Merge branch 'main' into codex/fix-router-transcription-auth

Author: yzhan1

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/values-01-2pods-minimal-example.yaml

@@ -29,6 +29,7 @@ servingEngineSpec:
       extraArgs: ["--gpu-memory-utilization", "0.4"]
 
 routerSpec:
-  repository: "localhost:5000/git-act-router"
+  repository: "git-act-router"
+  tag: "ci"
   imagePullPolicy: "IfNotPresent"
   enableRouter: true

.github/values-04-multiple-models.yaml

@@ -26,6 +26,7 @@ servingEngineSpec:
       - ReadWriteOnce
 
 routerSpec:
-  repository: "localhost:5000/git-act-router"
+  repository: "git-act-router"
+  tag: "ci"
   imagePullPolicy: "IfNotPresent"
   enableRouter: true

.github/values-05-secure-vllm.yaml

@@ -14,6 +14,7 @@ servingEngineSpec:
     requestGPU: 1
 
 routerSpec:
-  repository: "localhost:5000/git-act-router"
+  repository: "git-act-router"
+  tag: "ci"
   imagePullPolicy: "IfNotPresent"
   enableRouter: true

.github/values-11-monitoring.yaml

@@ -17,7 +17,8 @@ servingEngineSpec:
     requestGPU: 1
 
 routerSpec:
-  repository: "localhost:5000/git-act-router"
+  repository: "git-act-router"
+  tag: "ci"
   imagePullPolicy: "IfNotPresent"
   enableRouter: true
   serviceMonitor:

.github/workflows/ci.yml

@@ -25,10 +25,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
         with:
           enable-cache: true
           ignore-nothing-to-cache: true

.github/workflows/functionality-helm-chart.yml

@@ -29,7 +29,7 @@ jobs:
       - run: echo "🐧 This job is now running on a ${{ runner.os }} server hosted by GitHub!"
       - run: echo "🔎 The name of your branch is ${{ github.ref }} and your repository is ${{ github.repository }}."
       - name: Check out repository code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - run: echo "💡 The ${{ github.repository }} repository has been cloned to the runner."
       - run: echo "🖥️ The workflow is now ready to test your code on the runner."
       - name: Helm uninstall
@@ -61,17 +61,16 @@ jobs:
         run: |
           cd ${{ github.workspace }}
           kubectl config use-context minikube
-          sudo docker build --build-arg INSTALL_OPTIONAL_DEP=default -t localhost:5000/git-act-router -f docker/Dockerfile .
-          sudo docker push localhost:5000/git-act-router
           sudo sysctl fs.protected_regular=0
-          minikube image load localhost:5000/git-act-router
+          eval "$(minikube docker-env)"
+          docker build --build-arg INSTALL_OPTIONAL_DEP=default -t git-act-router:ci -f docker/Dockerfile .
           helm install vllm ./helm -f .github/values-05-secure-vllm.yaml
       - name: Validate the installation and send query to the stack
         run: |
           bash .github/port-forward.sh curl-05-secure-vllm
         timeout-minutes: 3
       - name: Archive functionality results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: always()
         with:
           name: output-05-secure-vllm
@@ -120,7 +119,7 @@ jobs:
           bash .github/port-forward.sh curl-02-two-pods
         timeout-minutes: 3
       - name: Archive functionality results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: always()
         with:
           name: output-02-two-pods
@@ -167,7 +166,7 @@ jobs:
           bash .github/port-forward.sh curl-04-multiple-models
         timeout-minutes: 5
       - name: Archive functionality results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: always()
         with:
           name: output-04-multiple-models
@@ -187,7 +186,7 @@ jobs:
       - run: echo "🐧 This job is now running on a ${{ runner.os }} server hosted by GitHub!"
       - run: echo "🔎 The name of your branch is ${{ github.ref }} and your repository is ${{ github.repository }}."
       - name: Check out repository code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - run: echo "💡 The ${{ github.repository }} repository has been cloned to the runner."
       - run: echo "🖥️ The workflow is now ready to test your code on the runner."
       - name: Helm uninstall
@@ -219,17 +218,16 @@ jobs:
         run: |
           cd ${{ github.workspace }}
           kubectl config use-context minikube
-          sudo docker build --build-arg INSTALL_OPTIONAL_DEP=default -t localhost:5000/git-act-router -f docker/Dockerfile .
-          sudo docker push localhost:5000/git-act-router
           sudo sysctl fs.protected_regular=0
-          minikube image load localhost:5000/git-act-router
+          eval "$(minikube docker-env)"
+          docker build --build-arg INSTALL_OPTIONAL_DEP=default -t git-act-router:ci -f docker/Dockerfile .
           helm install vllm ./helm -f .github/values-11-monitoring.yaml
       - name: Validate the installation and send query to the stack
         run: |
           bash .github/port-forward.sh curl-06-monitoring
         timeout-minutes: 3
       - name: Archive functionality results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: always()
         with:
           name: curl-06-monitoring

.github/workflows/helm-release.yml

@@ -28,7 +28,7 @@ jobs:
     steps:
       - name: Checkout Repository
         if: ${{ github.event_name == 'push' || github.event.inputs.release_type == 'helm_only' || github.event.inputs.release_type == 'all' }}
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
 
@@ -45,7 +45,7 @@ jobs:
 
       - name: Run chart-releaser
         if: ${{ github.event_name == 'push' || github.event.inputs.release_type == 'helm_only' || github.event.inputs.release_type == 'all' }}
-        uses: helm/chart-releaser-action@v1.7.0
+        uses: helm/chart-releaser-action@a0d2dc62c5e491af8ef6ba64a2e02bcf3fb33aa1 # v1.7.0
         with:
           skip_existing: false
           packages_with_index: true
@@ -62,7 +62,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
 
@@ -75,26 +75,26 @@ jobs:
           echo "Chart version: ${CHART_VERSION}"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       # Login only on main (since PRs must NOT push)
       - name: Login to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: docker.io
           username: lmcache
           password: ${{ secrets.LMCACHE_DOCKER_SECRET }}
 
       - name: Build and push router Docker image
         if: ${{ github.event_name == 'push' || github.event.inputs.release_type == 'router_only' || github.event.inputs.release_type == 'all' }}
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
         with:
           context: .
           file: docker/Dockerfile
@@ -110,7 +110,7 @@ jobs:
 
       - name: Build and push CRD controller Docker image
         if: ${{ github.event_name == 'push' || github.event.inputs.release_type == 'crd_only' || github.event.inputs.release_type == 'all' }}
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
         with:
           context: operator
           file: operator/Dockerfile

.github/workflows/operator-docker-release.yml

@@ -17,31 +17,31 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       # Login to GitHub Container Registry (GHCR)
       - name: Login to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       # Login to Docker Hub
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: docker.io
           username: lmcache
           password: ${{ secrets.LMCACHE_DOCKER_SECRET }}
 
       - name: Build and push image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
         with:
           context: operator
           file: operator/Dockerfile

.github/workflows/operator-test.yml

@@ -29,7 +29,7 @@ jobs:
       - run: echo "🔎 The name of your branch is ${{ github.ref }} and your repository is ${{ github.repository }}."
 
       - name: Check out repository code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - run: echo "💡 The ${{ github.repository }} repository has been cloned to the runner."
       - run: echo "🖥️ The workflow is now ready to test your code on the runner."
@@ -65,7 +65,7 @@ jobs:
           kubectl delete crd vllmrouters.production-stack.vllm.ai || true
 
       - name: Archive test results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: always()
         with:
           name: operator-test-results