Release/0.6

.cherry_picker.toml

@@ -0,0 +1,5 @@
+team = "lightspeed-core"
+repo = "lightspeed-stack"
+check_sha = "ea5de69d94e33aa2a75a622fec455bc4b0fa6c6b"
+fix_commit_msg = false
+default_branch = "main"

.github/pr-title-checker-config.json

@@ -4,7 +4,16 @@
     "color": "EEEEEE"
   },
   "CHECKS": {
-    "prefixes": ["LCORE-", "RSPEED-", "MGTM-", "OLS-", "RHIDP-", "LEADS-", "CWFHEALTH-"]
+    "prefixes": [
+      "LCORE-",
+      "RSPEED-",
+      "MGTM-",
+      "OLS-",
+      "RHIDP-",
+      "LEADS-",
+      "CWFHEALTH-",
+      "[release/"
+    ]
   },
   "MESSAGES": {
     "success": "All OK",

.github/workflows/build_and_push_release.yaml

@@ -27,7 +27,7 @@ jobs:
           # qemu is required for arm64 builds
           sudo apt install -y buildah qemu-user-static
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           # Fetch submodules (required for lightspeed-providers)
           submodules: 'recursive'

.github/workflows/e2e_tests.yaml

@@ -24,7 +24,7 @@ jobs:
       E2E_LLAMA_HOSTNAME: ${{ vars.E2E_LLAMA_HOSTNAME || 'llama-stack' }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # On PR_TARGET → the fork (or same repo) that opened the PR.
           # On push      → falls back to the current repository.
@@ -34,6 +34,11 @@ jobs:
           # On push      → the pushed commit that triggered the workflow.
           ref: ${{ github.event.pull_request.head.ref || github.sha }}
 
+          # Tests need access to secrets.
+          # This should be refactored if possible to mitigate the risk.
+          # https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target
+          allow-unsafe-pr-checkout: true
+
           # Don’t keep credentials when running untrusted PR code under PR_TARGET.
           persist-credentials: ${{ github.event_name != 'pull_request_target' }}
 

.github/workflows/e2e_tests_lightspeed_evaluation.yaml

@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           # On PR_TARGET → the fork (or same repo) that opened the PR.
           # On push      → falls back to the current repository.
@@ -30,6 +30,11 @@ jobs:
           # Don’t keep credentials when running untrusted PR code under PR_TARGET.
           persist-credentials: ${{ github.event_name != 'pull_request_target' }}
 
+          # Tests need access to secrets.
+          # This should be refactored if possible to mitigate the risk.
+          # https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target
+          allow-unsafe-pr-checkout: true
+
           # Fetch submodules (required for lightspeed-providers)
           submodules: 'recursive'
 
@@ -47,7 +52,7 @@ jobs:
           git log --oneline -5
 
       - name: Checkout lightspeed-Evaluation
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           repository: lightspeed-core/lightspeed-evaluation
           path: lightspeed-evaluation

.github/workflows/e2e_tests_providers.yaml

@@ -49,7 +49,7 @@ jobs:
       E2E_DEFAULT_PROVIDER_OVERRIDE: ${{ matrix.e2e_default_provider }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # On PR_TARGET → the fork (or same repo) that opened the PR.
           # On push      → falls back to the current repository.
@@ -59,6 +59,11 @@ jobs:
           # On push      → the pushed commit that triggered the workflow.
           ref: ${{ github.event.pull_request.head.ref || github.sha }}
 
+          # Tests need access to secrets.
+          # This should be refactored if possible to mitigate the risk.
+          # https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target
+          allow-unsafe-pr-checkout: true
+
           # Don’t keep credentials when running untrusted PR code under PR_TARGET.
           persist-credentials: ${{ github.event_name != 'pull_request_target' }}
 

.github/workflows/e2e_tests_rhaiis.yaml

@@ -38,7 +38,7 @@ jobs:
       E2E_DEFAULT_PROVIDER_OVERRIDE: vllm
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # On PR_TARGET → the fork (or same repo) that opened the PR.
           # On push      → falls back to the current repository.
@@ -48,6 +48,11 @@ jobs:
           # On push      → the pushed commit that triggered the workflow.
           ref: ${{ github.event.pull_request.head.ref || github.sha }}
 
+          # Tests need access to secrets.
+          # This should be refactored if possible to mitigate the risk.
+          # https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target
+          allow-unsafe-pr-checkout: true
+
           # Don’t keep credentials when running untrusted PR code under PR_TARGET.
           persist-credentials: ${{ github.event_name != 'pull_request_target' }}
 

.github/workflows/radon.yaml

@@ -12,7 +12,7 @@ jobs:
       pull-requests: read
     name: "radon"
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
       - uses: davidslusser/actions_python_radon@v1.0.0
         with:
           src: "src"

.konflux/build-args-konflux.conf

@@ -1,4 +1,4 @@
-BUILDER_BASE_IMAGE=registry.redhat.io/rhai/base-image-cpu-rhel9:3.2
+BUILDER_BASE_IMAGE=quay.io/aipcc/base-images/cpu:3.4.2-1782914778
 BUILDER_DNF_COMMAND=dnf
-RUNTIME_BASE_IMAGE=registry.redhat.io/rhai/base-image-cpu-rhel9:3.2
+RUNTIME_BASE_IMAGE=quay.io/aipcc/base-images/cpu:3.4.2-1782914778
 RUNTIME_DNF_COMMAND=dnf

.konflux/profiles.toml

@@ -0,0 +1,14 @@
+[common]
+python_version = "3.12"
+platforms = ["x86_64", "aarch64"]
+bootstrap_packages = ["maturin"]
+
+[profiles.cpu]
+rhoai_index_url = "https://packages.redhat.com/api/pypi/public-rhai/rhoai/3.4/cpu-ubi9/simple/"
+output_suffix = ""
+tekton_files = [
+    ".tekton/lightspeed-stack-pull-request.yaml",
+    ".tekton/lightspeed-stack-push.yaml",
+    ".tekton/lightspeed-stack-0-6-pull-request.yaml",
+    ".tekton/lightspeed-stack-0-6-push.yaml",
+]

.konflux/pypi_wheel_only.txt

@@ -0,0 +1,5 @@
+# Packages where PyPI has an sdist but it cannot be built reliably.
+# Rust/C++ bootstrap, binary-only distributions, CUDA stack.
+#
+# Pure-Python packages whose build backends pull in C-extension deps
+# (e.g. jinja2→markupsafe) that conflict with RHOAI-rebuilt wheels.

.konflux/redhat.repo

@@ -1,4 +1,4 @@
-[codeready-builder-for-rhel-9-$basearch-eus-rpms]
+[codeready-builder-for-rhel-9-$basearch-eus-rpms__9_DOT_6]
 name = Red Hat CodeReady Linux Builder for RHEL 9 $basearch - Extended Update Support (RPMs)
 baseurl = https://cdn.redhat.com/content/eus/rhel9/9.6/$basearch/codeready-builder/os
 enabled = 1
@@ -12,7 +12,7 @@ enabled_metadata = 0
 sslclientkey = $SSL_CLIENT_KEY
 sslclientcert = $SSL_CLIENT_CERT
 
-[rhel-9-for-$basearch-appstream-eus-rpms]
+[rhel-9-for-$basearch-appstream-eus-rpms__9_DOT_6]
 name = Red Hat Enterprise Linux 9 for $basearch - AppStream - Extended Update Support (RPMs)
 baseurl = https://cdn.redhat.com/content/eus/rhel9/9.6/$basearch/appstream/os
 enabled = 1
@@ -26,7 +26,7 @@ enabled_metadata = 0
 sslclientkey = $SSL_CLIENT_KEY
 sslclientcert = $SSL_CLIENT_CERT
 
-[rhel-9-for-$basearch-baseos-eus-rpms]
+[rhel-9-for-$basearch-baseos-eus-rpms__9_DOT_6]
 name = Red Hat Enterprise Linux 9 for $basearch - BaseOS - Extended Update Support (RPMs)
 baseurl = https://cdn.redhat.com/content/eus/rhel9/9.6/$basearch/baseos/os
 enabled = 1
@@ -39,31 +39,3 @@ metadata_expire = 86400
 enabled_metadata = 0
 sslclientkey = $SSL_CLIENT_KEY
 sslclientcert = $SSL_CLIENT_CERT
-
-[rhocp-4.17-for-rhel-9-$basearch-rpms]
-name = Red Hat OpenShift Container Platform 4.17 for RHEL 9 $basearch (RPMs)
-baseurl = https://cdn.redhat.com/content/dist/layered/rhel9/$basearch/rhocp/4.17/os
-enabled = 0
-gpgcheck = 1
-gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
-sslverify = 1
-sslcacert = /etc/rhsm/ca/redhat-uep.pem
-sslverifystatus = 1
-metadata_expire = 86400
-enabled_metadata = 0
-sslclientkey = $SSL_CLIENT_KEY
-sslclientcert = $SSL_CLIENT_CERT
-
-[rhocp-4.17-for-rhel-9-$basearch-source-rpms]
-name = Red Hat OpenShift Container Platform 4.17 for RHEL 9 $basearch (Source RPMs)
-baseurl = https://cdn.redhat.com/content/dist/layered/rhel9/$basearch/rhocp/4.17/source/SRPMS
-enabled = 0
-gpgcheck = 1
-gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
-sslverify = 1
-sslcacert = /etc/rhsm/ca/redhat-uep.pem
-sslverifystatus = 1
-metadata_expire = 86400
-enabled_metadata = 0
-sslclientkey = $SSL_CLIENT_KEY
-sslclientcert = $SSL_CLIENT_CERT