kubeflow-pipelines.yaml

package:
  name: kubeflow-pipelines
  version: 2.3.0
  epoch: 2
  description: Machine Learning Pipelines for Kubeflow
  checks:
    disabled:
      - empty
  copyright:
    - license: Apache-2.0

environment:
  contents:
    packages:
      - argo-cd
      - build-base
      - busybox
      - ca-certificates-bundle
      - eslint
      - git
      - go
      - go-licenses
      - jq
      - kubectl
      - nodejs
      - npm
      - openssf-compiler-options
      - py3-gpep517
      - py3-pip
      - py3-setuptools
      - py3-urllib3
      - py3-wheel
      - python3-dev

data:
  - name: backends-go-builds
    items:
      apiserver: apiserver;apiserver
      persistence_agent: persistence_agent;agent/persistence
      cache_server: cache_server;cache
      scheduledworkflow: swf;crd/controller/scheduledworkflow
      viewer-crd-controller: viewer;crd/controller/viewer

pipeline:
  - uses: git-checkout
    with:
      repository: https://github.com/kubeflow/pipelines
      tag: ${{package.version}}
      expected-commit: 4467df5f9c8242d389f20214f75fecfc4119e8cd

  - uses: patch
    with:
      patches: py-backend-cves.patch

  - runs: |
      go mod edit -dropreplace=k8s.io/kubernetes

  - uses: go/bump
    with:
      deps: google.golang.org/protobuf@v1.33.0 github.com/golang/protobuf@v1.5.4 golang.org/x/net@v0.23.0 sigs.k8s.io/controller-runtime@v0.15.3 k8s.io/kubernetes@v1.27.16
      replaces: k8s.io/api=k8s.io/api@v0.27.13 k8s.io/apimachinery=k8s.io/apimachinery@v0.27.13 k8s.io/client-go=k8s.io/client-go@v0.27.13 k8s.io/code-generator=k8s.io/code-generator@v0.27.13

  - uses: patch
    with:
      patches: k8s-method-signature.patch

  - uses: patch
    with:
      patches: bump_requirements.patch

  - uses: patch
    with:
      patches: add-samples.patch

  # ERROR: No matching distribution found for kfp==2.0.1
  - uses: patch
    with:
      patches: kfp.patch

  - uses: patch
    with:
      patches: upgrade-urllib3.patch

  - uses: patch
    with:
      patches: upgrade-urllib3-for-backend.patch

  - uses: patch
    with:
      patches: add-overrides.patch

subpackages:
  - range: backends-go-builds
    name: "kubeflow-pipelines-${{range.key}}"
    description: "Kubeflow Pipelines ${{range.key}}"
    pipeline:
      - runs: |
          cd backend

          mkdir -p ${{targets.subpkgdir}}/usr/bin
          mkdir -p ${{targets.subpkgdir}}/third_party

          name=$(echo "${{range.value}}" | cut -d ';' -f 1)
          path=$(echo "${{range.value}}" | cut -d ';' -f 2-)

          make build/$name
          install -Dm755 ./build/$name ${{targets.subpkgdir}}/usr/bin/${{range.key}}

          go-licenses check ./src/$path
          go-licenses csv ./src/$path > ${{targets.subpkgdir}}/third_party/$name.csv
          go-licenses save ./src/$path --save_path ${{targets.subpkgdir}}/third_party/NOTICES

          if [ "${name}" == "apiserver" ]; then
            mkdir -p ${{targets.subpkgdir}}/samples
            # Patch GHSA-248v-346w-9cwc
            sed -i 's|certifi==2023.7.22|certifi==2024.07.04|g' requirements.txt

            # Patch GHSA-jfmj-5v4g-7637
            sed -i 's|zipp==3.15.0|zipp==3.19.1|g' requirements.txt

            pip3 install --prefer-binary -r requirements.txt --prefix=/usr --root=${{targets.subpkgdir}}
            cp -r ../samples/* ${{targets.subpkgdir}}/samples
            cp ./src/$path/config/sample_config.json ${{targets.subpkgdir}}/samples/sample_config.json
            mkdir -p ${{targets.subpkgdir}}/config
            cp -r ./src/$path/config/* ${{targets.subpkgdir}}/config/
            export COMMIT_SHA=$(git rev-parse --short HEAD)
            sed -E "s#/(blob|tree)/master/#/\1/${COMMIT_SHA}/#g" -i ${{targets.subpkgdir}}/config/sample_config.json
            sed -E "s/%252Fmaster/%252F${COMMIT_SHA}/#g" -i ${{targets.subpkgdir}}/config/sample_config.json
          fi
      - uses: strip

  - name: "kubeflow-pipelines-cache-deployer"
    description: "Kubeflow Pipelines cache-deployer"
    dependencies:
      runtime:
        - busybox
        - bash
        - kubectl-latest
        - openssl
    pipeline:
      - runs: |
          mkdir -p ${{targets.subpkgdir}}/usr/bin
          mkdir -p ${{targets.subpkgdir}}/etc/cache-deployer
          mkdir -p ${{targets.subpkgdir}}/third_party

          install -m755 -D third_party/license.txt ${{targets.subpkgdir}}/third_party/license.txt

          install -m755 -D backend/src/cache/deployer/cache-webhook-config.v1.yaml.template ${{targets.subpkgdir}}/etc/cache-deployer/cache-webhook-config.v1.yaml.template
          install -m755 -D backend/src/cache/deployer/cache-webhook-config.v1beta1.v1.15.yaml.template ${{targets.subpkgdir}}/etc/cache-deployer/cache-webhook-config.v1beta1.v1.15.yaml.template
          install -m755 -D backend/src/cache/deployer/cache-webhook-config.v1beta1.yaml.template ${{targets.subpkgdir}}/etc/cache-deployer/cache-webhook-config.v1beta1.yaml.template

          install -m755 -D backend/src/cache/deployer/deploy-cache-service.sh ${{targets.subpkgdir}}/usr/bin/deploy-cache-service.sh
          install -m755 -D backend/src/cache/deployer/webhook-create-signed-cert.sh ${{targets.subpkgdir}}/usr/bin/webhook-create-signed-cert.sh
          install -m755 -D backend/src/cache/deployer/webhook-patch-ca-bundle.sh ${{targets.subpkgdir}}/usr/bin/webhook-patch-ca-bundle.sh

  - name: "kubeflow-pipelines-cache-deployer-compat"
    dependencies:
      runtime:
        - kubeflow-pipelines-cache-deployer
    pipeline:
      - runs: |
          mkdir -p ${{targets.subpkgdir}}/kfp/cache/deployer/
          ln -s /usr/bin/deploy-cache-service.sh "${{targets.subpkgdir}}"/kfp/cache/deployer/deploy-cache-service.sh
          ln -s /usr/bin/webhook-create-signed-cert.sh "${{targets.subpkgdir}}"/kfp/cache/deployer/webhook-create-signed-cert.sh
          ln -s /usr/bin/webhook-patch-ca-bundle.sh "${{targets.subpkgdir}}"/kfp/cache/deployer/webhook-patch-ca-bundle.sh
          ln -s /etc/cache-deployer/cache-webhook-config.v1.yaml.template "${{targets.subpkgdir}}"/kfp/cache/deployer/cache-webhook-config.v1.yaml.template
          ln -s /etc/cache-deployer/cache-webhook-config.v1beta1.v1.15.yaml.template "${{targets.subpkgdir}}"/kfp/cache/deployer/cache-webhook-config.v1beta1.v1.15.yaml.template
          ln -s /etc/cache-deployer/cache-webhook-config.v1beta1.yaml.template "${{targets.subpkgdir}}"/kfp/cache/deployer/cache-webhook-config.v1beta1.yaml.template

  - name: "kubeflow-pipelines-frontend"
    description: "Kubeflow Pipelines frontend"
    dependencies:
      runtime:
        - nodejs
        - wget
    pipeline:
      - uses: patch
        with:
          patches: GHSA-952p-6rrq-rcjv.patch
      - runs: |
          mkdir -p ${{targets.subpkgdir}}/server
          mkdir -p ${{targets.subpkgdir}}/client
          cd frontend/

          # Update package lock in server
          cd server/
          npm i
          npm audit fix --package-lock-only --legacy-peer-deps || true
          cd ../

          # Build frontend
          npm ci --legacy-peer-deps
          npm run postinstall
          npm run build
          # Copy to output
          cp -r ./build/* ${{targets.subpkgdir}}/client/

          # Build server
          cd ./server
          npm ci
          npm run build
          # Remove dev dependencies
          rm -rf ./node_modules
          npm ci --production
          # Copy to output
          mv ./* ${{targets.subpkgdir}}/server/

  - name: "kubeflow-pipelines-metadata-writer"
    description: "Kubeflow Pipelines metadata_writer"
    dependencies:
      runtime:
        - python3
        - py3-absl-py
        - py3-attrs
        - py3-cachetools
        - py3-certifi
        - py3-charset-normalizer
        - py3-google-auth
        - py3-grpcio
        - py3-idna
        - py3-kubernetes
        - py3-lru-dict
        - py3-ml-metadata
        - py3-oauthlib
        - py3-protobuf
        - py3-pyasn1-modules
        - py3-pyasn1
        - py3-dateutil
        - py3-pyyaml
        - py3-requests-oauthlib
        - py3-requests
        - py3-rsa
        - py3-six
        - py3-urllib3
        - py3-websocket-client
    pipeline:
      - runs: |
          cd backend/metadata_writer
          python3 -m gpep517 build-wheel \
            --wheel-dir dist \
            --output-fd 3 3>&1 >&2
          python3 -m installer -d "${{targets.subpkgdir}}" \
            dist/*.whl
          find ${{targets.subpkgdir}} -name "*.pyc" -exec rm -rf '{}' +

  - name: "kubeflow-pipelines-metadata-writer-compat"
    description: "Kubeflow Pipelines Metadata Writer"
    dependencies:
      runtime:
        - kubeflow-pipelines-metadata-writer
    pipeline:
      - runs: |
          mkdir -p ${{targets.subpkgdir}}/kfp/metadata_writer
          _py3ver=$(python3 -c 'import sys; print("{}.{}".format(sys.version_info.major, sys.version_info.minor))')
          ln -s /usr/lib/python"$_py3ver"/site-packages/metadata_writer.py "${{targets.subpkgdir}}"/kfp/metadata_writer/

  - name: kubeflow-pipelines-metadata-envoy-config
    description: Kubeflow Pipelines Metadata-Envoy Config
    dependencies:
      replaces:
        - envoy-config
    pipeline:
      - runs: |
          mkdir -p ${{targets.subpkgdir}}/etc/envoy/
          cp metadata-envoy-config.yaml ${{targets.subpkgdir}}/etc/envoy/metadata-envoy.yaml

update:
  enabled: true
  ignore-regex-patterns:
    - 'sdk-'
  github:
    identifier: kubeflow/pipelines