Release/0.4

.cherry_picker.toml

@@ -0,0 +1,5 @@
+team = "lightspeed-core"
+repo = "lightspeed-stack"
+check_sha = "ea5de69d94e33aa2a75a622fec455bc4b0fa6c6b"
+fix_commit_msg = false
+default_branch = "main"

.github/pr-title-checker-config.json

@@ -0,0 +1,23 @@
+{
+  "LABEL": {
+    "name": "title needs formatting",
+    "color": "EEEEEE"
+  },
+  "CHECKS": {
+    "prefixes": [
+      "LCORE-",
+      "RSPEED-",
+      "MGTM-",
+      "OLS-",
+      "RHIDP-",
+      "LEADS-",
+      "CWFHEALTH-",
+      "[release/"
+    ]
+  },
+  "MESSAGES": {
+    "success": "All OK",
+    "failure": "Failing CI test",
+    "notice": ""
+  }
+}

.github/workflows/build_and_push_release.yaml

@@ -27,15 +27,23 @@ jobs:
           # qemu is required for arm64 builds
           sudo apt install -y buildah qemu-user-static
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
+        with:
+          # Fetch submodules (required for lightspeed-providers)
+          submodules: 'recursive'
+          # Fetch all tags to determine latest stable version
+          fetch-tags: true
+      - name: Determine if latest tag should be applied
+        id: check_latest
+        run: ./scripts/latest-tag.py
       - name: Build image with Buildah
         id: build_image
         uses: redhat-actions/buildah-build@v2
         with:
           image: ${{ env.IMAGE_NAME }}
-          tags: |
+          tags: >-
             ${{ env.GIT_TAG }}
-            ${{ env.LATEST_TAG }}
+            ${{ steps.check_latest.outputs.apply_latest == 'true' && env.LATEST_TAG || '' }}
           containerfiles: |
             ${{ env.CONTAINER_FILE }}
           archs: amd64, arm64
@@ -48,7 +56,7 @@ jobs:
       - name: Check manifest
         run: |
           set -x
-          buildah manifest inspect ${{ steps.build_image.outputs.image }}:${{ env.LATEST_TAG }}
+          buildah manifest inspect ${{ steps.build_image.outputs.image-with-tag }}
       - name: Push image to Quay.io
         uses: redhat-actions/push-to-registry@v2
         with:

.github/workflows/e2e_tests.yaml

@@ -21,7 +21,7 @@ jobs:
       FAISS_VECTOR_STORE_ID: ${{ vars.FAISS_VECTOR_STORE_ID }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # On PR_TARGET → the fork (or same repo) that opened the PR.
           # On push      → falls back to the current repository.
@@ -31,6 +31,11 @@ jobs:
           # On push      → the pushed commit that triggered the workflow.
           ref: ${{ github.event.pull_request.head.ref || github.sha }}
 
+          # Tests need access to secrets.
+          # This should be refactored if possible to mitigate the risk.
+          # https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target
+          allow-unsafe-pr-checkout: true
+
           # Don’t keep credentials when running untrusted PR code under PR_TARGET.
           persist-credentials: ${{ github.event_name != 'pull_request_target' }}
 

.github/workflows/e2e_tests_providers.yaml

@@ -27,7 +27,7 @@ jobs:
       FAISS_VECTOR_STORE_ID: ${{ vars.FAISS_VECTOR_STORE_ID }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # On PR_TARGET → the fork (or same repo) that opened the PR.
           # On push      → falls back to the current repository.
@@ -37,6 +37,11 @@ jobs:
           # On push      → the pushed commit that triggered the workflow.
           ref: ${{ github.event.pull_request.head.ref || github.sha }}
 
+          # Tests need access to secrets.
+          # This should be refactored if possible to mitigate the risk.
+          # https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target
+          allow-unsafe-pr-checkout: true
+
           # Don’t keep credentials when running untrusted PR code under PR_TARGET.
           persist-credentials: ${{ github.event_name != 'pull_request_target' }}
 

.github/workflows/e2e_tests_rhaiis.yaml

@@ -28,7 +28,7 @@ jobs:
       FAISS_VECTOR_STORE_ID: ${{ vars.FAISS_VECTOR_STORE_ID }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # On PR_TARGET → the fork (or same repo) that opened the PR.
           # On push      → falls back to the current repository.
@@ -38,6 +38,11 @@ jobs:
           # On push      → the pushed commit that triggered the workflow.
           ref: ${{ github.event.pull_request.head.ref || github.sha }}
 
+          # Tests need access to secrets.
+          # This should be refactored if possible to mitigate the risk.
+          # https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target
+          allow-unsafe-pr-checkout: true
+
           # Don’t keep credentials when running untrusted PR code under PR_TARGET.
           persist-credentials: ${{ github.event_name != 'pull_request_target' }}
 

.github/workflows/radon.yaml

@@ -12,7 +12,7 @@ jobs:
       pull-requests: read
     name: "radon"
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
       - uses: davidslusser/actions_python_radon@v1.0.0
         with:
           src: "src"

AGENTS.md

@@ -191,6 +191,15 @@ uv run make test-e2e         # End-to-end tests
 - **SQLAlchemy**: Database ORM
 - **Kubernetes**: K8s auth integration
 
+## Pull Request Requirements
+
+**PR titles MUST start with a JIRA issue key prefix.** CI enforces this via `pr-title-checker` (config: `.github/pr-title-checker-config.json`).
+
+Allowed prefixes: `LCORE-`, `RSPEED-`, `MGTM-`, `OLS-`, `RHIDP-`, `LEADS-`, `CWFHEALTH-`, `[release/`
+
+- ✅ `RSPEED-2849: add user_agent to ResponsesEventData`
+- ❌ `feat(observability): add user_agent to ResponsesEventData`
+
 ## Development Workflow
 1. Use `uv sync --group dev --group llslibdev` for dependencies
 2. Always use `uv run` prefix for commands

CONTRIBUTING.md

@@ -10,6 +10,7 @@
 * [PR description](#pr-description)
 * [Definition of Done](#definition-of-done)
     * [A deliverable is to be considered “done” when](#a-deliverable-is-to-be-considered-done-when)
+* [Backports](#backports)
 * [AI assistants](#ai-assistants)
     * [“Mark” code with substantial AI-generated portions.](#mark-code-with-substantial-ai-generated-portions)
     * [Copyright and licence notices](#copyright-and-licence-notices)
@@ -97,12 +98,72 @@ Happy hacking!
 
 ## PR description
 
-* Jira ticket needs to be added into PR title, for example: `LCORE-740: type hints for models unit tests`
+* PR titles must start with a JIRA issue key prefix or the target branch of a backport in brackets. CI enforces this via
+  `pr-title-checker` (config: `.github/pr-title-checker-config.json`).
+  Allowed prefixes: `LCORE-`, `RSPEED-`, `MGTM-`, `OLS-`, `RHIDP-`, `LEADS-`,
+  `CWFHEALTH-`, `[release/`
+    - for example: `LCORE-740: type hints for models unit tests`
 * Fill-in all relevant information in the PR template
     - unused parts of PR template (like information about testing etc.) can be deleted
 * Please note that CodeRabbitAI will create a summary of your pull request
 
 
+
+## Backports
+
+We use [cherry_picker](https://pypi.org/project/cherry-picker/) to backport
+merged pull requests to release branches. See the
+[cherry_picker documentation](https://cherry-picker.readthedocs.io/) for full
+details.
+
+### Installation
+
+```bash
+pip install --user cherry_picker
+```
+
+### Usage
+
+After a pull request has been merged to `main`, you can backport it to one or
+more release branches:
+
+```bash
+# backport to a single release branch
+cherry_picker <commit-sha> release/0.6
+
+# backport to multiple release branches
+cherry_picker <commit-sha> release/0.5 release/0.6
+```
+
+`cherry_picker` will create a new branch, cherry-pick the commit, and open a
+pull request against the target release branch.
+
+If the commit you want to backport is a **merge commit**, append `^-` to the
+hash so that `cherry_picker` applies the correct parent diff:
+
+```bash
+cherry_picker <merge-commit-sha>^- release/0.6
+```
+
+If there are conflicts, `cherry_picker` will pause and let you resolve them.
+After resolving:
+
+```bash
+git add .
+cherry_picker --continue
+```
+
+To abort a backport in progress:
+
+```bash
+cherry_picker --abort
+```
+
+See the [branching documentation](docs/branching.md) for more details on our
+branching strategy and release workflow.
+
+
+
 ## Definition of Done
 
 ### A deliverable is to be considered “done” when
@@ -125,7 +186,7 @@ Happy hacking!
 Nontrivial and substantial AI-generated or AI-assisted content should be
 “marked” in appropriate cases. In deciding how to approach this, consider
 adopting one or more of the following recommendations. (This assumes you have
-not concluded that a suggestion is a match to some existing third-party code.) 
+not concluded that a suggestion is a match to some existing third-party code.)
 
 In a commit message, or in a pull request/merge request description field,
 identify the code assistant that you used, perhaps elaborating on how it was
@@ -271,14 +332,14 @@ Here is simple example:
 ```python
 def function_with_pep484_type_annotations(param1: int, param2: str) -> bool:
     """Example function with PEP 484 type annotations.
-    
+
     Args:
         param1: The first parameter.
         param2: The second parameter.
-    
+
     Returns:
         The return value. True for success, False otherwise.
-    
+
     Raises:
         ValueError: If the first parameter does not contain proper model name
     """

docs/contributing_guide.md

@@ -97,7 +97,11 @@ Happy hacking!
 
 ## PR description
 
-* Jira ticket needs to be added into PR title, for example: `LCORE-740: type hints for models unit tests`
+* PR titles must start with a JIRA issue key prefix or the target branch of a backport. CI enforces this via
+  `pr-title-checker` (config: `.github/pr-title-checker-config.json`).
+  Allowed prefixes: `LCORE-`, `RSPEED-`, `MGTM-`, `OLS-`, `RHIDP-`, `LEADS-`,
+  `CWFHEALTH-`, `[release/`
+    - for example: `LCORE-740: type hints for models unit tests`
 * Fill-in all relevant information in the PR template
     - unused parts of PR template (like information about testing etc.) can be deleted
 * Please note that CodeRabbitAI will create a summary of your pull request
@@ -125,7 +129,7 @@ Happy hacking!
 Nontrivial and substantial AI-generated or AI-assisted content should be
 “marked” in appropriate cases. In deciding how to approach this, consider
 adopting one or more of the following recommendations. (This assumes you have
-not concluded that a suggestion is a match to some existing third-party code.) 
+not concluded that a suggestion is a match to some existing third-party code.)
 
 In a commit message, or in a pull request/merge request description field,
 identify the code assistant that you used, perhaps elaborating on how it was
@@ -271,14 +275,14 @@ Here is simple example:
 ```python
 def function_with_pep484_type_annotations(param1: int, param2: str) -> bool:
     """Example function with PEP 484 type annotations.
-    
+
     Args:
         param1: The first parameter.
         param2: The second parameter.
-    
+
     Returns:
         The return value. True for success, False otherwise.
-    
+
     Raises:
         ValueError: If the first parameter does not contain proper model name
     """

docs/demos/lcore/contributing_guidelines.md

@@ -74,7 +74,10 @@ ptisnovs@redhat.com
 
 ## PR description
 
-* Jira ticket needs to be added into PR title
+* PR titles must start with a JIRA issue key prefix. CI enforces this via
+  `pr-title-checker` (config: `.github/pr-title-checker-config.json`).
+  Allowed prefixes: `LCORE-`, `RSPEED-`, `MGTM-`, `OLS-`, `RHIDP-`, `LEADS-`,
+  `CWFHEALTH-`, `[release/`
     - for example: `LCORE-740: type hints for models unit tests`
 * Fill-in all relevant information in the PR template
     - unused parts of PR template (like information about testing etc.) can be deleted

pyproject.toml

@@ -57,8 +57,8 @@ dependencies = [
     # Used by authorization resolvers
     "jsonpath-ng>=1.6.1",
     "psycopg2-binary>=2.9.10",
-    "litellm>=1.75.5.post1",
-    "urllib3==2.6.3",
+    "litellm>=1.83.7",
+    "urllib3>=2.6.3",
     # Used for agent card configuration
     "PyYAML>=6.0.0",
     # Used for rag faiss support

scripts/latest-tag.py

@@ -0,0 +1,58 @@
+#!/usr/bin/env python3
+
+"""Determine if the latest tag should be applied."""
+
+import os
+import subprocess
+
+
+def version_split(value: str) -> tuple[int, ...]:
+    """Split string into a tuple of ints."""
+    try:
+        return tuple(int(n) for n in value.split("."))
+    except ValueError:
+        return (-1,)
+
+
+def is_prerelease(tag: str) -> bool:
+    """Determine if a tag is a pre-release version."""
+    omit = {"rc", "alpha", "beta", "dev"}
+
+    return any(n in tag for n in omit)
+
+
+def get_latest_stable() -> str | None:
+    """Return the latest stable tag."""
+    stdout = subprocess.check_output(["git", "tag"], text=True)
+    tags = [tag for tag in stdout.splitlines() if not is_prerelease(tag)]
+    tags.sort(key=version_split)
+
+    return tags[-1] if tags else None
+
+
+def main() -> None:
+    """Determine latest tag."""
+    if not (current_tag := os.environ.get("GIT_TAG")):
+        reason = "GIT_TAG environment variable not set, skipping latest tag"
+        apply_latest = "false"
+    elif is_prerelease(current_tag):
+        reason = f"{current_tag} is a pre-release"
+        apply_latest = "false"
+    else:
+        latest_stable = get_latest_stable()
+        if current_tag == latest_stable:
+            reason = f"{current_tag} is the latest stable"
+            apply_latest = "true"
+        else:
+            reason = f"{current_tag} is not the latest stable ({latest_stable} is)"
+            apply_latest = "false"
+
+    print(reason)
+
+    if github_output := os.environ.get("GITHUB_OUTPUT"):
+        with open(github_output, "a") as f:
+            f.write(f"apply_latest={apply_latest}\n")
+
+
+if __name__ == "__main__":
+    main()