chore: merge main into develop

[SoulPancake]

Description

Merges latest main into develop.

Includes a one-commit fix on top of the merge:

fix(pkg/go): exempt $expression from the undefined-condition check

$expression is the reserved inline-expression condition name added in #664.
It never appears in the model's conditions block, so the semantic validation
from #616 would incorrectly report it as undefined. The fix mirrors the
exemption already present in the Java ModelValidator.

Supersedes #672.

References

• followup feat: support $expression reserved condition name on type restrictions #664
• followup feat(pkg/go): semantic validation using proto generated structs  #616

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: cb7b22b2-9b29-42dd-a1af-8f89bc8d779b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: Siddhant-K-code / name: Siddhant Khare (7a991c4, a03e3ed)
• ✅ login: SoulPancake / name: Anurag Bandyopadhyay (0d89fec, 9444831, e28e7fa, e7902b6)
• ✅ login: adriantam / name: Adrian Tam (96eccfe, a03e3ed)
• ✅ login: dependabot[bot] / name: dependabot[bot] (1007517, 7a991c4, 806daba, a03e3ed, c3c89f7, db371bf, e28e7fa)
• ✅ login: yissellokta / name: yissellokta (0d2ad7f)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​google.golang.org/​protobuf@​v1.36.11 ⏵ v1.36.12	+1
	golang/​github.com/​stretchr/​testify@​v1.11.1 ⏵ v1.12.1	-6

View full report

[Copilot]

Pull request overview

This PR merges the latest main branch into develop and layers in follow-up fixes related to the reserved inline-expression condition name $expression, ensuring it round-trips through DSL↔JSON and is not incorrectly flagged as an undefined condition during validation.

Changes:

• Extend the grammar and generated parsers to recognize $expression as a reserved condition name within type restrictions, and propagate it through DSL→JSON transformers (Go/JS/Java).
• Exempt $expression from “condition must be defined” validation (Go/JS/Java) and add shared semantic-validation corpus coverage.
• Harden Go graph builders against malformed RelationReference shapes, add regression tests, and update various dependency/workflow pins from the merge.

Reviewed changes

Copilot reviewed 42 out of 44 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/data/dsl-semantic-validation-cases.yaml	Adds shared semantic-validation cases asserting $expression is valid in restrictions.
pkg/js/validator/validate-dsl.ts	Exempts $expression from “must be defined” condition validation in JS.
pkg/js/transformer/dsltojson.ts	Emits $expression into RelationReference.condition during DSL→JSON transform.
pkg/js/package-lock.json	Updates lockfile dependency versions (merge update).
pkg/js/gen/OpenFGAParser.tokens	Regenerated JS parser token mapping for DOLLAR_EXPRESSION.
pkg/js/gen/OpenFGAParser.interp	Regenerated JS parser interpreter data for DOLLAR_EXPRESSION.
pkg/js/gen/OpenFGALexer.tokens	Regenerated JS lexer token mapping for DOLLAR_EXPRESSION.
pkg/java/src/main/java/dev/openfga/language/validation/ModelValidator.java	Exempts $expression from undefined-condition validation in Java.
pkg/java/src/main/java/dev/openfga/language/OpenFgaDslListener.java	Emits $expression into RelationReference.condition in Java DSL→JSON listener.
pkg/java/src/main/gen/dev/openfga/language/antlr/OpenFGAParser.tokens	Regenerated Java parser token mapping for DOLLAR_EXPRESSION.
pkg/java/src/main/gen/dev/openfga/language/antlr/OpenFGAParser.interp	Regenerated Java parser interpreter data for DOLLAR_EXPRESSION.
pkg/java/src/main/gen/dev/openfga/language/antlr/OpenFGALexer.tokens	Regenerated Java lexer token mapping for DOLLAR_EXPRESSION.
pkg/go/validation/condition_validation.go	Skips $expression in the Go undefined-condition reference check.
pkg/go/transformer/dsltojson.go	Emits $expression into RelationRef.Condition in Go DSL→JSON listener.
pkg/go/Makefile	Pins golangci-lint install to a specific version variable.
pkg/go/graph/weighted_graph_builder.go	Uses shared relation-reference classification and avoids node leakage across iterations.
pkg/go/graph/weighted_graph_builder_test.go	Adds regression tests for malformed relation references in weighted builder.
pkg/go/graph/graph.go	Documents edge-drop behavior when endpoints are nil/typed-nil.
pkg/go/graph/graph_builder.go	Adds classifyRelationReference and isNilNode, and hardens edge upsert/lookup casting.
pkg/go/graph/graph_builder_test.go	Adds regression tests for malformed references and typed-nil node handling.
pkg/go/go.sum	Updates Go module sums (merge/dependency updates).
pkg/go/go.mod	Updates Go dependency versions (e.g., testify/protobuf) and indirect requirements.
pkg/go/gen/OpenFGAParser.tokens	Regenerated Go parser token mapping for DOLLAR_EXPRESSION.
pkg/go/gen/OpenFGAParser.interp	Regenerated Go parser interpreter data for DOLLAR_EXPRESSION.
pkg/go/gen/OpenFGALexer.tokens	Regenerated Go lexer token mapping for DOLLAR_EXPRESSION.
OpenFGAParser.g4	Allows `(conditionName
OpenFGALexer.g4	Adds DOLLAR_EXPRESSION token before IDENTIFIER.
.github/workflows/test-release-scripts.yml	Bumps pinned actions/checkout SHA (merge update).
.github/workflows/scorecard.yml	Bumps pinned actions/checkout and ossf/scorecard-action SHAs.
.github/workflows/reusable-release-please.yaml	Bumps pinned actions/checkout SHA.
.github/workflows/pkg-js-release.yaml	Bumps pinned actions/checkout SHA.
.github/workflows/pkg-js-build.yaml	Bumps pinned actions/checkout and docker/setup-buildx-action SHAs.
.github/workflows/pkg-java-release.yaml	Bumps pinned actions (checkout/setup-java/gradle actions).
.github/workflows/pkg-java-build.yaml	Bumps pinned actions (checkout/setup-java/docker buildx).
.github/workflows/pkg-go-build.yaml	Bumps pinned actions and pins lint job Go version to match golangci-lint constraints.

Files not reviewed (1)

• pkg/js/package-lock.json: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[SoulPancake]

𝚁̶𝚎̶𝚙̶𝚕̶𝚊̶𝚌̶𝚒̶𝚗̶𝚐̶ ̶𝚠̶𝚒̶𝚝̶𝚑̶ ̶𝚊̶ ̶𝚜̶𝚚̶𝚞̶𝚊̶𝚜̶𝚑̶-̶𝚖̶𝚎̶𝚛̶𝚐̶𝚎̶ ̶𝚝̶𝚘̶ ̶𝚊̶𝚟̶𝚘̶𝚒̶𝚍̶ ̶𝙴̶𝚊̶𝚜̶𝚢̶𝙲̶𝙻̶𝙰̶ ̶𝚛̶𝚎̶-̶𝚌̶𝚑̶𝚎̶𝚌̶𝚔̶𝚒̶𝚗̶𝚐̶ ̶𝚞̶𝚙̶𝚜̶𝚝̶𝚛̶𝚎̶𝚊̶𝚖̶ ̶𝚌̶𝚘̶𝚖̶𝚖̶𝚒̶𝚝̶ ̶𝚊̶𝚞̶𝚝̶𝚑̶𝚘̶𝚛̶𝚜̶.̶
edit: squash merge would diverge the branches

[Siddhant-K-code]

/easycla