sync: Release candidate v0.37.0

.github/workflows/pr-issue-validator.yaml

@@ -11,133 +11,35 @@ on:
       - 'main'
       - 'release-**'
       - 'develop'
-      - 'hotfix-v0**'
-
+      - 'hotfix-**'
+    # paths-ignore:
+    #   - 'docs/**'
+    #   - '.github/'
+    #   - 'CHANGELOG/'
+    #   - 'charts/'
+    #   - 'manifests/'
+    #   - 'sample-docker-templates/'
 jobs:
   validate-PR-issue:
     runs-on: ubuntu-latest
-    permissions:
-      issues: write
-      contents: read
-      pull-requests: write
+
     steps:
     - name: Checkout repository
       uses: actions/checkout@v2
 
-    - name: Validate Issue Reference
+    - name: Set up jq (for parsing JSON)
+      run: sudo apt-get install -y jq
+
+    - name: PR Validation Script
       env:
-        GH_TOKEN: ${{ github.token }}
         PR_BODY: ${{ github.event.pull_request.body }}
         PRNUM: ${{ github.event.pull_request.number }}
         TITLE: ${{ github.event.pull_request.title }}
+        GH_TOKEN: ${{ github.token }}
+        GH_PR_VALIDATOR_TOKEN: ${{ secrets.GH_PR_VALIDATOR_TOKEN }}
+        BASE_REPO: ${{ github.event.pull_request.base.repo.full_name }}
+        HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
       run: |
-        set -x    
-        # Skip validation for documentation or chore PRs
-        if [[ "$TITLE" =~ ^(doc:|docs:|chore:|misc:|sync:) ]]; then
-          echo "Skipping validation for docs/chore PR."
-          echo "PR NUMBER-: $PRNUM "
-          gh pr edit $PRNUM --remove-label "PR:Issue-verification-failed"
-          gh pr edit $PRNUM --add-label "PR:Ready-to-Review"
-          exit 0
-        fi
-
-        # Define all issue matching patterns
-        patterns=(
-          "((Fixes|Resolves) #[0-9]+)" 
-          "((Fixes|Resolves) https://github.com/devtron-labs/devtron/issues/[0-9]+)" 
-          "((Fixes|Resolves) devtron-labs/devtron#[0-9]+)"
-          "(Fixes|Resolves):?\\s+\\[#([0-9]+)\\]" 
-          "((Fixes|Resolves):? #devtron-labs/devops-sprint/issues/[0-9]+)"
-          "((Fixes|Resolves):? #devtron-labs/sprint-tasks/issues/[0-9]+)" 
-          "((Fixes|Resolves) https://github.com/devtron-labs/devops-sprint/issues/[0-9]+)"
-          "((Fixes|Resolves) https://github.com/devtron-labs/sprint-tasks/issues/[0-9]+)"
-          "((Fixes|Resolves):? #devtron-labs/sprint-tasks#[0-9]+)" 
-        )
-
-        # Extract issue number and repo from PR body
-        extract_issue_number() {
-          local pattern="$1"  # Get the pattern as the first argument to the function
-
-          # Check if PR_BODY matches the provided pattern using Bash's =~ regex operator
-          if [[ "$PR_BODY" =~ $pattern ]]; then
-            echo "matched for this pattern $pattern"
-
-            issue_num=$(echo "$PR_BODY" | grep -oE "$pattern" | grep -oE "[0-9]+")
-
-            # Extract the repository name (e.g., devtron-labs/devtron) from PR_BODY using grep
-            repo=$(echo "$PR_BODY" | grep -oE "devtron-labs/[a-zA-Z0-9_-]+")
-            echo "Extracted issue number: $issue_num from repo: $repo"
-
-            return 0  # Return success
-          else
-            echo "No match for the pattern $pattern"
-          fi
-          return 1  # Return failure if no match
-        }
-
-        issue_num=""
-        repo="devtron-labs/devtron"  # Default repo
-        for pattern in "${patterns[@]}"; do
-          echo "Now checking for $pattern"
-          extract_issue_number "$pattern" && break
-        done
-
-        if [[ -z "$issue_num" ]]; then
-          echo "No valid issue number found."
-          gh pr edit $PRNUM --add-label "PR:Issue-verification-failed"
-          gh pr edit $PRNUM --remove-label "PR:Ready-to-Review"
-          exit 1
-        fi
-
-        # Form the issue API URL dynamically
-        issue_api_url="https://api.github.com/repos/$repo/issues/$issue_num"
-        echo "API URL: $issue_api_url"
-
-        # Check if the issue exists in the private repo
-        response_code=$(curl -s -o /dev/null -w "%{http_code}" \
-          --header "authorization: Bearer ${{ secrets.GH_PR_VALIDATOR_TOKEN }}" \
-          "$issue_api_url")
-
-        if [[ "$response_code" -eq 200 ]]; then
-          echo "Issue #$issue_num is valid and exists in $repo."
-
-          # Fetch the current state of the issue (open/closed) from the private repository.
-          issue_status=$(curl -s \
-            --header "authorization: Bearer ${{ secrets.GH_PR_VALIDATOR_TOKEN }}" \
-            "$issue_api_url" | jq '.state'|tr -d \")
-          # Check if the issue is still open.
-          # if [[ "$issue_status" == open ]]; then
-            # echo "Issue #$issue_num is opened."
-            if [[ $forked == true ]]; then
-              echo "PR:Ready-to-Review, exiting gracefully"
-              exit 0
-            fi
-            # Remove the 'Issue-verification-failed' label (if present) and add 'Ready-to-Review'.
-            gh pr edit $PRNUM --remove-label "PR:Issue-verification-failed"
-            gh pr edit $PRNUM --add-label "PR:Ready-to-Review"
-            echo "PR:Ready-to-Review, exiting gracefully"
-            exit 0
-          # else
-            # echo "Issue #$issue_num is closed. Please link an open issue to proceed."
-              # if [[ $forked == true ]]; then
-                # echo "PR:Ready-to-Review, exiting gracefully"
-                # exit 0
-              # fi
-            # Add a comment to the PR indicating the issue is not linked correctly.
-            # gh pr comment $PRNUM --body "PR is  linked to a closed issue. Please link an open issue to proceed."
-
-            # Add the 'Issue-verification-failed' label and remove 'Ready-to-Review'.
-            # gh pr edit $PRNUM --add-label "PR:Issue-verification-failed"
-            # gh pr edit $PRNUM --remove-label "PR:Ready-to-Review"
-            # exit 1
-          #fi
-        else
-          echo "Issue not found. Invalid URL or issue number."
-          # Add a comment to the PR indicating the issue is not linked correctly.
-          gh pr comment $PRNUM --body "PR is not linked to a valid issue. Please update the issue link."
-
-          # Apply 'Issue-verification-failed' label and remove 'Ready-to-Review' label.
-          gh pr edit $PRNUM --add-label "PR:Issue-verification-failed"
-          gh pr edit $PRNUM --remove-label "PR:Ready-to-Review"
-          exit 1
-        fi
+        wget https://raw.githubusercontent.com/devtron-labs/utilities/feat/central-pr-validator/.github/workflows/validateIssue.sh
+        chmod +x validateIssue.sh
+        ./validateIssue.sh 

authenticator/middleware/sessionmanager.go

@@ -47,6 +47,8 @@ const (
 	// ApiTokenClaimIssuer is the issuer who generated api-token for APIs
 	ApiTokenClaimIssuer = "apiTokenIssuer"
 
+	LicenseManagerClaimIssuer = "licenseManagerIssuer"
+
 	// invalidLoginError, for security purposes, doesn't say whether the username or password was invalid.  This does not mitigate the potential for timing attacks to determine which is which.
 	invalidLoginError         = "Invalid username or password"
 	blankPasswordError        = "Blank passwords are not allowed"
@@ -221,6 +223,8 @@ func (mgr *SessionManager) VerifyToken(tokenString string) (jwt.Claims, error) {
 		return mgr.Parse(tokenString)
 	case ApiTokenClaimIssuer:
 		return mgr.ParseApiToken(tokenString)
+	case LicenseManagerClaimIssuer:
+		return mgr.ParseApiToken(tokenString)
 	default:
 		// IDP signed token
 		prov, err := mgr.provider()

chart-sync/go.mod

@@ -5,7 +5,7 @@ go 1.22.4
 toolchain go1.22.6
 
 replace (
-	github.com/devtron-labs/common-lib => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20250521133250-228c55be30a2
+	github.com/devtron-labs/common-lib => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20250602063450-998593aefb28
 	helm.sh/helm/v3 v3.14.3 => github.com/devtron-labs/helm/v3 v3.14.1-0.20240401080259-90238cf69e42
 )
 

chart-sync/go.sum

@@ -54,8 +54,8 @@ github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/devtron-labs/devtron-services/common-lib v0.0.0-20250521133250-228c55be30a2 h1:mLbnHEC6F+/eWa4PkhIc4yQQHkPxcglMgdFoqv6c3nQ=
-github.com/devtron-labs/devtron-services/common-lib v0.0.0-20250521133250-228c55be30a2/go.mod h1:CXQGEo+kZc7JPX5hn4jJf1msal9q/ExSdAYGkHNPnQw=
+github.com/devtron-labs/devtron-services/common-lib v0.0.0-20250602063450-998593aefb28 h1:TuFPsIws3eAlIRajdqjEvh/Tl24iW7vTYWQ3T/qEgeo=
+github.com/devtron-labs/devtron-services/common-lib v0.0.0-20250602063450-998593aefb28/go.mod h1:HQVUnQI7WHwVq89Bib/18xJqM89S1+xI0O7REctMMrA=
 github.com/devtron-labs/helm/v3 v3.14.1-0.20240401080259-90238cf69e42 h1:pJmK44QaSztOiZe0iQHNf0sdy5KwkAeceydyhOG4RaY=
 github.com/devtron-labs/helm/v3 v3.14.1-0.20240401080259-90238cf69e42/go.mod h1:v6myVbyseSBJTzhmeE39UcPLNv6cQK6qss3dvgAySaE=
 github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
@@ -292,8 +292,9 @@ github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=

chart-sync/vendor/modules.txt

@@ -93,7 +93,7 @@ github.com/containerd/platforms
 # github.com/davecgh/go-spew v1.1.1
 ## explicit
 github.com/davecgh/go-spew/spew
-# github.com/devtron-labs/common-lib v0.0.0 => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20250521133250-228c55be30a2
+# github.com/devtron-labs/common-lib v0.0.0 => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20250602063450-998593aefb28
 ## explicit; go 1.21
 github.com/devtron-labs/common-lib/constants
 github.com/devtron-labs/common-lib/fetchAllEnv
@@ -791,4 +791,4 @@ sigs.k8s.io/structured-merge-diff/v4/value
 # sigs.k8s.io/yaml v1.3.0
 ## explicit; go 1.12
 sigs.k8s.io/yaml
-# github.com/devtron-labs/common-lib => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20250521133250-228c55be30a2
+# github.com/devtron-labs/common-lib => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20250602063450-998593aefb28

ci-runner/app/CiCdProcessor.go

@@ -100,14 +100,22 @@ func (impl *CiCdProcessor) ProcessCiCdEvent(ciCdRequest *helper.CiCdTriggerEvent
 	if logLevel == "" || logLevel == "DEBUG" {
 		log.Println(util.DEVTRON, " ci-cd request details -----> ", ciCdRequest)
 	}
+	impl.handleEventBasedOnType(ciCdRequest, &exitCode)
+	impl.HandleCleanup(*ciCdRequest, &exitCode, util.Source_Defer)
+	return
+}
 
-	defer impl.HandleCleanup(*ciCdRequest, &exitCode, util.Source_Defer)
+func (impl *CiCdProcessor) handleEventBasedOnType(ciCdRequest *helper.CiCdTriggerEvent, exitCode *int) {
+	defer func() { //recover in this function allows us to process further cleanup even if the code crashes
+		if r := recover(); r != nil {
+			log.Println("recovered from panic in handleEventBasedOnType:", r)
+		}
+	}()
 	if helper.IsCIOrJobTypeEvent(ciCdRequest.Type) {
-		impl.ciStage.HandleCIEvent(ciCdRequest, &exitCode)
+		impl.ciStage.HandleCIEvent(ciCdRequest, exitCode)
 	} else {
-		impl.cdStage.HandleCDEvent(ciCdRequest, &exitCode)
+		impl.cdStage.HandleCDEvent(ciCdRequest, exitCode)
 	}
-	return
 }
 
 func (impl *CiCdProcessor) CleanUpBuildxK8sDriver(ciCdRequest helper.CiCdTriggerEvent, wg *sync.WaitGroup) {

ci-runner/executor/stage/cdStages.go

@@ -56,9 +56,14 @@ func (impl *CdStage) HandleCDEvent(ciCdRequest *helper.CiCdTriggerEvent, exitCod
 	return
 }
 
-func (impl *CdStage) handleCDEvent(ciCdRequest *helper.CiCdTriggerEvent) (*helper.HandleCdEventResponse, error) {
+func (impl *CdStage) handleCDEvent(ciCdRequest *helper.CiCdTriggerEvent) (resp *helper.HandleCdEventResponse, err error) {
+	defer func() { //recover in this function allows us to send event even if the code crashes
+		if r := recover(); r != nil {
+			log.Println("recovered from panic in handleCDEvent:", r)
+			err = fmt.Errorf("panic occurred during CD event handling")
+		}
+	}()
 	var artifactUploaded bool
-	var err error
 	var allPluginArtifacts *helper.PluginArtifacts
 
 	allPluginArtifacts, err = impl.runCDStages(ciCdRequest)

ci-runner/executor/stage/ciStages.go

@@ -74,8 +74,8 @@ func NewCiStage(gitManager helper.GitManager, dockerHelper helper.DockerHelper,
 	}
 }
 
-func deferCIEvent(ciRequest *helper.CommonWorkflowRequest, artifactUploaded bool, err error) (exitCode int) {
-	log.Println(util.DEVTRON, "defer CI stage data.", "err: ", err, "artifactUploaded: ", artifactUploaded)
+func sendCIEventResult(ciRequest *helper.CommonWorkflowRequest, artifactUploaded bool, err error) (exitCode int) {
+	log.Println(util.DEVTRON, "sendCIEventResult CI stage data.", "err: ", err, "artifactUploaded: ", artifactUploaded)
 	if err != nil {
 		var stageError *helper.CiStageError
 		if errors.As(err, &stageError) {
@@ -99,13 +99,23 @@ func deferCIEvent(ciRequest *helper.CommonWorkflowRequest, artifactUploaded bool
 }
 
 func (impl *CiStage) HandleCIEvent(ciCdRequest *helper.CiCdTriggerEvent, exitCode *int) {
-	var artifactUploaded bool
-	var err error
+	artifactUploaded, err := impl.handleCIEvent(ciCdRequest)
+	if err != nil {
+		//log error and send event result
+		log.Println("ci stage error: ", err)
+	}
+	*exitCode = sendCIEventResult(ciCdRequest.CommonWorkflowRequest, artifactUploaded, err)
+}
+
+func (impl *CiStage) handleCIEvent(ciCdRequest *helper.CiCdTriggerEvent) (artifactUploaded bool, err error) {
+	defer func() { //recover in this function allows us to send event even if the code crashes
+		if r := recover(); r != nil {
+			log.Println("recovered from panic in handleCIEvent:", r)
+			err = fmt.Errorf("panic occurred during CI event handling")
+		}
+	}()
 	ciRequest := ciCdRequest.CommonWorkflowRequest
 	ciContext := cicxt.BuildCiContext(context.Background(), ciRequest.EnableSecretMasking)
-	defer func() {
-		*exitCode = deferCIEvent(ciRequest, artifactUploaded, err)
-	}()
 	artifactUploaded, err = impl.runCIStages(ciContext, ciCdRequest)
 	log.Println(util.DEVTRON, artifactUploaded, err)
 	var artifactUploadErr error
@@ -116,16 +126,16 @@ func (impl *CiStage) HandleCIEvent(ciCdRequest *helper.CiCdTriggerEvent, exitCod
 
 	if err != nil {
 		log.Println(util.DEVTRON, err)
-		return
+		return artifactUploaded, err
 	}
 
 	if artifactUploadErr != nil {
 		log.Println(util.DEVTRON, "error in artifact upload: ", artifactUploadErr)
 		if ciCdRequest.CommonWorkflowRequest.IsExtRun {
 			log.Println(util.DEVTRON, "Ignoring artifactUploadErr")
-			return
+			return artifactUploaded, err
 		}
-		return
+		return artifactUploaded, err
 	}
 
 	// sync cache
@@ -148,7 +158,7 @@ func (impl *CiStage) HandleCIEvent(ciCdRequest *helper.CiCdTriggerEvent, exitCod
 	if err != nil {
 		log.Println("error in cache push", err)
 	}
-	return
+	return artifactUploaded, err
 }
 
 // TODO: take as tech debt and break this function into parts for better code readability
@@ -672,17 +682,10 @@ func pullCache(metrics *helper.CIMetrics, ciCdRequest *helper.CiCdTriggerEvent)
 	log.Println(util.DEVTRON, " cache-pull")
 	start := time.Now()
 	metrics.CacheDownStartTime = start
-
-	defer func() {
-		log.Println(util.DEVTRON, " /cache-pull")
-		metrics.CacheDownDuration = time.Since(start).Seconds()
-	}()
-
 	err := helper.GetCache(ciCdRequest.CommonWorkflowRequest)
-	if err != nil {
-		return err
-	}
-	return nil
+	log.Println(util.DEVTRON, " /cache-pull")
+	metrics.CacheDownDuration = time.Since(start).Seconds()
+	return err
 }
 
 func (impl *CiStage) prepareStep(ciCdRequest *helper.CiCdTriggerEvent, metrics *helper.CIMetrics, skipCheckout bool) error {

ci-runner/go.mod

@@ -4,7 +4,7 @@ go 1.21
 
 toolchain go1.21.8
 
-replace github.com/devtron-labs/common-lib => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20250521133250-228c55be30a2
+replace github.com/devtron-labs/common-lib => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20250602063450-998593aefb28
 
 require (
 	github.com/Knetic/govaluate v3.0.0+incompatible

ci-runner/go.sum

@@ -95,8 +95,8 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/devtron-labs/devtron-services/common-lib v0.0.0-20250521133250-228c55be30a2 h1:mLbnHEC6F+/eWa4PkhIc4yQQHkPxcglMgdFoqv6c3nQ=
-github.com/devtron-labs/devtron-services/common-lib v0.0.0-20250521133250-228c55be30a2/go.mod h1:CXQGEo+kZc7JPX5hn4jJf1msal9q/ExSdAYGkHNPnQw=
+github.com/devtron-labs/devtron-services/common-lib v0.0.0-20250602063450-998593aefb28 h1:TuFPsIws3eAlIRajdqjEvh/Tl24iW7vTYWQ3T/qEgeo=
+github.com/devtron-labs/devtron-services/common-lib v0.0.0-20250602063450-998593aefb28/go.mod h1:HQVUnQI7WHwVq89Bib/18xJqM89S1+xI0O7REctMMrA=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/docker/cli v24.0.6+incompatible h1:fF+XCQCgJjjQNIMjzaSmiKJSCcfcXb3TWTcc7GAneOY=