fix(ci): address review feedback for PR #1884

- Use least-privilege secrets in ci.yaml: enumerate specific secrets
  for e2e-tests instead of secrets:inherit; remove secrets:inherit
  from release job (only uses automatic GITHUB_TOKEN)
- Add permissions (contents:read, id-token:write) to
  forward-compatibility run-e2e-tests job
- Enumerate secrets in forward-compatibility.yaml for consistency
- Fix container-toolkit GitHub repo name (NVIDIA/nvidia-container-toolkit)
- Fix mig-manager GitHub repo name (NVIDIA/mig-parted, not k8s-mig-manager)
- Replace yq-based YAML merge with Helm native multi-file values
  (-f file1 -f file2) since remote test machines lack yq
- Pass OPERATOR_OPTIONS in values-file helm install path to avoid
  silently dropping test-case-specific flags

Co-authored-by: Rajath Agasthya <rajathagasthya@users.noreply.github.com>
Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>

Author: ArangoGutierrez

.github/scripts/get-latest-images.sh

@@ -32,15 +32,15 @@ fi
 case "${COMPONENT}" in
     toolkit)
         IMAGE_REPO="ghcr.io/nvidia/container-toolkit"
-        GITHUB_REPO="NVIDIA/container-toolkit"
+        GITHUB_REPO="NVIDIA/nvidia-container-toolkit"
         ;;
     device-plugin)
         IMAGE_REPO="ghcr.io/nvidia/k8s-device-plugin"
         GITHUB_REPO="NVIDIA/k8s-device-plugin"
         ;;
     mig-manager)
         IMAGE_REPO="ghcr.io/nvidia/k8s-mig-manager"
-        GITHUB_REPO="NVIDIA/k8s-mig-manager"
+        GITHUB_REPO="NVIDIA/mig-parted"
         ;;
     *)
         echo "Error: Unknown component '${COMPONENT}'" >&2

.github/workflows/ci.yaml

@@ -80,7 +80,10 @@ jobs:
     with:
       operator_image: ${{ needs.variables.outputs.operator_image }}
       operator_version: ${{ needs.variables.outputs.operator_version }}
-    secrets: inherit
+    secrets:
+      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      AWS_SSH_KEY: ${{ secrets.AWS_SSH_KEY }}
 
   release:
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
@@ -92,4 +95,3 @@ jobs:
     with:
       commit_short_sha: ${{ needs.variables.outputs.commit_short_sha }}
       operator_image_base: ${{ needs.variables.outputs.operator_image_base }}
-    secrets: inherit

.github/workflows/forward-compatibility.yaml

@@ -69,12 +69,20 @@ jobs:
 
   run-e2e-tests:
     needs: [fetch-latest-images]
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/e2e-tests.yaml
     with:
       operator_image: ghcr.io/nvidia/gpu-operator
       operator_version: main-latest
       use_values_override: true
-    secrets: inherit
+    secrets:
+      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      AWS_SSH_KEY: ${{ secrets.AWS_SSH_KEY }}
+      SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+      SLACK_CHANNEL_ID: ${{ secrets.SLACK_CHANNEL_ID }}
 
   notify-failure:
     runs-on: ubuntu-latest

tests/scripts/install-operator.sh

@@ -34,30 +34,26 @@ if [[ "${USE_VALUES_FILE}" == "true" ]]; then
 	# Generate a temporary values file from environment variables
 	# and merge it with the provided VALUES_FILE
 	TEMP_ENV_VALUES=$(mktemp)
-	trap 'rm -f "${TEMP_ENV_VALUES:-}" "${COMBINED_VALUES:-}"' EXIT
+	trap 'rm -f "${TEMP_ENV_VALUES:-}"' EXIT
 	${SCRIPT_DIR}/env-to-values.sh "${TEMP_ENV_VALUES}"
 
-	# If VALUES_FILE exists, merge it with env-generated values using yq
-	# Otherwise just use the env-generated values
+	# If VALUES_FILE exists, use both files with Helm's native multi-file
+	# support (-f). Helm merges values in order, with later files taking
+	# precedence — so env-generated values override the provided file.
 	if [[ -f "${VALUES_FILE}" ]]; then
 		echo ""
 		echo "Using provided values file: ${VALUES_FILE}"
 		cat "${VALUES_FILE}"
 		echo ""
-		echo "Merged with environment-based values:"
+		echo "Environment-based values (takes precedence):"
 		cat "${TEMP_ENV_VALUES}"
 
-		# Create a combined values file using yq for proper YAML merging
-		COMBINED_VALUES=$(mktemp)
-		if ! command -v yq >/dev/null 2>&1; then
-			echo "Error: yq is required to merge YAML values files but was not found in PATH." >&2
-			echo "Install yq: https://github.com/mikefarah/yq" >&2
-			exit 1
-		fi
-		# yq merges YAML properly, with later files taking precedence
-		yq ea '. as $item ireduce ({}; . * $item )' "${VALUES_FILE}" "${TEMP_ENV_VALUES}" > "${COMBINED_VALUES}"
-		VALUES_FILE="${COMBINED_VALUES}"
+		# Pass both files to helm; the env values file comes second
+		# so its values take precedence over the override file.
+		EXTRA_VALUES_FILES="-f ${VALUES_FILE}"
+		VALUES_FILE="${TEMP_ENV_VALUES}"
 	else
+		EXTRA_VALUES_FILES=""
 		VALUES_FILE="${TEMP_ENV_VALUES}"
 	fi
 
@@ -113,7 +109,9 @@ if [[ "${USE_VALUES_FILE}" == "true" ]]; then
 	echo "Using values file approach: ${VALUES_FILE}"
 	${HELM} install ${PROJECT_DIR}/deployments/gpu-operator --generate-name \
 		-n "${TEST_NAMESPACE}" \
+		${EXTRA_VALUES_FILES} \
 		-f "${VALUES_FILE}" \
+		${OPERATOR_OPTIONS} \
 		--wait
 else
 	echo "Using --set flags approach"