sync: main to stable

.github/workflows/python-tests.yml

@@ -59,7 +59,7 @@ jobs:
         with:
           python-version: ${{ matrix.python }}
       - name: Set up Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: ${{ matrix.nodejs }}
       - name: Upgrade pip

.github/workflows/scorecard.yml

@@ -66,6 +66,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
         with:
           sarif_file: results.sarif

.github/workflows/trivy-image-scanning.yaml

@@ -45,7 +45,7 @@ jobs:
           timeout: 30m0s
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@a899987af240c0578ed84ce13c02319a693e168f # v4
+        uses: github/codeql-action/upload-sarif@0b7b740d4cd9b44f80c907b666497564df09d1d9 # v4
         if: always()
         with:
           sarif_file: 'trivy-results-${{ env.SANITIZED_IMAGE_NAME }}.sarif'

.github/workflows/ui-frontend-build.yml

@@ -29,7 +29,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Set up Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: "20"
 

Dockerfile.testops

@@ -31,17 +31,25 @@ RUN ARCH="${TARGETARCH:-amd64}" && \
     echo "$(<kubectl.sha256) kubectl" | sha256sum -c - && \
     install -m 0755 kubectl /usr/local/bin/ && rm -f kubectl kubectl.sha256
 
-# Install poetry and pytest
-RUN pip install --no-cache-dir poetry pytest
-
 # Give write permissions to all copied folders and change ownership to odh user
 RUN chown -R odh:odh /home/odh && \
     chmod -R 755 api/ manifests/ scripts/
+# Install poetry and pytest (as root, into the app-root virtualenv)
+RUN pip install --no-cache-dir poetry pytest
+
 RUN chown -R odh:odh /opt/app-root/src/
+
+# Disable the base image's auto-activation of /opt/app-root virtualenv so
+# Poetry creates its own in-project .venv instead of installing into root-owned dirs
+ENV VIRTUAL_ENV="" \
+    BASH_ENV="" \
+    ENV="" \
+    PROMPT_COMMAND="" \
+    POETRY_VIRTUALENVS_IN_PROJECT=true
+
 # Switch to odh user
 USER odh
 
-# Add user's pip bin to PATH
 ENV PATH="/home/odh/.local/bin:$PATH"
 
 # Set entrypoint to make command

clients/ui/frontend/src/app/pages/modelCatalog/screens/ModelCatalog.tsx

@@ -42,7 +42,7 @@ const ModelCatalog: React.FC = () => {
         provideChildrenPadding
       >
         <Sidebar hasBorder hasGutter>
-          <SidebarPanel>
+          <SidebarPanel variant="sticky">
             <ModelCatalogFilters />
           </SidebarPanel>
           <SidebarContent>

go.mod

@@ -12,7 +12,7 @@ require (
 	github.com/go-sql-driver/mysql v1.9.3
 	github.com/golang-migrate/migrate/v4 v4.19.1
 	github.com/golang/glog v1.2.5
-	github.com/jackc/pgx/v5 v5.9.1
+	github.com/jackc/pgx/v5 v5.9.2
 	github.com/kubeflow/model-registry/catalog/pkg/openapi v0.0.0-00010101000000-000000000000
 	github.com/kubeflow/model-registry/pkg/openapi v0.0.0
 	github.com/lib/pq v1.12.3
@@ -28,7 +28,7 @@ require (
 	gorm.io/driver/mysql v1.6.0
 	gorm.io/driver/postgres v1.6.0
 	gorm.io/gorm v1.31.1
-	k8s.io/apimachinery v0.35.3
+	k8s.io/apimachinery v0.35.4
 )
 
 require (

go.sum

@@ -92,8 +92,8 @@ github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsI
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgx/v5 v5.9.1 h1:uwrxJXBnx76nyISkhr33kQLlUqjv7et7b9FjCen/tdc=
-github.com/jackc/pgx/v5 v5.9.1/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
+github.com/jackc/pgx/v5 v5.9.2 h1:3ZhOzMWnR4yJ+RW1XImIPsD1aNSz4T4fyP7zlQb56hw=
+github.com/jackc/pgx/v5 v5.9.2/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
@@ -241,8 +241,8 @@ gorm.io/gorm v1.31.1 h1:7CA8FTFz/gRfgqgpeKIBcervUn3xSyPUmr6B2WXJ7kg=
 gorm.io/gorm v1.31.1/go.mod h1:XyQVbO2k6YkOis7C2437jSit3SsDK72s7n7rsSHd+Gs=
 gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
 gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
-k8s.io/apimachinery v0.35.3 h1:MeaUwQCV3tjKP4bcwWGgZ/cp/vpsRnQzqO6J6tJyoF8=
-k8s.io/apimachinery v0.35.3/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns=
+k8s.io/apimachinery v0.35.4 h1:xtdom9RG7e+yDp71uoXoJDWEE2eOiHgeO4GdBzwWpds=
+k8s.io/apimachinery v0.35.4/go.mod h1:NNi1taPOpep0jOj+oRha3mBJPqvi0hGdaV8TCqGQ+cc=
 pgregory.net/rapid v1.2.0 h1:keKAYRcjm+e1F0oAuU5F5+YPAWcyxNNRK2wud503Gnk=
 pgregory.net/rapid v1.2.0/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=

gorm-gen/go.mod

@@ -18,9 +18,9 @@ require (
 	github.com/go-sql-driver/mysql v1.8.1 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
-	github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
-	github.com/jackc/pgx/v5 v5.5.5 // indirect
-	github.com/jackc/puddle/v2 v2.2.1 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
+	github.com/jackc/pgx/v5 v5.9.0 // indirect
+	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
 	github.com/mattn/go-sqlite3 v1.14.22 // indirect

gorm-gen/go.sum

@@ -17,12 +17,12 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
-github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a h1:bbPeKD0xmW/Y25WS6cokEszi5g+S0QxI/d45PkRi7Nk=
-github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgx/v5 v5.5.5 h1:amBjrZVmksIdNjxGW/IiIMzxMKZFelXbUoPNb+8sjQw=
-github.com/jackc/pgx/v5 v5.5.5/go.mod h1:ez9gk+OAat140fv9ErkZDYFWmXLfV+++K0uAOiwgm1A=
-github.com/jackc/puddle/v2 v2.2.1 h1:RhxXJtFG022u4ibrCSMSiu5aOq1i77R3OHKNJj77OAk=
-github.com/jackc/puddle/v2 v2.2.1/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
+github.com/jackc/pgx/v5 v5.9.0 h1:T/dI+2TvmI2H8s/KH1/lXIbz1CUFk3gn5oTjr0/mBsE=
+github.com/jackc/pgx/v5 v5.9.0/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
+github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
+github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
 github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
 github.com/jinzhu/now v1.1.2/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
@@ -43,8 +43,8 @@ github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
-github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
 golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
 golang.org/x/mod v0.29.0 h1:HV8lRxZC4l2cr3Zq1LvtOsi/ThTgWnUk/y64QSs8GwA=

jobs/async-upload/Makefile

@@ -4,6 +4,7 @@ JOB_IMG_ORG ?= opendatahub
 JOB_IMG_NAME ?= model-registry-job-async-upload
 JOB_IMG ?= $(JOB_IMG_REGISTRY)/$(JOB_IMG_ORG)/$(JOB_IMG_NAME):$(JOB_IMG_VERSION)
 BUILD_IMAGE ?= true # whether to build the MR server image
+include odh_rules.mk
 CLUSTER_NAME ?= mr-e2e
 
 # MR Server Params
@@ -100,3 +101,13 @@ install: install-poetry-export
 .PHONY: install-poetry-export
 install-poetry-export:
 	poetry self add poetry-plugin-export
+
+.PHONY: undeploy-minio
+undeploy-minio:
+	@echo "Undeploy Minio..."
+	cd ../../ && ./scripts/undeploy_minio.sh
+
+.PHONY: undeploy-local-kind-registry
+undeploy-local-kind-registry:
+	@echo "Undeploy Local Kind Registry..."
+	cd ../../ && ./scripts/undeploy_local_registry.sh

jobs/async-upload/job/config.py

@@ -78,7 +78,7 @@ def _parser() -> cap.ArgumentParser:
     p.add_argument("--destination-oci-registry")
     p.add_argument("--destination-oci-username")
     p.add_argument("--destination-oci-password")
-    p.add_argument("--destination-oci-base-image", default="busybox:latest")
+    p.add_argument("--destination-oci-base-image", default="public.ecr.aws/docker/library/busybox:latest")
     # The `type` converter is needed here to support env-based booleans
     # See: https://github.com/bw2/ConfigArgParse/tree/master?tab=readme-ov-file#special-values
     p.add_argument("--destination-oci-enable-tls-verify", default=True, type=str2bool)

jobs/async-upload/job/models.py

@@ -43,7 +43,7 @@ class OCIConfig(BaseModel):
     username: str | None = None
     password: str | None = None
     email: str | None = None
-    base_image: str = "busybox:latest"
+    base_image: str = "public.ecr.aws/docker/library/busybox:latest"
     enable_tls_verify: bool = True
 
     @model_validator(mode='after')

jobs/async-upload/odh_rules.mk

@@ -0,0 +1,31 @@
+.PHONY: deploy-mr-odh
+deploy-mr-odh:
+	cd ../../ && ./scripts/deploy_on_odh.sh
+
+.PHONY: undeploy-mr-odh
+undeploy-mr-odh:
+	cd ../../ && ./scripts/undeploy_on_odh.sh
+
+.PHONY: test-e2e-odh-async-jobs
+test-e2e-odh-async-jobs: deploy-mr-odh deploy-local-registry deploy-test-minio
+	@echo "Running Async Jobs e2e tests..."
+	@( \
+	trap 'rm -f ../../scripts/manifests/minio/.env' EXIT; \
+	set -a; . ../../scripts/manifests/minio/.env; set +a; \
+	mkdir -p ../../results; \
+	. ../../scripts/odh_env.sh && \
+	poetry install --all-extras --with integration && \
+	poetry run pytest --e2e tests/integration/ -svvv -rA \
+		--html=../../results/report.html \
+		--junit-xml=../../results/xunit_report.xml \
+		--self-contained-html \
+		-o junit_suite_name=odh-async-upload \
+	)
+
+.PHONY: test-e2e-odh-async-jobs-cleanup
+test-e2e-odh-async-jobs-cleanup: undeploy-mr-odh undeploy-minio undeploy-local-kind-registry
+	@echo "Cleaning up port-forward processes..."
+	@if [ -f .port-forwards.pid ]; then \
+		kill $$(cat .port-forwards.pid) || true; \
+		rm -f .port-forwards.pid; \
+	fi

jobs/async-upload/samples/sample_job_s3_to_oci.yaml

@@ -112,7 +112,7 @@ spec:
             - name: MODEL_SYNC_DESTINATION_OCI_CREDENTIALS_PATH
               value: "/opt/creds/destination/.dockerconfigjson"
             - name: MODEL_SYNC_DESTINATION_OCI_BASE_IMAGE
-              value: "busybox:latest"
+              value: "public.ecr.aws/docker/library/busybox:latest"
             - name: MODEL_SYNC_DESTINATION_OCI_ENABLE_TLS_VERIFY
               value: "false"
 

manifests/kustomize/overlays/db/model-registry-db-deployment.yaml

@@ -25,7 +25,7 @@ spec:
         fsGroup: 999
       containers:
       - name: db-container
-        image: mysql:8.3
+        image: public.ecr.aws/docker/library/mysql:8.3
         args:
         - --datadir
         - /var/lib/mysql/datadir

scripts/get_async_upload_image.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Reads the async-upload job image from the model-registry-operator-parameters
+# ConfigMap in the applications namespace (from DSCInitialization).
+set -e
+
+APPS_NS=$(kubectl get dscinitializations default-dsci \
+  -o jsonpath='{.spec.applicationsNamespace}')
+
+kubectl get configmap model-registry-operator-parameters \
+  -n "$APPS_NS" \
+  -o jsonpath='{.data.IMAGES_JOBS_ASYNC_UPLOAD}'

scripts/manifests/minio/create_bucket.yaml

@@ -9,7 +9,7 @@ spec:
       restartPolicy: OnFailure
       containers:
       - name: mc
-        image: minio/mc
+        image: quay.io/minio/mc
         env:
           - name: MINIO_ROOT_USER
             valueFrom:

scripts/odh_env.sh

@@ -0,0 +1,30 @@
+# Common ODH environment variables for test targets.
+# Usage: . scripts/odh_env.sh
+#
+# Exported variables:
+#   AUTH_TOKEN, VERIFY_SSL, MR_NAMESPACE, MR_HOST_URL, MR_ENDPOINT,
+#   MODEL_SYNC_REGISTRY_SERVER_ADDRESS, MODEL_SYNC_REGISTRY_PORT,
+#   MODEL_SYNC_REGISTRY_IS_SECURE, MODEL_SYNC_REGISTRY_USER_TOKEN,
+#   CONTAINER_IMAGE_URI
+
+SCRIPT_DIR="$(dirname "$(realpath "${BASH_SOURCE[0]}")")"
+
+AUTH_TOKEN=$(kubectl config view --raw -o jsonpath="{.users[?(@.name==\"$(kubectl config view -o jsonpath="{.contexts[?(@.name==\"$(kubectl config current-context)\")].context.user}")\")].user.token}")
+export AUTH_TOKEN
+
+export VERIFY_SSL=False
+
+MR_NAMESPACE=$(kubectl get datasciencecluster default-dsc -o jsonpath='{.spec.components.modelregistry.registriesNamespace}')
+export MR_NAMESPACE
+
+MR_ENDPOINT=$(kubectl get service -n "${MR_NAMESPACE}" model-registry -o jsonpath='{.metadata.annotations.routing\.opendatahub\.io\/external-address-rest}')
+export MR_HOST_URL="https://${MR_ENDPOINT}"
+MR_ENDPOINT="${MR_ENDPOINT%%:*}"
+export MR_ENDPOINT
+
+export MODEL_SYNC_REGISTRY_SERVER_ADDRESS="https://${MR_ENDPOINT}"
+export MODEL_SYNC_REGISTRY_PORT="443"
+export MODEL_SYNC_REGISTRY_IS_SECURE="false"
+export MODEL_SYNC_REGISTRY_USER_TOKEN="${AUTH_TOKEN}"
+CONTAINER_IMAGE_URI=$("${SCRIPT_DIR}/get_async_upload_image.sh")
+export CONTAINER_IMAGE_URI

scripts/services/container_registry.yaml

@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
         - name: distribution-registry-test
-          image: docker.io/library/registry:2
+          image: public.ecr.aws/docker/library/registry:2
           args:
             - /etc/docker/registry/config.yml
           env: