Merge pull request #2604 from radofuchs/sync-main-to-release-0.7

LCORE-2935: Sync main to release 0.7

Author: radofuchs

.github/PULL_REQUEST_TEMPLATE.md

@@ -12,7 +12,8 @@
 - [ ] Documentation Update
 - [ ] Configuration Update
 - [ ] Bump-up service version
-- [ ] Bump-up dependent library
+- [ ] Bump-up dependent library [`pyproject.toml` + `uv.lock`]
+- [ ] Bump-up dependent library [`requirements.*.txt` for Konflux]
 - [ ] Bump-up library or tool used for development (does not change the final image)
 - [ ] CI configuration change
 - [ ] Konflux configuration change

.github/workflows/e2e_authorize.yaml

@@ -0,0 +1,76 @@
+# Gate before e2e jobs that use repository secrets (separate job so secrets are not sent if skipped).
+#
+# Uses the same collaborator permission API GitHub uses for push/merge access on
+# this repository (org base permissions, teams, and direct grants).
+name: Authorize E2E secrets access
+
+on:
+  workflow_call:
+    outputs:
+      authorized:
+        value: ${{ jobs.authorize.outputs.authorized }}
+
+jobs:
+  authorize:
+    name: Check repository owner or member
+    runs-on: ubuntu-latest
+    timeout-minutes: 1
+    if: github.event.action != 'labeled' || github.event.label.name == 'ok-to-test'
+    # Do not set permissions: contents: read — it blocks reading collaborator permissions.
+    outputs:
+      authorized: ${{ steps.check.outputs.authorized }}
+    steps:
+      - name: Allow repo owners and members, or ok-to-test from an owner
+        id: check
+        env:
+          GH_TOKEN: ${{ github.token }}
+          EVENT_NAME: ${{ github.event_name }}
+          EVENT_ACTION: ${{ github.event.action }}
+          IS_FORK: ${{ github.event.repository.fork }}
+          # PR author for merge-rights check (not github.actor — see dependabot hardening).
+          USER: ${{ github.event.pull_request.user.login || github.actor }}
+          ACTOR: ${{ github.actor }}
+          REPO_OWNER: ${{ github.repository_owner }}
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          allow() { echo "$1"; echo "authorized=true" >> "$GITHUB_OUTPUT"; exit 0; }
+          deny()  { echo "::warning::$1"; echo "authorized=false" >> "$GITHUB_OUTPUT"; exit 0; }
+
+          permission_of() {
+            local url="repos/${REPOSITORY}/collaborators/$(jq -nr --arg u "$1" '$u|@uri')/permission"
+            local perm
+            for attempt in 1 2 3; do
+              perm=$(gh api "$url" --jq .permission 2>/dev/null) && [ -n "$perm" ] && { echo "$perm"; return; }
+              echo "::debug::API attempt $attempt failed for $1, retrying in ${attempt}s…"
+              sleep "$attempt"
+            done
+            echo none
+          }
+
+          [ "$EVENT_NAME" = "schedule" ] && allow "Scheduled run."
+
+          echo "user=${USER} actor=${ACTOR} event=${EVENT_NAME}/${EVENT_ACTION:-none} fork=${IS_FORK}"
+
+          # Push to upstream: only users with push (merge) rights can push here.
+          [ "$EVENT_NAME" = "push" ] && [ "$IS_FORK" != "true" ] && allow "Push to upstream repository."
+
+          # Push to your own fork.
+          [ "$EVENT_NAME" = "push" ] && [ "$ACTOR" = "$REPO_OWNER" ] && allow "Push by fork owner."
+
+          USER_PERM=$(permission_of "$USER")
+          echo "user_permission=${USER_PERM}"
+          case "$USER_PERM" in
+            admin|maintain|write|triage|read)
+              allow "${USER} has repository access (${USER_PERM}, same source as merge rights)."
+              ;;
+          esac
+
+          # Outsider PR: repository owner added ok-to-test on this run.
+          [ "$EVENT_ACTION" = "labeled" ] || deny "${USER} has no repository access."
+
+          LABELER_PERM=$(permission_of "$ACTOR")
+          echo "ok-to-test labeler=${ACTOR} permission=${LABELER_PERM}"
+          [ "$LABELER_PERM" = "admin" ] && allow "Repository owner ${ACTOR} added ok-to-test."
+
+          deny "ok-to-test must be added by a repository owner (admin)."

.github/workflows/e2e_tests.yaml

@@ -1,19 +1,53 @@
 # .github/workflows/e2e_tests.yml
 name: E2E Tests
 
-on: [push, pull_request_target]
+on:
+  push:
+  pull_request_target:
+    types: [opened, synchronize, reopened, labeled]
 
 jobs:
+  # Own job so repository secrets are never sent to a runner unless this passes.
+  authorize:
+    uses: ./.github/workflows/e2e_authorize.yaml
+
   e2e_tests:
+    needs: authorize
+    if: needs.authorize.outputs.authorized == 'true'
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
         mode: ["server", "library"]
         environment: ["ci"]
-        e2e_group: [1, 2, 3]
+        # Config-aligned shards (@cfg_*). Packed small groups keep job count reasonable
+        # while avoiding mixed-config restarts inside large suites.
+        shard:
+          - name: default
+            tags: "not @skip and @cfg_default"
+          - name: authorized
+            tags: "not @skip and @cfg_authorized"
+          - name: mcp
+            tags: "not @skip and (@cfg_mcp or @cfg_mcp_invalid or @cfg_mcp_api_auth)"
+          - name: rbac
+            tags: "not @skip and @cfg_rbac"
+          - name: skills
+            tags: "not @skip and (@cfg_skills or @cfg_skills_directory)"
+          - name: shields
+            tags: "not @skip and @cfg_shields"
+          - name: other
+            tags: "not @skip and (@cfg_rh_identity or @cfg_negative or @cfg_byok_pdf or @cfg_degraded or @cfg_unified)"
+          # Server-only; listed in shard (not matrix.include) so it expands with
+          # mode=server before any library jobs. include would append after library.
+          - name: tls
+            tags: "not @skip and @cfg_tls"
+        exclude:
+          - mode: library
+            shard:
+              name: tls
+              tags: "not @skip and @cfg_tls"
 
-    name: "E2E: ${{ matrix.mode }} mode / ${{ matrix.environment }} / group ${{ matrix.e2e_group }}"
+    name: "E2E: ${{ matrix.mode }} / ${{ matrix.environment }} / ${{ matrix.shard.name }}"
 
     env:
       OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
@@ -30,9 +64,9 @@ jobs:
           # On push      → falls back to the current repository.
           repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
 
-          # On PR_TARGET → the PR head *commit* (reproducible).
+          # On PR_TARGET → the PR head commit at event time (not the moving branch).
           # On push      → the pushed commit that triggered the workflow.
-          ref: ${{ github.event.pull_request.head.ref || github.sha }}
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
           # Tests need access to secrets.
           # This should be refactored if possible to mitigate the risk.
@@ -43,7 +77,7 @@ jobs:
           persist-credentials: ${{ github.event_name != 'pull_request_target' }}
 
           # Fetch submodules (required for lightspeed-providers)
-          submodules: ‘recursive’
+          submodules: "recursive"
 
       - name: Verify actual git checkout result
         run: |
@@ -112,15 +146,15 @@ jobs:
           echo "=== Configuration Summary ==="
           echo "Deployment mode: ${{ matrix.mode }}"
           echo "Environment: ${{ matrix.environment }}"
-          echo "E2E shard (Makefile test-e2e-tagged): @e2e_group_${{ matrix.e2e_group }} (with not @skip)"
+          echo "E2E shard (Makefile test-e2e-tagged): ${{ matrix.shard.tags }}"
           echo "Source config: tests/e2e/configs/run-${{ matrix.environment }}.yaml"
           echo ""
           echo "=== Configuration Preview ==="
           echo "Providers: $(grep -c "provider_id:" run.yaml)"
           echo "Models: $(grep -c "model_id:" run.yaml)"
           echo ""
           echo "=== lightspeed-stack.yaml ==="
-          grep -A 3 "llama_stack:" lightspeed-stack.yaml
+          grep -A 3 "ogx:" lightspeed-stack.yaml
 
       - name: Cache HuggingFace embedding model
         uses: actions/cache@v4
@@ -239,8 +273,8 @@ jobs:
           TERM: xterm-256color
           FORCE_COLOR: 1
           E2E_DEPLOYMENT_MODE: ${{ matrix.mode }}
-          # Matches Makefile test-e2e-tagged / E2E_BEHAVE_TAG_EXPR (one @e2e_group_* per job).
-          E2E_BEHAVE_TAG_EXPR: "not @skip and @e2e_group_${{ matrix.e2e_group }}"
+          # Matches Makefile test-e2e-tagged / E2E_BEHAVE_TAG_EXPR (one @cfg_* pack per job).
+          E2E_BEHAVE_TAG_EXPR: "${{ matrix.shard.tags }}"
         run: |
           echo "Installing test dependencies..."
           pip install uv

.github/workflows/e2e_tests_lightspeed_evaluation.yaml

@@ -1,9 +1,16 @@
 name: E2E Tests for Lightspeed Evaluation
 
-on: [push, pull_request_target]
+on:
+  []
 
 jobs:
+  # Own job so repository secrets are never sent to a runner unless this passes.
+  authorize:
+    uses: ./.github/workflows/e2e_authorize.yaml
+
   e2e_tests:
+    needs: authorize
+    if: needs.authorize.outputs.authorized == 'true'
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -23,9 +30,9 @@ jobs:
           # On push      → falls back to the current repository.
           repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
 
-          # On PR_TARGET → the PR head *commit* (reproducible).
+          # On PR_TARGET → the PR head commit at event time (not the moving branch).
           # On push      → the pushed commit that triggered the workflow.
-          ref: ${{ github.event.pull_request.head.ref || github.sha }}
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
           # Don’t keep credentials when running untrusted PR code under PR_TARGET.
           persist-credentials: ${{ github.event_name != 'pull_request_target' }}
@@ -87,7 +94,7 @@ jobs:
           echo "Models: $(grep -c "model_id:" run.yaml)"
           echo ""
           echo "=== lightspeed-stack.yaml ==="
-          grep -A 3 "llama_stack:" lightspeed-stack.yaml
+          grep -A 3 "ogx:" lightspeed-stack.yaml
 
       - name: Run services (Library Mode)
         env: 

.github/workflows/e2e_tests_providers.yaml

@@ -7,29 +7,35 @@ on:
   workflow_dispatch:
 
 jobs:
+  # Own job so repository secrets are never sent to a runner unless this passes.
+  authorize:
+    uses: ./.github/workflows/e2e_authorize.yaml
+
   e2e_tests:
+    needs: authorize
+    if: needs.authorize.outputs.authorized == 'true'
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
         mode: ["server", "library"]
         environment: ["azure", "vertexai", "watsonx", "bedrock"]
         # Expected default LLM for Behave (matches tests/e2e/configs/run-<env>.yaml).
-        # | environment | model_id                            | provider_id   |
-        # |-------------|-------------------------------------|---------------|
-        # | azure       | gpt-4o-mini                         | azure         |
-        # | vertexai    | google/gemini-2.5-flash             | google-vertex |
-        # | watsonx     | meta-llama/llama-3-3-70b-instruct   | watsonx       |
-        # | bedrock     | deepseek.v3-v1:0                    | aws-bedrock   |
+        # | environment | model_id                                   | provider_id   |
+        # |-------------|--------------------------------------------| --------------|
+        # | azure       | gpt-4o-mini                                | azure         |
+        # | vertexai    | publishers/google/models/gemini-2.5-flash  | google-vertex |
+        # | watsonx     | meta-llama/llama-3-3-70b-instruct          | watsonx       |
+        # | bedrock     | deepseek.v3-v1:0                           | aws-bedrock   |
         include:
           - environment: azure
             e2e_default_model: gpt-4o-mini
             e2e_default_provider: azure
           - environment: vertexai
-            e2e_default_model: google/gemini-2.5-flash
+            e2e_default_model: publishers/google/models/gemini-2.5-flash
             e2e_default_provider: google-vertex
           - environment: watsonx
-            e2e_default_model: watsonx/meta-llama/llama-3-3-70b-instruct
+            e2e_default_model: meta-llama/llama-3-3-70b-instruct
             e2e_default_provider: watsonx
           - environment: bedrock
             e2e_default_model: deepseek.v3-v1:0
@@ -198,7 +204,7 @@ jobs:
           echo "Models: $(grep -c "model_id:" run.yaml)"
           echo ""
           echo "=== lightspeed-stack.yaml ==="
-          grep -A 3 "llama_stack:" lightspeed-stack.yaml
+          grep -A 3 "ogx:" lightspeed-stack.yaml
 
       - name: Cache HuggingFace embedding model
         uses: actions/cache@v4
@@ -330,10 +336,6 @@ jobs:
         if: matrix.environment == 'watsonx' && matrix.mode == 'server'
         run: sleep 3600  # 120 minutes
 
-      - name: Remove the prefix for watsonx default model
-        if: matrix.environment == 'watsonx'
-        run: echo "E2E_DEFAULT_MODEL_OVERRIDE=meta-llama/llama-3-3-70b-instruct" >> $GITHUB_ENV
-
       - name: Run e2e tests
         env:
           TERM: xterm-256color

.github/workflows/e2e_tests_rhaiis.yaml

@@ -8,7 +8,13 @@ on:
 
 
 jobs:
+  # Own job so repository secrets are never sent to a runner unless this passes.
+  authorize:
+    uses: ./.github/workflows/e2e_authorize.yaml
+
   e2e_tests:
+    needs: authorize
+    if: needs.authorize.outputs.authorized == 'true'
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false

.github/workflows/openapi_spectral.yaml

@@ -21,8 +21,8 @@ jobs:
         with:
           python-version: "3.12"
       - name: Install dependencies
-        # Same pattern as local dev (CONTRIBUTING.md): dev + llslibdev for a full app import.
-        run: uv sync --group dev --group llslibdev
+        # Same pattern as local dev (CONTRIBUTING.md): dev + ogxlibdev for a full app import.
+        run: uv sync --group dev --group ogxlibdev
       - name: Install PDM
         # scripts/generate_openapi_schema.py asserts OpenAPI info.version matches `pdm show --version`.
         run: uv pip install pdm

.github/workflows/pylint.yaml

@@ -18,6 +18,6 @@ jobs:
         with:
           python-version: '3.12'
       - name: Install dependencies
-        run: uv sync --group llslibdev
+        run: uv sync --group ogxlibdev
       - name: Python linter
         run: uv run pylint src tests

.github/workflows/pyright.yaml

@@ -18,6 +18,6 @@ jobs:
         with:
           python-version: '3.12'
       - name: Install dependencies
-        run: uv sync --group llslibdev
+        run: uv sync --group ogxlibdev
       - name: Run Pyright tests
         run: uv run pyright src

.github/workflows/unit_tests.yaml

@@ -24,7 +24,7 @@ jobs:
       - name: uv version
         run: uv --version
       - name: Install dependencies
-        run: uv pip install --python ${{ matrix.python-version }} --group llslibdev .
+        run: uv pip install --python ${{ matrix.python-version }} --group ogxlibdev .
       - name: Install pdm  # Required for dynamic version test
         run: uv pip install pdm
       - name: Run unit tests