Merge branch 'main' into stia_helm

Author: madhuri-rai07

.github/dependabot.yml

@@ -5,10 +5,18 @@
 
 version: 2
 updates:
+  # Update actions on a monthly interval
   - package-ecosystem: "github-actions"
-    directory: "metro-ai-suite/interactive-digital-avatar" # Location of package manifests
+    directory: "/"
     schedule:
       interval: "monthly"
+    cooldown:
+      default-days: 7
+    groups:
+      github-actions-dependency:
+        applies-to: version-updates
+        patterns:
+          - "*"
   - package-ecosystem: "pip"
     directory: "metro-ai-suite/interactive-digital-avatar"
     schedule:

.github/workflows/docs-reusable-workflow.yaml

@@ -2,9 +2,9 @@
 # SPDX-FileCopyrightText: (C) 2025 Intel Corporation
 # SPDX-License-Identifier: Apache-2.0
 
-name: 'Build Documentation'
+name: "Build Documentation"
 
-on:  # yamllint disable-line rule:truthy rule:line-length
+on: # yamllint disable-line rule:truthy rule:line-length
   workflow_call:
     inputs:
       docs_directory:
@@ -33,14 +33,13 @@ permissions:
 jobs:
   build-documentation:
     permissions:
-      contents: read        # minimal privilege required
+      contents: read # minimal privilege required
     runs-on: ubuntu-latest
     env:
       DOCS_DIR: ${{ inputs.docs_directory }}
     steps:
-
       - name: Checkout code
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           # Fetch all history, otherwise sporadic issue with missing tags
           fetch-depth: 0

.github/workflows/documentation-check.yaml

@@ -23,7 +23,7 @@ jobs:
       fail-fast: false
     steps:
     - name: Check out edge-ai-suites repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #4.2.2
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       with:
         persist-credentials: false
         path: edge-ai-suites-repo
@@ -34,7 +34,7 @@ jobs:
         docker compose up -d
         docker ps 
     - name: Checkout docker/docker-bench-security (master)
-      uses: actions/checkout@v4
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       with:
         repository: docker/docker-bench-security
         ref: master
@@ -59,7 +59,7 @@ jobs:
         --label docker_bench_security \
         docker-bench-security > dbs_scan_ibvs_app.txt
     - name: Upload DBS Scan artifact to Github
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f #v6.0.0
       with:
         name: DBS_Scan_Results
         path: docker-bench-security/dbs_scan_*
@@ -146,7 +146,7 @@ jobs:
         trivy fs -s HIGH,CRITICAL --ignore-unfixed . | tee trivy-fs-full-report-ignore-unfixed.txt
         mv trivy-fs* ${{ github.workspace }}/reports/Trivy
     - name: Upload Trivy Scan Reports
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f #v6.0.0
       with:
         name: Trivy-report
         path: reports/Trivy/
@@ -157,7 +157,7 @@ jobs:
       fail-fast: false
     steps:
     - name: Check out edge-ai-suites repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #4.2.2
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       with:
         persist-credentials: false
         path: edge-ai-suites-repo
@@ -177,7 +177,7 @@ jobs:
         docker run --rm -v "${{ github.workspace }}:/src" ghcr.io/pycqa/bandit/bandit -r /src/edge-ai-suites-repo/metro-ai-suite/image-based-video-search/ -f txt -o /src/reports/bandit-report.txt || true >> $GITHUB_STEP_SUMMARY
         echo "Please find full report in bandit-report.txt" >> $GITHUB_STEP_SUMMARY 
     - name: Upload Scan Reports
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f #v6.0.0
       with:
         name: virus-bandit-report
         path: reports/

.github/workflows/ibvs_pull_request.yaml

@@ -21,12 +21,12 @@ jobs:
       fail-fast: false
     steps:
     - name: Check out edge-ai-suites repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #4.2.2
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       with:
         path: edge-ai-suites-repo
         persist-credentials: false
     - name: Install Helm
-      uses: azure/setup-helm@v4
+      uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 #v4.2.0
       with:
         version: v3.15.2  
     - name: Log in to GitHub Container Registry
@@ -37,22 +37,28 @@ jobs:
         password: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Package Helm Chart
+      env:
+        HELM_CHART_TAG: ${{ inputs.helm-chart-tag }}
       run: |
         cd edge-ai-suites-repo/metro-ai-suite/image-based-video-search/chart
-        helm package . --version ${{ inputs.helm-chart-tag }} --app-version ${{ inputs.helm-chart-tag }}
+        helm package . --version "$HELM_CHART_TAG" --app-version "$HELM_CHART_TAG"
     - name: Push to GHCR
+      env:
+        HELM_CHART_TAG: ${{ inputs.helm-chart-tag }}
       run: |
-        CHART_PACKAGE=$(ls edge-ai-suites-repo/metro-ai-suite/image-based-video-search/chart/*-${{ inputs.helm-chart-tag }}.tgz)
+        CHART_PACKAGE=$(ls edge-ai-suites-repo/metro-ai-suite/image-based-video-search/chart/*-"$HELM_CHART_TAG".tgz)
         helm push $CHART_PACKAGE oci://ghcr.io/${{ github.repository }}/metro-ai-suites/
         
     - name: Update Github Summary
+      env:
+        HELM_CHART_TAG: ${{ inputs.helm-chart-tag }}
       run: |
         echo "### ✅ Image Based Video Search helm chart published to github container registry" >> $GITHUB_STEP_SUMMARY
           echo "- Registry: \`oci://ghcr.io/${{ github.repository }}\`" >> $GITHUB_STEP_SUMMARY
-          echo "- Version: \`${{ inputs.helm-chart-tag }}\`" >> $GITHUB_STEP_SUMMARY
+          echo "- Version: \`$HELM_CHART_TAG\`" >> $GITHUB_STEP_SUMMARY
           echo "### Helm Pull Commands" >> $GITHUB_STEP_SUMMARY
           echo '```bash' >> $GITHUB_STEP_SUMMARY
-          echo "helm pull oci://ghcr.io/${{ github.repository }}/metro-ai-suites/image-based-video-search --version ${{ inputs.helm-chart-tag }}" >> $GITHUB_STEP_SUMMARY 
+          echo "helm pull oci://ghcr.io/${{ github.repository }}/metro-ai-suites/image-based-video-search --version $HELM_CHART_TAG" >> $GITHUB_STEP_SUMMARY 
           echo '```' >> $GITHUB_STEP_SUMMARY
     - name: Clean up
       if: always()

.github/workflows/ibvs_weekly_package_helm.yaml

@@ -38,7 +38,7 @@ jobs:
         fi
         docker images --quiet --filter=dangling=true | xargs --no-run-if-empty docker rmi -f
     - name: Checkout edge-ai-libraries (main)
-      uses: actions/checkout@v4
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       with:
         repository: open-edge-platform/edge-ai-libraries
         ref: main
@@ -49,7 +49,7 @@ jobs:
         cd ./edge-ai-libraries/microservices/time-series-analytics/docker
         docker compose down -v 
         docker compose build
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       with:
           path: timeseries
           persist-credentials: false