chore(renovate): group tflint and terraform updates together

See merge request !1298

chore(deps): update dependency bridgecrewio/checkov to v3.2.504

See merge request !1302

chore(deps): update dependency mikefarah/yq to v4.52.4

See merge request !1304

chore(deps): update dependency open-policy-agent/opa to v1.13.2

See merge request !1305

chore(deps): update node.js to v24.13.1

See merge request !1306

chore(deps): update dependency renovate to v43.31.1

See merge request !1307

chore(deps): update ghcr.io/containerbase/base docker tag to v14.4.3

See merge request !1308

chore(deps): update dependency bridgecrewio/checkov to v3.2.505

See merge request !1310

chore(deps): update golang-minor to v1.26.0 (minor)

See merge request !1309

chore(deps): update dependency jdx/mise to v2026.2.19

See merge request !1303

Enable semantic-release to run on stable branches (matching pattern
`X-Y-stable`) in addition to the default branch.

The job previously failed on stable branches because it would checkout
the default branch instead of the current branch, causing semantic-release
to fail with "fatal: malformed object name X-Y-stable" when querying tags.

Changes:
- Use CI_COMMIT_BRANCH with fallback to CI_DEFAULT_BRANCH for git checkout,
  ensuring correct branch checkout on stable branches while preserving
  safe behavior for parent pipeline testing scenarios
- Add stable branch pattern (`/^\d+-\d+-stable$/`) to both delayed and
  regular release rules to allow releases from maintenance branches

Closes gitlab-com/gl-infra/delivery#21846

Add semantic_release_dry_run job that validates merge requests targeting
stable branches before they are merged.

The job performs a local merge of the MR commits into the target branch,
then runs semantic-release in dry-run mode to verify the commits would
produce a valid release. This catches attempts to merge features (which
would require a minor/major version bump) into stable branches that only
allow patch releases.

Key features:
- Checks out target branch and merges MR commits locally
- Uses -X theirs to auto-resolve conflicts (only commit history matters)
- Overrides CI environment to simulate running on target branch
- Uses file:// URL to avoid push permission checks
- Overrides plugins to avoid side effects and ensure compatibility
- Only runs on MRs targeting stable branches (X-Y-stable pattern)

Closes gitlab-com/gl-infra/delivery#21847

AI-assisted: GitLab Duo Agentic Chat (Claude Opus 4.5)

feat(semantic-release): support stable branch releases

See merge request !1299

## [3.6.0](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/compare/...) (2026-02-24)

### Features

* **semantic-release:** add dry-run validation for stable branch MRs ([395b5bb2](395b5bb2)), closes [gitlab-com/gl-infra/delivery#21847](https://gitlab.com/gitlab-com/gl-infra/delivery/-/issues/)
* **semantic-release:** release from stable branches ([21bc0a82](21bc0a82)), closes [gitlab-com/gl-infra/delivery#21846](https://gitlab.com/gitlab-com/gl-infra/delivery/-/issues/)

### Others

* **renovate:** group tflint and terraform updates together ([bf58b72c](bf58b72c))

### Dependencies

* **deps:** update dependency bridgecrewio/checkov to v3.2.504 ([1a0bf275](1a0bf275))
* **deps:** update dependency bridgecrewio/checkov to v3.2.505 ([8b9d8ed0](8b9d8ed0))
* **deps:** update dependency jdx/mise to v2026.2.19 ([b1b789f3](b1b789f3))
* **deps:** update dependency mikefarah/yq to v4.52.4 ([f2671e66](f2671e66))
* **deps:** update dependency open-policy-agent/opa to v1.13.2 ([69e19a78](69e19a78))
* **deps:** update dependency renovate to v43.31.1 ([cf87c6c3](cf87c6c3))
* **deps:** update ghcr.io/containerbase/base docker tag to v14.4.3 ([6db132d0](6db132d0))
* **deps:** update golang-minor to v1.26.0 ([60df5086](60df5086))
* **deps:** update node.js to v24.13.1 ([58c58f75](58c58f75))