Jonburdo 20260422 sync

.github/pull.yml

@@ -0,0 +1,5 @@
+version: "1"
+rules:
+  - base: main
+    upstream: kubeflow:main
+label: "tide/merge-method-merge"

.github/workflows/async-upload-test.yml

@@ -21,14 +21,14 @@ permissions: # set contents: read at top-level, per OpenSSF ScoreCard rule Token
 
 env:
   # Async Job
-  JOB_IMG_REGISTRY: ghcr.io
-  JOB_IMG_ORG: kubeflow
-  JOB_IMG_NAME: model-registry/job/async-upload
+  JOB_IMG_REGISTRY: quay.io
+  JOB_IMG_ORG: opendatahub
+  JOB_IMG_NAME: model-registry-job-async-upload
   JOB_IMG_VERSION: cicd
   # MR Server
-  IMG_REGISTRY: ghcr.io
-  IMG_ORG: kubeflow
-  IMG_REPO: model-registry/server
+  IMG_REGISTRY: quay.io
+  IMG_ORG: opendatahub
+  IMG_REPO: model-registry
   IMG_VERSION: cicd
   PUSH_IMAGE: false
 

.github/workflows/build-and-push-async-upload.yml

@@ -4,8 +4,6 @@ on:
   push:
     branches:
       - 'main'
-    tags:
-      - 'v*'
     paths:
       - 'jobs/async-upload/**'
       - '!LICENSE*'
@@ -18,12 +16,11 @@ on:
 permissions: read-all
 
 env:
-  IMG_REGISTRY: ghcr.io
-  IMG_ORG: kubeflow
-  IMG_NAME: model-registry/job/async-upload
-  REGISTRY_USER: ${{ github.actor }}
-  REGISTRY_PWD: ${{ secrets.GITHUB_TOKEN }}
-  PLATFORMS: linux/arm64,linux/amd64
+  IMG_REGISTRY: quay.io
+  IMG_ORG: opendatahub
+  IMG_NAME: model-registry-job-async-upload
+  REGISTRY_USER: ${{ secrets.QUAY_USERNAME }}
+  REGISTRY_PWD: ${{ secrets.QUAY_PASSWORD }}
 
 jobs:
   build-and-push:

.github/workflows/build-and-push-controller-image.yml

@@ -1,26 +1,28 @@
 name: Controller container image build and tag
 on:
-  push:
-    branches:
-      - 'main'
-    tags:
-      - 'v*'
-    paths-ignore:
-      - 'LICENSE*'
-      - '**.gitignore'
-      - '**.md'
-      - '**.txt'
-      - '.github/ISSUE_TEMPLATE/**'
-      - '.github/dependabot.yml'
-      - 'docs/**'
+  workflow_dispatch: {}
+  # FIXME: Re-enable when the repo exists in opendatahub
+  #push:
+  #  branches:
+  #    - 'main'
+  #  tags:
+  #    - 'v*'
+  #  paths-ignore:
+  #    - 'LICENSE*'
+  #    - '**.gitignore'
+  #    - '**.md'
+  #    - '**.txt'
+  #    - '.github/ISSUE_TEMPLATE/**'
+  #    - '.github/dependabot.yml'
+  #    - 'docs/**'
 permissions: read-all
 env:
-  IMG_REGISTRY: ghcr.io
-  IMG_ORG: kubeflow
-  IMG_REPO: model-registry/controller
+  IMG_REGISTRY: quay.io
+  IMG_ORG: opendatahub
+  IMG_REPO: model-registry-controller
   PUSH_IMAGE: true
-  DOCKER_USER: ${{ github.actor }}
-  DOCKER_PWD: ${{ secrets.GITHUB_TOKEN }}
+  DOCKER_USER: ${{ secrets.QUAY_USERNAME }}
+  DOCKER_PWD: ${{ secrets.QUAY_PASSWORD }}
   PLATFORMS: linux/arm64,linux/amd64
 jobs:
   build-controller-image:

.github/workflows/build-and-push-csi-image.yml

@@ -15,12 +15,12 @@ on:
       - 'docs/**'
 permissions: read-all
 env:
-  IMG_REGISTRY: ghcr.io
-  IMG_ORG: kubeflow
-  IMG_REPO: model-registry/storage-initializer
+  IMG_REGISTRY: quay.io
+  IMG_ORG: opendatahub
+  IMG_REPO: model-registry-storage-initializer
   PUSH_IMAGE: true
-  DOCKER_USER: ${{ github.actor }}
-  DOCKER_PWD: ${{ secrets.GITHUB_TOKEN }}
+  DOCKER_USER: ${{ secrets.QUAY_USERNAME }}
+  DOCKER_PWD: ${{ secrets.QUAY_PASSWORD }}
   PLATFORMS: linux/arm64,linux/amd64
 jobs:
   build-csi-image:

.github/workflows/build-and-push-image.yml

@@ -3,8 +3,6 @@ on:
   push:
     branches:
       - 'main'
-    tags:
-      - 'v*'
     paths-ignore:
       - 'LICENSE*'
       - '**.gitignore'
@@ -14,12 +12,12 @@ on:
       - '.github/dependabot.yml'
       - 'docs/**'
 env:
-  IMG_REGISTRY: ghcr.io
-  IMG_ORG: kubeflow
-  IMG_REPO: model-registry/server
+  IMG_REGISTRY: quay.io
+  IMG_ORG: opendatahub
+  IMG_REPO: model-registry
   PUSH_IMAGE: true
-  DOCKER_USER: ${{ github.actor }}
-  DOCKER_PWD: ${{ secrets.GITHUB_TOKEN }}
+  DOCKER_USER: ${{ secrets.QUAY_USERNAME }}
+  DOCKER_PWD: ${{ secrets.QUAY_PASSWORD }}
   PLATFORMS: linux/arm64,linux/amd64
 
 permissions: read-all

.github/workflows/build-and-push-testops-image.yml

@@ -0,0 +1,122 @@
+name: Build and Push testops container image
+
+on:
+  push:
+    branches:
+      - 'main'
+      - 'stable'
+      - 'stable-2.x'
+    paths:
+      - 'Dockerfile.testops'
+      - 'clients/python/**'
+      - 'api/**'
+      - 'manifests/**'
+      - 'scripts/**'
+      - '!LICENSE*'
+      - '!**.gitignore'
+      - '!**.md'
+      - '!**.txt'
+      - '.github/workflows/build-and-push-testops-image.yml' # self
+
+permissions: # set contents: read at top-level, per OpenSSF ScoreCard rule TokenPermissionsID
+  contents: read
+
+env:
+  IMG_REGISTRY: quay.io
+  IMG_ORG: opendatahub
+  IMG_NAME: model-registry-testops
+  REGISTRY_USER: ${{ secrets.QUAY_USERNAME }}
+  REGISTRY_PWD: ${{ secrets.QUAY_PASSWORD }}
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    if: github.repository == 'opendatahub-io/model-registry'
+    permissions:
+      contents: read
+      packages: write
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v5.0.0
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+
+    - name: Log in to the Container registry
+      uses: docker/login-action@v3
+      with:
+        registry: ${{ env.IMG_REGISTRY }}
+        username: ${{ env.REGISTRY_USER }}
+        password: ${{ env.REGISTRY_PWD }}
+
+    - name: Set branch-based environment
+      run: |
+        commit_sha=${{ github.sha }}
+        branch_name=${GITHUB_REF#refs/heads/}
+        tag=${branch_name}-${commit_sha:0:7}
+        # Calculate expiration date (7 days from now)
+        expiry_date=$(date -d '+7 days' -u +%Y-%m-%dT%H:%M:%SZ)
+
+        echo "VERSION=${tag}" >> $GITHUB_ENV
+        echo "BRANCH_NAME=${branch_name}" >> $GITHUB_ENV
+        echo "EXPIRY_DATE=${expiry_date}" >> $GITHUB_ENV
+
+    - name: Set tag environment # this is for v* tag image build
+      if: startsWith(github.ref, 'refs/tags/v')
+      run: |
+        echo "VERSION=${{ github.ref_name }}" >> $GITHUB_ENV
+
+    - name: Build and push SHA-based image (expires in 7 days)
+      uses: docker/build-push-action@v6
+      with:
+        context: .
+        file: ./Dockerfile.testops
+        push: true
+        tags: |
+          ${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_NAME }}:${{ env.VERSION }}
+        labels: |
+          org.opencontainers.image.source=https://github.com/${{ github.repository }}
+          org.opencontainers.image.revision=${{ github.sha }}
+          org.opencontainers.image.created=${{ github.event.repository.updated_at }}
+          quay.expires-after=7d
+        cache-from: type=gha
+        cache-to: type=gha,mode=max
+        provenance: mode=max
+        sbom: true
+
+    - name: Build and push persistent branch tags (main)
+      if: github.ref == 'refs/heads/main'
+      uses: docker/build-push-action@v6
+      with:
+        context: .
+        file: ./Dockerfile.testops
+        push: true
+        tags: |
+          ${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_NAME }}:${{ env.BRANCH_NAME }}
+          ${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_NAME }}:latest
+        labels: |
+          org.opencontainers.image.source=https://github.com/${{ github.repository }}
+          org.opencontainers.image.revision=${{ github.sha }}
+          org.opencontainers.image.created=${{ github.event.repository.updated_at }}
+        cache-from: type=gha
+        cache-to: type=gha,mode=max
+        provenance: mode=max
+        sbom: true
+
+    - name: Build and push persistent branch tags (non-main)
+      if: github.ref != 'refs/heads/main'
+      uses: docker/build-push-action@v6
+      with:
+        context: .
+        file: ./Dockerfile.testops
+        push: true
+        tags: |
+          ${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_NAME }}:${{ env.BRANCH_NAME }}
+        labels: |
+          org.opencontainers.image.source=https://github.com/${{ github.repository }}
+          org.opencontainers.image.revision=${{ github.sha }}
+          org.opencontainers.image.created=${{ github.event.repository.updated_at }}
+        cache-from: type=gha
+        cache-to: type=gha,mode=max
+        provenance: mode=max
+        sbom: true

.github/workflows/build-image-pr.yml

@@ -16,9 +16,9 @@ permissions: # set contents: read at top-level, per OpenSSF ScoreCard rule Token
   contents: read
 
 env:
-  IMG_REGISTRY: ghcr.io
-  IMG_ORG: kubeflow
-  IMG_REPO: model-registry/server
+  IMG_REGISTRY: quay.io
+  IMG_ORG: opendatahub
+  IMG_REPO: model-registry
   PUSH_IMAGE: false
   BRANCH: ${{ github.base_ref }}
 jobs:
@@ -47,13 +47,41 @@ jobs:
           IMG: "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_REPO }}:${{ steps.tags.outputs.tag }}"
         run: |
           kind load docker-image -n chart-testing ${IMG}
-      - name: Deploy Model Registry using manifests
+      - name: Deploy Operator With Test Image
         env:
           IMG: "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_REPO }}:${{ steps.tags.outputs.tag }}"
-        run: ./scripts/deploy_on_kind.sh
-      - name: Deployment logs
         run: |
-          kubectl logs -n kubeflow deployment/model-registry-deployment
+          echo "Deploying operator from model-registry-operator branch ${BRANCH}"
+          kubectl apply -k "https://github.com/opendatahub-io/model-registry-operator.git/config/default?ref=${BRANCH}"
+          kubectl set env -n model-registry-operator-system deployment/model-registry-operator-controller-manager REST_IMAGE="${IMG}"
+          kubectl wait --for=condition=Available=true -n model-registry-operator-system deployment/model-registry-operator-controller-manager --timeout=5m
+      - name: Display about MR Operator in KinD cluster status in any case
+        if: always()
+        run: |
+          kubectl get deployments -n model-registry-operator-system -o wide
+          kubectl get pods -n model-registry-operator-system -o wide --show-labels
+          kubectl events -A
+          kubectl describe -n model-registry-operator-system deployment/model-registry-operator-controller-manager
+          for p in $(kubectl get pods -n model-registry-operator-system -o name); do
+            echo "===== Logs for $p ====="
+            kubectl logs -n model-registry-operator-system $p
+          done
+      - name: Create Test Registry
+        run: |
+          kubectl apply -k "https://github.com/opendatahub-io/model-registry-operator.git/config/samples/mysql?ref=${BRANCH}"
+          kubectl get mr
+      - name: Wait for Test Registry Deployment
+        run: |
+          kubectl wait --for=condition=Available=true deployment/model-registry-db --timeout=5m
+          kubectl wait --for=condition=Available=true modelregistries/modelregistry-sample --timeout=5m
+      - name: Display KinD cluster status in any case
+        if: always()
+        run: |
+          kubectl get deployments -o wide
+          kubectl get pods -o wide
+          kubectl events
+          kubectl get modelregistries/modelregistry-sample -o wide
+          kubectl describe modelregistries/modelregistry-sample
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
@@ -73,6 +101,10 @@ jobs:
           pip install dist/*.whl
       - name: Connect with Python client
         run: |
-          kubectl port-forward -n kubeflow service/model-registry-service 8080:8080 &
+          kubectl port-forward service/modelregistry-sample 8080:8080 &
           sleep 5
           python test/python/test_mr_conn.py http://localhost 8080
+      - name: Check Pod Logs
+        if: always()
+        run: |
+          kubectl logs -l app=modelregistry-sample --all-containers --prefix

.github/workflows/build-image-ui-pr.yml

@@ -16,7 +16,7 @@ permissions: # set contents: read at top-level, per OpenSSF ScoreCard rule Token
 
 env:
   IMG_ORG: kubeflow
-  IMG_REPO: model-registry/ui
+  IMG_REPO: model-registry-ui
   PUSH_IMAGE: false
   BRANCH: ${{ github.base_ref }}
 jobs:

.github/workflows/build.yml

@@ -36,3 +36,9 @@ jobs:
         run: make test-cover
       - name: Catalog unit tests
         run: make -C catalog test-cover
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v4.5.0
+        with:
+          files: coverage.txt
+          token: ${{ secrets.CODECOV_TOKEN }}
+          fail_ci_if_error: true