Skip to content

ci: adding myself as reviewer and approver for github workflows & actions#12710

Merged
google-oss-prow[bot] merged 1 commit intokubeflow:masterfrom
nsingla:add_as_reviewer
Jan 27, 2026
Merged

ci: adding myself as reviewer and approver for github workflows & actions#12710
google-oss-prow[bot] merged 1 commit intokubeflow:masterfrom
nsingla:add_as_reviewer

Conversation

@nsingla
Copy link
Contributor

@nsingla nsingla commented Jan 27, 2026

Description of your changes:

Checklist:

@nsingla nsingla changed the title adding myself as reviewer and approver for github workflows & actions ci: adding myself as reviewer and approver for github workflows & actions Jan 27, 2026
Copy link
Contributor

@hbelmiro hbelmiro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm
/approve

@nsingla has been instrumental in contributing to our CI. He did several improvements and has provided thorough reviews.
Thank you for your work, Nelesh.

@hbelmiro
Copy link
Contributor

I thought that as an approver I was allowed to approve. But we need a root approver.
Can one of you guys please take a look @mprahl @zazulam.

Signed-off-by: Nelesh Singla <117123879+nsingla@users.noreply.github.com>
Copy link
Collaborator

@mprahl mprahl left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve
/lgtm

@google-oss-prow
Copy link

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: hbelmiro, mprahl

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@hbelmiro
Copy link
Contributor

/retest

@google-oss-prow google-oss-prow bot merged commit 09c5842 into kubeflow:master Jan 27, 2026
10 of 14 checks passed
@nsingla nsingla deleted the add_as_reviewer branch January 27, 2026 19:44
jtu-ampere pushed a commit to jtu-ampere/pipelines that referenced this pull request Feb 12, 2026
…ions (kubeflow#12710)

Signed-off-by: Nelesh Singla <117123879+nsingla@users.noreply.github.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>
google-oss-prow bot pushed a commit that referenced this pull request Feb 27, 2026
…ding workflows for building arm64 and amd64 container images (#12804)

* Fix unresolved create/schedule time placeholders (#12628)

* Fix unresolved create/schedule time placeholders

Signed-off-by: Surya Sameer Datta Vaddadi <f20220373@goa.bits-pilani.ac.in>

* Update backend/src/v2/driver/resolve.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Surya Sameer Datta Vaddadi <137607947+sameerdattav@users.noreply.github.com>

* Addressing comments

Signed-off-by: Surya Sameer Datta Vaddadi <f20220373@goa.bits-pilani.ac.in>

* gofmt driver.go

Signed-off-by: Surya Sameer Datta Vaddadi <f20220373@goa.bits-pilani.ac.in>

---------

Signed-off-by: Surya Sameer Datta Vaddadi <f20220373@goa.bits-pilani.ac.in>
Signed-off-by: Surya Sameer Datta Vaddadi <137607947+sameerdattav@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* Fix: pip upgrade in backend API Dockerfile (#12694)

The CI build for backend/api image failed when pip attempted to upgrade wheel. Debian's python3-wheel package lacks RECORD metadata, so the uninstall that pip performs as part of the upgrade aborted. Switch to invoking python3 -m pip with --ignore-installed so pip layers the updated pip/setuptools/wheel without removing the distro packages, and keep using --break-system-packages to satisfy Debian.

Signed-off-by: sduvvuri1603 <sduvvuri@redhat.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* Feat(workflow) Add multi-arch docker buildx to 2 workflows - build-and-push.yml and image-builds-master.yml

1. Update the workflows `build-and-push.yml` with 2 self-hosted runners on OCI :
- Changing `runs-on` to `self-hosted, Linux, X64`
- Add Docker Buildx action
- Add SSH agent action
- Add the new parameter, `platforms` for `linux/amd64,linux/arm64` or `linux/amd64` only
2. Update the workflow `image-builds-master.yml` to add platform parameter for handling `kfp-metadata-writer` and `kfp-inverse-proxy-agent` for amd64 only while building the others in Multi-Arch container images
3. Add two parameters for `docker/setup-buildx-action@v3` : `builder` and `use` for multi-arch container image

Signed-off-by: Jeffery T. (mrdojojo) <113143099+jtu-ampere@users.noreply.github.com>

Update build-and-push.yml

Update build-and-push.yml

Add action for setting Docker Buildx driver

Signed-off-by: Jeffery T. (mrdojojo) <113143099+jtu-ampere@users.noreply.github.com>

Update build-and-push.yml

Add two parameters for `docker/setup-buildx-action@v3` : `builder` and `use` for multi-arch container image

Signed-off-by: Jeffery T. (mrdojojo) <113143099+jtu-ampere@users.noreply.github.com>

Update build-and-push.yml

Disable the 2 parameters for `docker/setup-buildx-action@v3`

Signed-off-by: Jeffery T. (mrdojojo) <113143099+jtu-ampere@users.noreply.github.com>

Test workflow build-and-push.yml and image-builds-master.yml

Test workflow build-and-push.yml and image-builds-master.yml with self-hosted runner on OCI

Update build-and-push.yml

Add parameters to docker/setup-buildx-action@v3

Update build-and-push.yml

Update the endpoint with arm64 node hostname

Update build-and-push.yml

Add BUILDX_BUILDER env parameter

Update build-and-push.yml

Remove driver-opts

Update build-and-push.yml

Disable BUILDX_BUILDER

Update build-and-push.yml

Change `BUILDX_BUILDER` from 'oci-multiarch-builder' to 'poly-builder'

Signed-off-by: Jeffery T. (mrdojojo) <113143099+jtu-ampere@users.noreply.github.com>

Update build-and-push.yml

Test "builder: poly-builder" for docker/build-push-action@v6

Signed-off-by: Jeffery T. (mrdojojo) <113143099+jtu-ampere@users.noreply.github.com>

Update build-and-push.yml

Add a step to get SSH key from the disk for running docker buildx build over ssh

Signed-off-by: Jeffery T. (mrdojojo) <113143099+jtu-ampere@users.noreply.github.com>

Update build-and-push.yml

Signed-off-by: Jeffery T. (mrdojojo) <113143099+jtu-ampere@users.noreply.github.com>

Update image-builds-master.yml

Remove "linux/arm64" from kfp-inverse-proxy-agent

Signed-off-by: Jeffery T. (mrdojojo) <113143099+jtu-ampere@users.noreply.github.com>

Update build-and-push.yml

Update build-and-push.yml

Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* chore(ci): use author_association to avoid API rate limits in approve workflow (#12698)

Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* ci: adding myself as reviewer and approver for github workflows & actions (#12710)

Signed-off-by: Nelesh Singla <117123879+nsingla@users.noreply.github.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* chore(deps): bump urllib3 from 2.5.0 to 2.6.3 in /.github/resources/scripts/kfp-readiness (#12621)

Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.5.0 to 2.6.3.
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@2.5.0...2.6.3)

---
updated-dependencies:
- dependency-name: urllib3
  dependency-version: 2.6.3
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* chore(ci): Replace GitHub REST API calls with event payload and cache lookups (#12712)

Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* chore(deps): bump wheel from 0.45.1 to 0.46.2 in /backend/src/apiserver/visualization (#12697)

Bumps [wheel](https://github.com/pypa/wheel) from 0.45.1 to 0.46.2.
- [Release notes](https://github.com/pypa/wheel/releases)
- [Changelog](https://github.com/pypa/wheel/blob/main/docs/news.rst)
- [Commits](pypa/wheel@0.45.1...0.46.2)

---
updated-dependencies:
- dependency-name: wheel
  dependency-version: 0.46.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* chore(deps): bump urllib3 from 2.5.0 to 2.6.3 in /components/aws/sagemaker (#12619)

Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.5.0 to 2.6.3.
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@2.5.0...2.6.3)

---
updated-dependencies:
- dependency-name: urllib3
  dependency-version: 2.6.3
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* chore(deps): bump urllib3 from 2.6.0 to 2.6.3 in /backend/metadata_writer (#12624)

Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.6.0 to 2.6.3.
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@2.6.0...2.6.3)

---
updated-dependencies:
- dependency-name: urllib3
  dependency-version: 2.6.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* chore(deps): bump pyasn1 from 0.6.1 to 0.6.2 in /backend/metadata_writer (#12660)

Bumps [pyasn1](https://github.com/pyasn1/pyasn1) from 0.6.1 to 0.6.2.
- [Release notes](https://github.com/pyasn1/pyasn1/releases)
- [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst)
- [Commits](pyasn1/pyasn1@v0.6.1...v0.6.2)

---
updated-dependencies:
- dependency-name: pyasn1
  dependency-version: 0.6.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* chore(deps): bump pyasn1 from 0.6.1 to 0.6.2 in /backend/src/apiserver/visualization (#12661)

Bumps [pyasn1](https://github.com/pyasn1/pyasn1) from 0.6.1 to 0.6.2.
- [Release notes](https://github.com/pyasn1/pyasn1/releases)
- [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst)
- [Commits](pyasn1/pyasn1@v0.6.1...v0.6.2)

---
updated-dependencies:
- dependency-name: pyasn1
  dependency-version: 0.6.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* chore(deps): bump urllib3 from 2.5.0 to 2.6.3 in /backend (#12622)

Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.5.0 to 2.6.3.
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@2.5.0...2.6.3)

---
updated-dependencies:
- dependency-name: urllib3
  dependency-version: 2.6.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* chore(deps): bump urllib3 from 2.5.0 to 2.6.3 in /sdk/python (#12620)

Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.5.0 to 2.6.3.
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@2.5.0...2.6.3)

---
updated-dependencies:
- dependency-name: urllib3
  dependency-version: 2.6.3
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* chore(deps): bump pyasn1 from 0.6.1 to 0.6.2 in /sdk/python (#12674)

Bumps [pyasn1](https://github.com/pyasn1/pyasn1) from 0.6.1 to 0.6.2.
- [Release notes](https://github.com/pyasn1/pyasn1/releases)
- [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst)
- [Commits](pyasn1/pyasn1@v0.6.1...v0.6.2)

---
updated-dependencies:
- dependency-name: pyasn1
  dependency-version: 0.6.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* feat(launcher): Add credential refresh to launcher (#12708)

Signed-off-by: Caroline DeVoto <cmdevoto@users.noreply.github.com>
Co-authored-by: Caroline DeVoto <cmdevoto@users.noreply.github.com>
Co-authored-by: droctothorpe <mythicalsunlight@gmail.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* fix(testing) retention for image-builds-with-cache artifacts (#12735)

Signed-off-by: alyssacgoins <agoins@redhat.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* Update ML Pipeline server address to facilitate TLS-enabled gRPC connection (#12718)

Signed-off-by: alyssacgoins <agoins@redhat.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* feat(backend): add propagation policy option to DeleteRecurringRun. Fixes #7421, fixes #12573 (#12574)

add apiv2beta1 import

add apiv2beta1 to test file

minor error message update

fix lint

fix jobID naming

rebuild

restore k8s platform file

test - reorder ci workflow

Signed-off-by: JerT33 <trestjeremiah@gmail.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* fix(ci): update expected workflow compiler stub (#12739)

Signed-off-by: zazulam <m.zazula@gmail.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* chore(sdk): Add deprecation notice to `add_node_selector_constraint` docstring (#12741)

Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* chore: expose Kubeflow Pipelines version via public ConfigMap (#12717)

* Create public configmap

Signed-off-by: Surya Sameer Datta Vaddadi <f20220373@goa.bits-pilani.ac.in>

* Removed unnessary changes

Signed-off-by: Surya Sameer Datta Vaddadi <f20220373@goa.bits-pilani.ac.in>

* RELEASE.md cleanup

Signed-off-by: Surya Sameer Datta Vaddadi <f20220373@goa.bits-pilani.ac.in>

* Added metadata labels for consistency

Signed-off-by: Surya Sameer Datta Vaddadi <f20220373@goa.bits-pilani.ac.in>

* Correcting indentation

Signed-off-by: Surya Sameer Datta Vaddadi <f20220373@goa.bits-pilani.ac.in>

* Changed latest to dev in kustomization.yaml

Signed-off-by: Surya Sameer Datta Vaddadi <f20220373@goa.bits-pilani.ac.in>

---------

Signed-off-by: Surya Sameer Datta Vaddadi <f20220373@goa.bits-pilani.ac.in>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* docs: fix broken Kubeflow Pipelines installation link (#12753)

Signed-off-by: Aniket Patil <aniketpatil2027@gmail.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* Recurring Runs Queue Throughput Optimization (#12610)

* Scheduled Workflow Controleer Optimization
- Add metrics and skip update in ScheduledWorkflow if unchanged to avoid triggering unnecessary reconciliations

Signed-off-by: arpechenin <arpechenin@avito.ru>

* - Add pre-update check explanation
- Add README for flags & metrics
- Make defaultКesync interval configurable

Signed-off-by: arpechenin <arpechenin@avito.ru>

---------

Signed-off-by: arpechenin <arpechenin@avito.ru>
Co-authored-by: arpechenin <arpechenin@avito.ru>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* Fix the reconciliation bug: (#12648)

In multi-user mode, all jobs are ignored by the namespace filter (kubeflow).

Signed-off-by: arpechenin <arpechenin@avito.ru>
Co-authored-by: arpechenin <arpechenin@avito.ru>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* fix(frontend): show logs for terminated pods. Fixes #11969  (#12742)

Signed-off-by: Anay Sharma <anay20sharma11@gmail.com>
Co-authored-by: Anay Sharma <anay20sharma11@gmail.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* ci: add pr number to the cache key (#12764)

Signed-off-by: Nelesh Singla <117123879+nsingla@users.noreply.github.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* Fix executor handling for collected list artifacts (#12707)

* Fix executor handling for collected list artifacts

Signed-off-by: sduvvuri1603 <sduvvuri@redhat.com>

* Format executor loop per yapf

Signed-off-by: sduvvuri1603 <sduvvuri@redhat.com>

* chore: normalize executor string quotes

Signed-off-by: sduvvuri1603 <sduvvuri@redhat.com>

* refactor: dedupe list artifact resolver

Signed-off-by: sduvvuri1603 <sduvvuri@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

* chore: docformat executor helper docstring

Signed-off-by: sduvvuri1603 <sduvvuri@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Signed-off-by: sduvvuri1603 <sduvvuri@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* feat(backend): add gRPC metrics to api-server (RPS/latency), optimize execution spec reporting (#12010)

* - add standard grpc metrics to api-server
- add report gap histogram
- optimize create or update tasks query

Signed-off-by: ntny <ntny1986@gmail.com>
Signed-off-by: arpechenin <arpechenin@avito.ru>

* - move to the latest version of grpc-prometheus

Signed-off-by: arpechenin <arpechenin@avito.ru>

* - register metrics

Signed-off-by: arpechenin <arpechenin@avito.ru>

* - bump metrics lib

Signed-off-by: arpechenin <arpechenin@avito.ru>

* - fix metrics injection

Signed-off-by: arpechenin <arpechenin@avito.ru>

* merge

Signed-off-by: arpechenin <arpechenin@avito.ru>

---------

Signed-off-by: ntny <ntny1986@gmail.com>
Signed-off-by: arpechenin <arpechenin@avito.ru>
Co-authored-by: arpechenin <arpechenin@avito.ru>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* chore(ci): Simplify image-build workflow by removing caching logic (#12769)

Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* feat(ci): optimize copilot reviews (#12768)

Signed-off-by: droctothorpe <mythicalsunlight@gmail.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* fix: resolve 6 CVEs in frontend server via ESM + k8s client upgrade (#12756)

* fix: resolve 6 CVEs in frontend server via ESM conversion and dependency upgrades

Resolve CVE-2025-15284 (qs), CVE-2026-24842/CVE-2026-23950/CVE-2026-23745
(tar), CVE-2023-28155 (request), and CVE-2025-13465 (lodash) by upgrading
@kubernetes/client-node from 0.16.3 to 1.4.0 and modernizing the server.

Key changes:
- Migrate test framework from Jest to Vitest 3.x
- Convert server from CommonJS to ESM (type: module, node16 module
  resolution, .js extensions on all relative imports)
- Replace __dirname with import.meta.url equivalent
- Replace node-fetch and portable-fetch with native fetch (Node 22)
- Upgrade @kubernetes/client-node to 1.4.0 (ESM-only, eliminates request,
  tar, and qs from dependency tree, -105 packages)
- Rewrite all k8s API calls from positional args to named parameter objects
- Update return value handling (1.x returns objects directly, no {body}
  wrapper)
- Pin lodash to >=4.17.23 to fix prototype pollution CVE

Signed-off-by: Jeff Spahr <spahrj@gmail.com>

* fix: resolve prettier 1.19.1 incompatibility with TS 4.5+ syntax

Prettier 1.19.1 (used in CI) doesn't support `import { type X }` or
`import type { X }` syntax. Convert inline type imports to value imports
and run prettier to fix formatting.

Signed-off-by: Jeff Spahr <spahrj@gmail.com>

* fix: add @vitest/coverage-v8 dev dependency for CI coverage

CI runs `npm test -- --coverage` which requires @vitest/coverage-v8.

Signed-off-by: Jeff Spahr <spahrj@gmail.com>

* fix: convert done() callbacks to async/await in all server tests

Replace all done() callback patterns with async/await across 7 test
files. This eliminates vitest 3.x deprecation warnings that caused
non-zero exit codes in CI.

Key changes:
- Convert supertest done callbacks to awaited promises
- Use supertest(app.app) instead of supertest(app.start()) to avoid
  port binding and EADDRINUSE conflicts (see #12757)
- Add afterAll vi.unstubAllGlobals() for files that stub fetch
- Fix fetch mock response bodies to use web ReadableStream where
  handlers call Readable.fromWeb()

Signed-off-by: Jeff Spahr <spahrj@gmail.com>

* fix: upgrade vitest to 4.x and fix test compatibility

- Upgrade vitest and @vitest/coverage-v8 from ^3.2.4 to ^4.0.18 to
  align with PR #12754 (CRA→Vite migration)
- Migrate vitest.config.ts from deprecated poolOptions.forks.singleFork
  to maxWorkers: 1 (vitest 4 removed poolOptions)
- Fix healthz tests: use toMatchObject instead of supertest .expect(200, body)
  to avoid JSON key ordering sensitivity and buildDate timing race
- Fix GCS constructor mocks: use function keyword instead of arrow functions
  (vitest 4 requires constructable mock implementations)
- Promisify auth server .listen() in beforeEach to prevent EADDRINUSE
  errors from port binding races between test lifecycle hooks

Signed-off-by: Jeff Spahr <spahrj@gmail.com>

* test: add server integration tests for K8s client validation

Add dedicated integration tests for validating server-side changes
against a real Kubernetes cluster:

- server-test.js: 21 tests covering static files, API proxy, health
  endpoints, and artifact endpoints
- k8s-integration-test.js: 10 tests validating @kubernetes/client-node
  1.x upgrade (readNamespacedPodLog, createNamespacedPod,
  deleteNamespacedPod, error handling)

These tests are integrated into the e2e-test-frontend workflow and
will run automatically on PRs touching frontend/server/**.

Signed-off-by: Jeff Spahr <spahrj@gmail.com>

* fix: use default import for crypto-js ESM compatibility

crypto-js is a CommonJS package that exposes SHA1 on its default export.
With ESM `import * as crypto`, SHA1 ends up on crypto.default.SHA1, not
crypto.SHA1, causing "crypto.SHA1 is not a function" at runtime in the
tensorboard handler.

This passed locally because the Kind cluster was running an older image
still using CommonJS require(). CI builds fresh from the PR branch with
ESM compilation, exposing the issue.

Signed-off-by: Jeff Spahr <spahrj@gmail.com>

---------

Signed-off-by: Jeff Spahr <spahrj@gmail.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* fix(frontend): require podnamespace for pod logs when authz is enabled (#12778)

Signed-off-by: Jeff Spahr <spahrj@gmail.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* chore(ci): Update image-build workflow to use `github.run_id` for artifact path (#12773)

* chore(ci): Update image-build workflow to use `github.run_id` for artifact path

Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com>

* chore(ci): Update deploy action to use `github.run_id` for artifact path

Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com>

* chore(ci): Expand workflow trigger paths to include additional shared resources

Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com>

---------

Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* fix: support non-default cluster domain for metadata service (#12701)

* hard-coded cluster domain fix

Signed-off-by: Priyanshu-u07 <connect.priyanshu8271@gmail.com>

* resolve failing tests

Signed-off-by: Priyanshu-u07 <connect.priyanshu8271@gmail.com>

* add CLUSTER_DOMAIN env var to deployment and unit tests for GetClusterDomain

Signed-off-by: Priyanshu-u07 <connect.priyanshu8271@gmail.com>

* fixes

Signed-off-by: Priyanshu-u07 <connect.priyanshu8271@gmail.com>

* Use GetClusterDomain() for TLS ServerName

Signed-off-by: Priyanshu-u07 <connect.priyanshu8271@gmail.com>

---------

Signed-off-by: Priyanshu-u07 <connect.priyanshu8271@gmail.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* fix: argument list to long error for large DAGs. Fixes #12453 (#12737)

Signed-off-by: Anay Sharma <anay20sharma11@gmail.com>
Co-authored-by: Anay Sharma <anay20sharma11@gmail.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* fix(multi-user): sync frontend images on namespace deployments (#12783)

Signed-off-by: Jaison Paul <paul.jaison@gmail.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* fix(frontend): Patch Artifact Storage Key XSS Vulnerability. Fixes #12670 (#12671)

format code

change error response to 500

rework for simple length check

revert unchanged files

fix tests

Signed-off-by: JerT33 <trestjeremiah@gmail.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* feat(frontend): migrate CRA to Vite + Vitest (#12754)

- replace CRA with Vite 7 + updated build/dev config

- migrate UI tests to Vitest + Testing Library; keep server Jest

- restore typecheck parity, update TS/tooling, docs, and CI commands

- add local visual diff helper + runner script for reviewers

AI attribution: Claude Opus 4.5 + gpt-5.2-codex (reasoning xhigh).

Signed-off-by: Jeff Spahr <spahrj@gmail.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* chore(ci): Refine SeaweedFS S3 auth setup and enhance wait logic in deployment scripts (#12772)

* chore(ci): Refine SeaweedFS S3 auth setup and enhance wait logic in deployment scripts

Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com>

* chore(ci): Use double square brackets in SeaweedFS auth timeout check for consistency

Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com>

* chore(manifests): Refactor SeaweedFS startup logic with retries, probes, and streamlined scripts

Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com>

* Apply suggestions from code review

Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com>

---------

Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com>
Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com>
Co-authored-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* fix(ci): pass build-args to Docker builds to fix unknown ref in tutorial links (#12795)

The build-and-push workflow was not passing these build args, causing
Dockerfiles to use their default values ("unknown"). This resulted in
tutorial source code links pointing to tree/unknown/ (GitHub 404) and
the UI version display showing "unknown".

Fixes #12376

Signed-off-by: Jaison Paul <paul.jaison@gmail.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* fix(frontend): update server integration tests to support Vite build output (#12796)

Signed-off-by: kaikaila <lyk2772@126.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* docs : replace broken project argo link with offical argo workflow d… (#12781)

Signed-off-by: Aniket Patil <aniketpatil2027@gmail.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* chore(frontend): drop .vitest. prefix from test filenames (#12799)

Signed-off-by: Priyanshu-u07 <connect.priyanshu8271@gmail.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* Prevent duplicate shell completion entries in kfp CLI (#12699)

* Prevent duplicate shell completion entries in kfp CLI

Signed-off-by: rid <riddhima8214@gmail.com>

* fix(cli): remove trailing whitespace

Signed-off-by: rid <riddhima8214@gmail.com>

* fix(cli): apply yapf formatting

Signed-off-by: rid <riddhima8214@gmail.com>

---------

Signed-off-by: rid <riddhima8214@gmail.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* fix(sdk): add type inference for CLI run parameters. Fixes #11607 (#12767)

Signed-off-by: Pavan More <pavansmore05@gmail.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* chore: Remove minio (#12613)

* remove minio and default to seaweedfs

Signed-off-by: Harshvir Potpose <hpotpose62@gmail.com>

* fix indentation

Signed-off-by: Harshvir Potpose <hpotpose62@gmail.com>

* update readme

Signed-off-by: Harshvir Potpose <hpotpose62@gmail.com>

* remove minio-service and replace its references with seaweedfs

Signed-off-by: Harshvir Potpose <hpotpose62@gmail.com>

* Format frontend

Signed-off-by: Harshvir Potpose <hpotpose62@gmail.com>

* revert pinned version

Signed-off-by: Harshvir Potpose <hpotpose62@gmail.com>

* npm run format

Signed-off-by: Harshvir Potpose <hpotpose62@gmail.com>

* Keep the port-forward in the foreground

Signed-off-by: Harshvir Potpose <hpotpose62@gmail.com>

---------

Signed-off-by: Harshvir Potpose <hpotpose62@gmail.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* Feat (workflow) use GitHub Repository secrets for SSH Private key

1. Use `webfactory/ssh-agent@v0.9.0` to set `ssh-private-key`
2. Add IP_ARM64_NODE env parameter for testing docker buildx
3. Retrieve  SSH_PRIVATE_KEY and SSH_KNOWN_HOSTS from repository secrets.

Signed-off-by: Jeffery T. (mrdojojo) <113143099+jtu-ampere@users.noreply.github.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* feat(workflow) Add platforms parameter to each target container image for use

1. Add platforms parameter for each target container image
2. Add `secrets: inherit` for using build-and-push.yml workflow
3. Add platforms input parameter to build-and-push.yml workflow

Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* feat: add UI smoke test tool for visual regression testing (#12784)

* feat: add UI smoke test tool for visual regression testing

Playwright-based screenshot capture tool for comparing UI across
branches. Supports multiple modes: existing dev server, static build,
and proxy mode (static files + API forwarding to a real backend).
Not wired into CI yet — intended for local use when making UI changes.

Signed-off-by: Jeff Spahr <spahrj@gmail.com>

* feat: add UI smoke test tool for visual regression testing

Adds a developer tool for catching visual regressions in the KFP
frontend. Captures screenshots of key UI pages via Playwright and
generates side-by-side comparisons with pixel diff percentages.

Primary workflow — compare your branch against master with a live
Kind backend:

  node frontend/scripts/ui-smoke-test/smoke-test-runner.js --compare master

The tool:
- Detects which backend components changed and rebuilds only those
- Manages a Kind cluster lifecycle (start, deploy, port-forward)
- Checks out the base ref via git worktree (fast, offline)
- Builds both frontends and serves them on separate ports
- Captures screenshots of 8 key pages via headless Chrome
- Generates labeled side-by-side comparison images with diff %
- Supports testing someone else's PR via --pr <number>
- Auto-skips backend rebuild when only frontend files changed
- Checks prerequisites at startup and fails fast with install commands
- Guarantees cleanup (worktrees, k8s resources) on all exit paths
- Shows numbered step progress ([3/12] Building 2 backend components)

Also adds a Visual Regression Testing section to frontend/README.md
so developers can discover the tool from where they already work.

Signed-off-by: Jeff Spahr <spahrj@gmail.com>

* feat(ui-smoke-test): improve compare flow and diff reporting

Signed-off-by: Jeff Spahr <spahrj@gmail.com>

* fix(frontend): address review feedback on UI smoke test tool

Security hardening:
- shellEscape(): use single-quote wrapping instead of incomplete
  double-quote escaping to prevent command injection
- proxy-server.js: add path traversal guard (resolve + prefix check)
- Validate PR_NUMBER is numeric before shell interpolation
- Detect "upstream" remote for PR fetch (supports fork contributors)

Dead code cleanup:
- Remove redundant smoke-test.sh (Node.js runner is canonical entrypoint)
- Remove unused uploadImageToGitHub(), spawn import, PR_DIR, PROXY_PORT,
  deployResult variable
- Fix upload-to-pr.js header comment (remove imgbb/imgur reference)

Behavioral improvements:
- Implement PR comment editing via gh api (PATCH existing comment instead
  of creating duplicates)
- startFrontendServer: restore ml-pipeline-ui on build/start failure;
  preserve and restore prior replica count instead of hardcoding 1
- checkPortAvailability: use net-based port check as primary detection;
  lsof is now optional enrichment for PID/process info
- Cache Playwright install (skip via --dry-run if already present)
- Use npm ci instead of npm install for reproducible installs
- Always run npm ci before PR frontend build (prevent stale deps)
- Add degraded status for screenshots where waitFor/waitForData selectors
  fail, distinguishing from clean captures
- Treat empty UI_SMOKE_VIEWPORTS env var as unset (prevent crash)
- Remove redundant manifest.json filter (.endsWith('.png') suffices)

Signed-off-by: Jeff Spahr <spahrj@gmail.com>

---------

Signed-off-by: Jeff Spahr <spahrj@gmail.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>

* fix: multi platform build using 2 runners

Signed-off-by: Akash Jaiswal <akashjaiswal3846@gmail.com>

* Apply suggestions from code review

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Jeffery T. (mrdojojo) <113143099+jtu-ampere@users.noreply.github.com>

* Update build-and-push.yml

Remove `BUILDX_BUILDER: 'poly-builder'` and 

Signed-off-by: Jeffery T. (mrdojojo) <113143099+jtu-ampere@users.noreply.github.com>

* fix: multi platform fix

Signed-off-by: Akash Jaiswal <akashjaiswal3846@gmail.com>

* copilot: suggestions

Signed-off-by: Akash Jaiswal <akashjaiswal3846@gmail.com>

---------

Signed-off-by: Surya Sameer Datta Vaddadi <f20220373@goa.bits-pilani.ac.in>
Signed-off-by: Surya Sameer Datta Vaddadi <137607947+sameerdattav@users.noreply.github.com>
Signed-off-by: jtu-ampere <113143099+jtu-ampere@users.noreply.github.com>
Signed-off-by: sduvvuri1603 <sduvvuri@redhat.com>
Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com>
Signed-off-by: Nelesh Singla <117123879+nsingla@users.noreply.github.com>
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Caroline DeVoto <cmdevoto@users.noreply.github.com>
Signed-off-by: alyssacgoins <agoins@redhat.com>
Signed-off-by: JerT33 <trestjeremiah@gmail.com>
Signed-off-by: zazulam <m.zazula@gmail.com>
Signed-off-by: Aniket Patil <aniketpatil2027@gmail.com>
Signed-off-by: arpechenin <arpechenin@avito.ru>
Signed-off-by: Anay Sharma <anay20sharma11@gmail.com>
Signed-off-by: ntny <ntny1986@gmail.com>
Signed-off-by: droctothorpe <mythicalsunlight@gmail.com>
Signed-off-by: Jeff Spahr <spahrj@gmail.com>
Signed-off-by: Priyanshu-u07 <connect.priyanshu8271@gmail.com>
Signed-off-by: Jaison Paul <paul.jaison@gmail.com>
Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com>
Signed-off-by: kaikaila <lyk2772@126.com>
Signed-off-by: rid <riddhima8214@gmail.com>
Signed-off-by: Pavan More <pavansmore05@gmail.com>
Signed-off-by: Harshvir Potpose <hpotpose62@gmail.com>
Signed-off-by: Jeffery T. (mrdojojo) <113143099+jtu-ampere@users.noreply.github.com>
Signed-off-by: Akash Jaiswal <akashjaiswal3846@gmail.com>
Co-authored-by: Surya Sameer Datta Vaddadi <137607947+sameerdattav@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Sruthi Duvvuri <sduvvuri@redhat.com>
Co-authored-by: Helber Belmiro <helber.belmiro@gmail.com>
Co-authored-by: Nelesh Singla <117123879+nsingla@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Caroline DeVoto <69636236+cmdevoto@users.noreply.github.com>
Co-authored-by: Caroline DeVoto <cmdevoto@users.noreply.github.com>
Co-authored-by: droctothorpe <mythicalsunlight@gmail.com>
Co-authored-by: Alyssa Goins <80764587+alyssacgoins@users.noreply.github.com>
Co-authored-by: JerT33 <trestjeremiah@gmail.com>
Co-authored-by: Michael <m.zazula@gmail.com>
Co-authored-by: Aniket Patil <aniketpatil2027@gmail.com>
Co-authored-by: Anton Pechenin <ntny1986@gmail.com>
Co-authored-by: arpechenin <arpechenin@avito.ru>
Co-authored-by: AnaySh <92953394+AnaySh@users.noreply.github.com>
Co-authored-by: Anay Sharma <anay20sharma11@gmail.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Jeff Spahr <spahrj@gmail.com>
Co-authored-by: Priyanshu Kumar <connect.priyanshu8271@gmail.com>
Co-authored-by: jsonmp-k8 <46974812+jsonmp-k8@users.noreply.github.com>
Co-authored-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com>
Co-authored-by: kaikaila <lyk2772@126.com>
Co-authored-by: Riddhima8 <158545173+Riddhima8@users.noreply.github.com>
Co-authored-by: Pavan More <144130319+puwun@users.noreply.github.com>
Co-authored-by: Harshvir Potpose <hpotpose62@gmail.com>
Co-authored-by: Akash Jaiswal <akashjaiswal3846@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants