Repository navigation
Automated Sync from main to stable - #40
Open
rhods-devops-app[bot] wants to merge 232 commits into
Open
rhods-devops-app[bot] wants to merge 232 commits into
rhods-devops-app[bot] wants to merge 232 commits into
Conversation
* test(conformance): run driver suites with cargo Signed-off-by: Evan Lezar <elezar@nvidia.com> * fix(e2e): resolve conformance CLI path before cargo tests Signed-off-by: Evan Lezar <elezar@nvidia.com> * refactor(conformance): remove unused CLI scenario APIs Signed-off-by: Evan Lezar <elezar@nvidia.com> --------- Signed-off-by: Evan Lezar <elezar@nvidia.com>
* feat(providers): support stable credential placeholders Add credentials[].stable_placeholder so a running client keeps using an externally rotated static credential through the reference it already holds. Squashed replay of the earlier four commits onto upstream main 71c3cd9; re-derives the frozen schema fingerprints and adapts the provider environment revision test to the added capability argument. Signed-off-by: Shiju <shiju@nvidia.com> * fix(e2e): apply stable-placeholder supervisor image override Use ManagedGateway's per-process supervisor image override so the fixture CA reaches the supervisor when runtime image environment variables take precedence over gateway TOML. Restore the wrapper's original image after each test, following the provider-readiness fixture. Signed-off-by: Shiju <shiju@nvidia.com> * test(server): update public RPC schema fingerprint after merging main Signed-off-by: Shiju <shiju@nvidia.com> --------- Signed-off-by: Shiju <shiju@nvidia.com>
…4338) Signed-off-by: John Myers <johntmyers@users.noreply.github.com> Co-authored-by: John Myers <johntmyers@users.noreply.github.com>
* feat(sdk/ts): add createdAtMs to SandboxRef Signed-off-by: Eric Curtin <eric.curtin@docker.com> * docs(sdk/ts): document createdAtMs on SandboxRef Signed-off-by: Eric Curtin <eric.curtin@docker.com> --------- Signed-off-by: Eric Curtin <eric.curtin@docker.com>
…IDIA#4395) The stop path wrote Stopping and Stopped with a single compare-and-swap. In HA deployments every replica applies compute driver watch events for the terminating runtime without the per-replica lifecycle gate, so a watch write landing between the re-read and the CAS failed the stop RPC with "update sandbox lifecycle failed due to concurrent modification" and left the sandbox in Stopping. Retry both writes on PersistenceError::Conflict up to STOP_PHASE_CAS_RETRY_LIMIT, re-reading the sandbox on each attempt. The Stopping write re-runs the stop preconditions and the name check; the Stopped write proceeds only while the record is still Stopping, returns an already Stopped record as-is, and aborts on any other phase. Gateway startup recovery of retained Stopping sandboxes now shares the same helper instead of writing against its pre-driver snapshot. Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
Signed-off-by: Oliver Calder <oliver.calder@canonical.com>
* feat(python): expose sandbox status conditions in the SDK Add SandboxConditionRef and surface status.conditions on SandboxStatusRef and SandboxRef. Callers need condition reasons and transition times to time terminal transitions and explain failures that happen before the main process starts, without reading the raw proto. Signed-off-by: Max Dubrinsky <mdubrinsky@nvidia.com> * test(python): use real gateway condition values in conditions fixtures Signed-off-by: Max Dubrinsky <mdubrinsky@nvidia.com> --------- Signed-off-by: Max Dubrinsky <mdubrinsky@nvidia.com>
* fix(python): close client when Sandbox entry fails Signed-off-by: Eric Curtin <eric.curtin@docker.com> * test(python): share client patch helper Signed-off-by: Eric Curtin <eric.curtin@docker.com> --------- Signed-off-by: Eric Curtin <eric.curtin@docker.com>
* fix(network): validate chunked message framing Signed-off-by: Adrien Langou <alangou@nvidia.com> * fix(network): preserve chunk extension whitespace Signed-off-by: Adrien Langou <alangou@nvidia.com> --------- Signed-off-by: Adrien Langou <alangou@nvidia.com>
…NVIDIA#2810) Spell out that auto-closed PRs keep their discussion and can be reopened or replaced, separate DCO sign-off from cryptographic commit signing, and say to mark PR checklist items complete only after verification. Signed-off-by: politerealism <burdcat17@gmail.com>
Signed-off-by: Eric Curtin <eric.curtin@docker.com>
* fix(server): return SQLite write versions atomically Use RETURNING instead of a follow-up read. Signed-off-by: Eric Curtin <eric.curtin@docker.com> * refactor(server): dedupe sqlite write helpers Signed-off-by: Eric Curtin <eric.curtin@docker.com> --------- Signed-off-by: Eric Curtin <eric.curtin@docker.com>
…#4157) Signed-off-by: Eric Curtin <eric.curtin@docker.com>
* fix(cli): preserve external TLS for SSH forwarding Resolve the external scheme together with its authority when replacing an internal bind address with the registered gateway endpoint. Ported from NVIDIA#3714. Fixes: NVIDIA#3674 Signed-off-by: Daneyon Hansen <daneyon.hansen@solo.io> * docs(kubernetes): explain TLS SSH relay endpoint Signed-off-by: Daneyon Hansen <daneyon.hansen@solo.io> --------- Signed-off-by: Daneyon Hansen <daneyon.hansen@solo.io>
Signed-off-by: Yuedong Wu <dwcn22@outlook.com>
…NVIDIA#3910) The runtimes page examples omit the [openshell] version = 2 table, so a snippet copied into a new gateway.toml fails preflight with missing_version. Add the table to the first example and state that the remaining examples show only the tables they change. Closes NVIDIA#3881 Signed-off-by: fede-kamel <fkamelhar@gmail.com>
Signed-off-by: Eric Curtin <eric.curtin@docker.com>
NVIDIA#4081) * test(tmachine): add K3s PostgreSQL and mTLS conformance installer Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * fix(tmachine): reach the HA TLS gateway through its ClusterIP Drop the port-forward restart removed by the ClusterIP change, resolve the Service DNS name covered by the server certificate to the ClusterIP, bound each authenticated API wait attempt, and collect diagnostics from every gateway Pod. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * ci(tmachine): run K3s PostgreSQL and mTLS conformance Add the k3s-ha-tls installer to every core conformance matrix so Branch E2E, Release Dev, Release Tag, and manual Integration Tests cover three gateway replicas sharing PostgreSQL behind mTLS. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * refactor(tmachine): rename k3s-ha-tls installer to k3s-ha TLS is part of the supported HA configuration once gateway replicas share PostgreSQL, so the installer name only needs to distinguish HA from the single-replica k3s lane. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * refactor(tmachine): install K3s HA in a single Helm rollout Add an optional Helm values overlay to the K3s installer so the k3s-ha installer stages PostgreSQL first and installs the three-replica TLS gateway directly, instead of installing a plaintext gateway and upgrading. Drop the redundant unauthenticated-users override and the install-time API wait, which the conformance playbook already performs. Share K3s installer inputs in the tmachine configuration. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * fix(tmachine): make K3s HA staging rerunnable and wait for PostgreSQL Apply the OpenShell namespace instead of creating it so the staging play tolerates an existing namespace, and wait for the PostgreSQL rollout so gateway Pods do not start crash-looping against a missing database. Reflow and pluralize the K3s lane notes in CI.md. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> --------- Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
Closes NVIDIA#2401 Signed-off-by: Jim Meyer <jimeyer@nvidia.com>
Remove blanket review routing while preserving the explicit owners of the vouch list, workflows, actions, approval helpers, and SBOM check already on main. Signed-off-by: Jim Meyer <jimeyer@nvidia.com>
…4316) Signed-off-by: Gordon Sim <gsim@redhat.com>
* fix(driver-mxc): pass gateway name to mocked backend Refs NVIDIA#4191 Signed-off-by: Philippe Martin <phmartin@redhat.com> * fix(windows): use native executable paths in network test fixtures Signed-off-by: Philippe Martin <phmartin@redhat.com> --------- Signed-off-by: Philippe Martin <phmartin@redhat.com>
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 10.0.0 to 10.0.1. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@ae62891...20cfd1b) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 10.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: letv1nnn <letv1n2007@icloud.com>
* fix(server): audit proposal rejections in the gateway Signed-off-by: Eric Curtin <eric.curtin@docker.com> * fix(ocsf): show rejection details in CONFIG shorthand Signed-off-by: Eric Curtin <eric.curtin@docker.com> * fix(server): attribute rejection audits to operator principals Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com> --------- Signed-off-by: Eric Curtin <eric.curtin@docker.com> Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com> Co-authored-by: John Myers <9696606+johntmyers@users.noreply.github.com>
Signed-off-by: Taylor Mutch <taylormutch@gmail.com>
Evaluate issue acceptance using trusted default-branch code and the PR author's repository permissions. Report the native workflow job result, protect enforcement files, and align PR creation and review guidance. Closes NVIDIA#4339 Signed-off-by: Evan Lezar <elezar@nvidia.com>
The VM runtime scripts sourced pins.env optionally and duplicated the LIBKRUN_REF and UMOCI_VERSION defaults, so every bump had to update the same value in several files. Require pins.env, drop the duplicated defaults, and fail on an invalid LIBKRUN_REF instead of silently building upstream HEAD. Environment overrides still take precedence through the defaults in pins.env. Signed-off-by: Florent Benoit <fbenoit@redhat.com>
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
…RKDIR (NVIDIA#3931) * test(oci): share OCI image checks across Docker and Podman Add an oci-image feature testsuite that runs against installed artifacts. It covers custom WORKDIR placement, image content and ownership, workspace writes from the main process and exec, file transfer including directory-merge upload, OCI user identity, the managed /sandbox fallback, and rejection of an unwritable WORKDIR. CI runs the suite on the Docker rootful, Podman rootful, and Podman rootless tmachine guests. Replace the Docker-only custom_image e2e with the shared suite. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> Signed-off-by: Evan Lezar <elezar@nvidia.com> * test(oci): require WorkspaceValidationFailed and cover image USER fallback The unwritable WORKDIR scenario now requires the WorkspaceValidationFailed reason, so unrelated provisioning failures cannot pass it. The numeric USER scenario supplies a policy without a process section, so the image USER is the only source of the sandbox identity. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> Signed-off-by: Evan Lezar <elezar@nvidia.com> * test(podman): leave shared OCI identity checks to the oci-image suite The oci-image feature suite covers the sandbox identity seen by the main process and sandbox exec on Docker and Podman. The Podman e2e keeps the checks only it can make: the pinned image ID and the isolated workload/supervisor container pair. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> Signed-off-by: Evan Lezar <elezar@nvidia.com> * test(oci): accept existing workspace rejection diagnostics Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> Signed-off-by: Evan Lezar <elezar@nvidia.com> * test(oci): fix cleanup ordering and restore coverage parity Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> Signed-off-by: Evan Lezar <elezar@nvidia.com> * test(oci): remove migrated legacy workspace helpers and checks Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * fix(drivers): report rejected OCI working directories as WorkspaceValidationFailed The supervisor exits with the reserved status when the sandbox rejects the image working directory. Docker maps that exit during readiness and monitoring and records it before removing the supervisor container, and Podman maps the supervisor companion's exit instead of the workload's. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * test(oci): require WorkspaceValidationFailed for unwritable WORKDIR Unrelated provisioning failures can no longer pass the rejection scenario. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * fix(oci): keep exit 78 reserved and report fixed workspace diagnostics The supervisor no longer passes on a workload's own exit status 78, so drivers cannot misreport it as a workspace rejection after a runtime restart. The rejection is recognized once at agent start and carried as a typed error. Docker reports the same fixed condition message as Podman and logs the supervisor output instead, and its monitor removes the supervisor container when a stop overlaps diagnostics collection. The OCI image suite registers images for cleanup only after they build. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * refactor(oci): simplify workspace failure handling and OCI image tests Report a recorded Docker workspace rejection once, where supervisor readiness fails, and match its fixed message exactly. Read the Podman supervisor exit status once per inspection. Choose the supervisor exit status in one function and derive the workspace error type. The OCI image suite shares step helpers, checks that a custom workspace does not also create /sandbox, and its playbook waits for a connected gateway and collects failure diagnostics through the shared role. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * test(oci): replace podman_oci_identity with shared and driver suite checks The oci-image feature suite now checks, on Docker and Podman, that the image user has no capabilities, has no_new_privs set, and cannot read the sandbox control credentials, and that a custom WORKDIR is not a mount. The checks that need container inspection (pinned image ID, network=none, supervisor user and capabilities) move to a small test in the Podman driver suite. Remove the legacy podman_oci_identity e2e test. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * test(oci): keep podman_oci_identity for Podman-only isolation checks Restore the Podman e2e test removed in the previous commit and drop only the checks the shared oci-image suite now runs on Docker and Podman: workload capabilities, no_new_privs, credential readability, and the workspace and /sandbox mount checks. The pinned image ID and the workload/supervisor isolation checks stay, as does the Podman driver suite unchanged. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * refactor(oci): simplify workspace failure reporting and OCI image suite Carry the Docker control supervisor's failure reason in a typed error instead of matching status text, build the fixed workspace message where the wait result is classified, and drop the fake Docker server test. Inline image cleanup ordering in the suite, read the container engine once, share sandbox naming, and stop granting a literal /sandbox in the image identity policy. Add e2e:oci-image mise tasks and use them from the ARM64 Docker workflow and TESTING.md. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * test(oci): move shared container checks into the OCI image suite Inspect the containers the driver created through the gateway's engine in the shared suite: the workload runs the inspected image ID as the OCI identity without a network or supervisor credential mounts, and the supervisor is a separate non-root container. Keep only the Podman-specific supervisor identity and capability checks in podman_oci_identity. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * test(oci): check the workspace rejection reason from sandbox JSON Read the WorkspaceValidationFailed condition reason from sandbox get --output json instead of matching CLI output, and restore the Docker driver's original workspace failure helpers. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * test(oci): capture fixture image identity before sandbox creation Signed-off-by: Evan Lezar <elezar@nvidia.com> --------- Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> Signed-off-by: Evan Lezar <elezar@nvidia.com> Co-authored-by: Evan Lezar <elezar@nvidia.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| group: codex-compatibility-${{ inputs.candidate_ref }}-${{ github.run_id }} | ||
| group: codex-release-review | ||
| cancel-in-progress: false | ||
| queue: max |
| cancel-in-progress: true | ||
| group: codex-release-review | ||
| cancel-in-progress: false | ||
| queue: max |
| concurrency: | ||
| group: ${{ inputs.notes-only && format('release-notes-preview-{0}', github.ref) || 'release-stable' }} | ||
| cancel-in-progress: false | ||
| queue: max |
| concurrency: | ||
| group: snap-publish-${{ inputs.upload-channel }}-${{ matrix.arch }} | ||
| cancel-in-progress: false | ||
| queue: max |
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
Signed-off-by: konflux-internal-p02 <170854209+konflux-internal-p02[bot]@users.noreply.github.com> Co-authored-by: konflux-internal-p02[bot] <170854209+konflux-internal-p02[bot]@users.noreply.github.com>
… docker tag to v9.8-1792869995 (opendatahub-io#129) Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com> Co-authored-by: red-hat-konflux[bot] <126015336+red-hat-konflux[bot]@users.noreply.github.com>
… docker tag to v9.8-1792869995 (#43) Signed-off-by: konflux-internal-p02 <170854209+konflux-internal-p02[bot]@users.noreply.github.com> Co-authored-by: konflux-internal-p02[bot] <170854209+konflux-internal-p02[bot]@users.noreply.github.com>
Signed-off-by: konflux-internal-p02 <170854209+konflux-internal-p02[bot]@users.noreply.github.com> Co-authored-by: konflux-internal-p02[bot] <170854209+konflux-internal-p02[bot]@users.noreply.github.com>
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com> Co-authored-by: red-hat-konflux[bot] <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com> Co-authored-by: red-hat-konflux[bot] <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com> Co-authored-by: red-hat-konflux[bot] <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com> Co-authored-by: red-hat-konflux[bot] <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Signed-off-by: konflux-internal-p02 <170854209+konflux-internal-p02[bot]@users.noreply.github.com> Co-authored-by: konflux-internal-p02[bot] <170854209+konflux-internal-p02[bot]@users.noreply.github.com>
* ci(release): infer optional workflow tags Signed-off-by: Simon Scatton <sscatton@nvidia.com> * fix(release): use resolved tag in success notifications Signed-off-by: Simon Scatton <sscatton@nvidia.com> * fix(release): pin prerelease notes to resolved candidate Signed-off-by: Simon Scatton <sscatton@nvidia.com> --------- Signed-off-by: Simon Scatton <sscatton@nvidia.com>
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
* fix(deps): update tokio and crypto-bigint security patches Signed-off-by: Simon Scatton <sscatton@nvidia.com> * chore(deps): document temporary crypto-bigint advisory exception Signed-off-by: Simon Scatton <sscatton@nvidia.com> * fix(sandbox): migrate owned descriptors to AsyncFd register Signed-off-by: Simon Scatton <sscatton@nvidia.com> * test(server): avoid deadlock in concurrent CAS retry test Signed-off-by: Simon Scatton <sscatton@nvidia.com> --------- Signed-off-by: Simon Scatton <sscatton@nvidia.com>
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
| concurrency: | ||
| group: release-prerelease-tags | ||
| cancel-in-progress: false | ||
| queue: max |
| concurrency: | ||
| group: release-prerelease-tags | ||
| cancel-in-progress: false | ||
| queue: max |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated Sync from main to stable
This PR automatically syncs the
mainbranch to thestablebranch by opening a pull request frommainintostable.Sync Summary
Latest commit:
587dc921Merge remote-tracking branch 'upstream/main'Total commits to sync: 220
Source:
https://github.com/red-hat-data-services/OpenShell.git@mainTarget:
https://github.com/red-hat-data-services/OpenShell.git@stablePR head:
mainCommits to be synced
587dc921Merge remote-tracking branch 'upstream/main'952095cbchore(deps): refresh rpm lockfiles (chore(deps): refresh rpm lockfiles opendatahub-io/openshell#128)5e17fe94chore(deps): refresh rpm lockfiles [SECURITY] (chore(deps): refresh rpm lockfiles [SECURITY] opendatahub-io/openshell#127)260e844dMerge remote-tracking branch 'upstream/main'94543428chore(deps): refresh rpm lockfiles [SECURITY] (chore(deps): refresh rpm lockfiles [SECURITY] #44)fb89c250chore(deps): update registry.access.redhat.com/ubi9/nodejs-24-minimal docker tag to v9.8-1792869995 (chore(deps): update registry.access.redhat.com/ubi9/nodejs-24-minimal docker tag to v9.8-1792869995 #43)baaf0d16chore(deps): update registry.access.redhat.com/ubi9/nodejs-24-minimal docker tag to v9.8-1792869995 (chore(deps): update registry.access.redhat.com/ubi9/nodejs-24-minimal docker tag to v9.8-1792869995 opendatahub-io/openshell#129)ff4aafd4chore(deps): refresh rpm lockfiles (chore(deps): refresh rpm lockfiles #2)a57902c4Merge remote-tracking branch 'upstream/main'f4a9bd60Merge remote-tracking branch 'upstream/main'e3b4b05fMerge remote-tracking branch 'upstream/main'c4688aa8feat(helm): add certificate hook pod labels and annotations (feat(helm): add certificate hook pod labels and annotations NVIDIA/OpenShell#4895)e0016fa3Merge remote-tracking branch 'upstream/main'0b3b3a3dMerge remote-tracking branch 'upstream/main'f571c8e9docs(agents): ban AI attribution in PR descriptions and issues (docs(agents): ban AI attribution in PR descriptions and issues NVIDIA/OpenShell#4890)16250df2feat(helm): add server.extraEnv for the gateway container (feat(helm): add server.extraEnv for the gateway container NVIDIA/OpenShell#4876)567d3603fix(build): raise file limit for native gateway builds (fix(build): raise file limit for native gateway builds NVIDIA/OpenShell#3122)e0ba0789ci: keep rust caches warm on main and stop saving binary caches on branches (ci: keep rust caches warm on main and stop saving binary caches on branches NVIDIA/OpenShell#4881)b824e91bMerge remote-tracking branch 'upstream/main'1fce5ffaMerge remote-tracking branch 'upstream/main'fd5a55bcchore(deps): refresh rpm lockfiles [SECURITY] (chore(deps): refresh rpm lockfiles [SECURITY] #1)92434dcbtest(windows): repair the Windows MSVC test suite (test(windows): repair the Windows MSVC test suite NVIDIA/OpenShell#4862)72e4eaa8feat(snap): publish prerelease builds to latest/beta channel (feat(snap): publish prerelease builds to latest/beta channel NVIDIA/OpenShell#4870)8244f739Merge remote-tracking branch 'upstream/main'e188cadcMerge remote-tracking branch 'upstream/main'b504c301ci(security): allow DRS version references in zizmor5bfe2fbcdocs(contributing): exempt build and flaky-test fixes from the issue requirement (docs(contributing): exempt build and flaky-test fixes from the issue requirement NVIDIA/OpenShell#4875)bc4c8f00fix(deps): update ctutils to resolve timing advisory (fix(deps): update ctutils to resolve timing advisory NVIDIA/OpenShell#4867)38fc5c26Merge pull request CARRY: fix(skills): move ODH installer guidance out of upstream skill opendatahub-io/openshell#124 from opendatahub-io/fix/skill-sync-conflict/andre-motta6b32278bCARRY: fix(skills): move ODH installer guidance out of upstream skill60e6434achore(deps): refresh rpm lockfiles (chore(deps): refresh rpm lockfiles opendatahub-io/openshell#120)2d7a6f85chore(deps): refresh rpm lockfiles [SECURITY] (chore(deps): refresh rpm lockfiles [SECURITY] opendatahub-io/openshell#122)82a187cdMerge remote-tracking branch 'upstream/main'0e010064Merge pull request CARRY: test(odh): qualify managed workspace SCC identity isolation opendatahub-io/openshell#114 from 2000krysztof/test/odh-managed-workspace-scc-isolation5db572a9Merge remote-tracking branch 'upstream/main'6386a44cchore(deps): refresh rpm lockfiles [SECURITY] (chore(deps): refresh rpm lockfiles [SECURITY] opendatahub-io/openshell#119)eb0bdc9aMerge remote-tracking branch 'upstream/main'9a85667dfeat(kubernetes): host sandboxes on the shared supervisor (feat(kubernetes): host sandboxes on the shared supervisor NVIDIA/OpenShell#4702)07b7a74bfix(server): bound the provisioning-deadline scan's lock wait (fix(server): bound the provisioning-deadline scan's lock wait NVIDIA/OpenShell#4549)eec00ad4fix(podman): Increase the API timeout (Increase the podman driver's API timeout NVIDIA/OpenShell#4820)c018a045Merge remote-tracking branch 'upstream/main'132c5823docs(extensibility): document external compute driver setup (docs(extensibility): document external compute driver setup NVIDIA/OpenShell#4826)78376bd0fix(installer): resolve the gateway config dir like the CLI does (fix(installer): resolve the gateway config dir like the CLI does NVIDIA/OpenShell#4063)ea13dfcerefactor(supervisor): isolate state per sandbox instance (refactor(supervisor): isolate state per sandbox instance NVIDIA/OpenShell#4701)9152b6e4fix(vm): boot a digest-pinned image from the cache without a registry call (fix(vm): boot a digest-pinned image from the cache without a registry call NVIDIA/OpenShell#4582)cb42f5d9fix(snap): use openshell-prover instead of openshell.prover (fix(snap): use openshell-prover instead of openshell.prover NVIDIA/OpenShell#4835)fac82327test(testkit): add the testkit library for end-to-end suites (test(testkit): add the testkit library for end-to-end suites NVIDIA/OpenShell#4724)fe2eadf3Merge remote-tracking branch 'upstream/main'c2830aa0Merge remote-tracking branch 'upstream/main'7bbf1bfaMerge remote-tracking branch 'upstream/main'39d95b42chore(e2e): remove obsolete OpenShift sandbox SCC grant (chore(e2e): remove obsolete OpenShift sandbox SCC grant NVIDIA/OpenShell#4823)86e520a7Merge remote-tracking branch 'upstream/main'1a3330f6Merge remote-tracking branch 'upstream/main'0a516523chore(server): remove unused server macros crate (chore(server): remove unused server macros crate NVIDIA/OpenShell#4818)725d5c6fMerge remote-tracking branch 'upstream/main'029fda68refactor(cli): use Rust SDK transport (refactor(cli): use Rust SDK transport NVIDIA/OpenShell#4817)029ff74bMerge remote-tracking branch 'upstream/main'93508667Merge remote-tracking branch 'upstream/main'7bfc460cMerge remote-tracking branch 'upstream/main'1d880c9afix(examples): repair multi-agent notepad launch (fix(examples): repair multi-agent notepad launch NVIDIA/OpenShell#4807)20cb306dperf(docker): slow steady-state supervisor healthcheck (perf(docker): slow steady-state supervisor healthcheck NVIDIA/OpenShell#4802)4b7486e7test(auth): share fixtures for gateway audit event tests (test(auth): share fixtures for gateway audit event tests NVIDIA/OpenShell#4778)1846b2f0Merge pull request CARRY: fix(odh): restore upstream skill edits and SPDX header check opendatahub-io/openshell#118 from opendatahub-io/fix/sync-skill-license-headers/andre-motta33149c18CARRY: fix(odh): restore upstream skill edits and SPDX header check229382e5docs(sandbox): align workload image requirements with current runtime (docs(sandbox): align workload image requirements with current runtime NVIDIA/OpenShell#3967)5b429171Merge remote-tracking branch 'upstream/main'19ae2b7etest(cli): retry forward tests when ssh loses the port after the check (test(cli): retry forward tests when ssh loses the port after the check NVIDIA/OpenShell#4799)a4c27f9crefactor(auth): share audit helpers for gateway denials and rejections (refactor(auth): share audit helpers for gateway denials and rejections NVIDIA/OpenShell#4777)2fd802effeat(skills): add release-captain skill for the weekly release cadence (feat(skills): add release-captain skill for the weekly release cadence NVIDIA/OpenShell#4435)e7dc051bchore(sdk): update Vite to 8.1.6 (chore(sdk): update Vite to 8.1.6 NVIDIA/OpenShell#4792)220a1d5cchore(ci): use GPT-6.1 Sol for compatibility review (chore(ci): use GPT-6.1 Sol for compatibility review NVIDIA/OpenShell#4796)321b93a8feat(auth): emit OCSF events for SSH session and sandbox token checks (feat(auth): emit OCSF events for SSH session and sandbox token checks NVIDIA/OpenShell#4762)a56614f5CARRY: test(odh): qualify managed workspace SCC identity isolationceecf027fix(deps): update webpki to distrust compromised emSign CAs (fix(deps): update webpki to distrust compromised emSign CAs NVIDIA/OpenShell#4794)95dc7868Merge remote-tracking branch 'upstream/main'469e16d4chore(deps): refresh rpm lockfiles (chore(deps): refresh rpm lockfiles opendatahub-io/openshell#116)f8533ec4chore(deps): refresh rpm lockfiles [SECURITY] (chore(deps): refresh rpm lockfiles [SECURITY] opendatahub-io/openshell#115)d2239437fix(helm): allow shared supervisor SCC-assigned IDs (fix(helm): allow shared supervisor SCC-assigned IDs NVIDIA/OpenShell#4785)837fdfdcfix(sdk/go): accept CLI-compatible gateway names (fix(sdk/go): accept CLI-compatible gateway names NVIDIA/OpenShell#4767)72ab4dd9feat(kubernetes): deploy shared supervisor mode (feat(kubernetes): deploy shared supervisor mode NVIDIA/OpenShell#4695)bd0edb19refactor(tests): move tmachine support files under tests/tmachine (refactor(tests): move tmachine support files under tests/tmachine NVIDIA/OpenShell#4726)c7dd586bci(compatibility): review driver-facing executable flags (ci(compatibility): review driver-facing executable flags NVIDIA/OpenShell#4644)2071796achore(deps): bump certifi from 2026.5.20 to 2026.10.19 (chore(deps): bump certifi from 2026.5.20 to 2026.10.19 NVIDIA/OpenShell#4764)a2b8022efix(python): ship credential driver protocol bindings (fix(python): ship credential driver protocol bindings NVIDIA/OpenShell#4760)465324a8fix(vm): populate an empty guest /etc/hosts with loopback names (fix(vm): populate an empty guest /etc/hosts with loopback names NVIDIA/OpenShell#4182)f7e37af1ci(release): tag Go SDK module on stable releases (ci(release): tag Go SDK module on stable releases NVIDIA/OpenShell#4262)6df42539docs(providers): close stdin in the openrouter smoke test (docs(providers): close stdin in the openrouter smoke test NVIDIA/OpenShell#3907)915a5d15feat(auth): emit OCSF logon events for accepted gateway credentials (feat(auth): emit OCSF logon events for accepted gateway credentials NVIDIA/OpenShell#4761)0f5b4f0fci(release): reuse the promoted prerelease's release notes preview (ci(release): reuse the promoted prerelease's release notes preview NVIDIA/OpenShell#4754)ea265a2fdocs(cli): say --upload cannot take a command (docs(cli): say --upload cannot take a command NVIDIA/OpenShell#4502)32f02644feat(sandbox): initiate supervisor connections across compute drivers (feat(sandbox): initiate supervisor connections across compute drivers NVIDIA/OpenShell#4656)b182255dMerge remote-tracking branch 'upstream/main'a24340befeat(auth): emit OCSF events for gateway authorization denials (feat(auth): emit OCSF events for gateway authorization denials NVIDIA/OpenShell#4728)500132b4Merge pull request test(odh): exclude flaky tier1 cases and name xunit reports opendatahub-io/openshell#113 from Bobbins228/codex/odh-e2e-tier-exclusions-xunit92f3a41bci: update setup-buildx action to v4.4.1 (ci: update setup-buildx action to v4.4.1 NVIDIA/OpenShell#4741)d97709fbchore(deps): update Mermaid lint dependencies (chore(deps): update Mermaid lint dependencies NVIDIA/OpenShell#4743)30492bc5fix(deps): update russh to 0.64.1 (fix(deps): update russh to 0.64.1 NVIDIA/OpenShell#4742)bdb956f2fix(ci): grant prerelease publish pull request read permission (fix(ci): grant prerelease publish pull request read permission NVIDIA/OpenShell#4747)ddbaa297CARRY: test(odh): exclude tier1 cases and name xunit reports292c9c8dfix(vm): flush guest filesystem before a planned sandbox stop (fix(vm): flush guest filesystem before a planned sandbox stop NVIDIA/OpenShell#4195)Merging
GitHub automerge is enabled for this pull request once required checks pass.