Skip to content

Commit 9461d37

Browse files
committed
Merge remote-tracking branch 'upstream/main'
2 parents c624fcd + ebaebec commit 9461d37

File tree

109 files changed

+2306
-118520
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

109 files changed

+2306
-118520
lines changed

.github/workflows/build-notebooks-TEMPLATE.yaml

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -90,17 +90,28 @@ jobs:
9090
env:
9191
GIT_CRYPT_KEY: ${{ secrets.GIT_CRYPT_KEY }}
9292

93+
# https://console.redhat.com/insights/connector/activation-keys
94+
# This runs slower than storing the entitlement certificates with git-crypt,
95+
# but on the other hand, it's then not necessary to regularly update them in the repo.
9396
- name: Add subscriptions from GitHub secret
9497
if: ${{ inputs.subscription }}
9598
run: |
96-
sudo mkdir -p /etc/pki/
97-
sudo cp -R ${PWD}/ci/secrets/pki/* /etc/pki/
9899
# https://access.redhat.com/solutions/5870841
99100
# https://github.com/containers/common/issues/1735
100-
printf "${PWD}/ci/secrets/run/secrets/rhsm:/etc/rhsm\n${PWD}/ci/secrets/run/secrets/etc-pki-entitlement:/etc/pki/entitlement\n${PWD}/ci/secrets/pki/consumer:/etc/pki/consumer\n" | sudo tee /usr/share/containers/mounts.conf
101+
mkdir entitlement
102+
mkdir consumer
103+
docker run \
104+
-v ${PWD}/entitlement:/etc/pki/entitlement:Z \
105+
-v ${PWD}/consumer:/etc/pki/consumer:Z \
106+
--rm -t registry.access.redhat.com/ubi9/ubi \
107+
/usr/sbin/subscription-manager register --org=${SUBSCRIPTION_ORG} --activationkey=${SUBSCRIPTION_ACTIVATION_KEY}
108+
printf "${PWD}/entitlement:/etc/pki/entitlement\n${PWD}/consumer:/etc/pki/consumer\n" | sudo tee /usr/share/containers/mounts.conf
101109
102110
mkdir -p $HOME/.config/containers/
103111
sudo cp ${PWD}/ci/secrets/pull-secret.json $HOME/.config/containers/auth.json
112+
env:
113+
SUBSCRIPTION_ORG: ${{ secrets.SUBSCRIPTION_ORG }}
114+
SUBSCRIPTION_ACTIVATION_KEY: ${{ secrets.SUBSCRIPTION_ACTIVATION_KEY }}
104115

105116
# for bin/buildinputs in scripts/sandbox.py
106117
- uses: actions/setup-go@v5

.github/workflows/code-quality.yaml

Lines changed: 7 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,7 @@ jobs:
6666
run: rm -rf ./ci/secrets
6767

6868
- name: Validate YAML files (best code practices check included)
69+
if: ${{ !cancelled() }}
6970
id: validate-yaml-files
7071
run: |
7172
type yamllint || sudo apt-get -y install yamllint
@@ -75,31 +76,19 @@ jobs:
7576
7677
# In some YAML files we use JSON strings, let's check these
7778
- name: Validate JSON strings in YAML files (just syntax)
79+
if: ${{ !cancelled() }}
7880
id: validate-json-strings-in-yaml-files
7981
run: |
8082
type json_verify || sudo apt-get -y install yajl-tools
8183
bash ./ci/check-json.sh
8284
8385
- name: Validate JSON files (just syntax)
86+
if: ${{ !cancelled() }}
8487
id: validate-json-files
85-
run: |
86-
set -Eeuxo pipefail
87-
88-
type json_verify || sudo apt-get -y install yajl-tools
89-
shopt -s globstar
90-
ret_code=0
91-
echo "-- Checking a regular '*.json' files"
92-
for f in **/*.json; do echo "Checking: '${f}"; echo -n " > "; [[ "$(basename "$f")" == "tsconfig.json" ]] && echo "Skipping ${f}" && continue; cat $f | json_verify || ret_code=1; done
93-
echo "-- Checking a 'Pipfile.lock' files"
94-
for f in **/Pipfile.lock; do echo "Checking: '${f}"; echo -n " > "; cat $f | json_verify || ret_code=1; done
95-
echo "-- Checking a '*.ipynb' Jupyter notebook files"
96-
for f in **/*.ipynb; do echo "Checking: '${f}"; echo -n " > "; cat $f | json_verify || ret_code=1; done
97-
if test "${ret_code}" -ne 0; then
98-
echo "There were errors in some of the checked files. Please run `json_verify` on such files and fix issues there."
99-
fi
100-
exit "${ret_code}"
88+
run: ./ci/validate_json.py
10189

10290
- name: Validate Dockerfiles
91+
if: ${{ !cancelled() }}
10392
id: validate-dockerfiles
10493
run: |
10594
type hadolint || sudo apt-get -y install wget \
@@ -111,6 +100,6 @@ jobs:
111100
112101
# This simply checks that the manifests and respective kustomization.yaml finishes without an error.
113102
- name: Check kustomize manifest
103+
if: ${{ !cancelled() }}
114104
id: kustomize-manifests
115-
run: |
116-
./ci/kustomize.sh
105+
run: ./ci/kustomize.sh

.github/workflows/security.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,21 @@ jobs:
1616
security-events: write
1717
steps:
1818

19+
# https://github.com/astral-sh/setup-uv
20+
- name: Install the latest version of uv
21+
uses: astral-sh/setup-uv@v6
22+
with:
23+
version: "latest"
24+
activate-environment: false
25+
ignore-empty-workdir: true
26+
enable-cache: false
27+
1928
- name: Checkout code
2029
uses: actions/checkout@v5
2130

31+
# Trivy does not support pylock.toml https://github.com/aquasecurity/trivy/discussions/9408
32+
- run: find . -name pyproject.toml -execdir uv lock \;
33+
2234
- name: Trivy scan
2335
uses: aquasecurity/trivy-action@dc5a429b52fcf669ce959baa2c2dd26090d2a6c4 # 0.32.0
2436
with:
Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# yamllint disable-file
2+
# This pipeline is autogenerated by scripts/generate_pull_request_pipelineruns.py
3+
---
4+
apiVersion: tekton.dev/v1
5+
kind: PipelineRun
6+
metadata:
7+
annotations:
8+
build.appstudio.openshift.io/repo: https://github.com/opendatahub-io/notebooks?rev={{revision}}
9+
build.appstudio.redhat.com/commit_sha: '{{revision}}'
10+
build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
11+
build.appstudio.redhat.com/target_branch: '{{target_branch}}'
12+
pipelinesascode.tekton.dev/cancel-in-progress: 'true'
13+
pipelinesascode.tekton.dev/max-keep-runs: '3'
14+
pipelinesascode.tekton.dev/on-comment: ^/kfbuild\s+(all|odh\-base\-image\-cuda\-py311\-c9s|base\-images/cuda/12\.6/c9s\-python\-3\.11)
15+
pipelinesascode.tekton.dev/on-cel-expression: |
16+
event == "pull_request" && target_branch == "main" && ( "base-images/cuda/12.6/c9s-python-3.11/**".pathChanged() || ".tekton/odh-base-image-cuda-py311-c9s-pull-request.yaml".pathChanged() )
17+
&& body.repository.full_name == "opendatahub-io/notebooks"
18+
labels:
19+
appstudio.openshift.io/application: opendatahub-release
20+
appstudio.openshift.io/component: odh-base-image-cuda-py311-c9s
21+
pipelines.appstudio.openshift.io/type: build
22+
name: odh-base-image-cuda-py311-c9s-on-pull-request
23+
namespace: open-data-hub-tenant
24+
spec:
25+
timeouts:
26+
pipeline: 3h
27+
params:
28+
- name: git-url
29+
value: '{{source_url}}'
30+
- name: revision
31+
value: '{{revision}}'
32+
- name: output-image
33+
value: quay.io/opendatahub/odh-base-image-cuda-py311-c9s:on-pr-{{revision}}
34+
- name: image-expires-after
35+
value: 5d
36+
- name: build-platforms
37+
value:
38+
- linux/x86_64
39+
- name: dockerfile
40+
value: base-images/cuda/12.6/c9s-python-3.11/Dockerfile.cuda
41+
- name: path-context
42+
value: .
43+
pipelineRef:
44+
name: multiarch-pull-request-pipeline
45+
taskRunTemplate:
46+
serviceAccountName: build-pipeline-odh-base-image-cuda-py311-c9s
47+
workspaces:
48+
- name: git-auth
49+
secret:
50+
secretName: '{{ git_auth_secret }}'
51+
status: {}
Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
apiVersion: tekton.dev/v1
2+
kind: PipelineRun
3+
metadata:
4+
annotations:
5+
build.appstudio.openshift.io/repo: https://github.com/opendatahub-io/notebooks?rev={{revision}}
6+
build.appstudio.redhat.com/commit_sha: '{{revision}}'
7+
build.appstudio.redhat.com/target_branch: '{{target_branch}}'
8+
pipelinesascode.tekton.dev/cancel-in-progress: "false"
9+
pipelinesascode.tekton.dev/max-keep-runs: "3"
10+
pipelinesascode.tekton.dev/on-cel-expression: event == "push" && target_branch == "main" && ( "base-images/cuda/12.6/c9s-python-3.11/**".pathChanged() || ".tekton/odh-base-image-cuda-py311-c9s-push.yaml".pathChanged() )
11+
creationTimestamp:
12+
labels:
13+
appstudio.openshift.io/application: opendatahub-release
14+
appstudio.openshift.io/component: odh-base-image-cuda-py311-c9s
15+
pipelines.appstudio.openshift.io/type: build
16+
name: odh-base-image-cuda-py311-c9s-on-push
17+
namespace: open-data-hub-tenant
18+
spec:
19+
params:
20+
- name: git-url
21+
value: '{{source_url}}'
22+
- name: revision
23+
value: '{{revision}}'
24+
- name: output-image
25+
value: quay.io/opendatahub/odh-base-image-cuda-py311-c9s:{{revision}}
26+
- name: dockerfile
27+
value: base-images/cuda/12.6/c9s-python-3.11/Dockerfile.cuda
28+
- name: path-context
29+
value: .
30+
- name: additional-tags
31+
value:
32+
- '{{target_branch}}-{{revision}}'
33+
- v12.6
34+
pipelineRef:
35+
name: singlearch-push-pipeline
36+
taskRunTemplate:
37+
serviceAccountName: build-pipeline-odh-base-image-cuda-py311-c9s
38+
workspaces:
39+
- name: git-auth
40+
secret:
41+
secretName: '{{ git_auth_secret }}'
42+
status: {}
Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# yamllint disable-file
2+
# This pipeline is autogenerated by scripts/generate_pull_request_pipelineruns.py
3+
---
4+
apiVersion: tekton.dev/v1
5+
kind: PipelineRun
6+
metadata:
7+
annotations:
8+
build.appstudio.openshift.io/repo: https://github.com/opendatahub-io/notebooks?rev={{revision}}
9+
build.appstudio.redhat.com/commit_sha: '{{revision}}'
10+
build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
11+
build.appstudio.redhat.com/target_branch: '{{target_branch}}'
12+
pipelinesascode.tekton.dev/cancel-in-progress: 'true'
13+
pipelinesascode.tekton.dev/max-keep-runs: '3'
14+
pipelinesascode.tekton.dev/on-comment: ^/kfbuild\s+(all|odh\-base\-image\-cuda\-py312\-c9s|base\-images/cuda/12\.6/c9s\-python\-3\.12)
15+
pipelinesascode.tekton.dev/on-cel-expression: |
16+
event == "pull_request" && target_branch == "main" && ( "base-images/cuda/12.6/c9s-python-3.12/**".pathChanged() || ".tekton/odh-base-image-cuda-py312-c9s-pull-request.yaml".pathChanged() )
17+
&& body.repository.full_name == "opendatahub-io/notebooks"
18+
labels:
19+
appstudio.openshift.io/application: opendatahub-release
20+
appstudio.openshift.io/component: odh-base-image-cuda-py312-c9s
21+
pipelines.appstudio.openshift.io/type: build
22+
name: odh-base-image-cuda-py312-c9s-on-pull-request
23+
namespace: open-data-hub-tenant
24+
spec:
25+
timeouts:
26+
pipeline: 3h
27+
params:
28+
- name: git-url
29+
value: '{{source_url}}'
30+
- name: revision
31+
value: '{{revision}}'
32+
- name: output-image
33+
value: quay.io/opendatahub/odh-base-image-cuda-py312-c9s:on-pr-{{revision}}
34+
- name: image-expires-after
35+
value: 5d
36+
- name: build-platforms
37+
value:
38+
- linux/x86_64
39+
- name: dockerfile
40+
value: base-images/cuda/12.6/c9s-python-3.12/Dockerfile.cuda
41+
- name: path-context
42+
value: .
43+
pipelineRef:
44+
name: multiarch-pull-request-pipeline
45+
taskRunTemplate:
46+
serviceAccountName: build-pipeline-odh-base-image-cuda-py312-c9s
47+
workspaces:
48+
- name: git-auth
49+
secret:
50+
secretName: '{{ git_auth_secret }}'
51+
status: {}
Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
apiVersion: tekton.dev/v1
2+
kind: PipelineRun
3+
metadata:
4+
annotations:
5+
build.appstudio.openshift.io/repo: https://github.com/opendatahub-io/notebooks?rev={{revision}}
6+
build.appstudio.redhat.com/commit_sha: '{{revision}}'
7+
build.appstudio.redhat.com/target_branch: '{{target_branch}}'
8+
pipelinesascode.tekton.dev/cancel-in-progress: "false"
9+
pipelinesascode.tekton.dev/max-keep-runs: "3"
10+
pipelinesascode.tekton.dev/on-cel-expression: event == "push" && target_branch == "main" && ( "base-images/cuda/12.6/c9s-python-3.12/**".pathChanged() || ".tekton/odh-base-image-cuda-py312-c9s-push.yaml".pathChanged() )
11+
creationTimestamp:
12+
labels:
13+
appstudio.openshift.io/application: opendatahub-release
14+
appstudio.openshift.io/component: odh-base-image-cuda-py312-c9s
15+
pipelines.appstudio.openshift.io/type: build
16+
name: odh-base-image-cuda-py312-c9s-on-push
17+
namespace: open-data-hub-tenant
18+
spec:
19+
params:
20+
- name: git-url
21+
value: '{{source_url}}'
22+
- name: revision
23+
value: '{{revision}}'
24+
- name: output-image
25+
value: quay.io/opendatahub/odh-base-image-cuda-py312-c9s:{{revision}}
26+
- name: dockerfile
27+
value: base-images/cuda/12.6/c9s-python-3.12/Dockerfile.cuda
28+
- name: path-context
29+
value: .
30+
- name: additional-tags
31+
value:
32+
- '{{target_branch}}-{{revision}}'
33+
- v12.6
34+
pipelineRef:
35+
name: singlearch-push-pipeline
36+
taskRunTemplate:
37+
serviceAccountName: build-pipeline-odh-base-image-cuda-py312-c9s
38+
workspaces:
39+
- name: git-auth
40+
secret:
41+
secretName: '{{ git_auth_secret }}'
42+
status: {}
Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# yamllint disable-file
2+
# This pipeline is autogenerated by scripts/generate_pull_request_pipelineruns.py
3+
---
4+
apiVersion: tekton.dev/v1
5+
kind: PipelineRun
6+
metadata:
7+
annotations:
8+
build.appstudio.openshift.io/repo: https://github.com/opendatahub-io/notebooks?rev={{revision}}
9+
build.appstudio.redhat.com/commit_sha: '{{revision}}'
10+
build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
11+
build.appstudio.redhat.com/target_branch: '{{target_branch}}'
12+
pipelinesascode.tekton.dev/cancel-in-progress: 'true'
13+
pipelinesascode.tekton.dev/max-keep-runs: '3'
14+
pipelinesascode.tekton.dev/on-comment: ^/kfbuild\s+(all|odh\-base\-image\-cuda\-py312\-ubi9|base\-images/cuda/12\.6/ubi9\-python\-3\.12)
15+
pipelinesascode.tekton.dev/on-cel-expression: |
16+
event == "pull_request" && target_branch == "main" && ( "base-images/cuda/12.6/ubi9-python-3.12/**".pathChanged() || ".tekton/odh-base-image-cuda-py312-ubi9-pull-request.yaml".pathChanged() )
17+
&& body.repository.full_name == "opendatahub-io/notebooks"
18+
labels:
19+
appstudio.openshift.io/application: opendatahub-release
20+
appstudio.openshift.io/component: odh-base-image-cuda-py312-ubi9
21+
pipelines.appstudio.openshift.io/type: build
22+
name: odh-base-image-cuda-py312-ubi9-on-pull-request
23+
namespace: open-data-hub-tenant
24+
spec:
25+
timeouts:
26+
pipeline: 3h
27+
params:
28+
- name: git-url
29+
value: '{{source_url}}'
30+
- name: revision
31+
value: '{{revision}}'
32+
- name: output-image
33+
value: quay.io/opendatahub/odh-base-image-cuda-py312-ubi9:on-pr-{{revision}}
34+
- name: image-expires-after
35+
value: 5d
36+
- name: build-platforms
37+
value:
38+
- linux/x86_64
39+
- name: dockerfile
40+
value: base-images/cuda/12.6/ubi9-python-3.12/Dockerfile.cuda
41+
- name: path-context
42+
value: .
43+
pipelineRef:
44+
name: multiarch-pull-request-pipeline
45+
taskRunTemplate:
46+
serviceAccountName: build-pipeline-odh-base-image-cuda-py312-ubi9
47+
workspaces:
48+
- name: git-auth
49+
secret:
50+
secretName: '{{ git_auth_secret }}'
51+
status: {}
Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
apiVersion: tekton.dev/v1
2+
kind: PipelineRun
3+
metadata:
4+
annotations:
5+
build.appstudio.openshift.io/repo: https://github.com/opendatahub-io/notebooks?rev={{revision}}
6+
build.appstudio.redhat.com/commit_sha: '{{revision}}'
7+
build.appstudio.redhat.com/target_branch: '{{target_branch}}'
8+
pipelinesascode.tekton.dev/cancel-in-progress: "false"
9+
pipelinesascode.tekton.dev/max-keep-runs: "3"
10+
pipelinesascode.tekton.dev/on-cel-expression: event == "push" && target_branch == "main" && ( "base-images/cuda/12.6/ubi9-python-3.12/**".pathChanged() || ".tekton/odh-base-image-cuda-py312-ubi9-push.yaml".pathChanged() )
11+
creationTimestamp:
12+
labels:
13+
appstudio.openshift.io/application: opendatahub-release
14+
appstudio.openshift.io/component: odh-base-image-cuda-py312-ubi9
15+
pipelines.appstudio.openshift.io/type: build
16+
name: odh-base-image-cuda-py312-ubi9-on-push
17+
namespace: open-data-hub-tenant
18+
spec:
19+
params:
20+
- name: git-url
21+
value: '{{source_url}}'
22+
- name: revision
23+
value: '{{revision}}'
24+
- name: output-image
25+
value: quay.io/opendatahub/odh-base-image-cuda-py312-ubi9:{{revision}}
26+
- name: dockerfile
27+
value: base-images/cuda/12.6/ubi9-python-3.12/Dockerfile.cuda
28+
- name: path-context
29+
value: .
30+
- name: additional-tags
31+
value:
32+
- '{{target_branch}}-{{revision}}'
33+
- v12.6
34+
pipelineRef:
35+
name: singlearch-push-pipeline
36+
taskRunTemplate:
37+
serviceAccountName: build-pipeline-odh-base-image-cuda-py312-ubi9
38+
workspaces:
39+
- name: git-auth
40+
secret:
41+
secretName: '{{ git_auth_secret }}'
42+
status: {}

0 commit comments

Comments
 (0)