update-options \
    --workflow-id YourWorkflowId \
    --versioning-override-behavior one_time
```

Expected:

```text
Error: missing deployment name and/or build id with 'one_time' behavior
```

```bash
echo $?
```

Expected:

```text
1
```

**Composition**

```bash
temporal workflow update-options \
    --query 'WorkflowId = "YourWorkflowId"' \
    --yes \
    --versioning-override-behavior one_time \
    --versioning-override-deployment-name YourDeploymentName \
    --versioning-override-build-id YourBuildId
```

Expected: a batch update-options job is started. Use `temporal batch
describe` to inspect the batch, then `temporal workflow describe` on an
affected Workflow Execution to verify the one-time override.

Bump go.temporal.io/server to v1.31.1 (security patch via OSS server) (…

…#1088)

## What changed?
 Bumps `go.temporal.io/server v1.31.0` → `v1.31.1`.

 Transitively picks up the OSS server v1.31.1 security fixes:
- `apache/thrift v0.21.0` → `v0.23.0` (CVE-2026-41602 /
GHSA-wf45-q9ch-q8gh)
- `golang.org/x/crypto v0.46.0` → `v0.52.0` (GO-2026-5005, -5006, -5013,
-5017, -5018, -5019, -5020, -5021, -5023 CRITICAL/HIGH)
- `golang.org/x/net v0.48.0` → `v0.55.0` (GO-2026-5026 CRITICAL idna +
others)
- Go toolchain `1.26.3` → `1.26.4` (CVE-2026-42504, -42507, -27145,
GO-2026-5037/5038/5039 stdlib HIGH)
- `golang.org/x/sys`, `x/term`, `x/text`, `x/sync`, `x/mod`, `x/tools`
bumped transitively to satisfy the above

Merge remote-tracking branch 'origin/main' into release/1.7.x-standal…

…one-nexus-operations

# Conflicts:
#	go.mod
#	go.sum

fix: use allow instead of ignore for dependency-type in dependabot co…

…nfig (#1057)

## Summary
- `dependency-type` is only valid inside `allow`, not `ignore` in
dependabot.yml
- Replaces the invalid `ignore` entry with `allow: [{dependency-type:
direct}]` to achieve the same goal of skipping indirect/transitive
dependency updates
- Adds a CI workflow using `check-jsonschema` to validate
`dependabot.yml` on PRs and pushes to main
- Fixes the Dependabot config validation failure introduced in #1044

## Test plan
- [ ] Verify the `.github/dependabot.yml` validation check passes on
this PR
- [ ] Verify `check-jsonschema --builtin-schema vendor.dependabot
.github/dependabot.yml` passes locally