Automated Sync from main to stable - #16
Merged
Merged
Conversation
* test(python): synchronize interactive exec TTY readiness Wait for the complete readiness marker before streaming stdin so PTY echo cannot split the separately written TTY flags. Preserve pipe stream separation and verify consumed stdin and both output sentinels in TTY mode. Fixes NVIDIA#4075 Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * test(python): reuse interactive exec readiness marker Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> --------- Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
* fix(sandbox): restrict provider file mode (fixes NVIDIA#4091) Signed-off-by: Drew Newberry <anewberry@nvidia.com> * refactor(sandbox): set provider file mode with safe API Signed-off-by: Drew Newberry <anewberry@nvidia.com> --------- Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* fix(ci): prepare Nix development shells in setup-nix Signed-off-by: Evan Lezar <elezar@nvidia.com> * fix(ci): retry Nix builds before executing apps once Signed-off-by: Evan Lezar <elezar@nvidia.com> --------- Signed-off-by: Evan Lezar <elezar@nvidia.com> Co-authored-by: Evan Lezar <elezar@nvidia.com>
Signed-off-by: Oliver Calder <oliver.calder@canonical.com> Signed-off-by: Evan Lezar <elezar@nvidia.com>
…IDIA#4078) Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com> Co-authored-by: red-hat-konflux[bot] <126015336+red-hat-konflux[bot]@users.noreply.github.com>
… docker tag to v9.8-1790838157 (opendatahub-io#70) Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com> Co-authored-by: red-hat-konflux[bot] <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Upstream renamed the bundled-z3 Cargo feature to vendored-z3 in NVIDIA#3275, and the last upstream sync brought that into main. Dockerfile.konflux.gateway still requested bundled-z3, so cargo rejected the feature set and every gateway build failed. The new feature maps to the same z3-sys vendored build, so the resulting binary is unchanged. Signed-off-by: Emilien Macchi <emacchi@redhat.com>
…gateway-vendored-z3 CARRY: fix(konflux): build gateway with vendored-z3 feature (RHAI-4525)
Signed-off-by: Adrien Langou <alangou@nvidia.com>
…VIDIA#3957) Signed-off-by: Adrien Langou <alangou@nvidia.com>
…DIA#3973) * fix(providers): restore supervisor-backed GCP metadata discovery Relay the reserved metadata endpoint to the supervisor and restore project, account, and placeholder token responses from live provider state. Cover Google SDK discovery and repeated refresh with provider E2E tests. Closes NVIDIA#3860 Signed-off-by: Philippe Martin <phmartin@redhat.com> * fix(providers): preserve default metadata account without an email Use the default account identifier when the optional service account email is missing or empty. Cover repeated SDK refresh for missing, empty, and configured email values with distinct providers for parallel E2E execution. Signed-off-by: Philippe Martin <phmartin@redhat.com> * test(sandbox): fix metadata relay lint and timeout Signed-off-by: Philippe Martin <phmartin@redhat.com> --------- Signed-off-by: Philippe Martin <phmartin@redhat.com>
* feat(helm): add sandbox UID and GID values Closes NVIDIA#2697 Signed-off-by: Eric Curtin <eric.curtin@docker.com> * fix(helm): reject boolean sandbox UID and GID Signed-off-by: Eric Curtin <eric.curtin@docker.com> --------- Signed-off-by: Eric Curtin <eric.curtin@docker.com>
RHAI-4526: Remove the obsolete Z3 source artifact and build override now that the locked z3-sys uses z3-src. Signed-off-by: aipcc-bot <aipcc-bot@redhat.com>
…VIDIA#3507) The release tarball ships an unsigned binary that fails at runtime when Hypervisor.framework rejects the caller. Sign with the existing entitlements plist during the build, before artifact upload. Closes NVIDIA#3506 Signed-off-by: Florent Benoit <fbenoit@redhat.com>
…VIDIA#4114) * ci: pin CI images by digest and add native architecture smoke checks Signed-off-by: Adrien Langou <alangou@nvidia.com> * docs: resolve CI monitoring guidance conflict with main Signed-off-by: Adrien Langou <alangou@nvidia.com> --------- Signed-off-by: Adrien Langou <alangou@nvidia.com>
…-4526 RHAI-4526: fix(konflux): remove unused gateway Z3 prefetch
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
Upstream issue 3957 (see commit 36819f4) makes uploads fail closed when Git repository discovery or filtering fails. CLI image installs git-core only in its builder. The separate runtime cannot run git rev-parse, so default uploads fail even for ordinary directories outside a Git work tree. Install git-core in the runtime using the existing prefetched RPM closure and clarify its build/runtime role in rpms.in.yaml. Run git --version as the final non-root user so image builds fail if Git is unavailable. Fixes: RHAI-4864 Co-authored-by: GPT-6.1 Sol <noreply@openai.com> Signed-off-by: Martin Prpič <mprpic@redhat.com>
…maker/main/lock-file-maintenance-vulnerability chore(deps): refresh rpm lockfiles [SECURITY]
…4-cli-runtime-git CARRY: fix(konflux): install Git in the CLI runtime
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
11 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated Sync from main to stable
This PR automatically syncs the
mainbranch to thestablebranch by opening a pull request frommainintostable.Sync Summary
Latest commit:
57dc6be0Merge remote-tracking branch 'upstream/main'Total commits to sync: 32
Source:
https://github.com/red-hat-data-services/OpenShell.git@mainTarget:
https://github.com/red-hat-data-services/OpenShell.git@stablePR head:
mainCommits to be synced
57dc6be0Merge remote-tracking branch 'upstream/main'6205f37aMerge remote-tracking branch 'upstream/main'6420ac25Merge remote-tracking branch 'upstream/main'7fceee08Merge pull request CARRY: fix(konflux): install Git in the CLI runtime opendatahub-io/openshell#75 from opendatahub-io/fix/RHAI-4864-cli-runtime-gitfec36a08Merge pull request chore(deps): refresh rpm lockfiles [SECURITY] opendatahub-io/openshell#68 from opendatahub-io/konflux/mintmaker/main/lock-file-maintenance-vulnerability7145dafcCARRY: fix(konflux): install Git in the CLI runtimeec49209dfix(providers): stabilize provider environment revisions (fix(providers): stabilize provider environment revisions NVIDIA/OpenShell#4122)24220bd0Merge pull request RHAI-4526: fix(konflux): remove unused gateway Z3 prefetch opendatahub-io/openshell#74 from opendatahub-io/autofix/rhai-4526046fd2a0ci: pin CI images by digest and add native architecture smoke checks (ci: pin CI images by digest and add native architecture smoke checks NVIDIA/OpenShell#4114)6da17e8eMerge remote-tracking branch 'upstream/main'9d6e4b34Merge remote-tracking branch 'upstream/main'8e9136bbfix(vm): codesign macOS driver-vm with hypervisor entitlement in CI (ci(vm): codesign macOS driver-vm with hypervisor entitlement in CI NVIDIA/OpenShell#3507)aa832094fix(konflux): remove unused gateway Z3 prefetcha48920acfeat(helm): add sandbox UID and GID values (feat(helm): add sandbox UID and GID values NVIDIA/OpenShell#3947)f7273e48fix(providers): restore supervisor-backed GCP metadata discovery (fix(providers): restore supervisor-backed GCP metadata discovery NVIDIA/OpenShell#3973)36819f47fix(cli): stop uploads when Git filtering fails or selects no files (fix(cli)!: stop uploads when Git filtering fails or selects no files NVIDIA/OpenShell#3957)88afd36dfix(deps): upgrade russh to address Dependabot alert 40 (fix(deps): upgrade russh to address Dependabot alert 40 NVIDIA/OpenShell#4116)2ea0abc1Merge pull request CARRY: fix(konflux): build gateway with vendored-z3 feature (RHAI-4525) opendatahub-io/openshell#72 from opendatahub-io/fix-konflux-gateway-vendored-z3769e15acCARRY: fix(konflux): build gateway with vendored-z3 feature513e3d9echore(deps): update registry.access.redhat.com/ubi9/nodejs-24-minimal docker tag to v9.8-1790838157 (chore(deps): update registry.access.redhat.com/ubi9/nodejs-24-minimal docker tag to v9.8-1790838157 opendatahub-io/openshell#70)4ceb6780chore(deps): refresh rpm lockfiles (chore(deps): refresh rpm lockfiles opendatahub-io/openshell#71)5d6b3b81fix(kubernetes): serialize lifecycle cleanup with sandbox restart (fix(kubernetes): serialize lifecycle cleanup with sandbox restart NVIDIA/OpenShell#4078)bc15ead6Merge remote-tracking branch 'upstream/main'6e865df3feat(snap): ship the standalone prover binary in the snap (feat(snap): ship the standalone prover binary in the snap NVIDIA/OpenShell#3717)6048bed3fix(ci): retry Nix shell and app dependency preparation (fix(ci): retry Nix shell and app dependency preparation NVIDIA/OpenShell#4066)6a8389e8Merge remote-tracking branch 'upstream/main'f006d07cMerge remote-tracking branch 'upstream/main'8719fc9ffix(sandbox): restrict provider file mode (fix(sandbox): restrict provider file mode NVIDIA/OpenShell#4093)79f8537fMerge remote-tracking branch 'upstream/main'd20a711achore(deps): refresh rpm lockfiles [SECURITY]c70a2fe0Merge remote-tracking branch 'upstream/main'76cfd0e3test(python): synchronize interactive exec TTY readiness (test(python): synchronize interactive exec TTY readiness NVIDIA/OpenShell#4076)Merging
GitHub automerge is enabled for this pull request once required checks pass.