From 2fe9af7a3857d0bc1bf5f983f6536cb31d9a576d Mon Sep 17 00:00:00 2001 From: Maha Benzekri Date: Mon, 17 Aug 2026 10:51:41 +0200 Subject: [PATCH 1/9] Bump vault to 8.10.6 Pick up the vault fix accepting falsy constant params in request context validation: a signatureAge of 0 was dropped from the request context, failing policy evaluation (VAULT-735, found via RD-1890). Issue: ZENKO-5348 --- solution/deps.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/solution/deps.yaml b/solution/deps.yaml index 5f8d413a42..72cc603c0e 100644 --- a/solution/deps.yaml +++ b/solution/deps.yaml @@ -131,7 +131,7 @@ vault: dashboard: vault2/vault-dashboards policy: vault2/vault-policies image: vault2 - tag: 8.10.4 + tag: 8.10.6 envsubst: VAULT_TAG zenko-operator: sourceRegistry: ghcr.io/scality From f66c79cd985f67e8cbc7fb6f52f391cdfc7fe9b6 Mon Sep 17 00:00:00 2001 From: Francois Ferrand Date: Tue, 17 Mar 2026 15:20:37 +0100 Subject: [PATCH 2/9] Fix workflow tests with action-gh-release 2.5.2+ In order to handle race conditions, it makes an extra call to list versions after having created one. Issue: ZENKO-5224 (cherry picked from commit 7221694c59462e5a8462718f7e16b2dd1b5ff5c0) --- tests/workflows/release.spec.ts | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/tests/workflows/release.spec.ts b/tests/workflows/release.spec.ts index b7bc4f76e9..2c3c80c0f0 100644 --- a/tests/workflows/release.spec.ts +++ b/tests/workflows/release.spec.ts @@ -191,7 +191,22 @@ test.each([ // Mock release notes generation moctokit.rest.repos .listReleases() - .reply({ status: 200, data: [{ tag_name: '2.3.6', id: 123 }]}), + // First call from release notes generation, to get the previous release + .reply({ status: 200, data: [{ tag_name: '2.3.6', id: 122 }] }) + // Second call made by action-gh-release@v2.5.2+ (after release creation) to handle + // race condition when release is created by multiple jobs in parallel... + .reply({ + status: 200, data: [{ tag_name: '2.3.6', id: 122 }, { + id: 123, + draft: true, + name: "Release " + tag, + prerelease: tag === '2.3.7-rc.1', + tag_name: tag, + target_commitish: await getCommitHash(), + upload_url: 'http://uploads.github.com/repos/scality/Zenko/releases/456/assets{?name,label}', + html_url: 'http://github.com/repos/scality/Zenko/releases/456', + }], + }), moctokit.rest.repos .generateReleaseNotes({ owner: "scality", From 47d3c5e1e11baba85e12aa5eb92114b2488862b8 Mon Sep 17 00:00:00 2001 From: Francois Ferrand Date: Tue, 17 Mar 2026 17:17:42 +0100 Subject: [PATCH 3/9] gha: use action-gh-release@v2.5.0 Older versions are broken in CI Issue: ZENKO-5224 (cherry picked from commit 9b723ea319e052d7f267ceb45c19944fde72114c) --- .github/workflows/release.yaml | 2 +- tests/workflows/release.spec.ts | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 1f6e1afa9d..7c684649d7 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -103,7 +103,7 @@ jobs: core.exportVariable('RELEASE_NOTES', releaseNotes.body); - name: Create Release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@v2.5.0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/tests/workflows/release.spec.ts b/tests/workflows/release.spec.ts index 2c3c80c0f0..d0e1ae59cb 100644 --- a/tests/workflows/release.spec.ts +++ b/tests/workflows/release.spec.ts @@ -266,7 +266,7 @@ test.each([ }], 'release': [{ // Need to explicitely pass token, the GITHUB_TOKEN does not seem to be set - uses: 'softprops/action-gh-release@v2', + uses: 'softprops/action-gh-release@v2.5.0', mockWith: { with: { token: "my-token", From 8edf12b7413193830d13b73bf508654db033415d Mon Sep 17 00:00:00 2001 From: Maha Benzekri Date: Tue, 28 Jul 2026 17:26:10 +0200 Subject: [PATCH 4/9] Fix release workflow tests broken by act runner image drift The 5 'Promote artifacts' tests fail on development/2.13 even though everything is pinned (action-gh-release@v2.5.0, act 0.2.75): the catthehacker act image (pulled with forcePull) now ships node 24 in its toolcache, which changed how unmatched mocked requests fail. action-gh-release@v2.5.0 never calls getReleaseByTag: it scans listReleases (findTagFromReleases) before creating the release. The second mocked listReleases reply contained the draft release, so the pre-creation scan found the target tag and took the update-existing path, issuing an updateRelease call no mock matches. This used to pass by accident: the unmatched request surfaced as a fast 404 which the action recovered from by creating the release; on node 24 it now hangs until an undici headers timeout and fails the step. Make the second listReleases reply draft-free so the action takes the create path, with every request matched by a mock. scality/action-artifacts@v4 (floating tag) is now a node24 action, which act 0.2.75 refuses to run: bump act to 0.2.84 as on development/2.14, and adapt the step-result parsing to the timing suffix newer act appends to step status lines. Issue: ZENKO-5317 (cherry picked from commit 5cbd5985ae662114e7bfd0e1ba297db0b48b77ce) --- tests/workflows/package.json | 2 +- tests/workflows/release.spec.ts | 40 +++++++++++++++------------------ 2 files changed, 19 insertions(+), 23 deletions(-) diff --git a/tests/workflows/package.json b/tests/workflows/package.json index 69ff6e9477..486597bde1 100644 --- a/tests/workflows/package.json +++ b/tests/workflows/package.json @@ -3,7 +3,7 @@ "version": "1.0.0", "description": "Tests for GHA workflows", "scripts": { - "postinstall": "yarn --cwd node_modules/@kie/act-js node scripts/postinstall.js 0.2.75", + "postinstall": "yarn --cwd node_modules/@kie/act-js node scripts/postinstall.js 0.2.84", "test": "jest" }, "license": "Apache-2.0", diff --git a/tests/workflows/release.spec.ts b/tests/workflows/release.spec.ts index d0e1ae59cb..aff7fef4ee 100644 --- a/tests/workflows/release.spec.ts +++ b/tests/workflows/release.spec.ts @@ -193,20 +193,10 @@ test.each([ .listReleases() // First call from release notes generation, to get the previous release .reply({ status: 200, data: [{ tag_name: '2.3.6', id: 122 }] }) - // Second call made by action-gh-release@v2.5.2+ (after release creation) to handle - // race condition when release is created by multiple jobs in parallel... - .reply({ - status: 200, data: [{ tag_name: '2.3.6', id: 122 }, { - id: 123, - draft: true, - name: "Release " + tag, - prerelease: tag === '2.3.7-rc.1', - tag_name: tag, - target_commitish: await getCommitHash(), - upload_url: 'http://uploads.github.com/repos/scality/Zenko/releases/456/assets{?name,label}', - html_url: 'http://github.com/repos/scality/Zenko/releases/456', - }], - }), + // Second call made by action-gh-release@v2.5.0's findTagFromReleases, which scans + // all releases before creating one: it must not contain the target tag, or the + // action takes the update-existing-release path instead of creating the release. + .reply({ status: 200, data: [{ tag_name: '2.3.6', id: 122 }] }), moctokit.rest.repos .generateReleaseNotes({ owner: "scality", @@ -293,19 +283,25 @@ test.each([ } }); - var lastResult = result[result.length - 1]; - var postSteps = []; + // act >=0.2.81 appends a timing suffix to success/failure lines ("Main foo [40ms]"), which + // act-js's OutputParser splits into a named "Run" entry followed by an unnamed status entry. + // So the real status of result[i] lives on result[i + 1]; unnamed entries have status set. + var lastResult = result.length - 2; + var postSteps: number[] = []; // action-artifacts keep executing Post step, need to skip it... for (let i = result.length - 1; i >= 0; i--) { - if (result[i].name.startsWith('Main ')) { - lastResult = result[i]; + if (!result[i].name) { + postSteps.push(result[i].status); + } else if (result[i].name.startsWith('Main ')) { + lastResult = i; break; } - postSteps.push(result[i]); } - expect(lastResult.name).toStrictEqual('Main ' + stepName); - expect(lastResult.status).toStrictEqual(status.value()); - postSteps.forEach(r => expect(r.status).toStrictEqual(Pass.value())); + postSteps.pop(); // last pushed entry is the matched step's own status, not a post-step + + expect(result[lastResult].name.startsWith('Main ' + stepName)).toBe(true); + expect(result[lastResult + 1].status).toStrictEqual(status.value()); + postSteps.forEach(s => expect(s).toStrictEqual(Pass.value())); }) From a38f703d439bcc1c653488341f052c19f0f2bb5c Mon Sep 17 00:00:00 2001 From: Francois Ferrand Date: Fri, 3 Apr 2026 14:31:30 +0200 Subject: [PATCH 5/9] Fix ctst lint build MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - there are conflicting -and unresolved- dependencies on @types/nodes in the project - bumping @types/node@^24.0.0 → 24.12.0 thus creates the duplicate definition - since we don't specify frozen-lock-file on yarn install, this bump happened unexpectedly Issue: ZENKO-5242 --- .github/workflows/end2end.yaml | 5 ++++- tests/ctst/package.json | 1 + 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/end2end.yaml b/.github/workflows/end2end.yaml index 3e67409564..04fa46bf31 100644 --- a/.github/workflows/end2end.yaml +++ b/.github/workflows/end2end.yaml @@ -398,7 +398,10 @@ jobs: cache-dependency-path: tests/ctst/yarn.lock - name: Install ctst test dependencies working-directory: tests/ctst - run: yarn install + run: > + yarn install --frozen-lock-file --network-concurrency 1 || ( + yarn cache clean && yarn install --frozen-lock-file --network-concurrency 1 + ) - name: Lint ctst tests working-directory: tests/ctst run: yarn lint diff --git a/tests/ctst/package.json b/tests/ctst/package.json index 631c9a7601..893bf384c4 100644 --- a/tests/ctst/package.json +++ b/tests/ctst/package.json @@ -25,6 +25,7 @@ "@aws-sdk/client-s3": "^3.583.0", "@aws-sdk/client-sts": "^3.583.0", "@eslint/compat": "^1.1.1", + "@types/node": "^20.17.0", "cli-testing": "github:scality/cli-testing.git#1.2.4", "eslint": "^9.9.1", "eslint-config-scality": "scality/Guidelines#8.3.0", From a596bd1de01da7813ca9b1487947f285ff746171 Mon Sep 17 00:00:00 2001 From: Github Date: Fri, 3 Apr 2026 15:40:28 +0200 Subject: [PATCH 6/9] Fix lint-and-build-ctst failure We have multiple un-pinned dependency on "@types/node", which used to resolve fine to 24.x release. We are now pulling 25.x, which has a different definition of `URLPattern`. Since we depend on this module multiple times, we have two incompatible types, which triggering TS2403. This happens because he lint-and-build-ctst job runs `yarn install` in CI without `--frozen-lockfile`. - When the commit were merged: @types/node@25.x had not been released yet (or was not the latest). So no problem. - Now @types/node@25.x is published and satisfies the various conditions. A fresh yarn install now resolves two separate versions into node_modules: 24.x and 25.x for >=13.7.0. Both declare URLPattern, causing TS2403. Issue: ZENKO-5242 --- .github/workflows/end2end.yaml | 2 +- tests/ctst/package.json | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/end2end.yaml b/.github/workflows/end2end.yaml index 04fa46bf31..79936ee3aa 100644 --- a/.github/workflows/end2end.yaml +++ b/.github/workflows/end2end.yaml @@ -398,7 +398,7 @@ jobs: cache-dependency-path: tests/ctst/yarn.lock - name: Install ctst test dependencies working-directory: tests/ctst - run: > + run: >- yarn install --frozen-lock-file --network-concurrency 1 || ( yarn cache clean && yarn install --frozen-lock-file --network-concurrency 1 ) diff --git a/tests/ctst/package.json b/tests/ctst/package.json index 893bf384c4..8697a4e1cd 100644 --- a/tests/ctst/package.json +++ b/tests/ctst/package.json @@ -9,6 +9,7 @@ "private": true, "dependencies": { "@kubernetes/client-node": "^0.21.0", + "@types/node": "^20.1.1", "@types/proper-lockfile": "^4.1.4", "@types/qs": "^6.9.15", "assert": "^2.1.0", From 282b373a7e92532e2d7bf75152c4eff89693bbd4 Mon Sep 17 00:00:00 2001 From: Maha Benzekri Date: Mon, 17 Aug 2026 13:41:29 +0200 Subject: [PATCH 7/9] Bump zenko-operator to v1.7.9 The e2e deploy fails to pull gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0, which was removed when Google sunset the kubebuilder registry. zenko-operator v1.7.9 pulls the auth proxy from quay.io/brancz instead. Issue: ZENKO-5348 --- solution/deps.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/solution/deps.yaml b/solution/deps.yaml index 72cc603c0e..fb35b491fc 100644 --- a/solution/deps.yaml +++ b/solution/deps.yaml @@ -136,7 +136,7 @@ vault: zenko-operator: sourceRegistry: ghcr.io/scality image: zenko-operator - tag: v1.7.8 + tag: v1.7.9 envsubst: ZENKO_OPERATOR_TAG zenko-ui: sourceRegistry: ghcr.io/scality From 938ac81f28d8a1e01444db42c618e6ceedac442d Mon Sep 17 00:00:00 2001 From: Maha Benzekri Date: Mon, 17 Aug 2026 14:14:34 +0200 Subject: [PATCH 8/9] Raise zookeeper probe timeouts in CI fix script Operator v1.7.x creates the ZookeeperCluster with probe timeoutSeconds left at 0, floored to 1s by Kubernetes. With exec probe timeouts enforced, the readiness script is killed before the observer-to-participant promotion completes and the pod never becomes Ready. The operator-side fix (ZKOP-529) only exists in v1.8.8+, so patch the timeouts in the CI-only zookeeper fix script. Issue: ZENKO-5348 --- .github/scripts/end2end/fix-zookeeper.sh | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/.github/scripts/end2end/fix-zookeeper.sh b/.github/scripts/end2end/fix-zookeeper.sh index 1feb29df59..aedcc7a257 100755 --- a/.github/scripts/end2end/fix-zookeeper.sh +++ b/.github/scripts/end2end/fix-zookeeper.sh @@ -63,6 +63,10 @@ done # Patch the StatefulSet with JVM flags to disable container support # as ubuntu runners now are incompatible with zookeeper. +# Also raise the exec probe timeouts: operators without the ZKOP-529 fix +# leave probe timeoutSeconds at 0, which Kubernetes floors to 1s; with +# ExecProbeTimeout enforced the readiness script gets killed before the +# observer-to-participant promotion completes and the pod never turns Ready. kubectl -n "${NAMESPACE}" patch statefulset "${ZK_STS_NAME}" --type='strategic' \ -p '{ "spec": { @@ -76,7 +80,13 @@ kubectl -n "${NAMESPACE}" patch statefulset "${ZK_STS_NAME}" --type='strategic' "name": "JVMFLAGS", "value": "-Xmx512m -Xms512m -XX:-UseContainerSupport -XX:ActiveProcessorCount=1 -Djava.awt.headless=true -Dzookeeper.log.dir=/data/logs -Dzookeeper.root.logger=INFO,CONSOLE -Dlog4j.configuration=file:/data/conf/log4j.properties" } - ] + ], + "readinessProbe": { + "timeoutSeconds": 10 + }, + "livenessProbe": { + "timeoutSeconds": 10 + } } ] } From 28547a57caf1c458bafde1d87ee8327469a3100c Mon Sep 17 00:00:00 2001 From: Thomas Flament Date: Tue, 24 Feb 2026 11:46:49 +0100 Subject: [PATCH 9/9] Use Zookeeper image from Adobe fork Issue: ZENKO-5198 --- solution/deps.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/solution/deps.yaml b/solution/deps.yaml index fb35b491fc..c4ccb2c669 100644 --- a/solution/deps.yaml +++ b/solution/deps.yaml @@ -145,7 +145,7 @@ zenko-ui: tag: 3.2.7 envsubst: ZENKO_UI_TAG zookeeper: - sourceRegistry: pravega + sourceRegistry: ghcr.io/adobe/zookeeper-operator image: zookeeper - tag: 0.2.15 + tag: 3.8.4-0.2.15-adobe-20250923 envsubst: ZOOKEEPER_TAG