Merge pull request opendatahub-io#523 from jiridanek/rhds-main

Update Pipfile.lock files by piplock-renewal.yaml action

Author: openshift-merge-bot[bot]

.github/workflows/build-notebooks-push.yaml

@@ -0,0 +1,42 @@
+---
+"name": "Build Notebooks (push)"
+"on":
+  "push":
+  "workflow_dispatch":
+  "schedule":
+    - "cron": "0 2 * * *"
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  gen:
+    name: Generate job matrix
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.gen.outputs.matrix }}
+      has_jobs: ${{ steps.gen.outputs.has_jobs }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Determine targets to build (we want to build everything on push)
+        run: |
+          set -x
+          python3 ci/cached-builds/gen_gha_matrix_jobs.py
+        id: gen
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+
+  build:
+    needs: ["gen"]
+    strategy:
+      fail-fast: false
+      matrix: "${{ fromJson(needs.gen.outputs.matrix) }}"
+    uses: ./.github/workflows/build-notebooks-TEMPLATE.yaml
+    if: ${{ fromJson(needs.gen.outputs.has_jobs) }}
+    with:
+      target: "${{ matrix.target }}"
+      github: "${{ toJSON(github) }}"
+    secrets: inherit

.github/workflows/build-notebooks.yaml

@@ -7,6 +7,7 @@ on:  # yamllint disable-line rule:truthy
       - 'manifests/base/commit.env'
       - 'manifests/base/params.env'
       - 'ci/check-params-env.sh'
+      - 'ci/check-runtime-images.sh'
   workflow_dispatch:
 
 permissions:

.github/workflows/params-env.yaml

@@ -0,0 +1,60 @@
+---
+name: Validation of software versions referenced in ImageStream manifests
+on:  # yamllint disable-line rule:truthy
+  push:
+    # Since this check is so resource demanding, let's restrict also push action here.
+    paths:
+      - 'manifests/base/params.env'
+      - 'manifests/base/*-imagestream.yaml'
+      - 'ci/check-software-versions.py'
+  pull_request:
+    paths:
+      - 'manifests/base/params.env'
+      - 'manifests/base/*-imagestream.yaml'
+      - 'ci/check-software-versions.py'
+  workflow_dispatch:
+  release:
+
+permissions:
+  contents: read
+
+jobs:
+  validation-of-sw-versions-in-imagestreams:
+    runs-on: ubuntu-latest
+    env:
+      # Some pieces of code (image pulls for example) in podman consult TMPDIR or default to /var/tmp
+      TMPDIR: /home/runner/.local/share/containers/tmpdir
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Mount lvm overlay for podman operations
+        run: |
+          df -h
+          free -h
+
+          bash ./ci/cached-builds/gha_lvm_overlay.sh
+
+          df -h
+          free -h
+
+      - name: Configure Podman
+        run: |
+          set -Eeuxo pipefail
+
+          sudo cp ci/cached-builds/storage.conf /etc/containers/storage.conf
+
+          # should reset storage when changing storage.conf
+          sudo mkdir -p $HOME/.local/share/containers/storage/tmp
+          # remote (CONTAINER_HOST) podman does not do reset (and refuses --force option)
+          sudo podman system reset --force
+          # podman running as service ignores the TMPDIR env var here, let's give it a bind-mount to /var/tmp
+          sudo mkdir -p $TMPDIR
+          sudo mount --bind -o rw,noexec,nosuid,nodev,bind $TMPDIR /var/tmp
+
+          # quick check that podman works
+          sudo podman info
+
+      - name: Check software versions in manifest referencing the images
+        id: software-versions-check
+        run: |
+          sudo ./ci/check-software-versions.py --prune-podman-data

.github/workflows/software-versions.yaml

@@ -10,7 +10,7 @@ metadata:
     pipelinesascode.tekton.dev/cancel-in-progress: "true"
     pipelinesascode.tekton.dev/max-keep-runs: "3"
     pipelinesascode.tekton.dev/on-cel-expression: event == "pull_request" && target_branch
-      == "main"
+      == "main" && has(body.repository) && body.repository.full_name == "opendatahub-io/notebooks"
   creationTimestamp: null
   labels:
     appstudio.openshift.io/application: notebooks

.tekton/jupyter-minimal-ubi9-python-3-11-pull-request.yaml

@@ -9,7 +9,7 @@ metadata:
     pipelinesascode.tekton.dev/cancel-in-progress: "false"
     pipelinesascode.tekton.dev/max-keep-runs: "3"
     pipelinesascode.tekton.dev/on-cel-expression: event == "push" && target_branch
-      == "main"
+      == "main" && has(body.repository) && body.repository.full_name == "opendatahub-io/notebooks"
   creationTimestamp: null
   labels:
     appstudio.openshift.io/application: notebooks
@@ -25,6 +25,8 @@ spec:
     value: '{{revision}}'
   - name: output-image
     value: quay.io/redhat-user-workloads/rhoai-ide-konflux-tenant/jupyter-minimal-ubi9-python-3-11:{{revision}}
+  - name: image-expires-after
+    value: 28d
   - name: build-platforms
     value:
     - linux/x86_64

.tekton/jupyter-minimal-ubi9-python-3-11-push.yaml

@@ -107,7 +107,7 @@ endef
 #######################################        Build helpers                 #######################################
 
 # https://stackoverflow.com/questions/78899903/how-to-create-a-make-target-which-is-an-implicit-dependency-for-all-other-target
-skip-init-for := deploy% undeploy% test% scan-image-vulnerabilities
+skip-init-for := all-images deploy% undeploy% test% scan-image-vulnerabilities
 ifneq (,$(filter-out $(skip-init-for),$(MAKECMDGOALS) $(.DEFAULT_GOAL)))
 $(SELF): bin/buildinputs
 endif