sync: main to stable-2.x

.github/dependabot.yml

@@ -17,6 +17,8 @@ updates:
       - "/jobs/async-upload"
     schedule:
       interval: "weekly"
+    exclude-paths:
+      - "jobs/async-upload/requirements.txt"
   - package-ecosystem: "docker"
     directory: "/"
     schedule:

.github/workflows/async-upload-test.yml

@@ -16,7 +16,7 @@ on:
       - "jobs/async-upload/**"
       - ".github/workflows/**"
 
-permissions:
+permissions: # set contents: read at top-level, per OpenSSF ScoreCard rule TokenPermissionsID
   contents: read
 
 env:
@@ -39,7 +39,7 @@ jobs:
       run:
         working-directory: jobs/async-upload
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
@@ -66,7 +66,7 @@ jobs:
       run:
         working-directory: jobs/async-upload
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
@@ -89,7 +89,7 @@ jobs:
         working-directory: jobs/async-upload
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - name: Set up Python

.github/workflows/build-and-push-async-upload.yml

@@ -11,6 +11,10 @@ on:
       - '!**.gitignore'
       - '!**.md'
       - '!**.txt'
+      - '.github/workflows/build-and-push-async-upload.yml' # self
+
+permissions: # set contents: read at top-level, per OpenSSF ScoreCard rule TokenPermissionsID
+  contents: read
 
 env:
   IMG_REGISTRY: quay.io
@@ -27,7 +31,7 @@ jobs:
       packages: write
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
 
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
@@ -62,3 +66,5 @@ jobs:
           ${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_NAME }}:main
         cache-from: type=gha
         cache-to: type=gha,mode=max
+        provenance: mode=max # pay attention no secrets are passed as build arguments: https://docs.docker.com/build/ci/github-actions/attestations/#default-provenance:~:text=don%27t%20support%20attestations.-,Warning,-If%20you%27re%20using
+        sbom: true

.github/workflows/build-and-push-csi-image.yml

@@ -13,6 +13,8 @@ on:
       - '.github/ISSUE_TEMPLATE/**'
       - '.github/dependabot.yml'
       - 'docs/**'
+permissions: # set contents: read at top-level, per OpenSSF ScoreCard rule TokenPermissionsID\
+  contents: read
 env:
   IMG_REGISTRY: quay.io
   IMG_ORG: opendatahub
@@ -24,7 +26,8 @@ jobs:
   build-csi-image:
     runs-on: ubuntu-latest
     permissions:
-      contents: read
+      actions: read # anchore/sbom-action for syft
+      contents: write # anchore/sbom-action for syft
       packages: write
     steps:
       # Assign context variable for various action contexts (tag, main, CI)
@@ -35,7 +38,7 @@ jobs:
         if: github.head_ref == '' && github.ref == 'refs/heads/main'
         run: echo "BUILD_CONTEXT=main" >> $GITHUB_ENV
       # checkout branch
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       # set image version
       - name: Set main-branch environment
         if: env.BUILD_CONTEXT == 'main'
@@ -66,6 +69,18 @@ jobs:
         env:
           IMG: "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_REPO }}"
         run: IMG=${{ env.IMG }} IMG_VERSION=${{ env.VERSION }} make image/push
+      - name: Generate SBOM
+        uses: anchore/sbom-action@v0
+        with:
+          image: "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_REPO }}:${{ env.VERSION }}"
+          format: spdx-json # default, but making sure of the format
+          artifact-name: "model-registry-server-${{ env.VERSION }}-sbom.spdx.json"
+          output-file: "model-registry-server-${{ env.VERSION }}-sbom.spdx.json" # pin the file to use it later below
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@v3
+      - name: Attach SBOM to Image
+        run: |
+          cosign attach sbom --sbom model-registry-server-${{ env.VERSION }}-sbom.spdx.json "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_REPO }}:${{ env.VERSION }}"
       # Tag latest and main
       - name: Tag Latest
         if: env.BUILD_CONTEXT == 'main' && env.PUSH_IMAGE == 'true'

.github/workflows/build-and-push-image.yml

@@ -18,16 +18,18 @@ env:
   PUSH_IMAGE: true
   DOCKER_USER: ${{ secrets.QUAY_USERNAME }}
   DOCKER_PWD: ${{ secrets.QUAY_PASSWORD }}
+  PLATFORMS: linux/arm64,linux/amd64
 
-permissions: # default workflow permission, overridden for specific job where required
+permissions: # set contents: read at top-level, per OpenSSF ScoreCard rule TokenPermissionsID
   contents: read
 
 jobs:
   prepare:
     uses: ./.github/workflows/prepare.yml
   build-image:
     permissions:
-      contents: read
+      actions: read # anchore/sbom-action for syft
+      contents: write # anchore/sbom-action for syft
       packages: write
     runs-on: ubuntu-latest
     needs: prepare
@@ -40,7 +42,13 @@ jobs:
         if: github.head_ref == '' && github.ref == 'refs/heads/main'
         run: echo "BUILD_CONTEXT=main" >> $GITHUB_ENV
       # checkout branch
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
+      # Set up QEMU for multi-architecture builds
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      # Set up Docker Buildx
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
       # set image version
       - name: Set main-branch environment
         if: env.BUILD_CONTEXT == 'main'
@@ -55,23 +63,24 @@ jobs:
       - name: Build and Push Image
         shell: bash
         run: ./scripts/build_deploy.sh
-      - name: Tag Latest
-        if: env.BUILD_CONTEXT == 'main'
-        shell: bash
-        env:
-          IMG: "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_REPO }}"
-          BUILD_IMAGE: false # image is already built in "Build and Push Image" step
+      - name: Generate SBOM
+        uses: anchore/sbom-action@v0
+        with:
+          image: "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_REPO }}:${{ env.VERSION }}"
+          format: spdx-json # default, but making sure of the format
+          artifact-name: "model-registry-server-${{ env.VERSION }}-sbom.spdx.json"
+          output-file: "model-registry-server-${{ env.VERSION }}-sbom.spdx.json" # pin the file to use it later below
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@v3
+      - name: Attach SBOM to Image
         run: |
-          docker tag ${{ env.IMG }}:$VERSION ${{ env.IMG }}:latest
-          # BUILD_IMAGE=false skip the build, just push the tag made above
-          VERSION=latest ./scripts/build_deploy.sh
-      - name: Tag Main
+          cosign attach sbom --sbom model-registry-server-${{ env.VERSION }}-sbom.spdx.json "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_REPO }}:${{ env.VERSION }}"
+      - name: Tag Latest and Main
         if: env.BUILD_CONTEXT == 'main'
         shell: bash
         env:
           IMG: "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_REPO }}"
-          BUILD_IMAGE: false # image is already built in "Build and Push Image" step
         run: |
-          docker tag ${{ env.IMG }}:$VERSION ${{ env.IMG }}:main
-          # BUILD_IMAGE=false skip the build, just push the tag made above
-          VERSION=main ./scripts/build_deploy.sh
+          # Create manifest tags for multi-arch images
+          docker buildx imagetools create -t ${{ env.IMG }}:latest ${{ env.IMG }}:$VERSION
+          docker buildx imagetools create -t ${{ env.IMG }}:main ${{ env.IMG }}:$VERSION

.github/workflows/build-and-push-testops-image.yml

@@ -0,0 +1,122 @@
+name: Build and Push testops container image
+
+on:
+  push:
+    branches:
+      - 'main'
+      - 'stable'
+      - 'stable-2.x'
+    paths:
+      - 'Dockerfile.testops'
+      - 'clients/python/**'
+      - 'api/**'
+      - 'manifests/**'
+      - 'scripts/**'
+      - '!LICENSE*'
+      - '!**.gitignore'
+      - '!**.md'
+      - '!**.txt'
+      - '.github/workflows/build-and-push-testops-image.yml' # self
+
+permissions: # set contents: read at top-level, per OpenSSF ScoreCard rule TokenPermissionsID
+  contents: read
+
+env:
+  IMG_REGISTRY: quay.io
+  IMG_ORG: opendatahub
+  IMG_NAME: model-registry-testops
+  REGISTRY_USER: ${{ secrets.QUAY_USERNAME }}
+  REGISTRY_PWD: ${{ secrets.QUAY_PASSWORD }}
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    if: github.repository == 'opendatahub-io/model-registry'
+    permissions:
+      contents: read
+      packages: write
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v5.0.0
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+
+    - name: Log in to the Container registry
+      uses: docker/login-action@v3
+      with:
+        registry: ${{ env.IMG_REGISTRY }}
+        username: ${{ env.REGISTRY_USER }}
+        password: ${{ env.REGISTRY_PWD }}
+
+    - name: Set branch-based environment
+      run: |
+        commit_sha=${{ github.sha }}
+        branch_name=${GITHUB_REF#refs/heads/}
+        tag=${branch_name}-${commit_sha:0:7}
+        # Calculate expiration date (7 days from now)
+        expiry_date=$(date -d '+7 days' -u +%Y-%m-%dT%H:%M:%SZ)
+
+        echo "VERSION=${tag}" >> $GITHUB_ENV
+        echo "BRANCH_NAME=${branch_name}" >> $GITHUB_ENV
+        echo "EXPIRY_DATE=${expiry_date}" >> $GITHUB_ENV
+
+    - name: Set tag environment # this is for v* tag image build
+      if: startsWith(github.ref, 'refs/tags/v')
+      run: |
+        echo "VERSION=${{ github.ref_name }}" >> $GITHUB_ENV
+
+    - name: Build and push SHA-based image (expires in 7 days)
+      uses: docker/build-push-action@v6
+      with:
+        context: .
+        file: ./Dockerfile.testops
+        push: true
+        tags: |
+          ${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_NAME }}:${{ env.VERSION }}
+        labels: |
+          org.opencontainers.image.source=https://github.com/${{ github.repository }}
+          org.opencontainers.image.revision=${{ github.sha }}
+          org.opencontainers.image.created=${{ github.event.repository.updated_at }}
+          quay.expires-after=7d
+        cache-from: type=gha
+        cache-to: type=gha,mode=max
+        provenance: mode=max
+        sbom: true
+
+    - name: Build and push persistent branch tags (main)
+      if: github.ref == 'refs/heads/main'
+      uses: docker/build-push-action@v6
+      with:
+        context: .
+        file: ./Dockerfile.testops
+        push: true
+        tags: |
+          ${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_NAME }}:${{ env.BRANCH_NAME }}
+          ${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_NAME }}:latest
+        labels: |
+          org.opencontainers.image.source=https://github.com/${{ github.repository }}
+          org.opencontainers.image.revision=${{ github.sha }}
+          org.opencontainers.image.created=${{ github.event.repository.updated_at }}
+        cache-from: type=gha
+        cache-to: type=gha,mode=max
+        provenance: mode=max
+        sbom: true
+
+    - name: Build and push persistent branch tags (non-main)
+      if: github.ref != 'refs/heads/main'
+      uses: docker/build-push-action@v6
+      with:
+        context: .
+        file: ./Dockerfile.testops
+        push: true
+        tags: |
+          ${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_NAME }}:${{ env.BRANCH_NAME }}
+        labels: |
+          org.opencontainers.image.source=https://github.com/${{ github.repository }}
+          org.opencontainers.image.revision=${{ github.sha }}
+          org.opencontainers.image.created=${{ github.event.repository.updated_at }}
+        cache-from: type=gha
+        cache-to: type=gha,mode=max
+        provenance: mode=max
+        sbom: true

.github/workflows/build-and-push-ui-images-standalone.yml

@@ -13,6 +13,8 @@ on:
       - '!**.gitignore'
       - '!**.md'
       - '!**.txt'
+permissions: # set contents: read at top-level, per OpenSSF ScoreCard rule TokenPermissionsID
+  contents: read
 env:
   IMG_REGISTRY: ghcr.io
   IMG_ORG: kubeflow
@@ -27,7 +29,7 @@ jobs:
       packages: write
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
 
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
@@ -76,4 +78,6 @@ jobs:
           DEPLOYMENT_MODE=standalone
           STYLE_THEME=mui-theme
         cache-from: type=gha
-        cache-to: type=gha,mode=max
+        cache-to: type=gha,mode=max
+        provenance: mode=max # pay attention no secrets are passed as build arguments: https://docs.docker.com/build/ci/github-actions/attestations/#default-provenance:~:text=don%27t%20support%20attestations.-,Warning,-If%20you%27re%20using
+        sbom: true

.github/workflows/build-and-push-ui-images.yml

@@ -13,6 +13,8 @@ on:
       - '!**.gitignore'
       - '!**.md'
       - '!**.txt'
+permissions: # set contents: read at top-level, per OpenSSF ScoreCard rule TokenPermissionsID
+  contents: read
 env:
   IMG_REGISTRY: ghcr.io
   IMG_ORG: kubeflow
@@ -27,7 +29,7 @@ jobs:
       packages: write
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
 
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
@@ -76,4 +78,6 @@ jobs:
           DEPLOYMENT_MODE=kubeflow
           STYLE_THEME=mui-theme
         cache-from: type=gha
-        cache-to: type=gha,mode=max
+        cache-to: type=gha,mode=max
+        provenance: mode=max # pay attention no secrets are passed as build arguments: https://docs.docker.com/build/ci/github-actions/attestations/#default-provenance:~:text=don%27t%20support%20attestations.-,Warning,-If%20you%27re%20using
+        sbom: true