Merge pull request #1596 from pboyd/sync-kf-main-20260306

sync kf main 20260306

Author: openshift-merge-bot[bot]

.gitattributes

@@ -4,6 +4,7 @@
 # Do not edit below this line. Edits will be overwritten by gen_gitattributes.sh
 
 catalog/clients/python/src/catalog_openapi/__init__.py linguist-generated=true
+catalog/clients/python/src/catalog_openapi/api/mcp_catalog_service_api.py linguist-generated=true
 catalog/clients/python/src/catalog_openapi/api/model_catalog_service_api.py linguist-generated=true
 catalog/clients/python/src/catalog_openapi/api_client.py linguist-generated=true
 catalog/clients/python/src/catalog_openapi/configuration.py linguist-generated=true
@@ -16,6 +17,7 @@ catalog/clients/python/src/catalog_openapi/models/base_resource_dates.py linguis
 catalog/clients/python/src/catalog_openapi/models/base_resource_list.py linguist-generated=true
 catalog/clients/python/src/catalog_openapi/models/catalog_artifact.py linguist-generated=true
 catalog/clients/python/src/catalog_openapi/models/catalog_artifact_list.py linguist-generated=true
+catalog/clients/python/src/catalog_openapi/models/catalog_asset_type.py linguist-generated=true
 catalog/clients/python/src/catalog_openapi/models/catalog_label.py linguist-generated=true
 catalog/clients/python/src/catalog_openapi/models/catalog_label_list.py linguist-generated=true
 catalog/clients/python/src/catalog_openapi/models/catalog_metrics_artifact.py linguist-generated=true
@@ -32,6 +34,23 @@ catalog/clients/python/src/catalog_openapi/models/field_filter.py linguist-gener
 catalog/clients/python/src/catalog_openapi/models/filter_option.py linguist-generated=true
 catalog/clients/python/src/catalog_openapi/models/filter_option_range.py linguist-generated=true
 catalog/clients/python/src/catalog_openapi/models/filter_options_list.py linguist-generated=true
+catalog/clients/python/src/catalog_openapi/models/mcp_artifact.py linguist-generated=true
+catalog/clients/python/src/catalog_openapi/models/mcp_endpoints.py linguist-generated=true
+catalog/clients/python/src/catalog_openapi/models/mcp_env_var_metadata.py linguist-generated=true
+catalog/clients/python/src/catalog_openapi/models/mcp_resource_recommendation.py linguist-generated=true
+catalog/clients/python/src/catalog_openapi/models/mcp_resource_recommendation_high.py linguist-generated=true
+catalog/clients/python/src/catalog_openapi/models/mcp_resource_recommendation_minimal.py linguist-generated=true
+catalog/clients/python/src/catalog_openapi/models/mcp_resource_recommendation_recommended.py linguist-generated=true
+catalog/clients/python/src/catalog_openapi/models/mcp_runtime_metadata.py linguist-generated=true
+catalog/clients/python/src/catalog_openapi/models/mcp_runtime_metadata_capabilities.py linguist-generated=true
+catalog/clients/python/src/catalog_openapi/models/mcp_runtime_metadata_health_endpoints.py linguist-generated=true
+catalog/clients/python/src/catalog_openapi/models/mcp_security_indicator.py linguist-generated=true
+catalog/clients/python/src/catalog_openapi/models/mcp_server.py linguist-generated=true
+catalog/clients/python/src/catalog_openapi/models/mcp_server_list.py linguist-generated=true
+catalog/clients/python/src/catalog_openapi/models/mcp_tool.py linguist-generated=true
+catalog/clients/python/src/catalog_openapi/models/mcp_tool_parameter.py linguist-generated=true
+catalog/clients/python/src/catalog_openapi/models/mcp_tool_with_server.py linguist-generated=true
+catalog/clients/python/src/catalog_openapi/models/mcp_tools_list.py linguist-generated=true
 catalog/clients/python/src/catalog_openapi/models/metadata_bool_value.py linguist-generated=true
 catalog/clients/python/src/catalog_openapi/models/metadata_double_value.py linguist-generated=true
 catalog/clients/python/src/catalog_openapi/models/metadata_int_value.py linguist-generated=true

.github/workflows/build-and-push-async-upload.yml

@@ -13,8 +13,7 @@ on:
       - '!**.txt'
       - '.github/workflows/build-and-push-async-upload.yml' # self
 
-permissions: # set contents: read at top-level, per OpenSSF ScoreCard rule TokenPermissionsID
-  contents: read
+permissions: read-all
 
 env:
   IMG_REGISTRY: quay.io

.github/workflows/build-and-push-controller-image.yml

@@ -15,8 +15,7 @@ on:
   #    - '.github/ISSUE_TEMPLATE/**'
   #    - '.github/dependabot.yml'
   #    - 'docs/**'
-permissions: # set contents: read at top-level, per OpenSSF ScoreCard rule TokenPermissionsID\
-  contents: read
+permissions: read-all
 env:
   IMG_REGISTRY: quay.io
   IMG_ORG: opendatahub

.github/workflows/build-and-push-csi-image.yml

@@ -13,8 +13,7 @@ on:
       - '.github/ISSUE_TEMPLATE/**'
       - '.github/dependabot.yml'
       - 'docs/**'
-permissions: # set contents: read at top-level, per OpenSSF ScoreCard rule TokenPermissionsID\
-  contents: read
+permissions: read-all
 env:
   IMG_REGISTRY: quay.io
   IMG_ORG: opendatahub

.github/workflows/build-and-push-image.yml

@@ -20,8 +20,7 @@ env:
   DOCKER_PWD: ${{ secrets.QUAY_PASSWORD }}
   PLATFORMS: linux/arm64,linux/amd64
 
-permissions: # set contents: read at top-level, per OpenSSF ScoreCard rule TokenPermissionsID
-  contents: read
+permissions: read-all
 
 jobs:
   prepare:

.github/workflows/build-and-push-ui-images-standalone.yml

@@ -13,8 +13,7 @@ on:
       - '!**.gitignore'
       - '!**.md'
       - '!**.txt'
-permissions: # set contents: read at top-level, per OpenSSF ScoreCard rule TokenPermissionsID
-  contents: read
+permissions: read-all
 env:
   IMG_REGISTRY: ghcr.io
   IMG_ORG: kubeflow

.github/workflows/build-and-push-ui-images.yml

@@ -13,8 +13,7 @@ on:
       - '!**.gitignore'
       - '!**.md'
       - '!**.txt'
-permissions: # set contents: read at top-level, per OpenSSF ScoreCard rule TokenPermissionsID
-  contents: read
+permissions: read-all
 env:
   IMG_REGISTRY: ghcr.io
   IMG_ORG: kubeflow

.github/workflows/gh-workflow-approve.yml

@@ -0,0 +1,72 @@
+name: Approve Workflow Runs
+
+permissions: read-all
+
+on:
+  pull_request_target:
+    types:
+      - labeled
+      - synchronize
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event.number }}
+  cancel-in-progress: true
+
+jobs:
+  ok-to-test:
+    if: contains(github.event.pull_request.labels.*.name, 'ok-to-test') || github.event_name == 'pull_request_target'
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    permissions:
+      actions: write
+      contents: read
+
+    steps:
+      - name: Check if author is a Kubeflow GitHub member
+        id: membership-check
+        env:
+          AUTHOR_ASSOCIATION: ${{ github.event.pull_request.author_association }}
+          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          echo "::group::PR Information"
+          echo "PR Number: #$PR_NUMBER"
+          echo "PR Author: $PR_AUTHOR"
+          echo "Author Association: $AUTHOR_ASSOCIATION"
+          echo "::endgroup::"
+
+          if [[ "$AUTHOR_ASSOCIATION" == "MEMBER" || "$AUTHOR_ASSOCIATION" == "OWNER" || "$AUTHOR_ASSOCIATION" == "COLLABORATOR" ]]; then
+            echo "::notice::Author '$PR_AUTHOR' is a trusted contributor (association: $AUTHOR_ASSOCIATION). Auto-approving workflow runs."
+            echo "is_member=true" >> $GITHUB_OUTPUT
+          else
+            echo "::notice::Author '$PR_AUTHOR' is not a trusted contributor (association: $AUTHOR_ASSOCIATION). Checking for 'ok-to-test' label."
+            echo "is_member=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Approve Pending Workflow Runs
+        if: steps.membership-check.outputs.is_member == 'true' || contains(github.event.pull_request.labels.*.name, 'ok-to-test')
+        uses: actions/github-script@v8
+        with:
+          retries: 3
+          script: |
+            const request = {
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              event: "pull_request",
+              status: "action_required",
+              head_sha: context.payload.pull_request.head.sha,
+            }
+
+            core.info(`Getting workflow runs that need approval for commit ${request.head_sha}`)
+            const runs = await github.paginate(github.rest.actions.listWorkflowRunsForRepo, request)
+
+            core.info(`Found ${runs.length} workflow runs that need approval`)
+            for (const run of runs) {
+              core.info(`Approving workflow run ${run.id}`)
+              const request = {
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                run_id: run.id,
+              }
+              await github.rest.actions.approveWorkflowRun(request)
+            }

.github/workflows/go-generate.yml

@@ -4,13 +4,14 @@ on:
   schedule:
     - cron: "0 0 * * 1" # Monday 12 AM UTC
 
-permissions:
-  contents: write
-  pull-requests: write
+permissions: read-all
 
 jobs:
   go-generate:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - uses: actions/checkout@v6
       - name: Setup Go

.github/workflows/python-tests.yml

@@ -110,6 +110,9 @@ jobs:
           - python: "3.10"
             kubernetes-version: "v1.33.7"
             manifest-db: "db"
+          - python: "3.13"
+            kubernetes-version: "v1.34.3"
+            manifest-db: "db"
     env:
       FORCE_COLOR: "1"
       IMG_REGISTRY: quay.io