From 2fe9af7a3857d0bc1bf5f983f6536cb31d9a576d Mon Sep 17 00:00:00 2001 From: Maha Benzekri Date: Mon, 17 Aug 2026 10:51:41 +0200 Subject: [PATCH 1/7] Bump vault to 8.10.6 Pick up the vault fix accepting falsy constant params in request context validation: a signatureAge of 0 was dropped from the request context, failing policy evaluation (VAULT-735, found via RD-1890). Issue: ZENKO-5348 --- solution/deps.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/solution/deps.yaml b/solution/deps.yaml index 5f8d413a42..72cc603c0e 100644 --- a/solution/deps.yaml +++ b/solution/deps.yaml @@ -131,7 +131,7 @@ vault: dashboard: vault2/vault-dashboards policy: vault2/vault-policies image: vault2 - tag: 8.10.4 + tag: 8.10.6 envsubst: VAULT_TAG zenko-operator: sourceRegistry: ghcr.io/scality From f66c79cd985f67e8cbc7fb6f52f391cdfc7fe9b6 Mon Sep 17 00:00:00 2001 From: Francois Ferrand Date: Tue, 17 Mar 2026 15:20:37 +0100 Subject: [PATCH 2/7] Fix workflow tests with action-gh-release 2.5.2+ In order to handle race conditions, it makes an extra call to list versions after having created one. Issue: ZENKO-5224 (cherry picked from commit 7221694c59462e5a8462718f7e16b2dd1b5ff5c0) --- tests/workflows/release.spec.ts | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/tests/workflows/release.spec.ts b/tests/workflows/release.spec.ts index b7bc4f76e9..2c3c80c0f0 100644 --- a/tests/workflows/release.spec.ts +++ b/tests/workflows/release.spec.ts @@ -191,7 +191,22 @@ test.each([ // Mock release notes generation moctokit.rest.repos .listReleases() - .reply({ status: 200, data: [{ tag_name: '2.3.6', id: 123 }]}), + // First call from release notes generation, to get the previous release + .reply({ status: 200, data: [{ tag_name: '2.3.6', id: 122 }] }) + // Second call made by action-gh-release@v2.5.2+ (after release creation) to handle + // race condition when release is created by multiple jobs in parallel... + .reply({ + status: 200, data: [{ tag_name: '2.3.6', id: 122 }, { + id: 123, + draft: true, + name: "Release " + tag, + prerelease: tag === '2.3.7-rc.1', + tag_name: tag, + target_commitish: await getCommitHash(), + upload_url: 'http://uploads.github.com/repos/scality/Zenko/releases/456/assets{?name,label}', + html_url: 'http://github.com/repos/scality/Zenko/releases/456', + }], + }), moctokit.rest.repos .generateReleaseNotes({ owner: "scality", From 47d3c5e1e11baba85e12aa5eb92114b2488862b8 Mon Sep 17 00:00:00 2001 From: Francois Ferrand Date: Tue, 17 Mar 2026 17:17:42 +0100 Subject: [PATCH 3/7] gha: use action-gh-release@v2.5.0 Older versions are broken in CI Issue: ZENKO-5224 (cherry picked from commit 9b723ea319e052d7f267ceb45c19944fde72114c) --- .github/workflows/release.yaml | 2 +- tests/workflows/release.spec.ts | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 1f6e1afa9d..7c684649d7 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -103,7 +103,7 @@ jobs: core.exportVariable('RELEASE_NOTES', releaseNotes.body); - name: Create Release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@v2.5.0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/tests/workflows/release.spec.ts b/tests/workflows/release.spec.ts index 2c3c80c0f0..d0e1ae59cb 100644 --- a/tests/workflows/release.spec.ts +++ b/tests/workflows/release.spec.ts @@ -266,7 +266,7 @@ test.each([ }], 'release': [{ // Need to explicitely pass token, the GITHUB_TOKEN does not seem to be set - uses: 'softprops/action-gh-release@v2', + uses: 'softprops/action-gh-release@v2.5.0', mockWith: { with: { token: "my-token", From 8edf12b7413193830d13b73bf508654db033415d Mon Sep 17 00:00:00 2001 From: Maha Benzekri Date: Tue, 28 Jul 2026 17:26:10 +0200 Subject: [PATCH 4/7] Fix release workflow tests broken by act runner image drift The 5 'Promote artifacts' tests fail on development/2.13 even though everything is pinned (action-gh-release@v2.5.0, act 0.2.75): the catthehacker act image (pulled with forcePull) now ships node 24 in its toolcache, which changed how unmatched mocked requests fail. action-gh-release@v2.5.0 never calls getReleaseByTag: it scans listReleases (findTagFromReleases) before creating the release. The second mocked listReleases reply contained the draft release, so the pre-creation scan found the target tag and took the update-existing path, issuing an updateRelease call no mock matches. This used to pass by accident: the unmatched request surfaced as a fast 404 which the action recovered from by creating the release; on node 24 it now hangs until an undici headers timeout and fails the step. Make the second listReleases reply draft-free so the action takes the create path, with every request matched by a mock. scality/action-artifacts@v4 (floating tag) is now a node24 action, which act 0.2.75 refuses to run: bump act to 0.2.84 as on development/2.14, and adapt the step-result parsing to the timing suffix newer act appends to step status lines. Issue: ZENKO-5317 (cherry picked from commit 5cbd5985ae662114e7bfd0e1ba297db0b48b77ce) --- tests/workflows/package.json | 2 +- tests/workflows/release.spec.ts | 40 +++++++++++++++------------------ 2 files changed, 19 insertions(+), 23 deletions(-) diff --git a/tests/workflows/package.json b/tests/workflows/package.json index 69ff6e9477..486597bde1 100644 --- a/tests/workflows/package.json +++ b/tests/workflows/package.json @@ -3,7 +3,7 @@ "version": "1.0.0", "description": "Tests for GHA workflows", "scripts": { - "postinstall": "yarn --cwd node_modules/@kie/act-js node scripts/postinstall.js 0.2.75", + "postinstall": "yarn --cwd node_modules/@kie/act-js node scripts/postinstall.js 0.2.84", "test": "jest" }, "license": "Apache-2.0", diff --git a/tests/workflows/release.spec.ts b/tests/workflows/release.spec.ts index d0e1ae59cb..aff7fef4ee 100644 --- a/tests/workflows/release.spec.ts +++ b/tests/workflows/release.spec.ts @@ -193,20 +193,10 @@ test.each([ .listReleases() // First call from release notes generation, to get the previous release .reply({ status: 200, data: [{ tag_name: '2.3.6', id: 122 }] }) - // Second call made by action-gh-release@v2.5.2+ (after release creation) to handle - // race condition when release is created by multiple jobs in parallel... - .reply({ - status: 200, data: [{ tag_name: '2.3.6', id: 122 }, { - id: 123, - draft: true, - name: "Release " + tag, - prerelease: tag === '2.3.7-rc.1', - tag_name: tag, - target_commitish: await getCommitHash(), - upload_url: 'http://uploads.github.com/repos/scality/Zenko/releases/456/assets{?name,label}', - html_url: 'http://github.com/repos/scality/Zenko/releases/456', - }], - }), + // Second call made by action-gh-release@v2.5.0's findTagFromReleases, which scans + // all releases before creating one: it must not contain the target tag, or the + // action takes the update-existing-release path instead of creating the release. + .reply({ status: 200, data: [{ tag_name: '2.3.6', id: 122 }] }), moctokit.rest.repos .generateReleaseNotes({ owner: "scality", @@ -293,19 +283,25 @@ test.each([ } }); - var lastResult = result[result.length - 1]; - var postSteps = []; + // act >=0.2.81 appends a timing suffix to success/failure lines ("Main foo [40ms]"), which + // act-js's OutputParser splits into a named "Run" entry followed by an unnamed status entry. + // So the real status of result[i] lives on result[i + 1]; unnamed entries have status set. + var lastResult = result.length - 2; + var postSteps: number[] = []; // action-artifacts keep executing Post step, need to skip it... for (let i = result.length - 1; i >= 0; i--) { - if (result[i].name.startsWith('Main ')) { - lastResult = result[i]; + if (!result[i].name) { + postSteps.push(result[i].status); + } else if (result[i].name.startsWith('Main ')) { + lastResult = i; break; } - postSteps.push(result[i]); } - expect(lastResult.name).toStrictEqual('Main ' + stepName); - expect(lastResult.status).toStrictEqual(status.value()); - postSteps.forEach(r => expect(r.status).toStrictEqual(Pass.value())); + postSteps.pop(); // last pushed entry is the matched step's own status, not a post-step + + expect(result[lastResult].name.startsWith('Main ' + stepName)).toBe(true); + expect(result[lastResult + 1].status).toStrictEqual(status.value()); + postSteps.forEach(s => expect(s).toStrictEqual(Pass.value())); }) From a38f703d439bcc1c653488341f052c19f0f2bb5c Mon Sep 17 00:00:00 2001 From: Francois Ferrand Date: Fri, 3 Apr 2026 14:31:30 +0200 Subject: [PATCH 5/7] Fix ctst lint build MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - there are conflicting -and unresolved- dependencies on @types/nodes in the project - bumping @types/node@^24.0.0 → 24.12.0 thus creates the duplicate definition - since we don't specify frozen-lock-file on yarn install, this bump happened unexpectedly Issue: ZENKO-5242 --- .github/workflows/end2end.yaml | 5 ++++- tests/ctst/package.json | 1 + 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/end2end.yaml b/.github/workflows/end2end.yaml index 3e67409564..04fa46bf31 100644 --- a/.github/workflows/end2end.yaml +++ b/.github/workflows/end2end.yaml @@ -398,7 +398,10 @@ jobs: cache-dependency-path: tests/ctst/yarn.lock - name: Install ctst test dependencies working-directory: tests/ctst - run: yarn install + run: > + yarn install --frozen-lock-file --network-concurrency 1 || ( + yarn cache clean && yarn install --frozen-lock-file --network-concurrency 1 + ) - name: Lint ctst tests working-directory: tests/ctst run: yarn lint diff --git a/tests/ctst/package.json b/tests/ctst/package.json index 631c9a7601..893bf384c4 100644 --- a/tests/ctst/package.json +++ b/tests/ctst/package.json @@ -25,6 +25,7 @@ "@aws-sdk/client-s3": "^3.583.0", "@aws-sdk/client-sts": "^3.583.0", "@eslint/compat": "^1.1.1", + "@types/node": "^20.17.0", "cli-testing": "github:scality/cli-testing.git#1.2.4", "eslint": "^9.9.1", "eslint-config-scality": "scality/Guidelines#8.3.0", From a596bd1de01da7813ca9b1487947f285ff746171 Mon Sep 17 00:00:00 2001 From: Github Date: Fri, 3 Apr 2026 15:40:28 +0200 Subject: [PATCH 6/7] Fix lint-and-build-ctst failure We have multiple un-pinned dependency on "@types/node", which used to resolve fine to 24.x release. We are now pulling 25.x, which has a different definition of `URLPattern`. Since we depend on this module multiple times, we have two incompatible types, which triggering TS2403. This happens because he lint-and-build-ctst job runs `yarn install` in CI without `--frozen-lockfile`. - When the commit were merged: @types/node@25.x had not been released yet (or was not the latest). So no problem. - Now @types/node@25.x is published and satisfies the various conditions. A fresh yarn install now resolves two separate versions into node_modules: 24.x and 25.x for >=13.7.0. Both declare URLPattern, causing TS2403. Issue: ZENKO-5242 --- .github/workflows/end2end.yaml | 2 +- tests/ctst/package.json | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/end2end.yaml b/.github/workflows/end2end.yaml index 04fa46bf31..79936ee3aa 100644 --- a/.github/workflows/end2end.yaml +++ b/.github/workflows/end2end.yaml @@ -398,7 +398,7 @@ jobs: cache-dependency-path: tests/ctst/yarn.lock - name: Install ctst test dependencies working-directory: tests/ctst - run: > + run: >- yarn install --frozen-lock-file --network-concurrency 1 || ( yarn cache clean && yarn install --frozen-lock-file --network-concurrency 1 ) diff --git a/tests/ctst/package.json b/tests/ctst/package.json index 893bf384c4..8697a4e1cd 100644 --- a/tests/ctst/package.json +++ b/tests/ctst/package.json @@ -9,6 +9,7 @@ "private": true, "dependencies": { "@kubernetes/client-node": "^0.21.0", + "@types/node": "^20.1.1", "@types/proper-lockfile": "^4.1.4", "@types/qs": "^6.9.15", "assert": "^2.1.0", From 282b373a7e92532e2d7bf75152c4eff89693bbd4 Mon Sep 17 00:00:00 2001 From: Maha Benzekri Date: Mon, 17 Aug 2026 13:41:29 +0200 Subject: [PATCH 7/7] Bump zenko-operator to v1.7.9 The e2e deploy fails to pull gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0, which was removed when Google sunset the kubebuilder registry. zenko-operator v1.7.9 pulls the auth proxy from quay.io/brancz instead. Issue: ZENKO-5348 --- solution/deps.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/solution/deps.yaml b/solution/deps.yaml index 72cc603c0e..fb35b491fc 100644 --- a/solution/deps.yaml +++ b/solution/deps.yaml @@ -136,7 +136,7 @@ vault: zenko-operator: sourceRegistry: ghcr.io/scality image: zenko-operator - tag: v1.7.8 + tag: v1.7.9 envsubst: ZENKO_OPERATOR_TAG zenko-ui: sourceRegistry: ghcr.io/scality