Sync with downstream

.tekton/lightspeed-service-pull-request.yaml

@@ -32,8 +32,8 @@ spec:
     - name: build-source-image
       value: "true"
     - name: prefetch-input
-      value: '{"type": "pip", "path": ".", "allow_binary": "true"}'
-    - name: hermetic-build
+      value: '[{"type": "rpm", "path": "."}, {"type": "pip", "path": ".", "allow_binary": "true"}]'
+    - name: hermetic
       value: "true"
   taskRunSpecs:
     - pipelineTaskName: build-source-image
@@ -43,6 +43,20 @@ spec:
           memory: 1Gi
         limits:
           memory: 4Gi
+    - pipelineTaskName: clair-scan
+      computeResources:
+        requests:
+          cpu: '1'
+          memory: 1Gi
+        limits:
+          memory: 8Gi
+    - pipelineTaskName: ecosystem-cert-preflight-checks
+      computeResources:
+        requests:
+          cpu: '1'
+          memory: 1Gi
+        limits:
+          memory: 8Gi
   pipelineSpec:
     finally:
       - name: show-sbom
@@ -199,6 +213,8 @@ spec:
         params:
           - name: input
             value: $(params.prefetch-input)
+          - name: dev-package-managers
+            value: "true"
         runAfter:
           - clone-repository
         taskRef:

.tekton/lightspeed-service-push.yaml

@@ -31,8 +31,8 @@ spec:
     - name: build-source-image
       value: "true"
     - name: prefetch-input
-      value: '{"type": "pip", "path": ".", "allow_binary": "true"}'
-    - name: hermetic-build
+      value: '[{"type": "rpm", "path": "."}, {"type": "pip", "path": ".", "allow_binary": "true"}]'
+    - name: hermetic
       value: "true"
   taskRunSpecs:
     - pipelineTaskName: build-source-image
@@ -42,6 +42,20 @@ spec:
           memory: 1Gi
         limits:
           memory: 4Gi
+    - pipelineTaskName: clair-scan
+      computeResources:
+        requests:
+          cpu: '1'
+          memory: 1Gi
+        limits:
+          memory: 8Gi
+    - pipelineTaskName: ecosystem-cert-preflight-checks
+      computeResources:
+        requests:
+          cpu: '1'
+          memory: 1Gi
+        limits:
+          memory: 8Gi
   pipelineSpec:
     finally:
       - name: show-sbom
@@ -198,6 +212,8 @@ spec:
         params:
           - name: input
             value: $(params.prefetch-input)
+          - name: dev-package-managers
+            value: "true"
         runAfter:
           - clone-repository
         taskRef:

Containerfile

@@ -3,14 +3,15 @@ ARG LIGHTSPEED_RAG_CONTENT_IMAGE=quay.io/openshift-lightspeed/lightspeed-rag-con
 
 FROM ${LIGHTSPEED_RAG_CONTENT_IMAGE} as lightspeed-rag-content
 
-FROM registry.redhat.io/ubi9/ubi-minimal
+FROM registry.redhat.io/ubi9/ubi-minimal:latest
 
 ARG VERSION
+# todo: this is overriden by the image ubi9/python-311, we hard coded WORKDIR below to /app-root
+# makesure the default value of rag content is set according to APP_ROOT and then update the operator.
 ARG APP_ROOT=/app-root
 
 RUN microdnf install -y --nodocs --setopt=keepcache=0 --setopt=tsflags=nodocs \
-    python3.11 python3.11-devel python3.11-pip shadow-utils \
-    && microdnf clean all --enablerepo='*'
+    python3.11 python3.11-devel python3.11-pip
 
 # PYTHONDONTWRITEBYTECODE 1 : disable the generation of .pyc
 # PYTHONUNBUFFERED 1 : force the stdout and stderr streams to be unbuffered
@@ -23,18 +24,16 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
     LANG=en_US.UTF-8 \
     PIP_NO_CACHE_DIR=off
 
-WORKDIR ${APP_ROOT}
+WORKDIR /app-root
 
 COPY --from=lightspeed-rag-content /rag/vector_db/ocp_product_docs ./vector_db/ocp_product_docs
 COPY --from=lightspeed-rag-content /rag/embeddings_model ./embeddings_model
 
 # Add explicit files and directories
 # (avoid accidental inclusion of local directories or env files or credentials)
-COPY pyproject.toml pdm.lock runner.py ./
-RUN pip3.11 install --no-cache-dir --upgrade pip pdm==2.18.1 \
-    && pdm config python.use_venv false \
-    && pdm sync --global --prod -p ${APP_ROOT}
+COPY runner.py requirements.txt ./
 
+RUN pip3.11 install --no-cache-dir -r requirements.txt
 
 COPY ols ./ols
 
@@ -56,5 +55,5 @@ LABEL io.k8s.display-name="OpenShift LightSpeed Service" \
       vendor="Red Hat, Inc."
 
 
-# no-root user is checked in Konflux 
+# no-root user is checked in Konflux
 USER 1001

ols/app/metrics/token_counter.py

@@ -14,6 +14,7 @@
 logger = logging.getLogger(__name__)
 
 
+# (false alarm) pylint: disable=W0223
 class GenericTokenCounter(BaseCallbackHandler):
     """A callback handler to count tokens sent and received by the LLM.
 

pyproject.toml

@@ -110,6 +110,7 @@ dependencies = [
     "zipp==3.20.1",
     "jinja2==3.1.4",
     "scikit-learn==1.5.1",
+    "starlette==0.37.2",
     "tqdm==4.66.5",
 ]
 requires-python = "==3.11.*"