Add changes

.github/workflows/bandit.yml

@@ -22,7 +22,7 @@ jobs:
       - uses: hmarr/[email protected]
 
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           ref: ${{ inputs.head_sha }}
 

.github/workflows/blue.yml

@@ -0,0 +1,27 @@
+name: Blue
+
+on:
+  workflow_call:
+    inputs:
+      head_sha:
+        required: true
+        type: string
+
+jobs:
+  blue:
+    name: Blue
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.head_sha }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.10'
+
+      - uses: pre-commit/[email protected]
+        with:
+          extra_args: blue --all-files --hook-stage pre-push

.github/workflows/build_pypi.yml

@@ -57,7 +57,7 @@ jobs:
       - uses: hmarr/[email protected]
 
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           ref: ${{ inputs.ref }}
 

.github/workflows/bump-helm-chart.yml

@@ -33,7 +33,7 @@ jobs:
           git config --global user.email '[email protected]'
 
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           repository: "${{ github.repository_owner }}/${{ env.HELM_CHART_REPO_NAME }}"
           token: ${{ secrets.GIT_PAT }}

.github/workflows/cicd_pipeline.yml

@@ -37,7 +37,7 @@ jobs:
 
       - name: Checkout
         if: github.event_name == 'push'
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           ref: ${{ github.ref }}
 
@@ -51,6 +51,8 @@ jobs:
               - 'setup.py'
               - '.github/workflows/bandit.yml'
               - '.github/workflows/tests.yml'
+              - '.github/workflows/test_conda.yml'
+              - '.github/workflows/test_migrations.yml'
             frontend:
               - 'label_studio/frontend/**'
               - '.github/workflows/frontend-build.yml'
@@ -91,6 +93,24 @@ jobs:
     with:
       head_sha: ${{ github.event.pull_request.head.sha || github.event.after }}
 
+  ruff:
+    name: "Linter"
+    needs:
+      - changed_files
+    if: needs.changed_files.outputs.src == 'true'
+    uses: ./.github/workflows/ruff.yml
+    with:
+      head_sha: ${{ github.event.pull_request.head.sha || github.event.after }}
+
+  blue:
+    name: "Linter"
+    needs:
+      - changed_files
+    if: needs.changed_files.outputs.src == 'true'
+    uses: ./.github/workflows/blue.yml
+    with:
+      head_sha: ${{ github.event.pull_request.head.sha || github.event.after }}
+
   build-frontend:
     name: "Build"
     needs:
@@ -168,7 +188,7 @@ jobs:
       - uses: hmarr/[email protected]
 
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           token: ${{ secrets.GIT_PAT }}
           ref: ${{ github.sha }}
@@ -198,7 +218,7 @@ jobs:
             const rc_version = `${version}rc${ compare.ahead_by }`
             console.log(`rc-version: ${rc_version}`)
             core.setOutput("rc-version", rc_version);
-            
+
             function compareVersions(a, b) {
               if (a[1] === b[1])
                 if (a[2] === b[2])
@@ -211,7 +231,7 @@ jobs:
               else
                 return +a[1] - b[1]
             }
-            
+
             const versionMatch = version.match(regexp)
             if (!versionMatch) {
               core.setFailed(`Version "${version}" from branch "${target_commitish}" does not match the regexp ${regexp}`)
@@ -247,7 +267,7 @@ jobs:
             }
             console.log(`New version: ${version}`)
 
-            const rawTags = tags.map(e => e.name) 
+            const rawTags = tags.map(e => e.name)
             const tagsWithNew = [...rawTags, version]
             const sortedTags = tagsWithNew
               .filter(e => e.match(regexp))
@@ -272,7 +292,7 @@ jobs:
             if (release) {
                 console.log(`Draft release already exist ${release.html_url}`)
             } else {
-                console.log(`Draft release is not found creating a new one`)                
+                console.log(`Draft release is not found creating a new one`)
                 const {data: newDraftRelease} = await github.rest.repos.createRelease({
                     owner,
                     repo,
@@ -328,19 +348,19 @@ jobs:
           WORKFLOW_RUN_LINK: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
         run: |
           set -eux
-          
+
           previous_tag=$(git tag --sort=-committerdate | head -n1)
-          
+
           export PREVIOUS_REF="tags/${previous_tag}"
           python3 .github/helpers/gh_changelog_generator/gh_changelog_generator.py
-          
+
           echo "changelog_msg_b64=$(cat '${{ env.OUTPUT_FILE_MD }}' | base64 -w 0)" >> $GITHUB_OUTPUT
-          
+
           echo "CHANGELOG_MD<<CHANGELOG_MD_EOF" >> $GITHUB_ENV
           cat '${{ env.OUTPUT_FILE_MD }}' >> $GITHUB_ENV
           echo >> $GITHUB_ENV
           echo "CHANGELOG_MD_EOF" >> $GITHUB_ENV
-          
+
           echo "CHANGELOG_JSON<<CHANGELOG_JSON_EOF" >> $GITHUB_ENV
           cat '${{ env.OUTPUT_FILE_JSON }}' >> $GITHUB_ENV
           echo >> $GITHUB_ENV
@@ -385,3 +405,23 @@ jobs:
       ref: ${{ github.ref_name }}
       release-id: ${{ needs.draft-release.outputs.id }}
     secrets: inherit
+
+  check_gate:
+    name: "Ready to merge"
+    if: always()
+    needs:
+      - gitleaks
+      - bandit
+      - ruff
+      - blue
+      - pytest
+      - migrations
+      - build-docker
+    runs-on: ubuntu-latest
+    steps:
+      - name: Decide whether the needed jobs succeeded or failed
+        uses: re-actors/alls-green@release/v1
+        with:
+          allowed-failures:
+          allowed-skips: gitleaks, bandit, ruff, blue, pytest, migrations, conda-test, build-docker
+          jobs: ${{ toJSON(needs) }}

.github/workflows/codespell.yml

@@ -14,6 +14,6 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - name: Codespell
         uses: codespell-project/actions-codespell@v2

.github/workflows/docker-build-ontop.yml

@@ -51,7 +51,7 @@ jobs:
       - uses: hmarr/[email protected]
 
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           submodules: 'recursive'
           ref: ${{ inputs.ref }}
@@ -82,19 +82,19 @@ jobs:
           cat "${DOCKERFILE_PATH}"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2.10.0
+        uses: docker/setup-buildx-action@v3.0.0
 
       - name: Login to DockerHub
-        uses: docker/login-action@v2.2.0
+        uses: docker/login-action@v3.0.0
         with:
           username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
 
       - name: Push Docker image
-        uses: docker/build-push-action@v4.1.1
+        uses: docker/build-push-action@v5.0.0
         id: docker_build_and_push
         with:
           context: .

.github/workflows/docker-build-ubi.yml

@@ -25,17 +25,17 @@ jobs:
       - uses: hmarr/[email protected]
 
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           submodules: 'recursive'
           ref: ${{ inputs.sha }}
           fetch-depth: 0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2.10.0
+        uses: docker/setup-buildx-action@v3.0.0
 
       - name: Login to RedHat Registry
-        uses: docker/login-action@v2.2.0
+        uses: docker/login-action@v3.0.0
         with:
           registry: quay.io
           username: ${{ secrets.REDHAT_REGISTRY_LOGIN }}
@@ -150,7 +150,7 @@ jobs:
             core.setOutput("ubi-tags", ubiTags.join(','));
 
       - name: Build and push ubi
-        uses: docker/build-push-action@v4.1.1
+        uses: docker/build-push-action@v5.0.0
         id: docker_build_and_push_ubi
         with:
           context: .

.github/workflows/docker-build.yml

@@ -30,7 +30,7 @@ jobs:
       - uses: hmarr/[email protected]
 
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           submodules: 'recursive'
           ref: ${{ inputs.sha }}
@@ -66,10 +66,10 @@ jobs:
           echo "build_version=$version" >> $GITHUB_OUTPUT
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2.10.0
+        uses: docker/setup-buildx-action@v3.0.0
 
       - name: Login to DockerHub
-        uses: docker/login-action@v2.2.0
+        uses: docker/login-action@v3.0.0
         with:
           username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -108,10 +108,10 @@ jobs:
           fi
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
 
       - name: Push Docker image
-        uses: docker/build-push-action@v4.1.1
+        uses: docker/build-push-action@v5.0.0
         id: docker_build_and_push
         with:
           context: .

.github/workflows/docker-release-promote.yml

@@ -58,7 +58,7 @@ jobs:
             core.setOutput("sha", details.sha);
 
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           ref: ${{ inputs.release_tag }}
 
@@ -170,16 +170,16 @@ jobs:
           fi
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2.10.0
+        uses: docker/setup-buildx-action@v3.0.0
 
       - name: Login to DockerHub
-        uses: docker/login-action@v2.2.0
+        uses: docker/login-action@v3.0.0
         with:
           username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Login to RedHat Registry
-        uses: docker/login-action@v2.2.0
+        uses: docker/login-action@v3.0.0
         with:
           registry: quay.io
           username: ${{ secrets.REDHAT_REGISTRY_LOGIN }}
@@ -208,10 +208,10 @@ jobs:
           EOF
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
 
       - name: Build and Push Release Ubuntu Docker image
-        uses: docker/build-push-action@v4.1.1
+        uses: docker/build-push-action@v5.0.0
         id: docker_build
         with:
           context: ${{ steps.release_dockerfile.outputs.release_dir }}

.github/workflows/feature-flags-update.yml

@@ -37,7 +37,7 @@ jobs:
           git config --global user.email '[email protected]'
 
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           token: ${{ secrets.GIT_PAT }}
           fetch-depth: 1