From a01dd39c0d3e9c7f1d9942624bcf89bc367428f3 Mon Sep 17 00:00:00 2001 From: Prachi01Yadav Date: Wed, 26 Aug 2026 23:57:19 +0530 Subject: [PATCH 01/12] feat: add reusable verify-boilerplate composite action Signed-off-by: Prachi01Yadav --- .github/actions/verify-boilerplate/action.yml | 74 +++++++++++++++++++ 1 file changed, 74 insertions(+) create mode 100644 .github/actions/verify-boilerplate/action.yml diff --git a/.github/actions/verify-boilerplate/action.yml b/.github/actions/verify-boilerplate/action.yml new file mode 100644 index 000000000..4900a3719 --- /dev/null +++ b/.github/actions/verify-boilerplate/action.yml @@ -0,0 +1,74 @@ +# Copyright The Kubeflow Authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +name: Verify Boilerplate Headers +description: > + Verify that every source file carries the required Apache 2.0 copyright + header. Wraps hack/boilerplate/boilerplate.py from kubeflow/testing so + callers never need to vendor the script. + +inputs: + base-ref: + description: > + Base branch for new-file detection. Defaults to the pull-request base + branch (github.base_ref) so only changed/new files are flagged for + year-less header enforcement. + required: false + default: "" + boilerplate-dir: + description: > + Directory containing boilerplate template files (boilerplate.*.txt). + Leave empty to use the templates shipped with kubeflow/testing. + required: false + default: "" + python-version: + description: Python version to use. + required: false + default: "3.12" + +runs: + using: composite + steps: + - name: Set up Python + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + with: + python-version: ${{ inputs.python-version }} + + - name: Checkout kubeflow/testing + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + repository: kubeflow/testing + path: .kubeflow-testing + sparse-checkout: hack/boilerplate + + - name: Run boilerplate check + shell: bash + env: + BASE_REF: ${{ inputs.base-ref || github.base_ref || 'master' }} + BOILERPLATE_DIR: ${{ inputs.boilerplate-dir }} + run: | + ARGS=("--base-ref" "${BASE_REF}") + + if [[ -n "${BOILERPLATE_DIR}" ]]; then + ARGS+=("--boilerplate-dir" "${BOILERPLATE_DIR}") + else + ARGS+=("--boilerplate-dir" ".kubeflow-testing/hack/boilerplate") + fi + + python .kubeflow-testing/hack/boilerplate/boilerplate.py "${ARGS[@]}" + + - name: Cleanup + if: always() + shell: bash + run: rm -rf .kubeflow-testing From 7b656be7cfe92d568d64ca24ab39b0a4d71ef8c2 Mon Sep 17 00:00:00 2001 From: Prachi01Yadav Date: Thu, 27 Aug 2026 00:49:32 +0530 Subject: [PATCH 02/12] fix: use major version tags for actions Signed-off-by: Prachi01Yadav --- .github/actions/verify-boilerplate/action.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/actions/verify-boilerplate/action.yml b/.github/actions/verify-boilerplate/action.yml index 4900a3719..e65be43d1 100644 --- a/.github/actions/verify-boilerplate/action.yml +++ b/.github/actions/verify-boilerplate/action.yml @@ -41,12 +41,12 @@ runs: using: composite steps: - name: Set up Python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + uses: actions/setup-python@v5 with: python-version: ${{ inputs.python-version }} - name: Checkout kubeflow/testing - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + uses: actions/checkout@v4 with: repository: kubeflow/testing path: .kubeflow-testing From 01855dae0997bc13db9202b8b1285b67d84cbaba Mon Sep 17 00:00:00 2001 From: Prachi Yadav Date: Fri, 28 Aug 2026 15:14:32 +0530 Subject: [PATCH 03/12] Update .github/actions/verify-boilerplate/action.yml Co-authored-by: Tariq Hasan Signed-off-by: Prachi Yadav --- .github/actions/verify-boilerplate/action.yml | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/.github/actions/verify-boilerplate/action.yml b/.github/actions/verify-boilerplate/action.yml index e65be43d1..11e20bd00 100644 --- a/.github/actions/verify-boilerplate/action.yml +++ b/.github/actions/verify-boilerplate/action.yml @@ -55,18 +55,16 @@ runs: - name: Run boilerplate check shell: bash env: - BASE_REF: ${{ inputs.base-ref || github.base_ref || 'master' }} + BASE_REF: ${{ inputs.base-ref || github.base_ref || github.event.repository.default_branch || 'master' }} BOILERPLATE_DIR: ${{ inputs.boilerplate-dir }} run: | ARGS=("--base-ref" "${BASE_REF}") if [[ -n "${BOILERPLATE_DIR}" ]]; then ARGS+=("--boilerplate-dir" "${BOILERPLATE_DIR}") - else - ARGS+=("--boilerplate-dir" ".kubeflow-testing/hack/boilerplate") fi - python .kubeflow-testing/hack/boilerplate/boilerplate.py "${ARGS[@]}" + python "${GITHUB_ACTION_PATH}/../../../hack/boilerplate/boilerplate.py" "${ARGS[@]}" - name: Cleanup if: always() From c07e06bfc5a442ab997013f9cf8bbf5bba16c2fc Mon Sep 17 00:00:00 2001 From: Prachi Yadav Date: Fri, 28 Aug 2026 15:15:02 +0530 Subject: [PATCH 04/12] Update .github/actions/verify-boilerplate/action.yml Co-authored-by: Tariq Hasan Signed-off-by: Prachi Yadav --- .github/actions/verify-boilerplate/action.yml | 7 ------- 1 file changed, 7 deletions(-) diff --git a/.github/actions/verify-boilerplate/action.yml b/.github/actions/verify-boilerplate/action.yml index 11e20bd00..5a2f697b9 100644 --- a/.github/actions/verify-boilerplate/action.yml +++ b/.github/actions/verify-boilerplate/action.yml @@ -45,13 +45,6 @@ runs: with: python-version: ${{ inputs.python-version }} - - name: Checkout kubeflow/testing - uses: actions/checkout@v4 - with: - repository: kubeflow/testing - path: .kubeflow-testing - sparse-checkout: hack/boilerplate - - name: Run boilerplate check shell: bash env: From 6d999623d9cebdc00225bb82d79dcdbcf2a21ab9 Mon Sep 17 00:00:00 2001 From: Prachi01Yadav Date: Fri, 28 Aug 2026 15:28:32 +0530 Subject: [PATCH 05/12] refactor: remove cleanup step per review Signed-off-by: Prachi01Yadav --- .github/actions/verify-boilerplate/action.yml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/.github/actions/verify-boilerplate/action.yml b/.github/actions/verify-boilerplate/action.yml index 5a2f697b9..b73e04007 100644 --- a/.github/actions/verify-boilerplate/action.yml +++ b/.github/actions/verify-boilerplate/action.yml @@ -59,7 +59,3 @@ runs: python "${GITHUB_ACTION_PATH}/../../../hack/boilerplate/boilerplate.py" "${ARGS[@]}" - - name: Cleanup - if: always() - shell: bash - run: rm -rf .kubeflow-testing From 385432c0e317ba753fc1a45e6b0f3a506b1baf35 Mon Sep 17 00:00:00 2001 From: Prachi Yadav Date: Mon, 31 Aug 2026 11:26:45 +0530 Subject: [PATCH 06/12] Update .github/actions/verify-boilerplate/action.yml Co-authored-by: Tariq Hasan Signed-off-by: Prachi Yadav --- .github/actions/verify-boilerplate/action.yml | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/.github/actions/verify-boilerplate/action.yml b/.github/actions/verify-boilerplate/action.yml index b73e04007..35c106991 100644 --- a/.github/actions/verify-boilerplate/action.yml +++ b/.github/actions/verify-boilerplate/action.yml @@ -14,9 +14,16 @@ name: Verify Boilerplate Headers description: > - Verify that every source file carries the required Apache 2.0 copyright - header. Wraps hack/boilerplate/boilerplate.py from kubeflow/testing so - callers never need to vendor the script. + Verify Apache 2.0 copyright headers across a repository. Every source file + must match the boilerplate template once the copyright year is normalized + out; files added relative to the base branch must additionally use the + year-less header. Runs hack/boilerplate/boilerplate.py from the checkout of + kubeflow/testing that GitHub creates for this action, so the script version + always matches the reference the action is pinned to and callers never + vendor a copy. + + The caller must check out its own repository before this action runs, using + fetch-depth: 0 so the base branch can be resolved. inputs: base-ref: From 8dbe6c746b8e12ff4e2938033a37ed1d6628c6bf Mon Sep 17 00:00:00 2001 From: Prachi Yadav Date: Mon, 31 Aug 2026 11:27:23 +0530 Subject: [PATCH 07/12] Update .github/actions/verify-boilerplate/action.yml Co-authored-by: Tariq Hasan Signed-off-by: Prachi Yadav --- .github/actions/verify-boilerplate/action.yml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/actions/verify-boilerplate/action.yml b/.github/actions/verify-boilerplate/action.yml index 35c106991..58b96d103 100644 --- a/.github/actions/verify-boilerplate/action.yml +++ b/.github/actions/verify-boilerplate/action.yml @@ -26,11 +26,13 @@ description: > fetch-depth: 0 so the base branch can be resolved. inputs: - base-ref: + base-reference: description: > - Base branch for new-file detection. Defaults to the pull-request base - branch (github.base_ref) so only changed/new files are flagged for - year-less header enforcement. + Base branch used for new-file detection. Defaults to the pull-request + base branch, then to the repository default branch, so the action works + on both pull_request and push events without per-repository + configuration. Note that this governs only the year-less rule for newly + added files; all files are checked for header match regardless. required: false default: "" boilerplate-dir: From d8ff806eec637edc7c287710a3043054d14e3e1d Mon Sep 17 00:00:00 2001 From: Prachi Yadav Date: Mon, 31 Aug 2026 11:27:43 +0530 Subject: [PATCH 08/12] Update .github/actions/verify-boilerplate/action.yml Co-authored-by: Tariq Hasan Signed-off-by: Prachi Yadav --- .github/actions/verify-boilerplate/action.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/actions/verify-boilerplate/action.yml b/.github/actions/verify-boilerplate/action.yml index 58b96d103..ffbf59ced 100644 --- a/.github/actions/verify-boilerplate/action.yml +++ b/.github/actions/verify-boilerplate/action.yml @@ -42,7 +42,7 @@ inputs: required: false default: "" python-version: - description: Python version to use. + description: Python version used to run the checker. required: false default: "3.12" From 3709e11781c47b9fa6d65c852db7f005f26e90e9 Mon Sep 17 00:00:00 2001 From: Prachi Yadav Date: Mon, 31 Aug 2026 11:27:53 +0530 Subject: [PATCH 09/12] Update .github/actions/verify-boilerplate/action.yml Co-authored-by: Tariq Hasan Signed-off-by: Prachi Yadav --- .github/actions/verify-boilerplate/action.yml | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/.github/actions/verify-boilerplate/action.yml b/.github/actions/verify-boilerplate/action.yml index ffbf59ced..1583ef4ac 100644 --- a/.github/actions/verify-boilerplate/action.yml +++ b/.github/actions/verify-boilerplate/action.yml @@ -35,10 +35,17 @@ inputs: added files; all files are checked for header match regardless. required: false default: "" - boilerplate-dir: + boilerplate-directory: description: > - Directory containing boilerplate template files (boilerplate.*.txt). - Leave empty to use the templates shipped with kubeflow/testing. + Directory containing the boilerplate template files (boilerplate.*.txt). + Leave empty to use the templates shipped alongside the script in + kubeflow/testing. + required: false + default: "" + root-directory: + description: > + Directory to scan. Leave empty to use the workspace root. Set this when + the caller checks its repository out into a subdirectory. required: false default: "" python-version: From 0fa10f0ad83cb2e03e2a8fa3c4db166bbffd3704 Mon Sep 17 00:00:00 2001 From: Prachi Yadav Date: Mon, 31 Aug 2026 11:29:00 +0530 Subject: [PATCH 10/12] Update .github/actions/verify-boilerplate/action.yml Co-authored-by: Tariq Hasan Signed-off-by: Prachi Yadav --- .github/actions/verify-boilerplate/action.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/actions/verify-boilerplate/action.yml b/.github/actions/verify-boilerplate/action.yml index 1583ef4ac..7ac47a0f3 100644 --- a/.github/actions/verify-boilerplate/action.yml +++ b/.github/actions/verify-boilerplate/action.yml @@ -57,7 +57,7 @@ runs: using: composite steps: - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: ${{ inputs.python-version }} From 14cebb1d83715e8477bb6e5b594afd1c488e6754 Mon Sep 17 00:00:00 2001 From: Prachi Yadav Date: Mon, 31 Aug 2026 11:29:18 +0530 Subject: [PATCH 11/12] Update .github/actions/verify-boilerplate/action.yml Co-authored-by: Tariq Hasan Signed-off-by: Prachi Yadav --- .github/actions/verify-boilerplate/action.yml | 42 +++++++++++++++++-- 1 file changed, 38 insertions(+), 4 deletions(-) diff --git a/.github/actions/verify-boilerplate/action.yml b/.github/actions/verify-boilerplate/action.yml index 7ac47a0f3..03ecb3821 100644 --- a/.github/actions/verify-boilerplate/action.yml +++ b/.github/actions/verify-boilerplate/action.yml @@ -67,11 +67,45 @@ runs: BASE_REF: ${{ inputs.base-ref || github.base_ref || github.event.repository.default_branch || 'master' }} BOILERPLATE_DIR: ${{ inputs.boilerplate-dir }} run: | - ARGS=("--base-ref" "${BASE_REF}") + set -euo pipefail - if [[ -n "${BOILERPLATE_DIR}" ]]; then - ARGS+=("--boilerplate-dir" "${BOILERPLATE_DIR}") + action_root="$(cd "${GITHUB_ACTION_PATH}/../../.." && pwd)" + script="${action_root}/hack/boilerplate/boilerplate.py" + if [[ ! -f "${script}" ]]; then + echo "::error::boilerplate.py not found at ${script}. The action" \ + "expects to run from a checkout of kubeflow/testing." + exit 1 fi - python "${GITHUB_ACTION_PATH}/../../../hack/boilerplate/boilerplate.py" "${ARGS[@]}" + base_reference="${BASE_REFERENCE#refs/heads/}" + if [[ -z "${base_reference}" ]]; then + echo "::error::No base branch could be determined. Pass the" \ + "base-reference input explicitly." + exit 1 + fi + + root_directory="${ROOT_DIRECTORY:-${GITHUB_WORKSPACE}}" + if ! git -C "${root_directory}" rev-parse --git-dir >/dev/null 2>&1; then + echo "::error::${root_directory} is not a Git checkout. Run" \ + "actions/checkout with fetch-depth: 0 before this action, or" \ + "set the root-directory input." + exit 1 + fi + root_directory="$(cd "${root_directory}" && pwd)" + + if [[ -n "${BOILERPLATE_DIRECTORY}" ]]; then + if [[ ! -d "${BOILERPLATE_DIRECTORY}" ]]; then + echo "::error::boilerplate-directory ${BOILERPLATE_DIRECTORY}" \ + "does not exist." + exit 1 + fi + boilerplate_directory="$(cd "${BOILERPLATE_DIRECTORY}" && pwd)" + else + boilerplate_directory="${action_root}/hack/boilerplate" + fi + + python3 "${script}" \ + --rootdir "${root_directory}" \ + --boilerplate-dir "${boilerplate_directory}" \ + --base-ref "${base_reference}" From b1bf338223a39c2c7c0cf88a1a375292590fada5 Mon Sep 17 00:00:00 2001 From: Prachi Yadav Date: Mon, 31 Aug 2026 11:29:30 +0530 Subject: [PATCH 12/12] Update .github/actions/verify-boilerplate/action.yml Co-authored-by: Tariq Hasan Signed-off-by: Prachi Yadav --- .github/actions/verify-boilerplate/action.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/actions/verify-boilerplate/action.yml b/.github/actions/verify-boilerplate/action.yml index 03ecb3821..0e4b364fd 100644 --- a/.github/actions/verify-boilerplate/action.yml +++ b/.github/actions/verify-boilerplate/action.yml @@ -64,8 +64,12 @@ runs: - name: Run boilerplate check shell: bash env: - BASE_REF: ${{ inputs.base-ref || github.base_ref || github.event.repository.default_branch || 'master' }} - BOILERPLATE_DIR: ${{ inputs.boilerplate-dir }} + BASE_REFERENCE: >- + ${{ inputs.base-reference + || github.event.pull_request.base.ref + || github.event.repository.default_branch }} + BOILERPLATE_DIRECTORY: ${{ inputs.boilerplate-directory }} + ROOT_DIRECTORY: ${{ inputs.root-directory }} run: | set -euo pipefail