Repository navigation
Automated Sync from main to stable - #40
Open
rhods-devops-app[bot] wants to merge 395 commits into
Open
rhods-devops-app[bot] wants to merge 395 commits into
rhods-devops-app[bot] wants to merge 395 commits into
Conversation
Signed-off-by: Krzysztof Malczuk <kmalczuk@redhat.com>
…NVIDIA#4762) Some credentials are checked by handlers rather than by the gateway's authenticators, so their rejections only reached the caller and plain logs. They now emit the same OCSF events as the router's checks: - SSH session tokens. A ForwardTcp SSH connection whose token is missing, unknown, revoked, minted for another sandbox, or expired emits an Authentication failure with protocol ssh_session_token and a reason category. An accepted token logs on once, like other credentials. The router has already authenticated the caller, so these events name that caller. - IssueSandboxToken. A compute-driver identity that no longer matches the sandbox's recorded runtime emits an Authentication failure (stale_identity); a sandbox with no record, or no usable recorded identity, emits unknown_identity. A sandbox calling it with a gateway JWT is refused with method_not_permitted and raises the sandbox boundary finding. - RefreshSandboxToken. A caller that is not a gateway-JWT sandbox is refused with method_not_permitted. A request for an extension service the sandbox policy does not select is refused with the new extension_service_not_selected reason, without a finding, because a policy update can race the supervisor's request. - Sandbox logons on IssueSandboxToken and RefreshSandboxToken. The router logged a compute-driver credential on IssueSandboxToken, or a gateway JWT on RefreshSandboxToken, before the handler finished checking the recorded runtime or the token lineage, so a credential that failed that check recorded a success and then a failure. Those handlers now record the logon once their check passes. Other credentials on these methods are fully verified by the router and still log on there, even when authorization then refuses them. - GetCurrentUser. A non-user principal is refused with method_not_permitted. The router already blocks such callers, so this is defense in depth. Callers receive the same status codes and messages as before, and the events never include the tokens. Refs NVIDIA#2912 Signed-off-by: Kris Hicks <khicks@nvidia.com>
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
NVIDIA#4435) * feat(skills): add release-captain skill for the weekly release cadence Add an internal skill with Monday pre-flight, Tuesday stable cut, and recovery steps for the RFC 0014 release train. All tag, workflow, merge, and Slack actions require explicit maintainer approval. Closes NVIDIA#4433 Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): document starting a release train after tag-push triggers Pre-release tag pushes now start Release Tag, so the skill no longer dispatches after pushing. Add seed-commit selection from Release Dev results, a commit-type summary for the patch/minor decision, and a recovery row for a tag push that starts no run. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): create lightweight release tags regardless of signing config With tag.gpgSign enabled, git tag creates an annotated tag and blocks in an editor. Disable signing for the release tag commands so they create the same lightweight tags as Auto-Tag. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): capture release captain lessons from starting 0.1.5 Note that Auto-Tag skips report success and show how to tell from the log, the UTC time of the schedule across DST, where pre-releases appear instead of the Releases page, why tags need a forced fetch, reading workflow triggers from origin/main, the rolling dev tag, and the common compatibility-review false positive for unpublished internal crates. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): add recovery for pre-releases failing on new RustSec advisories Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): recommend fixing forward to a green pre-release A failed pre-release doesn't end the train. Document merging the fix and tagging the next pre-release by hand once its Release Dev run passes, letting the failed run finish for its remaining signal. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): describe the triage channel and thread replies for pre-release failures Name #openshell-triage, where TriageBot posts each failed Release Tag attempt, and ask the captain to reply in the failure's thread so others know a fix is underway. List common transient failure types and rerun once when a failure looks unrelated to the commit. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): drop Codex Security from release captain run matching Codex Security no longer runs in release qualification (NVIDIA#4469), so the stable release can't rely on a pre-release's Codex result and runs can't be matched by its job name. Match dispatched runs by the qualification artifact name instead. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): describe where and how to post the release coordination thread Name the CNCF Slack channel, note that the release ships from main with no release branch or cherry-picks, and add an example post. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): make seeding the next train the outgoing captain's handoff Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): update release captain for the Release workflow and add usage guide Stable releases are now dispatched with release.yml, which selects the qualified pre-release and creates the tag, and pre-releases run in release-prerelease.yml. Replace the stable tag push steps and stale recovery rows, add a preview of the selected candidate, add a section on when to use each part of the skill, and trim redundant explanations. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): explain what the release cutoff guarantees The release ships the final pre-release's commit only if it passes, so the coordination post must not promise that every PR merged by the cutoff ships. Describe the Auto-Tag and hand-tagged cutoffs, and tag the final pre-release by hand on Tuesday for a later cutoff. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): add release notes review and v0.1.5 release day lessons Review the release notes preview from the Pre-release run before approval, and describe how Release regenerates them. Correct the thread when the shipped pre-release was cut before the posted cutoff, require maintainer agreement for accepted-risk breaks in a patch release, and add recovery rows for startup failures and release notes failures. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): make starting the next train the captain's final duty Move starting the next train after closing the loop, so it is the last Tuesday step. The captain's week ends when the next -pre.1 Pre-release run passes or its failure is handed off. Also move open milestone items when closing the loop. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): trim the release captain skill to its durable steps Remove repeated guidance, week-specific examples, fragile commands, and debugging detail an agent can derive from the workflows. Keep the approval guardrails, the weekly steps, and a short recovery table. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(ci): document Release Auto-Tag and pre-release notes previews Add Release Auto-Tag to the workflow table, including that each train's -pre.1 is pushed by hand, and note that every Pre-release run writes a release notes preview. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): add a template for the release announcement reply Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): watch pre-releases in the week before your turn Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): remove internal channel references from release captain Check pre-release runs directly instead of relying on an internal notification channel, and drop internal Slack channel IDs. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * docs(skills): fix pre-release failures in a new number via Auto-Tag A rerun repeats the same commit, so a failure that needs a fix ships in the next -pre.N. Cut it by dispatching Release Auto-Tag from the tip of main, and tag a specific commit by hand only when needed. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> --------- Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
NVIDIA#4777) Handlers recorded each refusal by emitting an OCSF event and then building the status by hand, so a new refusal could skip the event. These helpers do both in one call: - audit::deny emits an authorization denial for the current request and returns the permission-denied status. Guards, workspace authorization, and the token and current-user handlers use it. - audit::reject_credential emits an Authentication failure for a credential a handler verifies itself and returns the rejection's status. It replaces emit_credential_failure for SSH session tokens and IssueSandboxToken. RefreshSandboxToken now takes its path and origin from the request scope, as every other handler does, instead of rebuilding them from the request. - Failure and logon events share one Authentication builder. - AuthMechanism and AuthFailureReason carry their audit labels. The logon digest uses the label instead of the variant's Debug name. Events and statuses are unchanged. Refs NVIDIA#2912 Signed-off-by: Kris Hicks <khicks@nvidia.com>
NVIDIA#4799) Forward tests retried on a new port only when the CLI's port check found the port in use. Another test can also take the port after that check passes and before the fake ssh binds it. The fake then panicked with exit status 101, which the retry did not recognize, so the test failed. The fake ssh now exits 255 when its port is taken, as ssh -o ExitOnForwardFailure=yes does, and the tests retry on that exit status too. Signed-off-by: Kris Hicks <khicks@nvidia.com>
…NVIDIA#3967) Workload images no longer need iproute2 or nftables since the supervisor moved out of the workload (NVIDIA#2942). Docker and Podman run images without USER as UID/GID 1000 (NVIDIA#3386), the driver creates /sandbox, and the CLI no longer builds Dockerfiles (NVIDIA#3214). Update the bring-your-own-container example and the runtimes page to match. Fixes NVIDIA#3965 Signed-off-by: Adel Zaalouk <azaalouk@redhat.com>
Restore debug-openshell-cluster skill edits dropped by sync merge 5b42917 and make license:check pass for midstream-only files. Signed-off-by: Andre Lustosa <alustosa@redhat.com>
…ill-license-headers/andre-motta CARRY: fix(odh): restore upstream skill edits and SPDX header check
Tests for the gateway's OCSF events each carried their own copy of the same fixtures: converting captured events to JSON, the request ID and peer address, running a handler inside a routed request, and checking event shapes. They now share them: - OcsfCapture::json_events returns captured events as their exported JSON. - auth::audit::test_support holds the test request origin, audited() for running a handler as a routed request, and assertions for authentication failures, logons, denials, boundary findings, the request origin, and redacted secrets. The event assertions also check each event against its OCSF class schema, which the handler tests did not do before. - auth::principal::test_support builds the OIDC user and gateway-JWT sandbox principals that several test modules defined identically. Refs NVIDIA#2912 Signed-off-by: Kris Hicks <khicks@nvidia.com>
Signed-off-by: Yuedong Wu <dwcn22@outlook.com>
* fix(examples): repair multi-agent notepad launch Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * test(examples): remove redundant demo harness Signed-off-by: Taylor Mutch <taylormutch@gmail.com> --------- Signed-off-by: Taylor Mutch <taylormutch@gmail.com>
Signed-off-by: Taylor Mutch <taylormutch@gmail.com>
Signed-off-by: Mrunal Patel <mrunalp@gmail.com>
Signed-off-by: Taylor Mutch <taylormutch@gmail.com>
The example configuration left the dashboard on its chart's default image, the upstream publisher's personal quay.io repository, although Konflux publishes a public ODH build. It now sets dashboard.images.dashboard to quay.io/opendatahub/odh-openshell-dashboard, pinned by digest. The chart reference stays on its upstream publisher until an ODH chart registry exists (RHOAIENG-96944). The installer gave the dashboard the admin role but not the user role. Dashboard builds since 2026-10-19 show an entitlement page to anyone without one of the two roles and default the user role to "user", so a standard user under any other role name was refused. The dashboard now gets oidc.userRole from user_role, as the gateway does. Charts that predate the value ignore it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Gage Krumbach <gkrumbac@redhat.com>
The example left the gateway, supervisor and sandbox runtime on the
gateway chart's defaults, the upstream publisher's images, while the
README asked for ODH builds without showing them. The example now names
quay.io/opendatahub/odh-openshell-{gateway,supervisor,sandbox} with
digest placeholders, and the README says how to pair a rhaiv tag with
the gateway chart. The default sandbox workload image stays on the
chart default: ODH publishes no replacement.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Gage Krumbach <gkrumbac@redhat.com>
Signed-off-by: Gaizka Menendez <gmenende@redhat.com>
Signed-off-by: Adrien Langou <alangou@nvidia.com>
* fix(ci): stop skipped release notes from skipping publication Stable releases that reused the prerelease notes preview skipped the Write Release Notes job. Every job that depends on Publish Release Assets used an implicit success() check, which treats a skipped job anywhere upstream as a failure. As a result, v0.1.6 never published its snap, TypeScript SDK, Go SDK tag, wheels, or Fern docs. Prereleases hit the same problem: Publish Prerelease Snap was always skipped. Move notes production out of release-publish.yml. release-notes.yml now chooses between reusing the preview and generating notes inside its steps, so the job always succeeds when notes exist. Release runs it as a sibling of Build, and Publish requires it. Publish Release Assets depends only on assembly and the Helm chart again. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * fix(ci): make stable release publication rerunnable Re-dispatching Release for an existing stable tag rebuilt the artifacts, overwrote the published GHCR version tags, and then failed at the Helm duplicate check before reaching the package publishers. Each publisher now skips what is already published: - GHCR keeps existing version tags and still verifies their SBOMs. - Helm skips packaging and pushing when both charts exist, and still fails when only one exists. The Helm action is loaded from the workflow revision, so retrying an older tag uses the current duplicate handling. - The GitHub Release uploads only missing assets. - npm and the PyPI wheel trigger skip versions that already exist, whether called by Release or dispatched by hand. test:release-workflows checks that publish logic is loaded from the workflow revision and that no needed publish job can be skipped on its own. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * fix(ci): fail release runs when an expected publisher does not succeed GitHub treats skipped jobs as passing, so v0.1.6 showed a green Release run although its publishers never ran. A final Check Publication job in release-publish.yml runs always and fails when any publisher expected for the release kind did not succeed, which also fires the existing Pre-release Slack alert. Release now sends the same Slack failure notice. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * fix(ci): fail instead of overwriting when a registry lookup errors The GHCR and Helm existence checks treated any lookup error as not published, so a transient registry error could fall through to a push that overwrites a published tag. Only a confirmed missing tag now counts as unpublished; any other lookup error fails the job. Also state in CI.md that published artifacts are never overwritten, and remove the static release workflow test; check-publication catches skipped publishers at runtime. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> --------- Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
…#4918) * feat(sdk): route Python SDK exec to the sandbox owner replica Ask GetSandbox for the owner replica, cache it for 30 seconds, and send it as x-openshell-replica on ExecSandbox. Retry once without the hint when the per-replica route has no healthy endpoint, forgetting the cached owner. Part of NVIDIA#4223 Signed-off-by: divesh <dgude@nvidia.com> * refactor(sdk): share the Python GetSandbox request for owner lookup Reuse get's request for the owner lookup, point the routing headers at their documented contract, and accept only string owner metadata. Part of NVIDIA#4223 Signed-off-by: divesh <dgude@nvidia.com> --------- Signed-off-by: divesh <dgude@nvidia.com>
…IA#5131) Signed-off-by: Artem Lytvyn <letv1n2007@icloud.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| concurrency: | ||
| group: ${{ inputs.notes-only && format('release-notes-preview-{0}', github.ref) || 'release-stable' }} | ||
| cancel-in-progress: false | ||
| queue: max |
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Signed-off-by: konflux-internal-p02 <170854209+konflux-internal-p02[bot]@users.noreply.github.com> Co-authored-by: konflux-internal-p02[bot] <170854209+konflux-internal-p02[bot]@users.noreply.github.com>
Signed-off-by: konflux-internal-p02 <170854209+konflux-internal-p02[bot]@users.noreply.github.com> Co-authored-by: konflux-internal-p02[bot] <170854209+konflux-internal-p02[bot]@users.noreply.github.com>
…24-e2e-image-discovery/Bobbins228
…3-review-followups CARRY: fix(odh): harden generic fetcher follow-ups
…tmaker/main/lock-file-maintenance chore(deps): refresh rpm lockfiles
…hub-io#158) CARRY: fix(ci): refresh stale e2e generic-fetcher checksums The Mint Maker bumps for uv, nextest, helm, and ocp-release rewrote the download URLs and filenames in deploy/konflux/e2e-odh/generic-fetcher.yaml without recomputing the checksums, leaving the previous versions' hashes in place. Hermeto's strict-mode verification then failed the prefetch-dependencies step of odh-openshell-e2e-on-pull-request on every PR. Refresh all eight amd64/arm64 checksums by running sync-generic-fetcher.py --update uv oc helm nextest, with each hash verified against the publisher's checksum sidecar. Signed-off-by: Emilien Macchi <emacchi@redhat.com> * fix(ci): generate typed gRPC stubs in the e2e image Upstream 5040 added --mypy_grpc_out to generate_python_proto.py, which needs the protoc-gen-mypy_grpc plugin from mypy-protobuf. The e2e image builds its hermetic venv from odh/requirements.txt, which did not include that package, so the image build failed at the proto generation step with "protoc-gen-mypy_grpc: program not found". The failure was masked until now because the stale generic-fetcher checksums failed the pipeline earlier. Add mypy-protobuf to odh/requirements.in and regenerate the locked requirements with hashes, matching the mypy-protobuf>=5.1 declaration in the root pyproject.toml. grpc_tools.protoc resolves plugins through PATH, and the image invokes the venv python without activating the venv, so also prepend /opt/odh-e2e-venv/bin to PATH for the generation step. Signed-off-by: Emilien Macchi <emacchi@redhat.com> --------- Signed-off-by: Emilien Macchi <emacchi@redhat.com>
… docker tag to v9.8-1793614932 (#91) Signed-off-by: konflux-internal-p02 <170854209+konflux-internal-p02[bot]@users.noreply.github.com> Co-authored-by: konflux-internal-p02[bot] <170854209+konflux-internal-p02[bot]@users.noreply.github.com>
Signed-off-by: konflux-internal-p02 <170854209+konflux-internal-p02[bot]@users.noreply.github.com> Co-authored-by: konflux-internal-p02[bot] <170854209+konflux-internal-p02[bot]@users.noreply.github.com>
… docker tag to v9.8-1793614932 (opendatahub-io#155) Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com> Co-authored-by: red-hat-konflux[bot] <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Signed-off-by: konflux-internal-p02 <170854209+konflux-internal-p02[bot]@users.noreply.github.com> Co-authored-by: konflux-internal-p02[bot] <170854209+konflux-internal-p02[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated Sync from main to stable
This PR automatically syncs the
mainbranch to thestablebranch by opening a pull request frommainintostable.Sync Summary
Latest commit:
a4c0bd2bchore(deps): refresh rpm lockfiles [SECURITY] (chore(deps): refresh rpm lockfiles [SECURITY] #92)Total commits to sync: 390
Source:
https://github.com/red-hat-data-services/OpenShell.git@mainTarget:
https://github.com/red-hat-data-services/OpenShell.git@stablePR head:
mainCommits to be synced
a4c0bd2bchore(deps): refresh rpm lockfiles [SECURITY] (chore(deps): refresh rpm lockfiles [SECURITY] #92)88cfe83cchore(deps): update registry.access.redhat.com/ubi9/nodejs-24-minimal docker tag to v9.8-1793614932 (chore(deps): update registry.access.redhat.com/ubi9/nodejs-24-minimal docker tag to v9.8-1793614932 #91)d2885888Merge remote-tracking branch 'upstream/main'172c4f59CARRY: fix(ci): refresh stale e2e generic-fetcher checksums (fix(ci): refresh stale e2e generic-fetcher checksums opendatahub-io/openshell#158)637c2927Merge remote-tracking branch 'upstream/main'b6d9081fMerge pull request chore(deps): refresh rpm lockfiles opendatahub-io/openshell#156 from opendatahub-io/konflux/mintmaker/main/lock-file-maintenance42ca9013Merge pull request CARRY: fix(odh): harden generic fetcher follow-ups opendatahub-io/openshell#147 from opendatahub-io/rhaieng-7753-review-followupsb3dc739cMerge remote-tracking branch 'upstream/main'9d093d39Merge pull request feat(odh): discover e2e images from operator CSV opendatahub-io/openshell#126 from Bobbins228/feat/RHAIENG-7924-e2e-image-discovery/Bobbins22876bf7eafchore(deps): refresh rpm lockfiles [SECURITY] (chore(deps): refresh rpm lockfiles [SECURITY] #89)828b6908chore(deps): refresh rpm lockfiles [SECURITY] (chore(deps): refresh rpm lockfiles [SECURITY] #84)12484eb7chore(deps): refresh rpm lockfiles4f3d09afMerge remote-tracking branch 'upstream/main'71b5bdbfMerge remote-tracking branch 'upstream/main'533dab52Merge remote-tracking branch 'upstream/main'634ca7d8fix(driver-vm): read sandbox account from prepared image rootfs (fix(driver-vm): read sandbox account from prepared image rootfs NVIDIA/OpenShell#5131)1afd9f69feat(sdk): route Python SDK exec to the sandbox owner replica (feat(sdk): route Python SDK exec to the sandbox owner replica NVIDIA/OpenShell#4918)00528d24fix(ci): make stable release publication retryable (fix(ci): make stable release publication retryable NVIDIA/OpenShell#4986)be5e4949fix(deps): update russh and pageant security fixes (fix(deps): update russh and pageant NVIDIA/OpenShell#5123)1a80e5c3CARRY: fix(odh): harden generic fetcher follow-upsfeab50a1Merge remote-tracking branch 'upstream/main'fa159deeMerge remote-tracking branch 'upstream/main'8ca7ecf6fix(deps): update pulldown-cmark to restore cargo-deny (fix(deps): update pulldown-cmark to restore cargo-deny NVIDIA/OpenShell#5122)0b7400e8docs: use a Python image in the service expose example (docs: use a Python image in the service expose example NVIDIA/OpenShell#4197)a659170echore(deps): upgrade OpenTelemetry to 0.33 (chore(deps): upgrade OpenTelemetry to 0.33 NVIDIA/OpenShell#5081)f500cbefMerge pull request chore(deps): update quay.io/openshift-release-dev/ocp-release docker tag to v4.22.21 opendatahub-io/openshell#153 from opendatahub-io/konflux/mintmaker/main/quay.io-openshift-release-dev-ocp-release-4.x6c23a3b0Merge pull request chore(deps): update dependency helm/helm to v4.3.1 opendatahub-io/openshell#152 from opendatahub-io/konflux/mintmaker/main/helm-helm-4.xc7e46749Merge pull request chore(deps): update registry.redhat.io/rust-builder-image/rust-rhel9 docker tag to v1.99.1 opendatahub-io/openshell#151 from opendatahub-io/konflux/mintmaker/main/registry.redhat.io-rust-builder-image-rust-rhel9-1.x7f7d0552Merge pull request chore(deps): refresh rpm lockfiles [SECURITY] opendatahub-io/openshell#150 from opendatahub-io/konflux/mintmaker/main/lock-file-maintenance-vulnerability53e9312fMerge pull request chore(deps): update registry.access.redhat.com/ubi9/ubi docker tag to v9.8-1793580630 opendatahub-io/openshell#149 from opendatahub-io/konflux/mintmaker/main/registry.access.redhat.com-ubi9-ubi-9.x39c254a0Merge pull request chore(deps): update dependency nextest-rs/nextest to v0.9.150 opendatahub-io/openshell#148 from opendatahub-io/konflux/mintmaker/main/nextest-rs-nextest-0.x0a99d156chore(deps): refresh rpm lockfiles (chore(deps): refresh rpm lockfiles opendatahub-io/openshell#154)aa239722Merge pull request chore(deps): update dependency astral-sh/uv to v0.13.6 opendatahub-io/openshell#143 from opendatahub-io/konflux/mintmaker/main/astral-sh-uv-0.xc92c2c79test(suites): port the conformance suites onto testkit and run conformance-integration on the runner (test(suites): port the conformance suites onto testkit and run conformance-integration on the runner NVIDIA/OpenShell#4774)91b3d217Merge remote-tracking branch 'upstream/main'0d63c6a1Merge pull request fix(rhoai): refine installer chart and image handling opendatahub-io/openshell#141 from Gkrumbach07/fix/121-installer-followups/Gkrumbach07bcac2839chore(deps): refresh rpm lockfiles [SECURITY] (chore(deps): refresh rpm lockfiles [SECURITY] #80)44d6d498chore(deps): update registry.access.redhat.com/ubi9/ubi docker tag to v9.8-179358063016574b71chore(deps): refresh rpm lockfiles [SECURITY] (chore(deps): refresh rpm lockfiles [SECURITY] #75)e4e89050chore(deps): update quay.io/openshift-release-dev/ocp-release docker tag to v4.22.210028ab68chore(deps): refresh rpm lockfiles [SECURITY] (chore(deps): refresh rpm lockfiles [SECURITY] #70)1f81b4b9chore(deps): refresh rpm lockfiles [SECURITY]665e0678chore(deps): update dependency helm/helm to v4.3.161cf93acchore(deps): update registry.redhat.io/rust-builder-image/rust-rhel9 docker tag to v1.99.1b99038acMerge remote-tracking branch 'upstream/main'15ecfaf0Merge remote-tracking branch 'upstream/main'b1e0e3ebMerge remote-tracking branch 'upstream/main'42671c2dfix(test): drop IPv6 loopback redirect from the Keycloak fixture realm (fix(test): drop IPv6 loopback redirect from the Keycloak fixture realm NVIDIA/OpenShell#5089)08da3e9echore(deps): refresh rpm lockfiles [SECURITY] (chore(deps): refresh rpm lockfiles [SECURITY] #66)477384e8chore(deps): update dependency nextest-rs/nextest to v0.9.150081afc83Merge remote-tracking branch 'upstream/main'743d2977Merge remote-tracking branch 'upstream/main'50a3237ftest(features): run feature tests against environment services, starting with Keycloak (test(features): run feature tests against environment services, starting with Keycloak NVIDIA/OpenShell#4891)73ae2222feat(cli): support fixed callback port for browser login in containers (feat(cli): support fixed callback port for browser login in containers NVIDIA/OpenShell#5065)0d27177bfeat(agents): support Kubernetes Gators with reusable tooling images (feat(agents): support Kubernetes Gators with reusable tooling images NVIDIA/OpenShell#4744)c2311ad0fix(core): resolve git rerun paths so worktree builds stay fresh (fix(core): resolve git rerun paths so worktree builds stay fresh NVIDIA/OpenShell#4947)d7b61689feat(python): ship typed sync and async gRPC stubs (feat(python): ship typed sync and async gRPC stubs NVIDIA/OpenShell#5040)28dd567aMerge pull request chore(sync): merge NVIDIA OpenShell main into ODH opendatahub-io/openshell#145 from opendatahub-io/chore/sync-nvidia-main/Bobbins22837712756feat(sandbox): support storage-preserving sandbox configuration updates (feat(sandbox): support storage-preserving sandbox configuration updates NVIDIA/OpenShell#4873)3391187cfeat(crypto): add a system OpenSSL backend and dependency guardrails (feat(crypto): add a system OpenSSL backend and dependency guardrails NVIDIA/OpenShell#4843)2b7cc77fchore(sync): merge latest NVIDIA OpenShell mainc6bb55daMerge remote-tracking branch 'upstream/main'0e96e8e8feat(ocsf)!: emit OCSF 1.8.0 only and deprecate the schema version knobs (feat(ocsf)!: emit OCSF 1.8.0 only and deprecate the schema version knobs NVIDIA/OpenShell#5036)bb956578Merge pull request CARRY: fix(konflux): bump UBI 9.8 bases for eMudhra CA distrust opendatahub-io/openshell#146 from opendatahub-io/fix/ubi9-emudhra-ca/andre-mottabc553c98fix(rhoai): inspect rendered dashboard role support187f940bCARRY: fix(konflux): bump UBI 9.8 bases for eMudhra CA distrustd1500c06Merge remote-tracking branch 'upstream/main'4a8ba9bdchore(sync): merge NVIDIA OpenShell main into ODH07a880f7Merge pull request chore(deps): update registry.access.redhat.com/ubi9/ubi:9.8 docker digest to 5f08e80 opendatahub-io/openshell#142 from opendatahub-io/konflux/mintmaker/main/registry.access.redhat.com-ubi9-ubi-9.8e336553cCARRY: feat(odh): discover e2e images from operator CSV5550a3eechore(deps): refresh rpm lockfiles [SECURITY]95893a7achore(deps): update dependency astral-sh/uv to v0.13.64f068860chore(deps): update registry.access.redhat.com/ubi9/ubi:9.8 docker digest to 5f08e803a5dfcd2fix(gateway): accept the full reconnect log buffer (fix(gateway): accept the full reconnect log buffer NVIDIA/OpenShell#5049)b705f433Merge remote-tracking branch 'upstream/main'e999bd03Merge pull request CARRY: feat(odh): pin runtime images by digest and add Renovate coverage opendatahub-io/openshell#112 from opendatahub-io/rhaieng-7753-followupsa74911d9fix(rhoai): refine installer chart and image handling6595765aMerge pull request fix(rhoai): install the ODH images and pass the dashboard user role opendatahub-io/openshell#121 from Gkrumbach07/rhoai-dashboard-odh-imagecc999543feat(sdk): route Go SDK exec and forward to the sandbox owner replica (feat(sdk): route Go SDK exec and forward to the sandbox owner replica NVIDIA/OpenShell#4852)077d4313fix(deps): resolve RustSec advisories and restore cargo-deny (fix(deps): resolve RustSec advisories and restore cargo-deny NVIDIA/OpenShell#5030)5e1d05e5Merge remote-tracking branch 'upstream/main'4d4c15c1fix(deps): upgrade zip through z3 0.22 (fix(deps): upgrade zip through z3 0.22 NVIDIA/OpenShell#5026)c0796165chore(deps): refresh rpm lockfiles [SECURITY] (chore(deps): refresh rpm lockfiles [SECURITY] opendatahub-io/openshell#139)eca2eb99chore(deps): refresh rpm lockfiles [SECURITY] (chore(deps): refresh rpm lockfiles [SECURITY] #58)ce0634efMerge remote-tracking branch 'upstream/main'69c99aa5chore(deps): refresh rpm lockfiles (chore(deps): refresh rpm lockfiles #57)5712061cchore(deps): refresh rpm lockfiles [SECURITY] (chore(deps): refresh rpm lockfiles [SECURITY] #56)d4e32263revert(ci): remove temporary v0.1.6 protobuf exception (revert(ci): remove temporary v0.1.6 protobuf exception NVIDIA/OpenShell#4978)a9538dd9chore(deps): refresh rpm lockfiles (chore(deps): refresh rpm lockfiles opendatahub-io/openshell#140)af6604a6feat(ocsf): validate OCSF events against exported JSON Schemas (feat(ocsf): validate OCSF events against exported JSON Schemas NVIDIA/OpenShell#5019)f88b5819fix(ocsf): address follow-ups from the fix(ocsf): emit schema-conformant OCSF 1.8 events NVIDIA/OpenShell#4288 review (fix(ocsf): address follow-ups from the #4288 review NVIDIA/OpenShell#5020)677875fdfix(build): restore Windows lint and trim the image build context (fix(build): restore Windows lint and trim the image build context NVIDIA/OpenShell#5021)2fb8d78afix(ci): keep Release Dev publishing when the snap upload or a Go tag breaks it (fix(ci): keep Release Dev publishing when the snap upload or a Go tag breaks it NVIDIA/OpenShell#5018)c5850d75feat(sdk): route Rust SDK exec to the sandbox owner replica (feat(sdk): route Rust SDK exec to the sandbox owner replica NVIDIA/OpenShell#4790)def7da87fix(ocsf): emit schema-conformant OCSF 1.8 events (fix(ocsf): emit schema-conformant OCSF 1.8 events NVIDIA/OpenShell#4288)6188420echore(deps): bump rustls (chore(deps): bump rustls from 0.23.45 to 0.23.46 in /examples/supervisor-middleware-content-guard NVIDIA/OpenShell#4998)ff1f8ff5fix(network): align destination checks for direct connections (fix(network): align destination checks for direct connections NVIDIA/OpenShell#5004)33138516feat(tests): add the tmachine Session API and run a conformance smoke test on tmachine (feat(tests): add the tmachine Session API and run a conformance smoke test on tmachine NVIDIA/OpenShell#4773)21be3493fix(e2e): make shared supervisor harness work with gateway TLS (fix(e2e): make shared supervisor harness work with gateway TLS NVIDIA/OpenShell#4984)8f469b10fix(odh): avoid redundant aggregate task wiringMerging
GitHub automerge is enabled for this pull request once required checks pass.