Merge stable into develop#9434
Open
infrahub-github-bot-app[bot] wants to merge 21 commits into
Open
Conversation
Background flows hung in RUNNING against TLS-only Redis because setup_blocks() built the Prefect RedisStorageContainer via from_host(), whose internal client path constructs redis.Redis(...) with no ssl= argument. INFRAHUB_CACHE_TLS_* settings were silently ignored for this one client even though lock.py and the cache adapter honored them. Always construct a connection_string URL from cache settings. Scheme selects rediss:// when tls_enabled is set; ssl_cert_reqs / ssl_check_hostname / ssl_ca_certs propagate as query params through redis.Redis.from_url onto the underlying SSLConnection. Single deterministic code path; brings the block in parity with the rest of the codebase's Redis clients. Closes #9217 Co-authored-by: Phillip Simonds <phillip@opsmill.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* IFC-1258: Fix relationship mutation constraints * refactor logic * update tests * update error message * early return and test cleanup --------- Co-authored-by: Aaron McCarty <aaron@opsmill.com>
IFC-2555: Fix prefix pool duplication
* increase the scope of the try catch: include the key lookup into JWKS * tests that no JWT exception slips through the test cases * test: extract shared OIDC setup into fixtures * chore: add changelog fragment for OIDC id_token verification error mapping * fix(security): return a gateway error for a non-JSON OIDC JWKS response
#9428) * fix(frontend): hide delete button on non-editable schema options (IFC-2663) The inline delete (trash) button on Enum and Dropdown input options was rendered for every option, including those on non-user-editable schema namespaces (e.g. the Core `group_type` enum: "default"/"internal"). The backend rejects deleting these, so users hit an error toast. Gate the delete button on `useNamespace(schema.namespace)?.user_editable`, mirroring the existing "+ Add option" affordance which was already gated the same way. Also add an `aria-label` to the icon-only delete buttons. Fixes #9389 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * lint --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* update quickstart * update * Revert non-quickstart changes from PR Restore .superset/config.json, schema-visualizer, and python_sdk to stable.
Recompile bug-agent workflows with gh-aw v0.77.5 (mcpg v0.3.22, firewall 0.25.58, setup v0.77.5) — brings the DIFC array-response fix (mcpg #6538 / gh-aw#34904). gh aw compile reformats .github/dependabot.yml into its managed shape (no doc-start, sequence indent 0, a >120-char ignore comment), which trips the repo's yamllint. Exclude it in .yamllint.yml, same as the already-ignored generated *.lock.yml files. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Re-introduce the approval-label gating reverted in #9357: set min-integrity: approved and approval-labels: [state/ai-pipeline-ready] on all four bug-agent workflows, recompiled with gh-aw v0.77.5. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Fix versions and schema generation command
PR body edits by non-allowed bots (e.g. cubic-dev-ai appending its review summary) spawn a workflow run that fails the actor gate and, via the cancel-in-progress concurrency group, cancels the legitimate in-flight reviewer run. Every pipeline iteration ends with a push, so 'synchronize' (plus 'opened'/'reopened') is sufficient to re-trigger the reviewer. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…e unset (#9429) (#9430) S3StorageSettings defaults the access key and secret to empty strings, and the storage layer forwarded them straight to boto3. boto3 treats an empty string as an explicit credential and skips the default credential provider chain, so S3 storage failed with AuthorizationHeaderMalformed on deployments relying on IRSA, EC2 instance profiles, or ECS task roles. InfrahubS3ObjectStorage now treats blank, whitespace-only, or incomplete static credentials as "not configured" and passes None, letting boto3 fall back to the default AWS credential provider chain. Complete static credentials are forwarded unchanged, so existing static-key and S3-compatible deployments are unaffected.
chore(ci): bump gh-aw to v0.77.5 and recompile workflows
…-reviewer-step fix(ci): drop 'edited' trigger from bug reviewer agent
* chore: release 1.9.7 * docs: address review feedback on 1.9.7 release notes Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
11 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merging stable into develop after merging pull request #9433.
Summary by cubic
Merge stable into develop for the 1.9.7 release: OIDC/S3/IPAM/Redis TLS fixes, guarded account password changes for externally managed users, and CI workflow hardening. Adds release notes, bumps versions, and updates docker-compose image tags; breaking change: schema attribute/relationship names containing “__” are now rejected.
Bug Fixes
id_tokenverification now returns 401 on invalid signature/audience/issuer or unresolved JWKS; non‑JSON JWKS maps to a gateway error (IFC-2664).INFRAHUB_CACHE_TLS_*using aredis:///rediss://URL, fixing TLS‑only Redis connections (bug: Background flows hang against TLS-only Redis (INFRAHUB_CACHE_TLS_* not honored by Prefect result-storage block) #9217).gh-awv0.77.5, gated them on thestate/ai-pipeline-readyapproval label, and removed the “edited” trigger; reformatted.github/dependabot.ymland ignored it in.yamllint.__in schema attribute/relationship names.New Features
CoreAccount.is_externally_managedfield with resolver.updateSelfnow rejects password changes for accounts linked to external identities; the UI hides the Password tab and form for such accounts (IFC-2664).Written for commit 1abea46. Summary will update on new commits.