Skip to content

Commit 852e288

Browse files
committed
Merge remote-tracking branch 'upstream/main' into dependabot/uv/langgraph-checkpoint-4.1.1
Signed-off-by: Sébastien Han <seb@redhat.com>
2 parents 2d7a85b + 1764a35 commit 852e288

13 files changed

Lines changed: 115 additions & 72 deletions

.github/workflows/backward-compat.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ jobs:
3636
fetch-depth: 0 # Need full history to access main branch
3737

3838
- name: Set up Python
39-
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
39+
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
4040
with:
4141
python-version: '3.12'
4242

@@ -446,7 +446,7 @@ jobs:
446446
fetch-depth: 0
447447

448448
- name: Set up Python
449-
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
449+
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
450450
with:
451451
python-version: '3.12'
452452

.github/workflows/ci-status.yml

Lines changed: 45 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ jobs:
2222
timeout-minutes: 180
2323
permissions:
2424
checks: read
25+
pull-requests: read
2526
steps:
2627
- name: Wait for CI checks to complete
2728
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -43,19 +44,47 @@ jobs:
4344
const excludedApps = new Set(['mergify']);
4445
4546
const terminalStatuses = new Set(['completed']);
46-
const successConclusions = new Set(['success', 'skipped', 'neutral', 'cancelled']);
47-
const failureConclusions = new Set(['failure', 'timed_out']);
47+
const successConclusions = new Set(['success', 'skipped', 'neutral']);
48+
const failureConclusions = new Set(['failure', 'timed_out', 'cancelled', 'action_required', 'startup_failure', 'stale']);
49+
const replayCheckPrefix = 'Integration Tests (';
50+
const recordCheckPrefix = 'record-providers (';
51+
52+
function pathTriggersReplay(path) {
53+
if (path.startsWith('src/ogx_ui/')) return false;
54+
return path.startsWith('src/ogx/') ||
55+
path.startsWith('tests/') ||
56+
path === 'uv.lock' ||
57+
path === 'pyproject.toml' ||
58+
path === '.github/workflows/integration-tests.yml' ||
59+
path === '.github/actions/setup-ollama/action.yml' ||
60+
path === '.github/actions/setup-test-environment/action.yml' ||
61+
path === '.github/actions/run-and-record-tests/action.yml' ||
62+
path === 'scripts/integration-tests.sh' ||
63+
path === 'scripts/generate_ci_matrix.py';
64+
}
65+
66+
let replayRequired = context.eventName === 'merge_group';
67+
if (context.payload.pull_request) {
68+
const changedFiles = await github.paginate(github.rest.pulls.listFiles, {
69+
owner,
70+
repo,
71+
pull_number: context.payload.pull_request.number,
72+
per_page: 100,
73+
});
74+
replayRequired = changedFiles.some(file => pathTriggersReplay(file.filename));
75+
core.info(`Replay required: ${replayRequired} (${changedFiles.length} changed file(s) checked)`);
76+
}
4877
4978
while (true) {
50-
const { data: checkRuns } = await github.rest.checks.listForRef({
79+
const checkRuns = await github.paginate(github.rest.checks.listForRef, {
5180
owner,
5281
repo,
5382
ref: sha,
5483
per_page: 100,
5584
});
5685
5786
// Filter to only GitHub Actions checks, excluding ourselves and bots
58-
const relevant = checkRuns.check_runs.filter(cr => {
87+
const relevant = checkRuns.filter(cr => {
5988
if (excludedChecks.has(cr.name)) return false;
6089
if (cr.app && excludedApps.has(cr.app.slug)) return false;
6190
// Only include GitHub Actions checks
@@ -71,8 +100,11 @@ jobs:
71100
72101
const pending = relevant.filter(cr => !terminalStatuses.has(cr.status));
73102
const completed = relevant.filter(cr => terminalStatuses.has(cr.status));
103+
const replayChecks = relevant.filter(cr => cr.name.startsWith(replayCheckPrefix));
104+
const recordChecks = relevant.filter(cr => cr.name.startsWith(recordCheckPrefix));
74105
75106
core.info(`Checks: ${completed.length} completed, ${pending.length} pending out of ${relevant.length} total`);
107+
core.info(`Replay checks: ${replayChecks.length}; record checks: ${recordChecks.length}`);
76108
77109
for (const cr of completed) {
78110
core.info(` ✓ ${cr.name}: ${cr.conclusion}`);
@@ -87,6 +119,15 @@ jobs:
87119
continue;
88120
}
89121
122+
if (replayRequired && replayChecks.length === 0) {
123+
if (recordChecks.length > 0) {
124+
core.warning('Record checks are present, but no replay matrix checks were found for this SHA.');
125+
}
126+
core.info('Replay checks are required for this change. Waiting 30s for the replay workflow to appear...');
127+
await new Promise(r => setTimeout(r, 30000));
128+
continue;
129+
}
130+
90131
// All checks completed — evaluate conclusions
91132
const failed = completed.filter(cr => failureConclusions.has(cr.conclusion));
92133

.github/workflows/dependabot-constraints.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ jobs:
3939
fetch-depth: 2
4040

4141
- name: Set up Python
42-
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
42+
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
4343
with:
4444
python-version: '3.12'
4545

.github/workflows/docs-build.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ jobs:
3434
cache-dependency-path: 'docs/package-lock.json'
3535

3636
- name: Cache node_modules
37-
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
37+
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
3838
id: cache-node-modules
3939
with:
4040
path: docs/node_modules

.github/workflows/integration-vector-io-tests.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -196,7 +196,7 @@ jobs:
196196
exit 1
197197
198198
- name: Cache Hugging Face models
199-
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
199+
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
200200
with:
201201
path: ~/.cache/huggingface
202202
key: hf-${{ runner.os }}-${{ matrix.python-version }}-nomic-embed-text-v1.5

.github/workflows/openapi-generator-validation.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,7 @@ jobs:
117117
python-version: '3.12'
118118

119119
- name: Set up Java
120-
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
120+
uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
121121
with:
122122
distribution: 'temurin'
123123
java-version: '11'

.github/workflows/pre-commit.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ jobs:
3636
fetch-depth: ${{ github.actor == 'dependabot[bot]' && 0 || 2 }}
3737

3838
- name: Set up Python
39-
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
39+
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
4040
with:
4141
python-version: '3.12'
4242
cache: pip
@@ -62,7 +62,7 @@ jobs:
6262
run: python -m pip install 'pre-commit>=4.4.0'
6363

6464
- name: Cache pre-commit
65-
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v4
65+
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4
6666
with:
6767
path: ~/.cache/pre-commit
6868
key: pre-commit-3|${{ env.pythonLocation }}|${{ hashFiles('.pre-commit-config.yaml') }}

.github/workflows/publish-openapi-sdk.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ jobs:
4242
python-version: '3.12'
4343

4444
- name: Set up Java
45-
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
45+
uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
4646
with:
4747
distribution: 'temurin'
4848
java-version: '11'

.github/workflows/pypi.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -170,7 +170,7 @@ jobs:
170170
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
171171

172172
- name: Set up Python
173-
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
173+
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
174174
with:
175175
python-version: "3.12"
176176

@@ -309,7 +309,7 @@ jobs:
309309
# === PYTHON SETUP (for all Python packages) ===
310310
- name: Set up Python
311311
if: steps.should-build.outputs.skip != 'true' && matrix.registry == 'pypi'
312-
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
312+
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
313313
with:
314314
python-version: "3.12"
315315

pyproject.toml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ constraint-dependencies = [
1515
"gitpython>=3.1.47", # Command injection via Git options bypass
1616
"h11>=0.16.0",
1717
"idna>=3.15",
18+
"joserfc>=1.6.7",
1819
"langgraph-checkpoint>=4.1.1",
1920
"lxml>=6.1.0", # CVE-2026-41066: XML entity expansion with default resolve_entities=True
2021
"pillow>=12.2.0", # CVE-2026-40192 + 4 more: heap overflow, OOB write, DoS
@@ -26,7 +27,7 @@ constraint-dependencies = [
2627
"setuptools<81", # milvus-lite imports pkg_resources; setuptools 81+ removes it
2728
"starlette>=1.3.1", # CVE-2026-48710
2829
"tornado>=6.5.5",
29-
"urllib3>=2.7.0",
30+
"urllib3>=2.7.0", # CVE-2026-44432: DoS via excessive decompression; CVE-2026-44431: cross-origin redirect header leak
3031
"transformers>=4.57.2,<5.0.0", # CVE-2026-1839 fix only in 5.x; ogx doesn't use Trainer; 5.x breaks HybridCache imports
3132
"werkzeug>=3.1.6", # CVE-2025-66221 + 2 more: safe_join() device name bypass
3233
]
@@ -57,7 +58,7 @@ dependencies = [
5758
"jsonschema",
5859
"ogx-api", # API and provider specifications (local dev via tool.uv.sources)
5960
"openai>=2.41.0",
60-
"python-dotenv",
61+
"python-dotenv>=1.2.2", # CVE-2026-28684: arbitrary file overwrite via symlink following
6162
"pyjwt[crypto]>=2.13.0", # Pull crypto to support RS256 for jwt. Requires 2.12.0+ to fix CVE-2026-32597.
6263
"pydantic>=2.11.9",
6364
"rich",

0 commit comments

Comments
 (0)