chore: merge main into 1733-supervisor-middleware-e2e-sdk

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

.github/workflows/branch-e2e.yml

@@ -426,6 +426,9 @@ jobs:
       job-name: Kubernetes HA E2E (Rust smoke)
       extra-helm-values: deploy/helm/openshell/ci/values-high-availability.yaml
       external-postgres-secret: openshell-ha-pg
+      test-name: kubernetes_ha_rebalancing
+      kubernetes-features: e2e,e2e-host-gateway,e2e-kubernetes,e2e-kubernetes-ha
+      use-envoy-gateway: true
       conformance-artifact-prefix: openshell-conformance
 
   kubernetes-credential-drivers-e2e:

.github/workflows/codex-security.yml

@@ -4,9 +4,6 @@
 name: Codex Security Release Qualification
 
 on:
-  push:
-    tags:
-      - "v*.*.*-pre.*"
   workflow_call:
     inputs:
       candidate_ref:

.github/workflows/e2e-kubernetes-test.yml

@@ -52,6 +52,11 @@ on:
         required: false
         type: string
         default: ""
+      use-envoy-gateway:
+        description: "Route the test through Envoy Gateway instead of a direct gateway Service port-forward"
+        required: false
+        type: boolean
+        default: false
       mise-version:
         description: "mise version to install on the bare Kubernetes e2e runner"
         required: false
@@ -140,6 +145,7 @@ jobs:
           OPENSHELL_E2E_KUBE_EXTERNAL_POSTGRES_SECRET: ${{ inputs.external-postgres-secret }}
           OPENSHELL_E2E_KUBE_TEST: ${{ inputs.test-name }}
           OPENSHELL_E2E_KUBERNETES_FEATURES: ${{ inputs.kubernetes-features }}
+          OPENSHELL_E2E_KUBE_USE_ENVOY: ${{ inputs.use-envoy-gateway && '1' || '0' }}
           IMAGE_TAG: ${{ inputs.image-tag }}
           OPENSHELL_REGISTRY: ghcr.io/nvidia/openshell
           E2E_TASK: ${{ inputs.e2e-task }}

.github/workflows/integration-runner.yml

@@ -24,7 +24,7 @@ on:
         type: string
         default: >-
           [
-            {"environment":"ubuntu-docker-rootful","installer":"binaries","testsuite":"conformance"},
+            {"environment":"ubuntu-docker-rootful","installer":"deb","testsuite":"conformance"},
             {"environment":"fedora-podman-rootful","installer":"binaries","testsuite":"conformance"},
             {"environment":"fedora-podman-rootless","installer":"binaries","testsuite":"conformance"}
           ]

.github/workflows/prepare-integration-inputs.yml

@@ -11,6 +11,11 @@ on:
         required: false
         type: string
         default: ""
+      deb-artifact-name:
+        description: Debian package artifact to include in the tmachine inputs
+        required: false
+        type: string
+        default: ""
     outputs:
       source_sha:
         description: Source revision of the candidate artifacts
@@ -65,6 +70,22 @@ jobs:
           github-token: ${{ github.token }}
           run-id: ${{ inputs['artifact-run-id'] || github.run_id }}
 
+      - name: Download Debian package artifact
+        if: inputs['deb-artifact-name'] != ''
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: ${{ inputs['deb-artifact-name'] }}
+          path: artifacts/packages/download
+          github-token: ${{ github.token }}
+          run-id: ${{ inputs['artifact-run-id'] || github.run_id }}
+
+      - name: Stage Debian package input
+        if: inputs['deb-artifact-name'] != ''
+        run: |
+          set -euo pipefail
+          mv artifacts/packages/download/*.deb artifacts/packages/openshell.deb
+          rmdir artifacts/packages/download
+
       - name: Log in to GHCR
         run: echo "${{ github.token }}" | docker login ghcr.io -u "${GITHUB_ACTOR}" --password-stdin
 

.github/workflows/release-dev.yml

@@ -102,12 +102,14 @@ jobs:
       checkout-ref: ${{ github.sha }}
 
   prepare-integration:
-    needs: [build-binaries, build-images]
+    needs: [build-binaries, build-deb, build-images]
     permissions:
       actions: read
       contents: read
       packages: read
     uses: ./.github/workflows/prepare-integration-inputs.yml
+    with:
+      deb-artifact-name: deb-linux-amd64
 
   conformance-integration:
     needs: prepare-integration

.github/workflows/release-tag.yml

@@ -4,6 +4,7 @@ on:
   push:
     tags:
       - "v*.*.*"
+      - "!v*.*.*-pre.*"
   workflow_dispatch:
     inputs:
       tag:
@@ -129,13 +130,35 @@ jobs:
       image-tag: ${{ needs.compute-versions.outputs.source_sha }}
       checkout-ref: ${{ needs.compute-versions.outputs.source_sha }}
 
+  security:
+    name: Security Scan
+    needs: [compute-versions, build-images]
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+      security-events: write
+    uses: ./.github/workflows/security-scan.yml
+    with:
+      candidate_ref: ${{ inputs.tag || github.ref_name }}
+      allow-high-critical: false
+      images: |
+        ghcr.io/nvidia/openshell/gateway:${{ needs.compute-versions.outputs.source_sha }}
+        ghcr.io/nvidia/openshell/sandbox:${{ needs.compute-versions.outputs.source_sha }}
+        ghcr.io/nvidia/openshell/supervisor:${{ needs.compute-versions.outputs.source_sha }}
+    secrets:
+      CODEX_SECURITY_API_KEY: ${{ secrets.CODEX_SECURITY_API_KEY }}
+      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
   prepare-integration:
-    needs: [compute-versions, build-binaries, build-images]
+    needs: [compute-versions, build-binaries, build-deb, build-images]
     permissions:
       actions: read
       contents: read
       packages: read
     uses: ./.github/workflows/prepare-integration-inputs.yml
+    with:
+      deb-artifact-name: deb-linux-amd64
 
   conformance-integration:
     needs: prepare-integration
@@ -306,6 +329,7 @@ jobs:
       - feature-specific-integration
       - docker-e2e
       - vm-e2e
+      - security
       - build-deb
       - build-rpm
       - build-snap

.github/workflows/security-scan.yml

@@ -7,7 +7,7 @@ on:
   workflow_dispatch:
     inputs:
       candidate_ref:
-        description: Pre-release tag to scan (vMAJOR.MINOR.PATCH-pre.N)
+        description: Release tag to scan; Codex runs only for pre-release tags
         required: true
         type: string
       stable_ref:
@@ -33,7 +33,7 @@ on:
   workflow_call:
     inputs:
       candidate_ref:
-        description: Pre-release tag to scan (vMAJOR.MINOR.PATCH-pre.N)
+        description: Release tag to scan; Codex runs only for pre-release tags
         required: true
         type: string
       stable_ref:
@@ -69,6 +69,7 @@ permissions:
 jobs:
   codex:
     name: Codex Security
+    if: contains(inputs.candidate_ref, '-pre.')
     uses: ./.github/workflows/codex-security.yml
     permissions:
       actions: read