Repository navigation
Automated Sync from main to stable - #40
Open
rhods-devops-app[bot] wants to merge 212 commits into
Open
rhods-devops-app[bot] wants to merge 212 commits into
rhods-devops-app[bot] wants to merge 212 commits into
Conversation
* test(conformance): run driver suites with cargo Signed-off-by: Evan Lezar <elezar@nvidia.com> * fix(e2e): resolve conformance CLI path before cargo tests Signed-off-by: Evan Lezar <elezar@nvidia.com> * refactor(conformance): remove unused CLI scenario APIs Signed-off-by: Evan Lezar <elezar@nvidia.com> --------- Signed-off-by: Evan Lezar <elezar@nvidia.com>
* feat(providers): support stable credential placeholders Add credentials[].stable_placeholder so a running client keeps using an externally rotated static credential through the reference it already holds. Squashed replay of the earlier four commits onto upstream main 71c3cd9; re-derives the frozen schema fingerprints and adapts the provider environment revision test to the added capability argument. Signed-off-by: Shiju <shiju@nvidia.com> * fix(e2e): apply stable-placeholder supervisor image override Use ManagedGateway's per-process supervisor image override so the fixture CA reaches the supervisor when runtime image environment variables take precedence over gateway TOML. Restore the wrapper's original image after each test, following the provider-readiness fixture. Signed-off-by: Shiju <shiju@nvidia.com> * test(server): update public RPC schema fingerprint after merging main Signed-off-by: Shiju <shiju@nvidia.com> --------- Signed-off-by: Shiju <shiju@nvidia.com>
…4338) Signed-off-by: John Myers <johntmyers@users.noreply.github.com> Co-authored-by: John Myers <johntmyers@users.noreply.github.com>
* feat(sdk/ts): add createdAtMs to SandboxRef Signed-off-by: Eric Curtin <eric.curtin@docker.com> * docs(sdk/ts): document createdAtMs on SandboxRef Signed-off-by: Eric Curtin <eric.curtin@docker.com> --------- Signed-off-by: Eric Curtin <eric.curtin@docker.com>
…IDIA#4395) The stop path wrote Stopping and Stopped with a single compare-and-swap. In HA deployments every replica applies compute driver watch events for the terminating runtime without the per-replica lifecycle gate, so a watch write landing between the re-read and the CAS failed the stop RPC with "update sandbox lifecycle failed due to concurrent modification" and left the sandbox in Stopping. Retry both writes on PersistenceError::Conflict up to STOP_PHASE_CAS_RETRY_LIMIT, re-reading the sandbox on each attempt. The Stopping write re-runs the stop preconditions and the name check; the Stopped write proceeds only while the record is still Stopping, returns an already Stopped record as-is, and aborts on any other phase. Gateway startup recovery of retained Stopping sandboxes now shares the same helper instead of writing against its pre-driver snapshot. Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
Signed-off-by: Oliver Calder <oliver.calder@canonical.com>
* feat(python): expose sandbox status conditions in the SDK Add SandboxConditionRef and surface status.conditions on SandboxStatusRef and SandboxRef. Callers need condition reasons and transition times to time terminal transitions and explain failures that happen before the main process starts, without reading the raw proto. Signed-off-by: Max Dubrinsky <mdubrinsky@nvidia.com> * test(python): use real gateway condition values in conditions fixtures Signed-off-by: Max Dubrinsky <mdubrinsky@nvidia.com> --------- Signed-off-by: Max Dubrinsky <mdubrinsky@nvidia.com>
* fix(python): close client when Sandbox entry fails Signed-off-by: Eric Curtin <eric.curtin@docker.com> * test(python): share client patch helper Signed-off-by: Eric Curtin <eric.curtin@docker.com> --------- Signed-off-by: Eric Curtin <eric.curtin@docker.com>
* fix(network): validate chunked message framing Signed-off-by: Adrien Langou <alangou@nvidia.com> * fix(network): preserve chunk extension whitespace Signed-off-by: Adrien Langou <alangou@nvidia.com> --------- Signed-off-by: Adrien Langou <alangou@nvidia.com>
…NVIDIA#2810) Spell out that auto-closed PRs keep their discussion and can be reopened or replaced, separate DCO sign-off from cryptographic commit signing, and say to mark PR checklist items complete only after verification. Signed-off-by: politerealism <burdcat17@gmail.com>
Signed-off-by: Eric Curtin <eric.curtin@docker.com>
* fix(server): return SQLite write versions atomically Use RETURNING instead of a follow-up read. Signed-off-by: Eric Curtin <eric.curtin@docker.com> * refactor(server): dedupe sqlite write helpers Signed-off-by: Eric Curtin <eric.curtin@docker.com> --------- Signed-off-by: Eric Curtin <eric.curtin@docker.com>
…#4157) Signed-off-by: Eric Curtin <eric.curtin@docker.com>
* fix(cli): preserve external TLS for SSH forwarding Resolve the external scheme together with its authority when replacing an internal bind address with the registered gateway endpoint. Ported from NVIDIA#3714. Fixes: NVIDIA#3674 Signed-off-by: Daneyon Hansen <daneyon.hansen@solo.io> * docs(kubernetes): explain TLS SSH relay endpoint Signed-off-by: Daneyon Hansen <daneyon.hansen@solo.io> --------- Signed-off-by: Daneyon Hansen <daneyon.hansen@solo.io>
Signed-off-by: Yuedong Wu <dwcn22@outlook.com>
…NVIDIA#3910) The runtimes page examples omit the [openshell] version = 2 table, so a snippet copied into a new gateway.toml fails preflight with missing_version. Add the table to the first example and state that the remaining examples show only the tables they change. Closes NVIDIA#3881 Signed-off-by: fede-kamel <fkamelhar@gmail.com>
Signed-off-by: Eric Curtin <eric.curtin@docker.com>
NVIDIA#4081) * test(tmachine): add K3s PostgreSQL and mTLS conformance installer Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * fix(tmachine): reach the HA TLS gateway through its ClusterIP Drop the port-forward restart removed by the ClusterIP change, resolve the Service DNS name covered by the server certificate to the ClusterIP, bound each authenticated API wait attempt, and collect diagnostics from every gateway Pod. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * ci(tmachine): run K3s PostgreSQL and mTLS conformance Add the k3s-ha-tls installer to every core conformance matrix so Branch E2E, Release Dev, Release Tag, and manual Integration Tests cover three gateway replicas sharing PostgreSQL behind mTLS. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * refactor(tmachine): rename k3s-ha-tls installer to k3s-ha TLS is part of the supported HA configuration once gateway replicas share PostgreSQL, so the installer name only needs to distinguish HA from the single-replica k3s lane. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * refactor(tmachine): install K3s HA in a single Helm rollout Add an optional Helm values overlay to the K3s installer so the k3s-ha installer stages PostgreSQL first and installs the three-replica TLS gateway directly, instead of installing a plaintext gateway and upgrading. Drop the redundant unauthenticated-users override and the install-time API wait, which the conformance playbook already performs. Share K3s installer inputs in the tmachine configuration. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * fix(tmachine): make K3s HA staging rerunnable and wait for PostgreSQL Apply the OpenShell namespace instead of creating it so the staging play tolerates an existing namespace, and wait for the PostgreSQL rollout so gateway Pods do not start crash-looping against a missing database. Reflow and pluralize the K3s lane notes in CI.md. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> --------- Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
Closes NVIDIA#2401 Signed-off-by: Jim Meyer <jimeyer@nvidia.com>
Remove blanket review routing while preserving the explicit owners of the vouch list, workflows, actions, approval helpers, and SBOM check already on main. Signed-off-by: Jim Meyer <jimeyer@nvidia.com>
…4316) Signed-off-by: Gordon Sim <gsim@redhat.com>
* fix(driver-mxc): pass gateway name to mocked backend Refs NVIDIA#4191 Signed-off-by: Philippe Martin <phmartin@redhat.com> * fix(windows): use native executable paths in network test fixtures Signed-off-by: Philippe Martin <phmartin@redhat.com> --------- Signed-off-by: Philippe Martin <phmartin@redhat.com>
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 10.0.0 to 10.0.1. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@ae62891...20cfd1b) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 10.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: letv1nnn <letv1n2007@icloud.com>
* fix(server): audit proposal rejections in the gateway Signed-off-by: Eric Curtin <eric.curtin@docker.com> * fix(ocsf): show rejection details in CONFIG shorthand Signed-off-by: Eric Curtin <eric.curtin@docker.com> * fix(server): attribute rejection audits to operator principals Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com> --------- Signed-off-by: Eric Curtin <eric.curtin@docker.com> Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com> Co-authored-by: John Myers <9696606+johntmyers@users.noreply.github.com>
Signed-off-by: Taylor Mutch <taylormutch@gmail.com>
Evaluate issue acceptance using trusted default-branch code and the PR author's repository permissions. Report the native workflow job result, protect enforcement files, and align PR creation and review guidance. Closes NVIDIA#4339 Signed-off-by: Evan Lezar <elezar@nvidia.com>
The VM runtime scripts sourced pins.env optionally and duplicated the LIBKRUN_REF and UMOCI_VERSION defaults, so every bump had to update the same value in several files. Require pins.env, drop the duplicated defaults, and fail on an invalid LIBKRUN_REF instead of silently building upstream HEAD. Environment overrides still take precedence through the defaults in pins.env. Signed-off-by: Florent Benoit <fbenoit@redhat.com>
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
…RKDIR (NVIDIA#3931) * test(oci): share OCI image checks across Docker and Podman Add an oci-image feature testsuite that runs against installed artifacts. It covers custom WORKDIR placement, image content and ownership, workspace writes from the main process and exec, file transfer including directory-merge upload, OCI user identity, the managed /sandbox fallback, and rejection of an unwritable WORKDIR. CI runs the suite on the Docker rootful, Podman rootful, and Podman rootless tmachine guests. Replace the Docker-only custom_image e2e with the shared suite. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> Signed-off-by: Evan Lezar <elezar@nvidia.com> * test(oci): require WorkspaceValidationFailed and cover image USER fallback The unwritable WORKDIR scenario now requires the WorkspaceValidationFailed reason, so unrelated provisioning failures cannot pass it. The numeric USER scenario supplies a policy without a process section, so the image USER is the only source of the sandbox identity. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> Signed-off-by: Evan Lezar <elezar@nvidia.com> * test(podman): leave shared OCI identity checks to the oci-image suite The oci-image feature suite covers the sandbox identity seen by the main process and sandbox exec on Docker and Podman. The Podman e2e keeps the checks only it can make: the pinned image ID and the isolated workload/supervisor container pair. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> Signed-off-by: Evan Lezar <elezar@nvidia.com> * test(oci): accept existing workspace rejection diagnostics Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> Signed-off-by: Evan Lezar <elezar@nvidia.com> * test(oci): fix cleanup ordering and restore coverage parity Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> Signed-off-by: Evan Lezar <elezar@nvidia.com> * test(oci): remove migrated legacy workspace helpers and checks Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * fix(drivers): report rejected OCI working directories as WorkspaceValidationFailed The supervisor exits with the reserved status when the sandbox rejects the image working directory. Docker maps that exit during readiness and monitoring and records it before removing the supervisor container, and Podman maps the supervisor companion's exit instead of the workload's. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * test(oci): require WorkspaceValidationFailed for unwritable WORKDIR Unrelated provisioning failures can no longer pass the rejection scenario. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * fix(oci): keep exit 78 reserved and report fixed workspace diagnostics The supervisor no longer passes on a workload's own exit status 78, so drivers cannot misreport it as a workspace rejection after a runtime restart. The rejection is recognized once at agent start and carried as a typed error. Docker reports the same fixed condition message as Podman and logs the supervisor output instead, and its monitor removes the supervisor container when a stop overlaps diagnostics collection. The OCI image suite registers images for cleanup only after they build. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * refactor(oci): simplify workspace failure handling and OCI image tests Report a recorded Docker workspace rejection once, where supervisor readiness fails, and match its fixed message exactly. Read the Podman supervisor exit status once per inspection. Choose the supervisor exit status in one function and derive the workspace error type. The OCI image suite shares step helpers, checks that a custom workspace does not also create /sandbox, and its playbook waits for a connected gateway and collects failure diagnostics through the shared role. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * test(oci): replace podman_oci_identity with shared and driver suite checks The oci-image feature suite now checks, on Docker and Podman, that the image user has no capabilities, has no_new_privs set, and cannot read the sandbox control credentials, and that a custom WORKDIR is not a mount. The checks that need container inspection (pinned image ID, network=none, supervisor user and capabilities) move to a small test in the Podman driver suite. Remove the legacy podman_oci_identity e2e test. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * test(oci): keep podman_oci_identity for Podman-only isolation checks Restore the Podman e2e test removed in the previous commit and drop only the checks the shared oci-image suite now runs on Docker and Podman: workload capabilities, no_new_privs, credential readability, and the workspace and /sandbox mount checks. The pinned image ID and the workload/supervisor isolation checks stay, as does the Podman driver suite unchanged. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * refactor(oci): simplify workspace failure reporting and OCI image suite Carry the Docker control supervisor's failure reason in a typed error instead of matching status text, build the fixed workspace message where the wait result is classified, and drop the fake Docker server test. Inline image cleanup ordering in the suite, read the container engine once, share sandbox naming, and stop granting a literal /sandbox in the image identity policy. Add e2e:oci-image mise tasks and use them from the ARM64 Docker workflow and TESTING.md. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * test(oci): move shared container checks into the OCI image suite Inspect the containers the driver created through the gateway's engine in the shared suite: the workload runs the inspected image ID as the OCI identity without a network or supervisor credential mounts, and the supervisor is a separate non-root container. Keep only the Podman-specific supervisor identity and capability checks in podman_oci_identity. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * test(oci): check the workspace rejection reason from sandbox JSON Read the WorkspaceValidationFailed condition reason from sandbox get --output json instead of matching CLI output, and restore the Docker driver's original workspace failure helpers. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * test(oci): capture fixture image identity before sandbox creation Signed-off-by: Evan Lezar <elezar@nvidia.com> --------- Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> Signed-off-by: Evan Lezar <elezar@nvidia.com> Co-authored-by: Evan Lezar <elezar@nvidia.com>
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com> Co-authored-by: red-hat-konflux[bot] <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com> Co-authored-by: red-hat-konflux[bot] <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Keep debug-openshell-cluster identical to upstream so the upstream sync stops conflicting, and move the ODH installer guidance into a midstream-only debug-odh-openshell-install skill. Signed-off-by: Andre Lustosa <alustosa@redhat.com>
…ync-conflict/andre-motta CARRY: fix(skills): move ODH installer guidance out of upstream skill
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
…requirement (NVIDIA#4875) Prior to this change, CONTRIBUTING.md, the PR template, and the create-github-pr skill required every PR except automated dependency updates to close an issue. A maintainer fixing a broken build or flaky tests had to file an issue that only restated the failure the PR already describes. Now, authors with WRITE, MAINTAIN, or ADMIN access may open a PR that only fixes a broken build or flaky tests without a separate issue, and describe the failure in the PR instead. Authors without write access still need an accepted issue; the PR Issue Acceptance workflow already passes write-access authors without checking for linked issues, so it needs no change. The branch naming rule now covers PRs without an issue, and the sync-agent-infra consistency check states the new rule. Signed-off-by: Kris Hicks <khicks@nvidia.com>
Signed-off-by: Gaizka Menendez <277906206+gmenher@users.noreply.github.com>
…4870) * feat(snap): publish prerelease builds to latest/beta channel Signed-off-by: Oliver Calder <oliver.calder@canonical.com> * fixup! feat(snap): publish prerelease builds to latest/beta channel Signed-off-by: Oliver Calder <oliver.calder@canonical.com> * fix(snap): use concurrency group when checking version to publish snap Signed-off-by: Oliver Calder <oliver.calder@canonical.com> --------- Signed-off-by: Oliver Calder <oliver.calder@canonical.com>
* fix(isolation): validate Unix socket paths the same way on every host Prior to this change, SandboxTransport::validate checked Unix socket paths with Path::is_absolute(). On Windows that requires a drive or UNC prefix, so a POSIX path such as /run/backend.sock was rejected as "invalid boundary control transport endpoint". The isolation backend registration work in NVIDIA#3898 added tests that register Unix endpoints in the core registration types, gateway config, gateway config preflight, and supervisor backend setup; all of them failed on the Windows MSVC runners. The Windows test job only runs on PRs labeled test:windows, so the break went unnoticed on main. Unix transport is refused at runtime on non-Unix hosts, so these paths are always POSIX paths regardless of where they are validated. Now, both the core registration validator and the sandbox backend protocol validator use a new openshell_core::paths::is_posix_absolute helper, which applies the POSIX rule (the path starts with '/') on every host. On Unix this matches is_absolute() exactly. Signed-off-by: Kris Hicks <khicks@nvidia.com> * test(supervisor): run baseline write-back cases only on Unix hosts The startup policy write-refusal tests from NVIDIA#3785 rely on enrich_proto_baseline_paths adding the proxy baseline paths (/usr, /tmp, /dev/null, ...) to a policy, which triggers a write-back that the fake gateway then refuses. Enrichment only adds paths that exist on the host. Prior to this change, the tests assumed those paths exist, so on Windows enrichment added nothing, the precondition assertions failed, and the baseline case of permanent_codes_still_exit never saw a write to refuse. Now, the four baseline write-back tests are gated to Unix, and permanent_codes_still_exit checks the image policy upload case on every host and the baseline write-back case only on Unix. Signed-off-by: Kris Hicks <khicks@nvidia.com> * test(server): scale the SQLite concurrent-write test for Windows fsync sqlite_concurrent_writes_return_their_own_resource_version (NVIDIA#4408) runs 8 writers that each make 25 unconditional and 25 version-checked writes against one row of an on-disk WAL database with synchronous=FULL. Writers serialize on the SQLite write lock and wait out sqlx's default 5s busy_timeout. Prior to this change, the per-commit fsync cost on the Windows runners was high enough that a waiting writer starved past that timeout and failed with "database is locked" after about 7s. Now, each writer makes 5 writes on Windows and 25 elsewhere. The test still races every writer on the same row, which is what it checks. Signed-off-by: Kris Hicks <khicks@nvidia.com> * test(server): hold scope-mix locks for wall-clock time, not timer ticks random_scope_mix_never_deadlocks (NVIDIA#4147) runs 64 tasks of 50 random lock operations and holds each operation's locks for 0-2 ms, failing if the mix does not finish within 20s. Prior to this change, the hold was a tokio::time::sleep. Windows timers round a 1 ms sleep up to about 16 ms, and a quarter of the operations take the exclusive global lock, so the serialized holds alone took several seconds and the full mix exceeded the 20s deadline on the Windows runners. Now, occupy yields until a std::time::Instant deadline, so holds last 0-2 ms of wall-clock time on every platform and the deadline means the same thing everywhere. Signed-off-by: Kris Hicks <khicks@nvidia.com> * test(supervisor): run sandbox instance host tests only on Unix hosts The sandbox_instance_host tests added with per-instance supervisor state (NVIDIA#4701) admit hosted instances through SandboxInstanceHost::new, which prepares a private directory per instance. Hosted sandbox instances are Unix-only: on other hosts prepare_private_dir returns "hosted sandbox instances require a Unix host". Prior to this change, the test module still compiled and ran on Windows, so all three tests failed while creating their host. Now, the test module is gated to Unix, and the Unix-only permission check inside one test no longer needs its own cfg attribute. Signed-off-by: Kris Hicks <khicks@nvidia.com> --------- Signed-off-by: Kris Hicks <khicks@nvidia.com>
Signed-off-by: konflux-internal-p02 <170854209+konflux-internal-p02[bot]@users.noreply.github.com> Co-authored-by: konflux-internal-p02[bot] <170854209+konflux-internal-p02[bot]@users.noreply.github.com>
…anches (NVIDIA#4881) Branch Checks never runs on main, so PR mirrors had no main rust-checks cache to restore and each one saved its own. Per-binary release build caches were also saved from every branch. Together they filled the 50 GB cache quota within hours and evicted main's caches. Save per-binary caches only on main, and add a Rust Cache workflow that builds the Branch Checks test targets on each push to main so PRs and merge groups can restore a matching rust-checks cache. Signed-off-by: Kris Hicks <khicks@nvidia.com>
Native gateway builds exhaust the default open-file soft limit. Raise the soft limit to the hard limit (capped) in the shared build environment and apply it from the gateway task scripts. Explicitly read the current soft limit and only raise it when needed. Signed-off-by: Jim Meyer <jimeyer@nvidia.com>
Signed-off-by: Eric Curtin <eric.curtin@docker.com>
…A#4890) The rule against mentioning Claude or other AI agents covered only commits, so harness defaults could still add "Generated with" footers to PR descriptions. Extend it to PR descriptions and issues. Signed-off-by: Jim Meyer <jimeyer@nvidia.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| group: codex-compatibility-${{ inputs.candidate_ref }}-${{ github.run_id }} | ||
| group: codex-release-review | ||
| cancel-in-progress: false | ||
| queue: max |
| cancel-in-progress: true | ||
| group: codex-release-review | ||
| cancel-in-progress: false | ||
| queue: max |
| concurrency: | ||
| group: ${{ inputs.notes-only && format('release-notes-preview-{0}', github.ref) || 'release-stable' }} | ||
| cancel-in-progress: false | ||
| queue: max |
| concurrency: | ||
| group: snap-publish-${{ inputs.upload-channel }}-${{ matrix.arch }} | ||
| cancel-in-progress: false | ||
| queue: max |
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated Sync from main to stable
This PR automatically syncs the
mainbranch to thestablebranch by opening a pull request frommainintostable.Sync Summary
Latest commit:
0b3b3a3dMerge remote-tracking branch 'upstream/main'Total commits to sync: 203
Source:
https://github.com/red-hat-data-services/OpenShell.git@mainTarget:
https://github.com/red-hat-data-services/OpenShell.git@stablePR head:
mainCommits to be synced
0b3b3a3dMerge remote-tracking branch 'upstream/main'b824e91bMerge remote-tracking branch 'upstream/main'1fce5ffaMerge remote-tracking branch 'upstream/main'fd5a55bcchore(deps): refresh rpm lockfiles [SECURITY] (chore(deps): refresh rpm lockfiles [SECURITY] #1)92434dcbtest(windows): repair the Windows MSVC test suite (test(windows): repair the Windows MSVC test suite NVIDIA/OpenShell#4862)72e4eaa8feat(snap): publish prerelease builds to latest/beta channel (feat(snap): publish prerelease builds to latest/beta channel NVIDIA/OpenShell#4870)8244f739Merge remote-tracking branch 'upstream/main'e188cadcMerge remote-tracking branch 'upstream/main'b504c301ci(security): allow DRS version references in zizmor5bfe2fbcdocs(contributing): exempt build and flaky-test fixes from the issue requirement (docs(contributing): exempt build and flaky-test fixes from the issue requirement NVIDIA/OpenShell#4875)bc4c8f00fix(deps): update ctutils to resolve timing advisory (fix(deps): update ctutils to resolve timing advisory NVIDIA/OpenShell#4867)38fc5c26Merge pull request CARRY: fix(skills): move ODH installer guidance out of upstream skill opendatahub-io/openshell#124 from opendatahub-io/fix/skill-sync-conflict/andre-motta6b32278bCARRY: fix(skills): move ODH installer guidance out of upstream skill60e6434achore(deps): refresh rpm lockfiles (chore(deps): refresh rpm lockfiles opendatahub-io/openshell#120)2d7a6f85chore(deps): refresh rpm lockfiles [SECURITY] (chore(deps): refresh rpm lockfiles [SECURITY] opendatahub-io/openshell#122)82a187cdMerge remote-tracking branch 'upstream/main'0e010064Merge pull request CARRY: test(odh): qualify managed workspace SCC identity isolation opendatahub-io/openshell#114 from 2000krysztof/test/odh-managed-workspace-scc-isolation5db572a9Merge remote-tracking branch 'upstream/main'6386a44cchore(deps): refresh rpm lockfiles [SECURITY] (chore(deps): refresh rpm lockfiles [SECURITY] opendatahub-io/openshell#119)eb0bdc9aMerge remote-tracking branch 'upstream/main'9a85667dfeat(kubernetes): host sandboxes on the shared supervisor (feat(kubernetes): host sandboxes on the shared supervisor NVIDIA/OpenShell#4702)07b7a74bfix(server): bound the provisioning-deadline scan's lock wait (fix(server): bound the provisioning-deadline scan's lock wait NVIDIA/OpenShell#4549)eec00ad4fix(podman): Increase the API timeout (Increase the podman driver's API timeout NVIDIA/OpenShell#4820)c018a045Merge remote-tracking branch 'upstream/main'132c5823docs(extensibility): document external compute driver setup (docs(extensibility): document external compute driver setup NVIDIA/OpenShell#4826)78376bd0fix(installer): resolve the gateway config dir like the CLI does (fix(installer): resolve the gateway config dir like the CLI does NVIDIA/OpenShell#4063)ea13dfcerefactor(supervisor): isolate state per sandbox instance (refactor(supervisor): isolate state per sandbox instance NVIDIA/OpenShell#4701)9152b6e4fix(vm): boot a digest-pinned image from the cache without a registry call (fix(vm): boot a digest-pinned image from the cache without a registry call NVIDIA/OpenShell#4582)cb42f5d9fix(snap): use openshell-prover instead of openshell.prover (fix(snap): use openshell-prover instead of openshell.prover NVIDIA/OpenShell#4835)fac82327test(testkit): add the testkit library for end-to-end suites (test(testkit): add the testkit library for end-to-end suites NVIDIA/OpenShell#4724)fe2eadf3Merge remote-tracking branch 'upstream/main'c2830aa0Merge remote-tracking branch 'upstream/main'7bbf1bfaMerge remote-tracking branch 'upstream/main'39d95b42chore(e2e): remove obsolete OpenShift sandbox SCC grant (chore(e2e): remove obsolete OpenShift sandbox SCC grant NVIDIA/OpenShell#4823)86e520a7Merge remote-tracking branch 'upstream/main'1a3330f6Merge remote-tracking branch 'upstream/main'0a516523chore(server): remove unused server macros crate (chore(server): remove unused server macros crate NVIDIA/OpenShell#4818)725d5c6fMerge remote-tracking branch 'upstream/main'029fda68refactor(cli): use Rust SDK transport (refactor(cli): use Rust SDK transport NVIDIA/OpenShell#4817)029ff74bMerge remote-tracking branch 'upstream/main'93508667Merge remote-tracking branch 'upstream/main'7bfc460cMerge remote-tracking branch 'upstream/main'1d880c9afix(examples): repair multi-agent notepad launch (fix(examples): repair multi-agent notepad launch NVIDIA/OpenShell#4807)20cb306dperf(docker): slow steady-state supervisor healthcheck (perf(docker): slow steady-state supervisor healthcheck NVIDIA/OpenShell#4802)4b7486e7test(auth): share fixtures for gateway audit event tests (test(auth): share fixtures for gateway audit event tests NVIDIA/OpenShell#4778)1846b2f0Merge pull request CARRY: fix(odh): restore upstream skill edits and SPDX header check opendatahub-io/openshell#118 from opendatahub-io/fix/sync-skill-license-headers/andre-motta33149c18CARRY: fix(odh): restore upstream skill edits and SPDX header check229382e5docs(sandbox): align workload image requirements with current runtime (docs(sandbox): align workload image requirements with current runtime NVIDIA/OpenShell#3967)5b429171Merge remote-tracking branch 'upstream/main'19ae2b7etest(cli): retry forward tests when ssh loses the port after the check (test(cli): retry forward tests when ssh loses the port after the check NVIDIA/OpenShell#4799)a4c27f9crefactor(auth): share audit helpers for gateway denials and rejections (refactor(auth): share audit helpers for gateway denials and rejections NVIDIA/OpenShell#4777)2fd802effeat(skills): add release-captain skill for the weekly release cadence (feat(skills): add release-captain skill for the weekly release cadence NVIDIA/OpenShell#4435)e7dc051bchore(sdk): update Vite to 8.1.6 (chore(sdk): update Vite to 8.1.6 NVIDIA/OpenShell#4792)220a1d5cchore(ci): use GPT-6.1 Sol for compatibility review (chore(ci): use GPT-6.1 Sol for compatibility review NVIDIA/OpenShell#4796)321b93a8feat(auth): emit OCSF events for SSH session and sandbox token checks (feat(auth): emit OCSF events for SSH session and sandbox token checks NVIDIA/OpenShell#4762)a56614f5CARRY: test(odh): qualify managed workspace SCC identity isolationceecf027fix(deps): update webpki to distrust compromised emSign CAs (fix(deps): update webpki to distrust compromised emSign CAs NVIDIA/OpenShell#4794)95dc7868Merge remote-tracking branch 'upstream/main'469e16d4chore(deps): refresh rpm lockfiles (chore(deps): refresh rpm lockfiles opendatahub-io/openshell#116)f8533ec4chore(deps): refresh rpm lockfiles [SECURITY] (chore(deps): refresh rpm lockfiles [SECURITY] opendatahub-io/openshell#115)d2239437fix(helm): allow shared supervisor SCC-assigned IDs (fix(helm): allow shared supervisor SCC-assigned IDs NVIDIA/OpenShell#4785)837fdfdcfix(sdk/go): accept CLI-compatible gateway names (fix(sdk/go): accept CLI-compatible gateway names NVIDIA/OpenShell#4767)72ab4dd9feat(kubernetes): deploy shared supervisor mode (feat(kubernetes): deploy shared supervisor mode NVIDIA/OpenShell#4695)bd0edb19refactor(tests): move tmachine support files under tests/tmachine (refactor(tests): move tmachine support files under tests/tmachine NVIDIA/OpenShell#4726)c7dd586bci(compatibility): review driver-facing executable flags (ci(compatibility): review driver-facing executable flags NVIDIA/OpenShell#4644)2071796achore(deps): bump certifi from 2026.5.20 to 2026.10.19 (chore(deps): bump certifi from 2026.5.20 to 2026.10.19 NVIDIA/OpenShell#4764)a2b8022efix(python): ship credential driver protocol bindings (fix(python): ship credential driver protocol bindings NVIDIA/OpenShell#4760)465324a8fix(vm): populate an empty guest /etc/hosts with loopback names (fix(vm): populate an empty guest /etc/hosts with loopback names NVIDIA/OpenShell#4182)f7e37af1ci(release): tag Go SDK module on stable releases (ci(release): tag Go SDK module on stable releases NVIDIA/OpenShell#4262)6df42539docs(providers): close stdin in the openrouter smoke test (docs(providers): close stdin in the openrouter smoke test NVIDIA/OpenShell#3907)915a5d15feat(auth): emit OCSF logon events for accepted gateway credentials (feat(auth): emit OCSF logon events for accepted gateway credentials NVIDIA/OpenShell#4761)0f5b4f0fci(release): reuse the promoted prerelease's release notes preview (ci(release): reuse the promoted prerelease's release notes preview NVIDIA/OpenShell#4754)ea265a2fdocs(cli): say --upload cannot take a command (docs(cli): say --upload cannot take a command NVIDIA/OpenShell#4502)32f02644feat(sandbox): initiate supervisor connections across compute drivers (feat(sandbox): initiate supervisor connections across compute drivers NVIDIA/OpenShell#4656)b182255dMerge remote-tracking branch 'upstream/main'a24340befeat(auth): emit OCSF events for gateway authorization denials (feat(auth): emit OCSF events for gateway authorization denials NVIDIA/OpenShell#4728)500132b4Merge pull request test(odh): exclude flaky tier1 cases and name xunit reports opendatahub-io/openshell#113 from Bobbins228/codex/odh-e2e-tier-exclusions-xunit92f3a41bci: update setup-buildx action to v4.4.1 (ci: update setup-buildx action to v4.4.1 NVIDIA/OpenShell#4741)d97709fbchore(deps): update Mermaid lint dependencies (chore(deps): update Mermaid lint dependencies NVIDIA/OpenShell#4743)30492bc5fix(deps): update russh to 0.64.1 (fix(deps): update russh to 0.64.1 NVIDIA/OpenShell#4742)bdb956f2fix(ci): grant prerelease publish pull request read permission (fix(ci): grant prerelease publish pull request read permission NVIDIA/OpenShell#4747)ddbaa297CARRY: test(odh): exclude tier1 cases and name xunit reports292c9c8dfix(vm): flush guest filesystem before a planned sandbox stop (fix(vm): flush guest filesystem before a planned sandbox stop NVIDIA/OpenShell#4195)7417f753fix(ci): wait for controller reconciliation before Kubernetes conformance (fix(ci): wait for controller reconciliation before Kubernetes conformance NVIDIA/OpenShell#4676)d4ad1bbdfix(snap): only enable gateway user service for one user (fix(snap): only enable gateway user service for one user NVIDIA/OpenShell#4615)d2a35084fix(server): reject reserved annotation keys (fix(server): reject reserved annotation keys NVIDIA/OpenShell#4626)2798108bfix(ocsf): report https scheme for TLS-terminated requests (fix(ocsf): report https scheme for TLS-terminated requests NVIDIA/OpenShell#4684)b01dd625fix(server): warn on dangling provider refs at startup (fix(server): warn on dangling provider refs at startup NVIDIA/OpenShell#4661)50b7fcd0ci(release): generate PR-based stable release notes (ci(release): generate PR-based stable release notes NVIDIA/OpenShell#4654)1cb9ef8arefactor(crypto): introduce a generic interface for crypto libraries and refactor AWS-LC (refactor(crypto): introduce a generic interface for crypto libraries and refactor AWS-LC NVIDIA/OpenShell#3351)834b14f7ci(helm): retry chart pushes when GHCR briefly misses a new manifest (ci(helm): retry chart pushes when GHCR briefly misses a new manifest NVIDIA/OpenShell#4578)c38e2799ci(release): list failed jobs in pre-release failure notices (ci(release): list failed jobs in pre-release failure notices NVIDIA/OpenShell#4719)0bfa1e8bfix(deps): update pytest to 9.0.3 (fix(deps): update pytest to 9.0.3 NVIDIA/OpenShell#4713)740c8fe2fix(deps): patch TypeScript test dependencies (fix(deps): patch TypeScript test dependencies NVIDIA/OpenShell#4712)1a5220c3fix(deps): update setuptools to 83.0.0 (fix(deps): update setuptools to 83.0.0 NVIDIA/OpenShell#4711)b4cf1ddbchore(deps): accept build-only zip advisories (chore(deps): accept build-only zip advisories NVIDIA/OpenShell#4710)b1cfc917ci(release): promote qualified prereleases to stable (ci(release): promote qualified prereleases to stable NVIDIA/OpenShell#4611)55bf7864feat(tmachine): build local RPM artifacts (feat(tmachine): build local RPM artifacts NVIDIA/OpenShell#4651)b58e24c9fix(supervisor): report plaintext scheme to middleware (fix(supervisor): report plaintext scheme to middleware NVIDIA/OpenShell#4397)fdfbf84ffix(ocsf): report the required device.os.type_id (fix(ocsf): report the required device.os.type_id NVIDIA/OpenShell#4677)Merging
GitHub automerge is enabled for this pull request once required checks pass.