Merge branch 'main' into feat/projects-viz

Author: raunakab

.cursor/skills/merge-dependabot-prs/SKILL.md

@@ -9,11 +9,11 @@ description: >
   Use when the user asks to merge, clean up, clear out, or land Dependabot (or
   similar bot-authored) PRs.
 license: MIT
-compatibility: Requires git, pre-commit, uv, bun, and gh (GitHub CLI) authenticated with write access to onyx-dot-app/onyx.
+compatibility: Requires git, pre-commit, uv, bun, ods (the repo venv's devtools script), and gh (GitHub CLI) authenticated with write access to onyx-dot-app/onyx.
 metadata:
   author: jmelahman
-  version: "1.0"
-allowed-tools: Bash(gh:*), Bash(git:*), Bash(pre-commit:*), Bash(bun install:*)
+  version: "1.1"
+allowed-tools: Bash(gh:*), Bash(git:*), Bash(pre-commit:*), Bash(bun install:*), Bash(ods audit:*)
 ---
 
 # Merge Dependabot PRs
@@ -58,9 +58,18 @@ same package, or a manual bump PR overlapping a bot one.
 ## 2. Triage into buckets, confirm the plan
 
 These PRs aren't in a rush. Wait for every check to complete — required and
-advisory alike (e.g. `storybook-build` on `web/**` changes, which never gates
-the queue but pages Slack if broken post-merge) — and treat any red check as
-a failure to classify, never as noise to skip.
+advisory alike — and treat any red check as a failure to classify, never as
+noise to skip. Two advisory checks matter here even though the queue ignores
+them:
+
+- `storybook-build` (`pr-storybook-build.yml`) on `web/**` changes — never
+  gates the queue, but pages Slack if broken post-merge.
+- `audit` (`audit.yml`) — runs on every lockfile, `pyproject.toml`,
+  `.github/workflows/**`, and `tools/ods/**` change, so it runs on almost every
+  Dependabot PR. Treat it as **required for this skill**: a Dependabot PR does
+  not get enqueued while `audit` is red. A red `audit` means the bump either
+  pulled in a vulnerable version or landed next to one, and merging it ships
+  the finding.
 
 - **Green & ready** — every check completed and passing, advisory included.
 - **Failing — mechanical** — only a generated/lock file wasn't regenerated
@@ -80,7 +89,29 @@ in per PR.
 
 Summarize buckets and proposed actions, confirm with `AskUserQuestion`, then act.
 
-## 3. Green: approve and enqueue
+## 3. Green: audit, approve, enqueue
+
+Run `ods audit` on the PR's code before you enqueue it. CI's `audit` job covers
+this, but it is skipped when the PR touches no audited path, and it is advisory
+in the queue — so confirm it yourself for every Dependabot PR.
+
+```bash
+gh pr checkout <pr>
+source .venv/bin/activate   # ods ships in the repo venv
+ods audit --fail-on=critical
+```
+
+`ods audit` scans `bun.lock` and `uv.lock` plus open Dependabot alerts, and
+exits non-zero on an unignored finding at or above `--fail-on`
+([tools/ods/README.md](../../../tools/ods/README.md)). It reads the **working
+tree**, so the PR branch must be checked out — a run on `main` says nothing
+about the bump.
+
+**If it exits non-zero, STOP.** Don't enqueue and don't try to work out whether
+the finding came from this bump or was already on `main`. Report the advisory ids
+and let the user say how to proceed.
+
+Then, once clean:
 
 ```bash
 gh pr review <pr> --approve

.github/actions/build-backend-image/action.yml

@@ -61,6 +61,10 @@ runs:
         build-args: |
           BASE_IMAGE_REGISTRY=${{ env.BASE_IMAGE_REGISTRY }}
         tags: ${{ inputs.runs-on-ecr-cache }}:nightly-llm-it-backend-${{ inputs.run-id }}
+        # Attestations attach as ECR referrers to the image digest, which is
+        # stable across runs and caps out at 100 per subject.
+        provenance: false
+        sbom: false
         cache-from: |
           type=registry,ref=${{ inputs.runs-on-ecr-cache }}:backend-cache-${{ inputs.github-sha }}
           type=registry,ref=${{ inputs.runs-on-ecr-cache }}:backend-cache-${{ steps.format-branch.outputs.cache-suffix }}

.github/actions/build-devcontainer-image/action.yml

@@ -63,6 +63,10 @@ runs:
         build-args: |
           BASE_IMAGE_REGISTRY=${{ env.BASE_IMAGE_REGISTRY }}
         tags: ${{ inputs.runs-on-ecr-cache }}:${{ inputs.tag-prefix }}-${{ inputs.run-id }}
+        # Attestations attach as ECR referrers to the image digest, which is
+        # stable across runs and caps out at 100 per subject.
+        provenance: false
+        sbom: false
         cache-from: |
           type=registry,ref=${{ inputs.runs-on-ecr-cache }}:devcontainer-cache-${{ inputs.github-sha }}
           type=registry,ref=${{ inputs.runs-on-ecr-cache }}:devcontainer-cache-${{ steps.format-branch.outputs.cache-suffix }}

.github/actions/build-model-server-image/action.yml

@@ -82,6 +82,10 @@ runs:
           BASE_IMAGE_REGISTRY=${{ env.BASE_IMAGE_REGISTRY }}
           ${{ env.DHI_PYTHON_BUILD_ARGS }}
         tags: ${{ inputs.runs-on-ecr-cache }}:${{ inputs.tag-prefix }}-${{ inputs.run-id }}
+        # Attestations attach as ECR referrers to the image digest, which is
+        # stable across runs and caps out at 100 per subject.
+        provenance: false
+        sbom: false
         cache-from: |
           type=registry,ref=${{ inputs.runs-on-ecr-cache }}:model-server-cache-${{ inputs.github-sha }}
           type=registry,ref=${{ inputs.runs-on-ecr-cache }}:model-server-cache-${{ steps.format-branch.outputs.cache-suffix }}

.github/actions/install-deps-and-generate-openapi-client/action.yml

@@ -0,0 +1,20 @@
+name: "Install Python deps"
+description: "Syncs Python deps inside the devcontainer into the bind-mounted workspace, so later `uv run --no-sync` steps share one venv."
+inputs:
+  devcontainer-image:
+    description: "Fully qualified devcontainer image reference (registry:tag)"
+    required: true
+runs:
+  using: "composite"
+  steps:
+    - name: Sync deps in devcontainer
+      shell: bash
+      env:
+        DEVCONTAINER_IMAGE: ${{ inputs.devcontainer-image }}
+        WORKSPACE: ${{ github.workspace }}
+      run: |
+        docker run --rm \
+          -v "${WORKSPACE}:/workspace" \
+          -w /workspace \
+          "${DEVCONTAINER_IMAGE}" \
+          uv sync --frozen --no-group model_server

.github/actions/install-python-deps/action.yml

@@ -85,8 +85,8 @@ runs:
           minio \
           inference_model_server
 
-    - name: Install Python deps and generate OpenAPI client
-      uses: ./.github/actions/install-deps-and-generate-openapi-client
+    - name: Install Python deps
+      uses: ./.github/actions/install-python-deps
       with:
         devcontainer-image: ${{ inputs.runs-on-ecr-cache }}:nightly-llm-it-devcontainer-${{ inputs.run-id }}
 

.github/actions/run-nightly-provider-chat-test/action.yml

@@ -50,7 +50,7 @@ jobs:
       - name: Configure AWS credentials
         id: aws
         continue-on-error: true # the audit still runs (with no suppressions) if creds are unavailable
-        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # ratchet:aws-actions/configure-aws-credentials@v6.2.2
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # ratchet:aws-actions/configure-aws-credentials@v6.2.3
         with:
           role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
           aws-region: us-east-2

.github/actions/setup-playwright/action.yml

@@ -176,7 +176,7 @@ jobs:
 
       - name: Configure AWS credentials
         continue-on-error: true # the audit still runs (with no suppressions) if creds are unavailable
-        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # ratchet:aws-actions/configure-aws-credentials@v6.2.2
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # ratchet:aws-actions/configure-aws-credentials@v6.2.3
         with:
           role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
           aws-region: us-east-2
@@ -186,6 +186,16 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: uv run --no-sync --with onyx-devtools ods audit --fail-on=critical
 
+  # Validate that a pushed release tag is versioned correctly, via
+  # `ods release --check`. A cloud tag must be the tag `ods release cloud`
+  # would have cut: its commit on origin/main, its base matching the release
+  # branches, its counter in sequence. Stable (vX.Y.Z) and beta
+  # (vX.Y.Z-beta.N) tags must sit on their release/vX.Y branch with the
+  # patch or counter in sequence; a beta must precede its stable release.
+  #
+  # Deliberately gated on the raw ref name, not on computed tag-type outputs:
+  # a tag that is neither a valid cloud nor stable tag fails loudly here
+  # instead of being skipped by a wrongly computed output.
   check-version-tag:
     runs-on: ubuntu-slim
     timeout-minutes: 10
@@ -204,9 +214,9 @@ jobs:
           # NOTE: This isn't caching much and zizmor suggests this could be poisoned, so disable.
           enable-cache: false
 
-      - name: Validate tag is versioned correctly
+      - name: Validate the tag is versioned correctly
         run: |
-          uv run --no-sync --with release-tag tag --check
+          uv run --no-sync --with onyx-devtools ods release --check --ref "$GITHUB_REF_NAME"
 
   notify-slack-on-tag-check-failure:
     needs:
@@ -334,7 +344,7 @@ jobs:
 
       - name: Configure AWS credentials
         if: startsWith(matrix.platform, 'macos-')
-        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c
         with:
           role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
           aws-region: us-east-2
@@ -505,7 +515,7 @@ jobs:
           persist-credentials: false
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c
         with:
           role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
           aws-region: us-east-2
@@ -587,7 +597,7 @@ jobs:
           persist-credentials: false
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c
         with:
           role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
           aws-region: us-east-2
@@ -664,7 +674,7 @@ jobs:
       - uses: runs-on/action@4e5f72399b6b17f2e79c511c1b38a315a64d22dc
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c
         with:
           role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
           aws-region: us-east-2
@@ -761,7 +771,7 @@ jobs:
           persist-credentials: false
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c
         with:
           role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
           aws-region: us-east-2
@@ -815,7 +825,6 @@ jobs:
             NEXT_PUBLIC_POSTHOG_KEY=${{ secrets.POSTHOG_KEY }}
             NEXT_PUBLIC_POSTHOG_HOST=${{ secrets.POSTHOG_HOST }}
             NEXT_PUBLIC_SENTRY_DSN=${{ secrets.SENTRY_DSN }}
-            NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=${{ secrets.STRIPE_PUBLISHABLE_KEY }}
             NEXT_PUBLIC_RECAPTCHA_SITE_KEY=${{ vars.NEXT_PUBLIC_RECAPTCHA_SITE_KEY }}
             NEXT_PUBLIC_GTM_ENABLED=true
             NEXT_PUBLIC_FORGOT_PASSWORD_ENABLED=true
@@ -854,7 +863,7 @@ jobs:
           persist-credentials: false
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c
         with:
           role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
           aws-region: us-east-2
@@ -908,7 +917,6 @@ jobs:
             NEXT_PUBLIC_POSTHOG_KEY=${{ secrets.POSTHOG_KEY }}
             NEXT_PUBLIC_POSTHOG_HOST=${{ secrets.POSTHOG_HOST }}
             NEXT_PUBLIC_SENTRY_DSN=${{ secrets.SENTRY_DSN }}
-            NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=${{ secrets.STRIPE_PUBLISHABLE_KEY }}
             NEXT_PUBLIC_RECAPTCHA_SITE_KEY=${{ vars.NEXT_PUBLIC_RECAPTCHA_SITE_KEY }}
             NEXT_PUBLIC_GTM_ENABLED=true
             NEXT_PUBLIC_FORGOT_PASSWORD_ENABLED=true
@@ -942,7 +950,7 @@ jobs:
       - uses: runs-on/action@4e5f72399b6b17f2e79c511c1b38a315a64d22dc
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c
         with:
           role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
           aws-region: us-east-2
@@ -1026,7 +1034,7 @@ jobs:
           persist-credentials: false
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c
         with:
           role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
           aws-region: us-east-2
@@ -1122,7 +1130,7 @@ jobs:
           persist-credentials: false
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c
         with:
           role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
           aws-region: us-east-2
@@ -1212,7 +1220,7 @@ jobs:
       - uses: runs-on/action@4e5f72399b6b17f2e79c511c1b38a315a64d22dc
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c
         with:
           role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
           aws-region: us-east-2
@@ -1319,7 +1327,7 @@ jobs:
           persist-credentials: false
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c
         with:
           role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
           aws-region: us-east-2
@@ -1405,7 +1413,7 @@ jobs:
           persist-credentials: false
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c
         with:
           role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
           aws-region: us-east-2
@@ -1485,7 +1493,7 @@ jobs:
       - uses: runs-on/action@4e5f72399b6b17f2e79c511c1b38a315a64d22dc
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c
         with:
           role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
           aws-region: us-east-2
@@ -1585,7 +1593,7 @@ jobs:
 
       - name: Configure AWS credentials
         if: needs.determine-builds.outputs.is-test-run != 'true' && vars.DOCKER_NO_CACHE != 'true'
-        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c
         with:
           role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
           aws-region: us-east-2
@@ -1651,7 +1659,7 @@ jobs:
           persist-credentials: false
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c
         with:
           role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
           aws-region: us-east-2
@@ -1724,7 +1732,7 @@ jobs:
           persist-credentials: false
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c
         with:
           role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
           aws-region: us-east-2
@@ -1792,7 +1800,7 @@ jobs:
       - uses: runs-on/action@4e5f72399b6b17f2e79c511c1b38a315a64d22dc
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c
         with:
           role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
           aws-region: us-east-2
@@ -2035,7 +2043,7 @@ jobs:
       - name: Configure AWS credentials
         if: steps.should-run.outputs.run == 'true'
         continue-on-error: true # the audit still runs (with no suppressions) if creds are unavailable
-        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # ratchet:aws-actions/configure-aws-credentials@v6.2.2
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # ratchet:aws-actions/configure-aws-credentials@v6.2.3
         with:
           role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
           aws-region: us-east-2