Merge remote-tracking branch 'upstream/main' into rhoai-3.6-ea.1

Author: m-rafeeq

.github/actions/trivy-scan-action/action.yml

@@ -26,7 +26,7 @@ inputs:
   trivy-version:
     description: 'Version of Trivy to use'
     required: false
-    default: '0.70.0'
+    default: '0.73.0'
   podman-socket:
     description: 'Path to Podman socket (required for image scans)'
     required: false

.github/workflows/build-notebooks-TEMPLATE.yaml

@@ -60,7 +60,7 @@ jobs:
       # GitHub image registry used for storing $(CONTAINER_ENGINE)'s cache
       CACHE: "ghcr.io/${{ github.repository }}/workbench-images/build-cache"
       # https://github.com/aquasecurity/trivy
-      TRIVY_VERSION: 0.70.0
+      TRIVY_VERSION: 0.73.0
       # Targets (and their folder) that should be scanned using FS instead of IMAGE scan due to resource constraints
       TRIVY_SCAN_FS_JSON: '{}'
       # Makefile variables

.github/workflows/code-quality.yaml

@@ -78,13 +78,18 @@ jobs:
     permissions:
       contents: read
       packages: read
+      code-quality: write  # upload coverage to GitHub Code Quality
     runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false  # https://github.com/actions/checkout/issues/2312
           # Full history so tests/test_pylock_downgrade.py can `git show origin/main:…/pylock.toml`.
           fetch-depth: 0
+          # Check out the PR head (not the merge commit) so coverage maps to head.sha, which is
+          # what upload-code-coverage attributes the report to (matches the action's README
+          # example). On push, head.sha is empty -> falls back to github.sha (unchanged).
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Login to GitHub Container Registry
         if: ${{ github.repository != 'opendatahub-io/notebooks' }}
@@ -142,6 +147,28 @@ jobs:
           flags: python
           fail_ci_if_error: false
 
+      # --- GitHub Code Quality: native code coverage on PRs (complements Codecov) ---
+      # One-time repo setup: Settings > Security > Code quality > Enable code quality.
+      # Needs (1) a Cobertura XML report -- coverage.xml, produced above by pytest-cov
+      # via PYTEST_ADDOPTS -- and (2) code-quality:write, granted on this job's perms.
+      # Fork PRs and merge_group runs are skipped by the action itself (read-only token).
+      # Feature docs:   https://docs.github.com/en/code-security/code-quality
+      # Setup guide:    https://docs.github.com/en/code-security/how-tos/maintain-quality-code/set-up-code-coverage
+      # Enable feature: https://docs.github.com/en/code-security/how-tos/maintain-quality-code/enable-code-quality
+      # Upload action:  https://github.com/actions/upload-code-coverage
+      # NOTE: on push/workflow_dispatch this action interpolates github.ref_name/github.ref into a
+      # shell run: (upstream script injection: https://github.com/actions/upload-code-coverage/issues/26).
+      # Only reachable with write access (which already grants CI code execution), so no marginal
+      # risk here; the fix belongs upstream (pass those values via env:).
+      - name: Upload Python coverage to GitHub Code Quality
+        if: ${{ !cancelled() && steps.install-deps.conclusion == 'success' }}
+        uses: actions/upload-code-coverage@1c15be36fc3733ba839b1dd643bd9556e4426dc1  # v1.4.1
+        with:
+          file: coverage.xml
+          language: Python
+          label: code-coverage/python
+          fail-on-error: false  # non-blocking, matching the Codecov steps
+
       - name: Upload test results to Codecov
         if: ${{ !cancelled() && steps.install-deps.conclusion == 'success' }}
         uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3  # v1.2.1
@@ -153,8 +180,13 @@ jobs:
     runs-on: ubuntu-26.04
     permissions:
       contents: read
+      code-quality: write  # upload coverage to GitHub Code Quality
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false  # don't leave the (code-quality:write) token in .git/config for PR code
+          # PR head (not the merge commit) so Go coverage maps to head.sha (see pytest-tests note).
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
@@ -174,6 +206,20 @@ jobs:
         run: gotestsum --junitfile=junit-go.xml -- -coverprofile=coverage-go.out -covermode=atomic ./...
         working-directory: scripts/buildinputs
 
+      - name: Convert Go coverage to Cobertura XML
+        id: go-cobertura
+        if: ${{ !cancelled() }}
+        continue-on-error: true  # optional coverage tooling must not fail the go-tests job
+        # upload-code-coverage only accepts Cobertura; Codecov reads the native .out directly.
+        # GitHub's documented Go recipe (see the "set-up-code-coverage" guide, language table):
+        #   go test -coverprofile=cover.out && gocover-cobertura < cover.out > coverage.xml
+        # https://docs.github.com/en/code-security/how-tos/maintain-quality-code/set-up-code-coverage
+        # https://github.com/boumenot/gocover-cobertura
+        run: |
+          go install github.com/boumenot/gocover-cobertura@v1.5.0
+          "$(go env GOPATH)/bin/gocover-cobertura" < coverage-go.out > coverage-go.xml
+        working-directory: scripts/buildinputs
+
       - name: Upload Go coverage to Codecov
         if: ${{ !cancelled() }}
         uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v7.0.0
@@ -184,6 +230,16 @@ jobs:
           flags: go
           fail_ci_if_error: false
 
+      # See the upstream-injection note on the Python upload above (github.com/actions/upload-code-coverage/issues/26).
+      - name: Upload Go coverage to GitHub Code Quality
+        if: ${{ !cancelled() && steps.go-cobertura.outcome == 'success' }}
+        uses: actions/upload-code-coverage@1c15be36fc3733ba839b1dd643bd9556e4426dc1  # v1.4.1
+        with:
+          file: scripts/buildinputs/coverage-go.xml
+          language: Go
+          label: code-coverage/go
+          fail-on-error: false  # non-blocking, matching the Codecov steps
+
       - name: Upload Go test results to Codecov
         if: ${{ !cancelled() }}
         uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3  # v1.2.1

.github/workflows/security.yaml

@@ -5,11 +5,16 @@ name: Security
   push:
     branches:
       - main
+      - stable
+      - 'rhoai-*'
   pull_request:
+  schedule:
+    - cron: '0 5 * * 3'
   workflow_dispatch:
 jobs:
   build:
     name: Trivy scan (fs)
+    if: github.event_name != 'schedule'
     runs-on: ubuntu-26.04
     permissions:
       contents: read
@@ -18,6 +23,50 @@ jobs:
 
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Trivy scan
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25  # v0.36.0
+        with:
+          version: 'v0.73.0'
+          scan-type: 'fs'
+          trivy-config: trivy.yaml
+          format: 'sarif'
+          output: 'trivy-results.sarif'
+          exit-code: '0'
+
+      - name: Update Security tab
+        uses: github/codeql-action/upload-sarif@d1ba80a13dd99fba24a470575428917156a28b43  # v4.37.5
+        with:
+          sarif_file: 'trivy-results.sarif'
+
+  scheduled-scan:
+    name: Trivy scan (fs) [${{ matrix.ref }}]
+    # `schedule` only ever fires against the default branch, so a plain cron
+    # trigger would never re-scan the rhoai-* release branches once they go
+    # quiet. Sweep the active ones explicitly instead. Those branches only
+    # exist on the downstream repo, so skip this on forks/upstream.
+    if: github.event_name == 'schedule' && github.repository == 'red-hat-data-services/notebooks'
+    runs-on: ubuntu-26.04
+    permissions:
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        ref: [main, rhoai-3.5, rhoai-3.4, rhoai-3.3, rhoai-2.25]
+    steps:
+
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          ref: ${{ matrix.ref }}
+          persist-credentials: false
+
+      - name: Resolve checked-out commit
+        id: commit
+        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
 
       - name: Trivy scan
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25  # v0.36.0
@@ -33,3 +82,8 @@ jobs:
         uses: github/codeql-action/upload-sarif@d1ba80a13dd99fba24a470575428917156a28b43  # v4.37.5
         with:
           sarif_file: 'trivy-results.sarif'
+          # Required here (unlike the push/pull_request job above): matrix.ref
+          # points at a branch other than the one that triggered this run, so
+          # the commit info can't be inferred from github context.
+          ref: refs/heads/${{ matrix.ref }}
+          sha: ${{ steps.commit.outputs.sha }}

.pre-commit-config.yaml

@@ -30,7 +30,7 @@ repos:
         pass_filenames: false
   # https://github.com/astral-sh/ruff-pre-commit
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.20
+    rev: v0.16.2
     hooks:
       - id: ruff-check
         types_or: [python, pyi, jupyter]

base-images/copr/src/copr_rebuild/models.py

@@ -77,8 +77,8 @@ class BuildResult(BaseModel):
 
 def main():
     """Generate the JSON schema for the Manifest model."""
-    import json  # noqa: PLC0415
-    from pathlib import Path  # noqa: PLC0415
+    import json  # ruff: ignore[import-outside-top-level]
+    from pathlib import Path  # ruff: ignore[import-outside-top-level]
 
     out = Path(__file__).parent / "manifest_schema.json"
     schema = {

base-images/cpu/c9s-python-3.12/Dockerfile.cpu

@@ -1,13 +1,13 @@
 ARG TARGETARCH
 
-FROM quay.io/centos/centos:stream9@sha256:e389f09f8af8baade5be5de6dbf70d8b5975ddc54641858f35552ea3c98ac872 AS buildscripts
+FROM quay.io/centos/centos:stream9@sha256:04bad0b08ac68a63b1810ea78a9d2ed4fb431e11d9c4c3916418edd4932856bd AS buildscripts
 COPY base-images/utils/aipcc.sh /mnt/aipcc.sh
 COPY base-images/utils/fix-permissions base-images/utils/rpm-file-permissions /mnt/usr/bin/
 
 ####################
 # base             #
 ####################
-FROM quay.io/centos/centos:stream9@sha256:e389f09f8af8baade5be5de6dbf70d8b5975ddc54641858f35552ea3c98ac872 AS base
+FROM quay.io/centos/centos:stream9@sha256:04bad0b08ac68a63b1810ea78a9d2ed4fb431e11d9c4c3916418edd4932856bd AS base
 
 ARG PYTHON_VERSION=3.12
 ENV PYTHON=python${PYTHON_VERSION}

base-images/cuda/12.9/c9s-python-3.12/Dockerfile.cuda

@@ -1,6 +1,6 @@
 ARG TARGETARCH
 
-FROM quay.io/centos/centos:stream9@sha256:e389f09f8af8baade5be5de6dbf70d8b5975ddc54641858f35552ea3c98ac872 AS buildscripts
+FROM quay.io/centos/centos:stream9@sha256:04bad0b08ac68a63b1810ea78a9d2ed4fb431e11d9c4c3916418edd4932856bd AS buildscripts
 COPY base-images/utils/aipcc.sh /mnt/aipcc.sh
 COPY base-images/utils/fix-permissions /mnt/usr/bin/
 

base-images/cuda/13.0/c9s-python-3.12/Dockerfile.cuda

@@ -1,6 +1,6 @@
 ARG TARGETARCH
 
-FROM quay.io/centos/centos:stream9@sha256:e389f09f8af8baade5be5de6dbf70d8b5975ddc54641858f35552ea3c98ac872 AS buildscripts
+FROM quay.io/centos/centos:stream9@sha256:04bad0b08ac68a63b1810ea78a9d2ed4fb431e11d9c4c3916418edd4932856bd AS buildscripts
 COPY base-images/utils/aipcc.sh /mnt/aipcc.sh
 COPY base-images/utils/fix-permissions /mnt/usr/bin/
 

base-images/rocm/7.14/c9s-python-3.12/Dockerfile.rocm

@@ -1,6 +1,6 @@
 ARG TARGETARCH
 
-FROM quay.io/centos/centos:stream9@sha256:e389f09f8af8baade5be5de6dbf70d8b5975ddc54641858f35552ea3c98ac872 AS buildscripts
+FROM quay.io/centos/centos:stream9@sha256:04bad0b08ac68a63b1810ea78a9d2ed4fb431e11d9c4c3916418edd4932856bd AS buildscripts
 COPY base-images/utils/aipcc.sh /mnt/aipcc.sh
 COPY base-images/utils/fix-permissions /mnt/usr/bin/