Merge branch 'main' into scc

Author: dbasunag

.github/workflows/add-remove-labels.yml

@@ -11,12 +11,6 @@ on:
 
   issue_comment:
     types: [created, edited, deleted]
-    # I don't believe the conditional is supported here
-    # if: |
-    #   contains(github.event.comment.body, '/wip') ||
-    #   contains(github.event.comment.body, '/verified') ||
-    #   contains(github.event.comment.body, '/lgtm') ||
-    #   contains(github.event.comment.body, '/hold')
 
 
 permissions:
@@ -26,6 +20,12 @@ permissions:
 
 jobs:
   add-remove-labels:
+    if: |
+      contains(github.event.comment.body, '/wip') ||
+      contains(github.event.comment.body, '/verified') ||
+      contains(github.event.comment.body, '/lgtm') ||
+      contains(github.event.comment.body, '/hold') ||
+      contains(github.event.comment.body, '/cherry-pick')
     runs-on: ubuntu-latest
 
     steps:
@@ -36,27 +36,6 @@ jobs:
           comment-id: ${{ github.event.comment.id }}
           reactions: '+1'
 
-      # This currently fails with either the bot PAT or the standard github token secret
-      # gh: Insufficient scopes for reacting to this Pull Request Review Comment. (HTTP 403)
-      # {"message":"Insufficient scopes for reacting to this Pull Request Review Comment.","documentation_url":"https://docs.github.com/rest/reactions/reactions#create-reaction-for-a-pull-request-review-comment","status":"403"}
-      # It could work if we had a token with the proper permissions.
-      # See https://github.com/peter-evans/create-or-update-comment/issues/392 for why the action above doesn't work.
-      # Confirmed as a bug, see: https://github.com/github/docs/issues/36899
-      # - name: Acknowledge the review with thumbs up reaction
-      #   if: ${{ github.event.review }}
-      #   env:
-      #     GH_TOKEN: ${{ secrets.OPENDATAHUB_TESTS_BOT_PAT }}
-      #     REVIEW_COMMENT_ID: ${{ github.event.review.id }}
-      #     REPO_NAME: ${{ github.event.repository.name }}
-      #     REPO_OWNER: ${{ github.event.repository.owner.login }}
-      #   run: |
-      #     gh api \
-      #     --method POST \
-      #     -H "Accept: application/vnd.github+json" \
-      #     -H "X-GitHub-Api-Version: 2022-11-28" \
-      #     /repos/$REPO_OWNER/$REPO_NAME/pulls/comments/$REVIEW_COMMENT_ID/reactions \
-      #     -f "content=+1"
-
       - uses: actions/checkout@v4
 
       - name: Install uv

.github/workflows/cherry-pick-comment.yml

@@ -0,0 +1,25 @@
+name: Cherry Pick On Comment
+on:
+  issue_comment:
+    types: [created]
+jobs:
+  cherry-pick:
+    name: Cherry Pick
+    if: |
+      github.event.issue.pull_request != '' &&
+      contains(github.event.comment.body, '/cherry-pick') &&
+      ((github.event.pull_request.author_association != 'NONE') &&
+      (github.event.pull_request.author_association != 'MANNEQUIN') &&
+      (github.event.pull_request.author_association != 'FIRST_TIMER') &&
+      (github.event.pull_request.author_association != 'FIRST_TIME_CONTRIBUTOR'))
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout the latest code
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.OPENDATAHUB_TESTS_BOT_PAT }}
+          fetch-depth: 0 # otherwise, you will fail to push refs to dest repo
+      - name: Automatic Cherry Pick
+        uses:  dbasunag/cherry-pick-pr@master
+        env:
+          GITHUB_TOKEN: ${{ secrets.OPENDATAHUB_TESTS_BOT_PAT }}

.github/workflows/scripts/constants.py

@@ -35,6 +35,8 @@
         `lgtm` label removed on each new commit push.
  * To mark PR as verified comment `/verified` to the PR, to un-verify comment `/verified cancel` to the PR.
         `verified` label removed on each new commit push.
+ * To Cherry-pick a merged PR `/cherry-pick <target_branch_name>` to the PR. If <target_branch_name> is valid,
+         and the current PR is merged, a cherry-picked PR would be created and linked to the current PR.
 
 <details>
 <summary>Supported labels</summary>

.pre-commit-config.yaml

@@ -35,7 +35,7 @@ repos:
       - id: detect-secrets
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.11.2
+    rev: v0.11.4
     hooks:
       - id: ruff
       - id: ruff-format

tests/conftest.py

@@ -24,6 +24,7 @@
 from simple_logger.logger import get_logger
 
 from utilities.data_science_cluster_utils import update_components_in_dsc
+from utilities.exceptions import ClusterLoginError
 from utilities.general import get_s3_secret_dict
 from utilities.infra import (
     create_ns,
@@ -246,33 +247,36 @@ def unprivileged_client(
     non_admin_user_password: tuple[str, str],
 ) -> Generator[DynamicClient, Any, Any]:
     """
-    Provides none privileged API client. If non_admin_user_password is None, then it will yield admin_client.
+    Provides none privileged API client. If non_admin_user_password is None, then it will raise.
     """
     if non_admin_user_password is None:
-        yield admin_client
+        raise ValueError("Unprivileged user not provisioned")
 
     else:
         current_user = run_command(command=["oc", "whoami"])[1].strip()
+        non_admin_user_name = non_admin_user_password[0]
 
         if login_with_user_password(
             api_address=admin_client.configuration.host,
-            user=non_admin_user_password[0],
+            user=non_admin_user_name,
             password=non_admin_user_password[1],
         ):
             with open(kubconfig_filepath) as fd:
                 kubeconfig_content = yaml.safe_load(fd)
 
             unprivileged_context = kubeconfig_content["current-context"]
 
+            unprivileged_client = get_client(config_file=kubconfig_filepath, context=unprivileged_context)
+
             # Get back to admin account
             login_with_user_password(
                 api_address=admin_client.configuration.host,
                 user=current_user.strip(),
             )
-            yield get_client(config_file=kubconfig_filepath, context=unprivileged_context)
+            yield unprivileged_client
 
         else:
-            yield admin_client
+            raise ClusterLoginError(user=non_admin_user_name)
 
 
 @pytest.fixture(scope="session")

tests/model_explainability/conftest.py

@@ -0,0 +1,21 @@
+from typing import Generator, Any
+
+import pytest
+from kubernetes.dynamic import DynamicClient
+from ocp_resources.namespace import Namespace
+from ocp_resources.persistent_volume_claim import PersistentVolumeClaim
+
+
+@pytest.fixture(scope="class")
+def pvc_minio_namespace(
+    admin_client: DynamicClient, minio_namespace: Namespace
+) -> Generator[PersistentVolumeClaim, Any, Any]:
+    with PersistentVolumeClaim(
+        client=admin_client,
+        name="minio-pvc",
+        namespace=minio_namespace.name,
+        accessmodes=PersistentVolumeClaim.AccessMode.RWO,
+        volume_mode=PersistentVolumeClaim.VolumeMode.FILE,
+        size="10Gi",
+    ) as pvc:
+        yield pvc

tests/model_explainability/guardrails/conftest.py

@@ -209,7 +209,7 @@ def vllm_gateway_config(admin_client: DynamicClient, model_namespace: Namespace)
 def minio_llm_deployment(
     admin_client: DynamicClient,
     minio_namespace: Namespace,
-    llm_models_pvc: PersistentVolumeClaim,
+    pvc_minio_namespace: PersistentVolumeClaim,
 ) -> Generator[Deployment, Any, Any]:
     with Deployment(
         client=admin_client,
@@ -229,7 +229,7 @@ def minio_llm_deployment(
                 "volumes": [
                     {
                         "name": "model-volume",
-                        "persistentVolumeClaim": {"claimName": "llm-models-claim"},
+                        "persistentVolumeClaim": {"claimName": pvc_minio_namespace.name},
                     }
                 ],
                 "initContainers": [
@@ -282,18 +282,3 @@ def minio_llm_deployment(
     ) as deployment:
         deployment.wait_for_replicas(timeout=Timeout.TIMEOUT_10MIN)
         yield deployment
-
-
-@pytest.fixture(scope="class")
-def llm_models_pvc(
-    admin_client: DynamicClient, minio_namespace: Namespace
-) -> Generator[PersistentVolumeClaim, Any, Any]:
-    with PersistentVolumeClaim(
-        client=admin_client,
-        name="llm-models-claim",
-        namespace=minio_namespace.name,
-        accessmodes=PersistentVolumeClaim.AccessMode.RWO,
-        volume_mode=PersistentVolumeClaim.VolumeMode.FILE,
-        size="10Gi",
-    ) as pvc:
-        yield pvc