Sync main to release 0.7

.github/PULL_REQUEST_TEMPLATE.md

@@ -12,7 +12,8 @@
 - [ ] Documentation Update
 - [ ] Configuration Update
 - [ ] Bump-up service version
-- [ ] Bump-up dependent library
+- [ ] Bump-up dependent library [`pyproject.toml` + `uv.lock`]
+- [ ] Bump-up dependent library [`requirements.*.txt` for Konflux]
 - [ ] Bump-up library or tool used for development (does not change the final image)
 - [ ] CI configuration change
 - [ ] Konflux configuration change

.github/workflows/e2e_authorize.yaml

@@ -0,0 +1,76 @@
+# Gate before e2e jobs that use repository secrets (separate job so secrets are not sent if skipped).
+#
+# Uses the same collaborator permission API GitHub uses for push/merge access on
+# this repository (org base permissions, teams, and direct grants).
+name: Authorize E2E secrets access
+
+on:
+  workflow_call:
+    outputs:
+      authorized:
+        value: ${{ jobs.authorize.outputs.authorized }}
+
+jobs:
+  authorize:
+    name: Check repository owner or member
+    runs-on: ubuntu-latest
+    timeout-minutes: 1
+    if: github.event.action != 'labeled' || github.event.label.name == 'ok-to-test'
+    # Do not set permissions: contents: read — it blocks reading collaborator permissions.
+    outputs:
+      authorized: ${{ steps.check.outputs.authorized }}
+    steps:
+      - name: Allow repo owners and members, or ok-to-test from an owner
+        id: check
+        env:
+          GH_TOKEN: ${{ github.token }}
+          EVENT_NAME: ${{ github.event_name }}
+          EVENT_ACTION: ${{ github.event.action }}
+          IS_FORK: ${{ github.event.repository.fork }}
+          # PR author for merge-rights check (not github.actor — see dependabot hardening).
+          USER: ${{ github.event.pull_request.user.login || github.actor }}
+          ACTOR: ${{ github.actor }}
+          REPO_OWNER: ${{ github.repository_owner }}
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          allow() { echo "$1"; echo "authorized=true" >> "$GITHUB_OUTPUT"; exit 0; }
+          deny()  { echo "::warning::$1"; echo "authorized=false" >> "$GITHUB_OUTPUT"; exit 0; }
+
+          permission_of() {
+            local url="repos/${REPOSITORY}/collaborators/$(jq -nr --arg u "$1" '$u|@uri')/permission"
+            local perm
+            for attempt in 1 2 3; do
+              perm=$(gh api "$url" --jq .permission 2>/dev/null) && [ -n "$perm" ] && { echo "$perm"; return; }
+              echo "::debug::API attempt $attempt failed for $1, retrying in ${attempt}s…"
+              sleep "$attempt"
+            done
+            echo none
+          }
+
+          [ "$EVENT_NAME" = "schedule" ] && allow "Scheduled run."
+
+          echo "user=${USER} actor=${ACTOR} event=${EVENT_NAME}/${EVENT_ACTION:-none} fork=${IS_FORK}"
+
+          # Push to upstream: only users with push (merge) rights can push here.
+          [ "$EVENT_NAME" = "push" ] && [ "$IS_FORK" != "true" ] && allow "Push to upstream repository."
+
+          # Push to your own fork.
+          [ "$EVENT_NAME" = "push" ] && [ "$ACTOR" = "$REPO_OWNER" ] && allow "Push by fork owner."
+
+          USER_PERM=$(permission_of "$USER")
+          echo "user_permission=${USER_PERM}"
+          case "$USER_PERM" in
+            admin|maintain|write|triage|read)
+              allow "${USER} has repository access (${USER_PERM}, same source as merge rights)."
+              ;;
+          esac
+
+          # Outsider PR: repository owner added ok-to-test on this run.
+          [ "$EVENT_ACTION" = "labeled" ] || deny "${USER} has no repository access."
+
+          LABELER_PERM=$(permission_of "$ACTOR")
+          echo "ok-to-test labeler=${ACTOR} permission=${LABELER_PERM}"
+          [ "$LABELER_PERM" = "admin" ] && allow "Repository owner ${ACTOR} added ok-to-test."
+
+          deny "ok-to-test must be added by a repository owner (admin)."

.github/workflows/e2e_tests.yaml

@@ -1,19 +1,51 @@
 # .github/workflows/e2e_tests.yml
 name: E2E Tests
 
-on: [push, pull_request_target]
+on:
+  push:
+  pull_request_target:
+    types: [opened, synchronize, reopened, labeled]
 
 jobs:
+  # Own job so repository secrets are never sent to a runner unless this passes.
+  authorize:
+    uses: ./.github/workflows/e2e_authorize.yaml
+
   e2e_tests:
+    needs: authorize
+    if: needs.authorize.outputs.authorized == 'true'
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
         mode: ["server", "library"]
         environment: ["ci"]
-        e2e_group: [1, 2, 3]
+        # Config-aligned shards (@cfg_*). Packed small groups keep job count reasonable
+        # while avoiding mixed-config restarts inside large suites.
+        shard:
+          - name: default
+            tags: "not @skip and @cfg_default"
+          - name: authorized
+            tags: "not @skip and @cfg_authorized"
+          - name: mcp
+            tags: "not @skip and (@cfg_mcp or @cfg_mcp_invalid or @cfg_mcp_api_auth)"
+          - name: rbac
+            tags: "not @skip and @cfg_rbac"
+          - name: skills
+            tags: "not @skip and (@cfg_skills or @cfg_skills_directory)"
+          - name: other
+            tags: "not @skip and (@cfg_rh_identity or @cfg_negative or @cfg_byok_pdf or @cfg_degraded or @cfg_unified)"
+          # Server-only; listed in shard (not matrix.include) so it expands with
+          # mode=server before any library jobs. include would append after library.
+          - name: tls
+            tags: "not @skip and @cfg_tls"
+        exclude:
+          - mode: library
+            shard:
+              name: tls
+              tags: "not @skip and @cfg_tls"
 
-    name: "E2E: ${{ matrix.mode }} mode / ${{ matrix.environment }} / group ${{ matrix.e2e_group }}"
+    name: "E2E: ${{ matrix.mode }} / ${{ matrix.environment }} / ${{ matrix.shard.name }}"
 
     env:
       OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
@@ -30,9 +62,9 @@ jobs:
           # On push      → falls back to the current repository.
           repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
 
-          # On PR_TARGET → the PR head *commit* (reproducible).
+          # On PR_TARGET → the PR head commit at event time (not the moving branch).
           # On push      → the pushed commit that triggered the workflow.
-          ref: ${{ github.event.pull_request.head.ref || github.sha }}
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
           # Tests need access to secrets.
           # This should be refactored if possible to mitigate the risk.
@@ -43,7 +75,7 @@ jobs:
           persist-credentials: ${{ github.event_name != 'pull_request_target' }}
 
           # Fetch submodules (required for lightspeed-providers)
-          submodules: ‘recursive’
+          submodules: "recursive"
 
       - name: Verify actual git checkout result
         run: |
@@ -112,7 +144,7 @@ jobs:
           echo "=== Configuration Summary ==="
           echo "Deployment mode: ${{ matrix.mode }}"
           echo "Environment: ${{ matrix.environment }}"
-          echo "E2E shard (Makefile test-e2e-tagged): @e2e_group_${{ matrix.e2e_group }} (with not @skip)"
+          echo "E2E shard (Makefile test-e2e-tagged): ${{ matrix.shard.tags }}"
           echo "Source config: tests/e2e/configs/run-${{ matrix.environment }}.yaml"
           echo ""
           echo "=== Configuration Preview ==="
@@ -239,8 +271,8 @@ jobs:
           TERM: xterm-256color
           FORCE_COLOR: 1
           E2E_DEPLOYMENT_MODE: ${{ matrix.mode }}
-          # Matches Makefile test-e2e-tagged / E2E_BEHAVE_TAG_EXPR (one @e2e_group_* per job).
-          E2E_BEHAVE_TAG_EXPR: "not @skip and @e2e_group_${{ matrix.e2e_group }}"
+          # Matches Makefile test-e2e-tagged / E2E_BEHAVE_TAG_EXPR (one @cfg_* pack per job).
+          E2E_BEHAVE_TAG_EXPR: "${{ matrix.shard.tags }}"
         run: |
           echo "Installing test dependencies..."
           pip install uv

.github/workflows/e2e_tests_lightspeed_evaluation.yaml

@@ -1,9 +1,18 @@
 name: E2E Tests for Lightspeed Evaluation
 
-on: [push, pull_request_target]
+on:
+  push:
+  pull_request_target:
+    types: [opened, synchronize, reopened, labeled]
 
 jobs:
+  # Own job so repository secrets are never sent to a runner unless this passes.
+  authorize:
+    uses: ./.github/workflows/e2e_authorize.yaml
+
   e2e_tests:
+    needs: authorize
+    if: needs.authorize.outputs.authorized == 'true'
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -23,9 +32,9 @@ jobs:
           # On push      → falls back to the current repository.
           repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
 
-          # On PR_TARGET → the PR head *commit* (reproducible).
+          # On PR_TARGET → the PR head commit at event time (not the moving branch).
           # On push      → the pushed commit that triggered the workflow.
-          ref: ${{ github.event.pull_request.head.ref || github.sha }}
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
           # Don’t keep credentials when running untrusted PR code under PR_TARGET.
           persist-credentials: ${{ github.event_name != 'pull_request_target' }}

.github/workflows/e2e_tests_providers.yaml

@@ -7,29 +7,35 @@ on:
   workflow_dispatch:
 
 jobs:
+  # Own job so repository secrets are never sent to a runner unless this passes.
+  authorize:
+    uses: ./.github/workflows/e2e_authorize.yaml
+
   e2e_tests:
+    needs: authorize
+    if: needs.authorize.outputs.authorized == 'true'
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
         mode: ["server", "library"]
         environment: ["azure", "vertexai", "watsonx", "bedrock"]
         # Expected default LLM for Behave (matches tests/e2e/configs/run-<env>.yaml).
-        # | environment | model_id                            | provider_id   |
-        # |-------------|-------------------------------------|---------------|
-        # | azure       | gpt-4o-mini                         | azure         |
-        # | vertexai    | google/gemini-2.5-flash             | google-vertex |
-        # | watsonx     | meta-llama/llama-3-3-70b-instruct   | watsonx       |
-        # | bedrock     | deepseek.v3-v1:0                    | aws-bedrock   |
+        # | environment | model_id                                   | provider_id   |
+        # |-------------|--------------------------------------------| --------------|
+        # | azure       | gpt-4o-mini                                | azure         |
+        # | vertexai    | publishers/google/models/gemini-2.5-flash  | google-vertex |
+        # | watsonx     | meta-llama/llama-3-3-70b-instruct          | watsonx       |
+        # | bedrock     | deepseek.v3-v1:0                           | aws-bedrock   |
         include:
           - environment: azure
             e2e_default_model: gpt-4o-mini
             e2e_default_provider: azure
           - environment: vertexai
-            e2e_default_model: google/gemini-2.5-flash
+            e2e_default_model: publishers/google/models/gemini-2.5-flash
             e2e_default_provider: google-vertex
           - environment: watsonx
-            e2e_default_model: watsonx/meta-llama/llama-3-3-70b-instruct
+            e2e_default_model: meta-llama/llama-3-3-70b-instruct
             e2e_default_provider: watsonx
           - environment: bedrock
             e2e_default_model: deepseek.v3-v1:0
@@ -330,10 +336,6 @@ jobs:
         if: matrix.environment == 'watsonx' && matrix.mode == 'server'
         run: sleep 3600  # 120 minutes
 
-      - name: Remove the prefix for watsonx default model
-        if: matrix.environment == 'watsonx'
-        run: echo "E2E_DEFAULT_MODEL_OVERRIDE=meta-llama/llama-3-3-70b-instruct" >> $GITHUB_ENV
-
       - name: Run e2e tests
         env:
           TERM: xterm-256color

.github/workflows/e2e_tests_rhaiis.yaml

@@ -8,7 +8,13 @@ on:
 
 
 jobs:
+  # Own job so repository secrets are never sent to a runner unless this passes.
+  authorize:
+    uses: ./.github/workflows/e2e_authorize.yaml
+
   e2e_tests:
+    needs: authorize
+    if: needs.authorize.outputs.authorized == 'true'
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false

.konflux/build-args-konflux.conf

@@ -1,4 +1,4 @@
-BUILDER_BASE_IMAGE=quay.io/aipcc/base-images/cpu:3.5.0-1782914735
+BUILDER_BASE_IMAGE=quay.io/aipcc/base-images/cpu:3.5.0-1786556387
 BUILDER_DNF_COMMAND=dnf
-RUNTIME_BASE_IMAGE=quay.io/aipcc/base-images/cpu:3.5.0-1782914735
+RUNTIME_BASE_IMAGE=quay.io/aipcc/base-images/cpu:3.5.0-1786556387
 RUNTIME_DNF_COMMAND=dnf

.konflux/profiles.toml

@@ -1,12 +1,6 @@
 [common]
 python_version = "3.12"
 platforms = ["x86_64", "aarch64"]
-# Toolchains/bootstrap tools that are not resolved from pyproject.toml, but
-# still need to be listed in the Tekton "binary.packages" so Hermeto
-# prefetches them as prebuilt wheels instead of building from sdist.
-# uv and pip come from .konflux/requirements.hermetic.txt; uv in particular
-# must stay wheel-only because its PyPI sdist ships a Rust Cargo.lock that
-# Hermeto rejects as out of sync with Cargo.toml.
 bootstrap_packages = ["maturin", "uv", "pip"]
 
 [profiles.cpu]

.konflux/redhat.repo

@@ -1,4 +1,4 @@
-[codeready-builder-for-rhel-9-$basearch-eus-rpms]
+[codeready-builder-for-rhel-9-$basearch-eus-rpms__9_DOT_6]
 name = Red Hat CodeReady Linux Builder for RHEL 9 $basearch - Extended Update Support (RPMs)
 baseurl = https://cdn.redhat.com/content/eus/rhel9/9.6/$basearch/codeready-builder/os
 enabled = 1
@@ -12,7 +12,7 @@ enabled_metadata = 0
 sslclientkey = $SSL_CLIENT_KEY
 sslclientcert = $SSL_CLIENT_CERT
 
-[rhel-9-for-$basearch-appstream-eus-rpms]
+[rhel-9-for-$basearch-appstream-eus-rpms__9_DOT_6]
 name = Red Hat Enterprise Linux 9 for $basearch - AppStream - Extended Update Support (RPMs)
 baseurl = https://cdn.redhat.com/content/eus/rhel9/9.6/$basearch/appstream/os
 enabled = 1
@@ -26,7 +26,7 @@ enabled_metadata = 0
 sslclientkey = $SSL_CLIENT_KEY
 sslclientcert = $SSL_CLIENT_CERT
 
-[rhel-9-for-$basearch-baseos-eus-rpms]
+[rhel-9-for-$basearch-baseos-eus-rpms__9_DOT_6]
 name = Red Hat Enterprise Linux 9 for $basearch - BaseOS - Extended Update Support (RPMs)
 baseurl = https://cdn.redhat.com/content/eus/rhel9/9.6/$basearch/baseos/os
 enabled = 1
@@ -40,24 +40,10 @@ enabled_metadata = 0
 sslclientkey = $SSL_CLIENT_KEY
 sslclientcert = $SSL_CLIENT_CERT
 
-[rhocp-4.17-for-rhel-9-$basearch-rpms]
-name = Red Hat OpenShift Container Platform 4.17 for RHEL 9 $basearch (RPMs)
-baseurl = https://cdn.redhat.com/content/dist/layered/rhel9/$basearch/rhocp/4.17/os
-enabled = 0
-gpgcheck = 1
-gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
-sslverify = 1
-sslcacert = /etc/rhsm/ca/redhat-uep.pem
-sslverifystatus = 1
-metadata_expire = 86400
-enabled_metadata = 0
-sslclientkey = $SSL_CLIENT_KEY
-sslclientcert = $SSL_CLIENT_CERT
-
-[rhocp-4.17-for-rhel-9-$basearch-source-rpms]
-name = Red Hat OpenShift Container Platform 4.17 for RHEL 9 $basearch (Source RPMs)
-baseurl = https://cdn.redhat.com/content/dist/layered/rhel9/$basearch/rhocp/4.17/source/SRPMS
-enabled = 0
+[rhelai-3.5-for-rhel-9-$basearch-rpms]
+name = Red Hat Enterprise Linux AI (3.5) for RHEL 9 $basearch (RPMs)
+baseurl = https://cdn.redhat.com/content/dist/layered/rhel9/$basearch/rhelai/3.5/os
+enabled = 1
 gpgcheck = 1
 gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
 sslverify = 1

.konflux/requirements-build.txt

@@ -1,5 +1,5 @@
 #
-# This file is autogenerated by pip-compile with Python 3.13
+# This file is autogenerated by pip-compile with Python 3.14
 # by the following command:
 #
 #    pybuild-deps compile --output-file=.konflux/requirements-build.txt .konflux/_tmp_sdist_list.txt
@@ -14,7 +14,9 @@ flit-core==4.0.2
     # via
     #   packaging
     #   pathspec
-hatchling==1.31.0
+hatch-vcs==0.5.0
+    # via pydantic-ai-skills
+hatchling==1.32.0
     # via
     #   logfire
     #   pydantic-ai
@@ -41,7 +43,9 @@ setuptools-scm==10.2.1
     #   pluggy
     #   setuptools-rust
 tomlkit==0.15.1
-    # via uv-dynamic-versioning
+    # via
+    #   hatchling
+    #   uv-dynamic-versioning
 trove-classifiers==2026.6.1.19
     # via hatchling
 uv-dynamic-versioning==0.14.0
@@ -50,7 +54,7 @@ uv-dynamic-versioning==0.14.0
     #   pydantic-ai-slim
     #   pydantic-evals
     #   pydantic-graph
-vcs-versioning==2.2.3
+vcs-versioning==2.2.4
     # via setuptools-scm
 
 # The following packages are considered to be unsafe in a requirements file: