sync: main to stable

.github/workflows/build-and-push-image.yml

@@ -18,6 +18,7 @@ env:
   PUSH_IMAGE: true
   DOCKER_USER: ${{ secrets.QUAY_USERNAME }}
   DOCKER_PWD: ${{ secrets.QUAY_PASSWORD }}
+  PLATFORMS: linux/arm64,linux/amd64
 
 permissions: # set contents: read at top-level, per OpenSSF ScoreCard rule TokenPermissionsID
   contents: read
@@ -41,7 +42,13 @@ jobs:
         if: github.head_ref == '' && github.ref == 'refs/heads/main'
         run: echo "BUILD_CONTEXT=main" >> $GITHUB_ENV
       # checkout branch
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v5.0.0
+      # Set up QEMU for multi-architecture builds
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      # Set up Docker Buildx
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
       # set image version
       - name: Set main-branch environment
         if: env.BUILD_CONTEXT == 'main'
@@ -68,23 +75,12 @@ jobs:
       - name: Attach SBOM to Image
         run: |
           cosign attach sbom --sbom model-registry-server-${{ env.VERSION }}-sbom.spdx.json "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_REPO }}:${{ env.VERSION }}"
-      - name: Tag Latest
+      - name: Tag Latest and Main
         if: env.BUILD_CONTEXT == 'main'
         shell: bash
         env:
           IMG: "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_REPO }}"
-          BUILD_IMAGE: false # image is already built in "Build and Push Image" step
         run: |
-          docker tag ${{ env.IMG }}:$VERSION ${{ env.IMG }}:latest
-          # BUILD_IMAGE=false skip the build, just push the tag made above
-          VERSION=latest ./scripts/build_deploy.sh
-      - name: Tag Main
-        if: env.BUILD_CONTEXT == 'main'
-        shell: bash
-        env:
-          IMG: "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_REPO }}"
-          BUILD_IMAGE: false # image is already built in "Build and Push Image" step
-        run: |
-          docker tag ${{ env.IMG }}:$VERSION ${{ env.IMG }}:main
-          # BUILD_IMAGE=false skip the build, just push the tag made above
-          VERSION=main ./scripts/build_deploy.sh
+          # Create manifest tags for multi-arch images
+          docker buildx imagetools create -t ${{ env.IMG }}:latest ${{ env.IMG }}:$VERSION
+          docker buildx imagetools create -t ${{ env.IMG }}:main ${{ env.IMG }}:$VERSION

.github/workflows/build.yml

@@ -29,7 +29,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v6
         with:
-          go-version: "1.24"
+          go-version: "1.25.3"
       - name: Build
         run: make build/compile
       - name: Registry unit tests

.github/workflows/check-db-schema-structs.yaml

@@ -18,7 +18,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v6
         with:
-          go-version: "1.24.4"
+          go-version: "1.25.3"
       - name: Generate MySQL DB schema structs
         run: make gen/gorm/mysql
       - name: Check if there are uncommitted file changes
@@ -38,7 +38,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v6
         with:
-          go-version: "1.24.4"
+          go-version: "1.25.3"
       - name: Generate PostgreSQL DB schema structs
         run: make gen/gorm/postgres
       - name: Check if there are uncommitted file changes

.github/workflows/controller-test.yml

@@ -44,7 +44,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.24'
+          go-version: "1.25.3"
 
       - name: Running Tests
         run: |

.github/workflows/first-time-contributor-pr.yml

@@ -1,51 +1,85 @@
-# goal: this is meant to remind maintainers/approvers to add labels to ensure all tests are executed before merging
-# and avoid merging without realizing that required tests has not been run; complementary to bulletpoint in template: https://github.com/kubeflow/model-registry/blame/de5f225d96a4daeca77506d233082b1c4ea5afa3/.github/pull_request_template.md#L21
-name: Welcome first-time contributors (Beta)
+name: Welcome first-time contributors (Beta2)
+
 on:
-  pull_request_target:
+  pull_request:
+    types: 
+      - opened
+      - synchronize
+      - reopened
+  issues:
     types:
       - opened
+
 permissions: # set contents: read at top-level, per OpenSSF ScoreCard rule TokenPermissionsID
   contents: read
 
-# do NOT: add actions/checkout to this flow, add-third party scripts, or auto-trigger CI jobs
 jobs:
   welcome:
+    runs-on: ubuntu-latest
     permissions:
       pull-requests: write
-    runs-on: ubuntu-latest
+      issues: write
     steps:
-      - name: Check contributor status
-        id: check_1st_time_contrib
-        uses: actions/github-script@v8
-        with:
-          script: |
-            const { data: pr } = await github.rest.pulls.get({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              pull_number: context.issue.number
-            });
-            const isFirstTimeContributor = pr.user.contributions === 0;
-            console.log(`First-time contributor status: ${isFirstTimeContributor}`);
-            core.setOutput('isFirstTimeContributor', isFirstTimeContributor.toString());
-
-      - name: Log contributor status (isFirstTimeContributor true)
-        if: steps.check_1st_time_contrib.outputs.isFirstTimeContributor == 'true'
-        run: echo "First-time contributor status is ${{ steps.check_1st_time_contrib.outputs.isFirstTimeContributor }}"
-
-      - name: Log contributor status (isFirstTimeContributor false)
-        if: steps.check_1st_time_contrib.outputs.isFirstTimeContributor == 'false'
-        run: echo "First-time contributor status is ${{ steps.check_1st_time_contrib.outputs.isFirstTimeContributor }}"
-
-      - name: Add a comment to the PR if first time contributor
-        if: steps.check_1st_time_contrib.outputs.isFirstTimeContributor == 'true'
-        uses: actions/github-script@v8
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install PyYAML
+        run: pip3 install pyyaml
+
+      - name: Extract approvers from OWNERS file
+        id: set-approvers
+        run: |
+          python3 << 'EOF'
+          import yaml
+          import os
+
+          with open('OWNERS', 'r') as f:
+              data = yaml.safe_load(f)
+
+          approvers = data.get('approvers', [])
+          result = ' '.join([f'@{approver}' for approver in approvers])
+
+          with open(os.environ['GITHUB_OUTPUT'], 'a') as f:
+              f.write(f'approvers={result}\n')
+
+          print(f'Extracted approvers: {result}')
+          EOF
+      - name: Log approvers
+        run: |
+          echo "Approvers: ${{ steps.set-approvers.outputs.approvers }}"
+
+      - name: Welcome first-time contributors message
+        uses: actions/first-interaction@v3
+        continue-on-error: true
         with:
-          script: |
-            github.rest.issues.createComment({
-              issue_number: context.issue.number,
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              body: "Maintainers: let's ensure the label `ok-to-test` has been maintained and all the tests have been executed before merging.<br/><br/>Thank you for your first Pull Request! 🎉🎉"
-            })
-# do NOT: add actions/checkout to this flow, add-third party scripts, or auto-trigger CI jobs
+          issue_message: |
+            🎉 **Welcome to the Kubeflow Model Registry!** 🎉
+            Thanks for opening your first issue! We're happy to have you as part of our community 🚀
+
+            **Here's what happens next:**
+            - If you'd like to contribute to this issue, check out our [Contributing Guide](https://github.com/kubeflow/model-registry/blob/main/CONTRIBUTING.md) for repo-specific guidelines and the [Kubeflow Contributor Guide](https://www.kubeflow.org/docs/about/contributing/) for general community standards
+            - Our team will review your issue soon!
+
+            **Join the community:**
+            - **Slack**: Join our [Slack channels](https://www.kubeflow.org/docs/about/community/#slack-channels)
+            - **Meetings**: Attend the [Kubeflow](https://www.kubeflow.org/docs/about/community/#list-of-available-meetings) online calls
+
+            Feel free to ask questions in the comments if you need any help or clarification!
+            Thanks again for contributing to Kubeflow! 🙏
+          pr_message: |
+            🎉 **Welcome to the Kubeflow Model Registry!** 🎉
+            Thanks for opening your first PR! We're happy to have you as part of our community 🚀
+
+            **Here's what happens next:**
+            - If you haven't already, please check out our [Contributing Guide](https://github.com/kubeflow/model-registry/blob/main/CONTRIBUTING.md) for repo-specific guidelines and the [Kubeflow Contributor Guide](https://www.kubeflow.org/docs/about/contributing/) for general community standards
+            - Our team will review your PR soon!
+
+            **Join the community:**
+            - **Slack**: Join our [Slack channels](https://www.kubeflow.org/docs/about/community/#slack-channels)
+            - **Meetings**: Attend the [Kubeflow](https://www.kubeflow.org/docs/about/community/#list-of-available-meetings) online calls
+
+            Feel free to ask questions in the comments if you need any help or clarification!
+            Thanks again for contributing to Kubeflow! 🙏
+
+            Note for: ${{ steps.set-approvers.outputs.approvers }}
+            Kindly ensure the label `ok-to-test` has been added to the PR, and all the tests have been executed before merging!

.github/workflows/go-mod-tidy-diff-check.yml

@@ -21,7 +21,7 @@ jobs:
             - name: Set up Go
               uses: actions/setup-go@v6
               with:
-                  go-version: '1.24'
+                  go-version: "1.25.3"
 
             - name: Cache Go modules
               uses: actions/cache@v4

.github/workflows/prepare.yml

@@ -12,7 +12,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v6
         with:
-          go-version: "1.24"
+          go-version: "1.25.3"
       - name: Prepare
         run: make clean build/prepare
       - name: Check if there are uncommitted file changes

.github/workflows/python-tests.yml

@@ -61,12 +61,7 @@ jobs:
       - name: Nox lint
         working-directory: clients/python
         run: |
-          if [[ ${{ matrix.session }} == "mypy" ]]; then
-            nox --python=${{ matrix.python }} ||\
-              echo "::error title='mypy failure'::Check the logs for more details"
-          else
-            nox --python=${{ matrix.python }}
-          fi
+          nox --python=${{ matrix.python }}
 
   check-autogen:
     name: Check autogenerated code is in sync
@@ -252,9 +247,9 @@ jobs:
         if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || (github.event_name == 'pull_request' && steps.check-openapi-changed.outputs.openapi == 'true')
         working-directory: clients/python
         run: |
-          kubectl port-forward -n ${{ env.MR_NAMESPACE }} service/model-registry-service 8080:8080 &
-          kubectl port-forward -n minio svc/minio 9000:9000 &
-          kubectl port-forward service/distribution-registry-test-service 5001:5001 &
+          kubectl port-forward -n ${{ env.MR_NAMESPACE }} service/model-registry-service 8080:8080 > /dev/null 2>&1 &
+          kubectl port-forward -n minio svc/minio 9000:9000 > /dev/null 2>&1 &
+          kubectl port-forward service/distribution-registry-test-service 5001:5001 > /dev/null 2>&1 &
           sleep 2
           nox --python=${{ matrix.python }} --session=fuzz
 

.github/workflows/ui-bff-build.yml

@@ -38,7 +38,7 @@ jobs:
         run: make clean
 
       - name: Lint
-        uses: golangci/golangci-lint-action@v8
+        uses: golangci/golangci-lint-action@v9
         with:
           version: v2.1.0
           working-directory: clients/ui/bff/

Dockerfile

@@ -1,5 +1,5 @@
 # Build the model-registry binary
-FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:1.24 AS common
+FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:1.25 AS common
 ARG TARGETOS
 ARG TARGETARCH
 

Dockerfile.odh

@@ -1,5 +1,5 @@
 # Build the model-registry binary
-FROM registry.access.redhat.com/ubi9/go-toolset:1.24 AS builder
+FROM registry.access.redhat.com/ubi9/go-toolset:1.25 AS builder
 
 WORKDIR /workspace
 # Copy the Go Modules manifests and workspace file

Makefile

@@ -173,11 +173,11 @@ bin/envtest:
 
 GOLANGCI_LINT ?= ${PROJECT_BIN}/golangci-lint
 bin/golangci-lint:
-	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(PROJECT_BIN) v2.0.2
+	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(PROJECT_BIN) v2.6.2
 
 GOVERTER ?= ${PROJECT_BIN}/goverter
 bin/goverter:
-	GOBIN=$(PROJECT_PATH)/bin ${GO} install github.com/jmattheis/goverter/cmd/goverter@v1.8.1
+	GOBIN=$(PROJECT_PATH)/bin ${GO} install github.com/jmattheis/goverter/cmd/goverter@v1.9.2
 
 YQ ?= ${PROJECT_BIN}/yq
 bin/yq:

README.md

@@ -46,7 +46,7 @@ Model registry provides a central repository for model developers to store and m
 8. [UI](clients/ui/README.md)
 
 ## Pre-requisites:
-- go >= 1.24
+- go >= 1.25
 - protoc v24.3 - [Protocol Buffers v24.3 Release](https://github.com/protocolbuffers/protobuf/releases/tag/v24.3)
 - npm >= 10.2.0 - [Installing Node.js and npm](https://docs.npmjs.com/downloading-and-installing-node-js-and-npm)
 - Java >= 11.0

RELEASE.md

@@ -89,8 +89,7 @@ git push --set-upstream origin mr_maintainer-$TDATE-upstreamSync
 
 - optional. if you create the tag from local git (see point below); await GHA complete that push Container images to docker.io or any other KF registry: https://github.com/kubeflow/model-registry/actions
 - create [the Release from GitHub](https://github.com/kubeflow/model-registry/releases/new), ⚠️ select the _release branch_ ⚠️ , input the _new tag_<br/>(in this example the tag is created from GitHub; alternatively, you could just do the tag manually by checking out the release branch locally--remember to pull!!--and issuing the tag from local machine).
-Encouraging in upstream to mark it as a non-production release (in the github screen).
-Encouraging to use the "alpha" version policy of KF in the beginning of the release markdown (see previous pre-releases).
+- encouraging to use the "alpha" version policy of KF in the beginning of the release markdown (see previous releases).
 
 It is helpful to prefix this in the release notes: