⚠️ Sync upstream/integration (8327e7f) -> release/4 2026-02-09 (deployment changes present)

.github/CODEOWNERS

@@ -1,7 +1,8 @@
-# Frontend only for ngui
+# Frontend
 ngui/             @hystax/ui
+jira_ui/          @hystax/ui
 
-# Backend for other directories
+# Backend
 auth/             @hystax/backend
 bi_exporter/      @hystax/backend
 bumischeduler/    @hystax/backend
@@ -13,7 +14,6 @@ gemini/           @hystax/backend
 herald/           @hystax/backend
 insider/          @hystax/backend
 jira_bus/         @hystax/backend
-jira_ui/          @hystax/backend
 katara/           @hystax/backend
 keeper/           @hystax/backend
 metroculus/       @hystax/backend

.github/workflows/auto-assign-author.yml

@@ -9,16 +9,50 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       pull-requests: write
+      issues: write  # Required because assignees API works via issues 
+      contents: read # Minimal read access to repository contents
 
     steps:
       - name: Assign PR author
         uses: actions/github-script@v8
         with:
           script: |
-            const reporter = context.actor
-            await github.rest.issues.addAssignees({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.payload.pull_request.number,
-              assignees: [reporter]
-            })
+            // Repository owner (organization or user who owns the repo)
+            const owner = context.repo.owner;
+
+            // Repository name
+            const repo = context.repo.repo;
+
+            // Login of the pull request author
+            const prAuthor = context.payload.pull_request.user.login;
+
+            try {
+              // Check the permission level of the PR author
+              const { data: perm } =
+                await github.rest.repos.getCollaboratorPermissionLevel({
+                  owner,
+                  repo,
+                  username: prAuthor
+                });
+
+              // If the author has write/maintain/admin rights → assign them to the PR
+              if (["write", "maintain", "admin"].includes(perm.permission)) {
+                await github.rest.issues.addAssignees({
+                  owner,
+                  repo,
+                  issue_number: context.payload.pull_request.number,
+                  assignees: [prAuthor]
+                });
+                console.log(`Assigned PR to ${prAuthor}`);
+              } else {
+                // If the author has insufficient rights → skip assignment
+                console.log(
+                  `Skipping assignment for ${prAuthor}: permission=${perm.permission}`
+                );
+              }
+            } catch (error) {
+              // If the author is not a collaborator (e.g., PR from a fork) → skip without failing
+              console.log(
+                `Skipping assignment for ${prAuthor}: not a collaborator`
+              );
+            }

.gitignore

@@ -24,4 +24,7 @@ rest_api/.clickhouse
 # jira_ui
 jira_ui/*/.env
 jira_ui/*/node_modules
-jira_ui/*/build/
+jira_ui/*/build/
+
+# Vagrant
+optscale-deploy/.vagrant/

build.sh

@@ -110,6 +110,12 @@ do
     else
       echo "Building image for ${COMPONENT}, build tag: ${BUILD_TAG}"
       $BUILD_TOOL build $FLAGS -t ${COMPONENT}:${BUILD_TAG} -f ${DOCKERFILE} .
+
+      # If the build fails, exit with the same status code as the build command
+      build_status_code="$?"
+      if [ "$build_status_code" -gt 0 ]; then
+        exit $build_status_code
+      fi
     fi
 
     if use_registry; then

bumiworker/bumiworker/modules/archive/instance_subscription.py

@@ -27,12 +27,13 @@ def __init__(self, *args, **kwargs):
     def supported_cloud_types(self):
         return SUPPORTED_CLOUD_TYPES
 
-    def _has_discounts(self, raw_info):
+    @staticmethod
+    def _has_discounts(raw_info):
         if raw_info.get('cost') == 0:
             # savings plan applied
             return True
         for key in ['coupons_discount', 'resource_package_discount']:
-            if key in raw_info and float(raw_info[key]):
+            if key in raw_info and float(raw_info[key] or 0):
                 return True
 
     def _get(self, previous_options, optimizations, cloud_accounts_map,

docker_images/cleanelkdb/clean-elk-db.sh

@@ -22,7 +22,8 @@ remove_line_from_filebeat() {
 
 remove_index_from_elk() {
 	echo "DELETING "$2" INDEX FROM ELK"
-	curl -s -X DELETE $1':'$ELK_PORT'/'$2
+	encoded_index=$(jq -rn --arg index "$2" '$index|@uri')
+	curl -s -X DELETE $1':'$ELK_PORT'/'$encoded_index
 }
 
 m_total_log_size=$(get_size_of_logs $ELK_IP)
@@ -34,12 +35,11 @@ fi
 
 echo "SIZE OF LOGS BIGGER "$LOG_SIZE_MAX"Mb -> START TO REMOVE LOGS"
 curl -s -X GET "$ELK_IP:$ELK_PORT/_cat/indices?v" > curl_test.txt
-cat curl_test.txt | awk '/filebeat/ { print $3 }' | sort --reverse > filebeat.txt
+grep -oE '(%{[^}]+}|[a-zA-Z_]+)-[0-9]{4}\.[0-9]{2}\.[0-9]{2}' curl_test.txt | sort -t '-' -k2,2 > filebeat.txt
 
 while [ $m_total_log_size -gt $LOG_SIZE_MAX ]; do
 	m_filebeat=$(tail -n -1 filebeat.txt)
 	filebeat_date=$(echo $m_filebeat | awk -F '-' '{ print $2 }')
-
 	if [ "$m_filebeat" = "" ] ; then
 		break
 	else

docker_images/common/install-peer-finder.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+
+# TODO: Instead of this script we should use multi stage docker builds
+#       but this is good enough until we get arround to it
+#       Or even better -- see if we need this tool at all or if there is a better
+#       way to install it (e.g. via a package manager)
+
+set -x
+
+arch="$(uname -m)"
+dest_bin_path="/usr/local/bin/peer-finder"
+
+apt-get update
+apt-get install -y --no-install-recommends openssl ca-certificates wget
+rm -rf /var/lib/apt/lists/*
+
+if [[ "$arch" == "x86_64" || "$arch" == "amd64" ]]; then
+    wget -O $dest_bin_path https://storage.googleapis.com/kubernetes-release/pets/peer-finder
+elif [[ "$arch" == "aarch64" || "$arch" == "arm64" ]]; then
+    wget https://github.com/kmodules/peer-finder/releases/download/v1.0.2/peer-finder-linux-arm64.tar.gz \
+        -O /tmp/peer-finder-linux-arm64.tar.gz
+    tar -xzf /tmp/peer-finder-linux-arm64.tar.gz -C /tmp
+    mv /tmp/peer-finder-linux-arm64 $dest_bin_path
+else
+    echo "Unsupported architecture: $arch"
+    exit 1
+fi
+
+chmod +x $dest_bin_path
+apt-get purge -y --auto-remove ca-certificates wget
+

docker_images/error_pages/Dockerfile

@@ -1,3 +1,10 @@
-FROM ingressnginx/custom-error-pages:v1.2.0
+# TODO: The base image doesn't support arm64 yet but shouldn't be too hard to change that,
+# though it will require a change in the `kubernetes/ingress-nginx` repo.
+# References:
+#   * Base image's Dockerfile: https://github.com/kubernetes/ingress-nginx/blob/main/images/custom-error-pages/rootfs/Dockerfile
+#   * Relevant issue on GitHub: https://github.com/kubernetes/ingress-nginx/issues/10245
+
+ARG arch=amd64
+FROM --platform="linux/${arch}" ingressnginx/custom-error-pages:v1.2.0
 
 COPY docker_images/error_pages/www /www

docker_images/etcd/Dockerfile

@@ -1,7 +1,18 @@
-FROM gcr.io/etcd-development/etcd:v3.2.13
-RUN apk update
-# https://github.com/Yelp/dumb-init/issues/73#issuecomment-240439732
-RUN apk add ca-certificates wget && update-ca-certificates
-RUN apk --no-cache add curl
-RUN wget $(curl -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/nexusriot/etcd-walker/releases/tags/0.0.11 | grep -Eo 'https://(.*linux_x64_static)') -O /bin/etcd-walker
+# etcd is a distroless image starting from v3.5, meaning we don't have access to a shell or package manager.
+# this is why we use multi-stage builds to build and copy the binary into the final image.
+# ref: https://github.com/GoogleContainerTools/distroless?tab=readme-ov-file#docker
+
+FROM golang:1.24.6 AS build-etcd-walker
+
+RUN git clone https://github.com/nexusriot/etcd-walker/ /tmp/etcd-walker-src
+
+WORKDIR /tmp/etcd-walker-src
+RUN git checkout 0.2.1
+RUN go build -ldflags "-linkmode external -extldflags -static" -o etcd-walker cmd/etcd-walker/main.go
+
+RUN mv etcd-walker /bin/etcd-walker
 RUN chmod +x /bin/etcd-walker
+
+# NOTE: v3.6+ require significant changes as they removed support for the V2 API, see https://etcd.io/docs/v3.6/upgrades/upgrade_3_6/
+FROM gcr.io/etcd-development/etcd:v3.2.13
+COPY --from=build-etcd-walker /bin/etcd-walker /bin/etcd-walker

docker_images/mariadb/Dockerfile

@@ -1,11 +1,8 @@
 FROM mariadb:10.3
 
-RUN set -x \
-  && apt-get update && apt-get install -y --no-install-recommends ca-certificates wget \
-  && rm -rf /var/lib/apt/lists/* \
-  && wget -O /usr/local/bin/peer-finder https://storage.googleapis.com/kubernetes-release/pets/peer-finder \
-  && chmod +x /usr/local/bin/peer-finder \
-  && apt-get purge -y --auto-remove ca-certificates wget
+COPY docker_images/common/install-peer-finder.sh /tmp/install-peer-finder.sh
+RUN chmod +x /tmp/install-peer-finder.sh
+RUN /tmp/install-peer-finder.sh
 
 COPY docker_images/mariadb/galera /opt/galera/
 COPY docker_images/mariadb/docker-entrypoint.sh /usr/local/bin/

docker_images/mongo/Dockerfile

@@ -1,10 +1,7 @@
 FROM mongo:3.6
 
-RUN set -x \
-  && apt-get update && apt-get install -y --no-install-recommends openssl ca-certificates wget \
-  && rm -rf /var/lib/apt/lists/* \
-  && wget -O /usr/local/bin/peer-finder https://storage.googleapis.com/kubernetes-release/pets/peer-finder \
-  && chmod +x /usr/local/bin/peer-finder \
-  && apt-get purge -y --auto-remove ca-certificates wget
+COPY docker_images/common/install-peer-finder.sh /tmp/install-peer-finder.sh
+RUN chmod +x /tmp/install-peer-finder.sh
+RUN /tmp/install-peer-finder.sh
 
 COPY docker_images/mongo/on-start.sh /on-start.sh