Merge remote-tracking branch 'origin/main' into gk/develocityIntegration

* origin/main: (156 commits)
  Upgrade Netris SDK version to 1.1.0 since 24.0 (#14365)
  feature: instance boot group and readiness rules (#13907)
  dont show unathorized notification for prelogin (#14054)
  .github: Upgrade docker/login-action to fix ASF Allowlist failure (#14276)
  virtual router: Add route-maps to BGP peers for Routed Mode (#9964)
  Add pre-commit hook to validate dependabot.yml (#14107)
  Add the ASF Allowlist check workflow (#14113)
  Revert "VMware to KVM: cold (VDDK) and warm (CBT) migration into Ceph/RBD and Linstor, plus importVm adoption of existing RBD root volumes and Linstor root/data volumes (#13656)"
  VMware to KVM: cold (VDDK) and warm (CBT) migration into Ceph/RBD and Linstor, plus importVm adoption of existing RBD root volumes and Linstor root/data volumes (#13656)
  engine-schema: upgrade path for 24.0.0 (#14033)
  xenserver/xcpng: do not bypass secondary storage when copy volumes between pools (#13750)
  backport: Incremental NAS backup support for KVM (#13074) (#13877)
  storage: KVM - enable RBD/Ceph volume encryption support (#13556)
  backup: remove the powered-off precondition for all backup providers (#14094)
  Nas backup: Fix mount/unmount error handling and timeout in LibvirtRestoreBackupCommandWrapper (#14006)
  kvm: apply rbd_default_data_pool when creating volumes from templates on RBD (#13361)
  server: copy template details to vm instance details when import VM (#12793)
  marvin: use pycryptodome instead of PyCrypt (#13594)
  Packaging: accept normalized Marvin archive names (#13793)
  SharedFS: fix NPE when accessing systemvm templates for unsupported hypervisors (#13930)
  ...

Author: ribafish

.asf.yaml

@@ -58,6 +58,7 @@ github:
     - GaOrtiga
     - bhouse-nexthop
     - Dogface2k
+    - prashanthr2
 
   rulesets:
     - name: "Default Branch Protection"
@@ -73,7 +74,7 @@ github:
 
   copilot_code_review:
     enabled: true
-    review_drafts: true
+    review_drafts: false
     review_on_push: true
 
 notifications:

.codespellrc

@@ -17,4 +17,4 @@
 
 [codespell]
 ignore-words = .github/linters/codespell.txt
-skip = systemvm/agent/noVNC/*,ui/package.json,ui/package-lock.json,ui/public/js/less.min.js,ui/public/locales/*.json,server/src/test/java/org/apache/cloudstack/network/ssl/CertServiceTest.java,test/integration/smoke/test_ssl_offloading.py
+skip = systemvm/agent/noVNC/*,ui/package.json,ui/package-lock.json,ui/public/js/less.min.js,ui/public/locales/*.json,server/src/test/java/org/apache/cloudstack/network/ssl/CertServiceTest.java,test/integration/smoke/test_ssl_offloading.py,tools/apidoc-versions-diff/*

.editorconfig

@@ -0,0 +1,26 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+# indent_size = 4
+indent_style = space
+insert_final_newline = true
+# max_line_length = 120
+# tab_width = 4

.github/dependabot.yml

@@ -41,3 +41,14 @@ updates:
       interval: "daily"
     cooldown:
       default-days: 7
+  - package-ecosystem: "pre-commit"
+    directory: "/"
+    open-pull-requests-limit: 2
+    schedule:
+      interval: "weekly"
+    groups:
+      pre-commit-hooks:
+        patterns:
+          - "*"
+    cooldown:
+      default-days: 7

.github/linters/codespell.txt

@@ -184,6 +184,8 @@ environmnet
 equivalant
 erro
 erronous
+errorprone
+everthing
 everytime
 excute
 execept

.github/workflows/asf-allowlist-check.yml

@@ -0,0 +1,34 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+---
+name: "ASF Allowlist Check"
+"on":
+  pull_request:
+    paths: [".github/**"]
+  push:
+    branches: [main]
+    paths: [".github/**"]
+permissions:
+  contents: read
+jobs:
+  asf-allowlist-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: apache/infrastructure-actions/allowlist-check@61dcea11f19e2bbe1263f14d72235e8da17d3ad0  # allowlist-check/v1.0.0

.github/workflows/docker-cloudstack-simulator.yml

@@ -22,8 +22,7 @@ on:
     branches:
       - main
     tags:
-      - 4.*
-      - 5.*
+      - '[0-9]+.[0-9]+.*'
 
 permissions:
   contents: read
@@ -38,7 +37,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Login to Docker Registry
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ${{ secrets.DOCKER_REGISTRY }}
           username: ${{ secrets.DOCKERHUB_USER }}

.github/workflows/rat.yml

@@ -43,7 +43,7 @@ jobs:
         env:
           DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
         run: |
-          mvn -P developer,systemvm -Dsimulator -Dnoredist -pl . org.apache.rat:apache-rat-plugin:0.12:check
+          mvn -P developer,systemvm -Dsimulator -Dnoredist -pl . org.apache.rat:apache-rat-plugin:0.18:check
       - name: Rat Report
         if: always()
         run: |

.github/workflows/sonar-check.yml

@@ -83,12 +83,14 @@ jobs:
             const emojiMap  = { A: '🟢', B: '🟡', C: '🟠', D: '🔴', F: '⛔' };
             const emoji     = emojiMap[grade] ?? '❓';
             const runUrl    = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
+            const marker    = '<!-- coverage-grade-bot -->';
 
             const branchRow = branchPct !== 'N/A'
               ? `| Branch coverage | **${branchPct}%** |`
               : '';
 
             const body = [
+              marker,
               `## ${emoji} Test Coverage Grade: \`${grade}\` — ${label}`,
               '',
               '| Metric | Value |',
@@ -109,10 +111,26 @@ jobs:
               `> [View full Actions run](${runUrl})`,
             ].filter(l => l !== undefined).join('\n');
 
-            await github.rest.issues.createComment({
+            const { data: comments } = await github.rest.issues.listComments({
               owner:        context.repo.owner,
               repo:         context.repo.repo,
               issue_number: context.issue.number,
-              body:         body,
             });
-            console.log('Posted coverage grade comment');
+            const existing = comments.find(c => c.user.login === 'github-actions[bot]' && c.body.includes(marker));
+            if (existing) {
+              await github.rest.issues.updateComment({
+                owner:      context.repo.owner,
+                repo:       context.repo.repo,
+                comment_id: existing.id,
+                body:       body,
+              });
+              console.log('Updated existing coverage grade comment');
+            } else {
+              await github.rest.issues.createComment({
+                owner:        context.repo.owner,
+                repo:         context.repo.repo,
+                issue_number: context.issue.number,
+                body:         body,
+              });
+              console.log('Posted coverage grade comment');
+            }

.pre-commit-config.yaml

@@ -26,26 +26,37 @@ repos:
       - id: identity
       - id: check-hooks-apply
   - repo: https://github.com/thlorenz/doctoc.git
-    rev: v2.3.0
+    rev: 59dcae910a6ad4bbe8711275b854e3cd5c30f08b  # frozen: v2.5.0
     hooks:
       - id: doctoc
         name: Add TOC for Markdown files
         files: ^CONTRIBUTING\.md$|^INSTALL\.md$|^README\.md$
+  - repo: local
+    hooks:
+      - id: check-zip-file-is-not-committed
+        name: check no zip files are committed
+        description: Zip files are not allowed in the repository
+        language: fail
+        entry: |
+          Zip files are not allowed in the repository as they are hard to
+          track and have security implications. Please remove the zip file from the repository.
+        files: (?i)\.zip$
+        exclude: ^core/src/test/resources/vhds/test\.vhd\.zip$
   - repo: https://github.com/oxipng/oxipng
-    rev: v10.1.0
+    rev: 340cd9878d8d8289f09fa101b48a8f5f0b7783f4 # frozen: v10.2.0
     hooks:
       - id: oxipng
         name: run oxipng
         description: optimize PNG images with lossless compression
         args: ['-o', '4', '--strip', 'safe', '--alpha']
   - repo: https://github.com/gitleaks/gitleaks
-    rev: v8.30.0
+    rev: 83d9cd684c87d95d656c1458ef04895a7f1cbd8e  # frozen: v8.30.1
     hooks:
       - id: gitleaks
         name: run gitleaks
         description: detect hardcoded secrets
   - repo: https://github.com/Lucas-C/pre-commit-hooks
-    rev: v1.5.6
+    rev: ad1b27d73581aa16cca06fc4a0761fc563ffe8e8 # frozen: v1.5.6
     hooks:
       - id: chmod
         name: set file permissions
@@ -62,6 +73,16 @@ repos:
           - --license-filepath
           - .github/workflows/license-templates/LICENSE.txt
           - --fuzzy-match-generates-todo
+      - id: insert-license
+        name: add license for all conf files
+        description: automatically adds a license header to all conf files that don't have a license header
+        files: \.conf$
+        args:
+          - --comment-style
+          - '|#|'
+          - --license-filepath
+          - .github/workflows/license-templates/LICENSE.txt
+          - --fuzzy-match-generates-todo
       - id: insert-license
         name: add license for all Markdown files
         files: \.md$
@@ -122,7 +143,7 @@ repos:
           - --fuzzy-match-generates-todo
         exclude: ^\.github/workflows/.*\.lock\.yml$
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v6.0.0
+    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # frozen: v6.0.0
     hooks:
       #- id: check-added-large-files
       - id: check-case-conflict
@@ -166,18 +187,18 @@ repos:
         args: [--markdown-linebreak-ext=md]
         exclude: ^services/console-proxy/rdpconsole/src/test/doc/freerdp-debug-log\.txt$
   - repo: https://github.com/codespell-project/codespell
-    rev: v2.4.2
+    rev: 57b21406f092110c18776e39b0bda50d37c945c8 # frozen: v2.4.3
     hooks:
       - id: codespell
         name: run codespell
         description: Check spelling with codespell
   - repo: https://github.com/pycqa/flake8
-    rev: 7.3.0
+    rev: c48217e1fc006c2dddd14df54e83b67da15de5cd  # frozen: 7.3.0
     hooks:
-    - id: flake8
-      args: [--config, .github/linters/.flake8]
+      - id: flake8
+        args: [--config, .github/linters/.flake8]
   - repo: https://github.com/igorshubovych/markdownlint-cli
-    rev: v0.48.0
+    rev: 5b5dddc4fb0f83c3ea1fc5616fa63e115dce83e0 # frozen: v0.49.1
     hooks:
       - id: markdownlint
         name: run markdownlint
@@ -186,7 +207,7 @@ repos:
         types: [markdown]
         files: \.md$
   - repo: https://github.com/adrienverge/yamllint
-    rev: v1.38.0
+    rev: cba56bcde1fdd01c1deb3f945e69764c291a6530 # frozen: v1.38.0
     hooks:
       - id: yamllint
         name: run yamllint
@@ -195,3 +216,10 @@ repos:
         types: [yaml]
         files: \.ya?ml$
         exclude: ^.*k8s-.*\.ya?ml$|^.github/workflows/.*\.lock\.ya?ml$
+  - repo: https://github.com/python-jsonschema/check-jsonschema
+    rev: 12e63946db2c5cfcc9030fac21c3883ba88c6ed8 # frozen: 0.38.0
+    hooks:
+      - id: check-dependabot
+        name: validate dependabot config
+        description: ensures the dependabot config file is valid
+        files: ^\.github/dependabot\.ya?ml$