Merge remote-tracking branch 'origin/730-feat-leapfrogai-api-registry…

…1-flavor' into 835-upgrade-vllm-for-gptq-bfloat16-inferencing

.github/actions/lfai-core/action.yaml

@@ -22,7 +22,7 @@ runs:
     - name: Deploy LFAI-API
       shell: bash
       run: |
-        make build-api LOCAL_VERSION=e2e-test
+        make build-api LOCAL_VERSION=e2e-test FLAVOR=upstream
         docker image prune -af
         uds zarf package deploy packages/api/zarf-package-leapfrogai-api-amd64-e2e-test.tar.zst --confirm
         rm packages/api/zarf-package-leapfrogai-api-amd64-e2e-test.tar.zst

.github/actions/uds-cluster/action.yaml

@@ -6,15 +6,18 @@ inputs:
     description: Registry1 Username
   registry1Password:
     description: Registry1 Password
+  ghToken:
+    description: GitHub Token
 
 runs:
   using: composite
   steps:
     - name: Setup UDS Environment
       uses: defenseunicorns/uds-common/.github/actions/setup@822dac4452e6815aadcf09f487406ff258756a0c # v0.14.0
       with:
-        username: ${{ inputs.registry1Username }}
-        password: ${{ inputs.registry1Password }}
+        registry1Username: ${{ inputs.registry1Username }}
+        registry1Password: ${{ inputs.registry1Password }}
+        ghToken: ${{ inputs.ghToken }}
         udsCliVersion: 0.14.0
 
     - name: Checkout Repo
@@ -23,4 +26,4 @@ runs:
     - name: Create UDS Cluster
       shell: bash
       run: |
-        UDS_CONFIG=.github/config/uds-config.yaml make create-uds-cpu-cluster
+        UDS_CONFIG=.github/config/uds-config.yaml make create-uds-cpu-cluster

.github/workflows/e2e-llama-cpp-python.yaml

@@ -68,6 +68,7 @@ jobs:
           with:
             registry1Username: ${{ secrets.IRON_BANK_ROBOT_USERNAME }}
             registry1Password: ${{ secrets.IRON_BANK_ROBOT_PASSWORD }}
+            ghToken: ${{ secrets.GITHUB_TOKEN }}
 
         - name: Setup LFAI-API and Supabase
           uses: ./.github/actions/lfai-core

.github/workflows/e2e-playwright.yaml

@@ -81,6 +81,7 @@ jobs:
           with:
             registry1Username: ${{ secrets.IRON_BANK_ROBOT_USERNAME }}
             registry1Password: ${{ secrets.IRON_BANK_ROBOT_PASSWORD }}
+            ghToken: ${{ secrets.GITHUB_TOKEN }}
 
         - name: Create Test User
           run: |

.github/workflows/e2e-registry1-weekly.yaml

@@ -0,0 +1,125 @@
+name: e2e-registry1-weekly
+
+on:
+  schedule:
+    - cron: "0 0 * * 6" # Run every Sunday at 12 AM EST
+  workflow_dispatch: # trigger manually as needed
+  pull_request:
+    types:
+      - opened # default trigger
+      - reopened # default trigger
+      - synchronize # default trigger
+      - ready_for_review # don't run on draft PRs
+      - milestoned # allows us to trigger on bot PRs
+    paths:
+      - .github/workflows/e2e-registry1-weekly.yaml
+      - uds-bundles/latest/**
+
+concurrency:
+  group: e2e-registry1-weekly-${{ github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  test-flavors:
+    runs-on: ai-ubuntu-big-boy-8-core
+    name: e2e_registry1_weekly
+
+    permissions:
+      contents: read
+      packages: write
+      id-token: write # This is needed for OIDC federation.
+
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+
+      - name: Setup Python
+        uses: ./.github/actions/python
+
+      - name: Setup UDS Cluster
+        uses: ./.github/actions/uds-cluster
+        with:
+          registry1Username: ${{ secrets.IRON_BANK_ROBOT_USERNAME }}
+          registry1Password: ${{ secrets.IRON_BANK_ROBOT_PASSWORD }}
+          ghToken: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Setup Playwright
+        run: |
+          npm --prefix src/leapfrogai_ui ci
+          npx --prefix src/leapfrogai_ui playwright install
+
+      - name: Create Registry1 Packages
+        run: |
+          LOCAL_VERSION=registry1 FLAVOR=registry1 make build-api
+
+      # Mutate UDS bundle definition to use Registry1 packages
+      - name: Mutation to Registry1 Bundle
+        run: |
+          uds zarf tools yq -i '.packages[1] |= del(.repository)' uds-bundles/latest/cpu/uds-bundle.yaml
+          uds zarf tools yq -i '.packages[1] |= .ref = "registry1"' uds-bundles/latest/cpu/uds-bundle.yaml
+          uds zarf tools yq -i '.packages[1] |= .path = "../../../packages/api"' uds-bundles/latest/cpu/uds-bundle.yaml
+          uds zarf tools yq -i '.metadata.version = "registry1"' uds-bundles/latest/cpu/uds-bundle.yaml
+
+      - name: Create and Deploy Bundle
+        run: |
+          cd uds-bundles/latest/cpu
+          uds create . --confirm && \
+            uds deploy uds-bundle-leapfrogai-amd64-registry1.tar.zst \
+              --set LEAPFROGAI_API_BASE_URL="http://leapfrogai-api.leapfrogai.svc.cluster.local:8080" --confirm --no-progress && \
+            rm -rf uds-bundle-leapfrogai-amd64-registry1.tar.zst && \
+            docker system prune -af
+
+      - name: Generate Secrets
+        id: generate_secrets
+        run: |
+          PASSWORD=$(cat <(openssl rand -base64 32 | tr -dc 'a-zA-Z0-9!@#$%^&*()_+-=[]{}|;:,.<>?' | head -c 20) <(echo '!@1Aa') | fold -w1 | shuf | tr -d '\n')
+          echo "::add-mask::$PASSWORD"
+          echo "FAKE_E2E_USER_PASSWORD=$PASSWORD" >> $GITHUB_OUTPUT
+          ANON_KEY=$(uds zarf tools kubectl get secret supabase-bootstrap-jwt -n leapfrogai -o jsonpath='{.data.anon-key}' | base64 -d)
+          echo "::add-mask::$ANON_KEY"
+          echo "ANON_KEY=$ANON_KEY" >> $GITHUB_OUTPUT
+          SERVICE_ROLE_KEY=$(uds zarf tools kubectl get secret -n leapfrogai supabase-bootstrap-jwt -o jsonpath={.data.service-key} | base64 -d)
+          echo "::add-mask::$SERVICE_ROLE_KEY"
+          echo "SERVICE_ROLE_KEY=$SERVICE_ROLE_KEY" >> $GITHUB_OUTPUT
+
+      - name: Verify Secrets
+        run: |
+          echo "FAKE_E2E_USER_PASSWORD is set: ${{ steps.generate_secrets.outputs.FAKE_E2E_USER_PASSWORD != '' }}"
+          echo "ANON_KEY is set: ${{ steps.generate_secrets.outputs.ANON_KEY != '' }}"
+          echo "SERVICE_ROLE_KEY is set: ${{ steps.generate_secrets.outputs.SERVICE_ROLE_KEY != '' }}"
+
+      # Backends
+      - name: Run Backend Tests
+        run: |
+          python -m pytest ./tests/e2e/test_llama.py -v
+          python -m pytest ./tests/e2e/test_text_embeddings.py -v
+          python -m pytest ./tests/e2e/test_whisper.py -v
+          python -m pytest ./tests/e2e/test_supabase.py -v
+          python -m pytest ./tests/e2e/test_api.py -v
+
+      - name: Run Playwright E2E Tests
+        env:
+          SERVICE_ROLE_KEY: ${{ steps.generate_secrets.outputs.SERVICE_ROLE_KEY }}
+          FAKE_E2E_USER_PASSWORD: ${{ steps.generate_secrets.outputs.FAKE_E2E_USER_PASSWORD }}
+          ANON_KEY: ${{ steps.generate_secrets.outputs.ANON_KEY }}
+        run: |
+          chmod +x ./.github/scripts/createUser.sh
+          ./.github/scripts/createUser.sh
+
+          cp src/leapfrogai_ui/.env.example src/leapfrogai_ui/.env
+          mkdir -p playwright/auth
+          touch playwright/auth.user.json
+
+          SERVICE_ROLE_KEY=$SERVICE_ROLE_KEY TEST_ENV=CI USERNAME=doug PASSWORD=$FAKE_E2E_USER_PASSWORD PUBLIC_SUPABASE_ANON_KEY=$ANON_KEY npm --prefix src/leapfrogai_ui run test:integration:ci
+
+      - name: Archive Playwright Report
+        uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
+        if: ${{ !cancelled() }}
+        with:
+          name: playwright-report
+          path: src/leapfrogai_ui/e2e-report/
+          retention-days: 30

.github/workflows/e2e-text-embeddings.yaml

@@ -70,6 +70,7 @@ jobs:
           with:
             registry1Username: ${{ secrets.IRON_BANK_ROBOT_USERNAME }}
             registry1Password: ${{ secrets.IRON_BANK_ROBOT_PASSWORD }}
+            ghToken: ${{ secrets.GITHUB_TOKEN }}
 
         - name: Setup LFAI-API and Supabase
           uses: ./.github/actions/lfai-core

.github/workflows/e2e-vllm.yaml

@@ -68,10 +68,12 @@ jobs:
             additionalOptionalDep: dev-vllm
 
         - name: Setup UDS Environment
-          uses: defenseunicorns/uds-common/.github/actions/setup@05f42bb3117b66ebef8c72ae050b34bce19385f5
+          uses: defenseunicorns/uds-common/.github/actions/setup@822dac4452e6815aadcf09f487406ff258756a0c # v0.14.0
           with:
-            username: ${{ secrets.IRON_BANK_ROBOT_USERNAME }}
-            password: ${{ secrets.IRON_BANK_ROBOT_PASSWORD }}
+            registry1Username: ${{ secrets.IRON_BANK_ROBOT_USERNAME }}
+            registry1Password: ${{ secrets.IRON_BANK_ROBOT_PASSWORD }}
+            ghToken: ${{ secrets.GITHUB_TOKEN }}
+            udsCliVersion: 0.14.0
 
         ########## c
         # vLLM

.github/workflows/e2e-whisper.yaml

@@ -70,6 +70,7 @@ jobs:
           with:
             registry1Username: ${{ secrets.IRON_BANK_ROBOT_USERNAME }}
             registry1Password: ${{ secrets.IRON_BANK_ROBOT_PASSWORD }}
+            ghToken: ${{ secrets.GITHUB_TOKEN }}
 
         - name: Setup LFAI-API and Supabase
           uses: ./.github/actions/lfai-core

Makefile

@@ -4,6 +4,7 @@ REG_NAME ?= registry
 LOCAL_VERSION ?= $(shell git rev-parse --short HEAD)
 DOCKER_FLAGS :=
 ZARF_FLAGS :=
+FLAVOR := upstream
 SILENT_DOCKER_FLAGS := --quiet
 SILENT_ZARF_FLAGS := --no-progress -l warn --no-color
 MAX_JOBS := 4
@@ -64,21 +65,24 @@ build-supabase: local-registry docker-supabase
 docker-api: local-registry sdk-wheel
 	@echo $(DOCKER_FLAGS)
 	@echo $(ZARF_FLAGS)
+ifeq ($(FLAVOR),upstream)
 	## Build the API image (and tag it for the local registry)
 	docker build ${DOCKER_FLAGS} --platform=linux/${ARCH} --build-arg LOCAL_VERSION=${LOCAL_VERSION} -t ghcr.io/defenseunicorns/leapfrogai/leapfrogai-api:${LOCAL_VERSION} -f packages/api/Dockerfile .
 	docker tag ghcr.io/defenseunicorns/leapfrogai/leapfrogai-api:${LOCAL_VERSION} localhost:${REG_PORT}/defenseunicorns/leapfrogai/leapfrogai-api:${LOCAL_VERSION}
-
+endif
 	## Build the migration container for this version of the API
 	docker build ${DOCKER_FLAGS} --platform=linux/${ARCH} -t ghcr.io/defenseunicorns/leapfrogai/api-migrations:${LOCAL_VERSION} -f Dockerfile.migrations --build-arg="MIGRATIONS_DIR=packages/api/supabase/migrations" .
 	docker tag ghcr.io/defenseunicorns/leapfrogai/api-migrations:${LOCAL_VERSION} localhost:${REG_PORT}/defenseunicorns/leapfrogai/api-migrations:${LOCAL_VERSION}
 
 build-api: local-registry docker-api ## Build the leapfrogai_api container and Zarf package
+ifeq ($(FLAVOR),upstream)
 	## Push the images to the local registry (Zarf is super slow if the image is only in the local daemon)
 	docker push ${DOCKER_FLAGS} localhost:${REG_PORT}/defenseunicorns/leapfrogai/leapfrogai-api:${LOCAL_VERSION}
+endif
 	docker push ${DOCKER_FLAGS} localhost:${REG_PORT}/defenseunicorns/leapfrogai/api-migrations:${LOCAL_VERSION}
 
 	## Build the Zarf package
-	uds zarf package create packages/api -a ${ARCH} -o packages/api --registry-override=ghcr.io=localhost:${REG_PORT} --insecure --set LEAPFROGAI_IMAGE_VERSION=${LOCAL_VERSION} ${ZARF_FLAGS} --confirm
+	uds zarf package create packages/api --flavor ${FLAVOR} -a ${ARCH} -o packages/api --registry-override=ghcr.io=localhost:${REG_PORT} --insecure --set IMAGE_VERSION=${LOCAL_VERSION} ${ZARF_FLAGS} --confirm
 
 docker-ui:
 	## Build the UI image (and tag it for the local registry)

README.md

@@ -115,6 +115,30 @@ LeapfrogAI provides several backends for a variety of use cases. Below is the ba
 
 The [repeater](packages/repeater/) "model" is a basic "backend" that parrots all inputs it receives back to the user. It is built out the same way all the actual backends are and it is primarily used for testing the API.
 
+### Flavors
+
+Each component has different images and values that refer to a specific image registry and/or hardening source. These images are packaged using [Zarf Flavors](https://docs.zarf.dev/ref/examples/package-flavors/):
+
+1. `upstream`: uses upstream vendor images from open source container registries and repositories
+2. 🚧 `registry1`: uses [IronBank hardened images](https://repo1.dso.mil/dsop) from the Repo1 harbor registry
+3. 🚧 `unicorn`: uses [Chainguard hardened images](https://www.chainguard.dev/chainguard-images) from the Chainguard registry
+
+Below is the current component flavors list:
+
+| Component                                      |  `upstream`  |  `registry1`  |  `chainguard`  |
+| ---------------------------------------------- | ------------ | ------------- | -------------- |
+| [api](packages/api/)                           |      ✅      |      ✅      |      🚧       |
+| [ui](packages/ui/)                             |      ✅      |      🚧      |      🚧       |
+| [supabase](packages/supabase/)                 |      ✅      |      🚧      |      🚧       |
+| [migrations](./Dockerfile.migrations)          |      ✅      |      🚧      |      🚧       |
+| [llama-cpp-python](packages/llama-cpp-python/) |      ✅      |      🚧      |      🚧       |
+| [whisper](packages/whisper/)                   |      ✅      |      🚧      |      🚧       |
+| [text-embeddings](packages/text-embeddings/)   |      ✅      |      🚧      |      🚧       |
+| [vllm](packages/vllm/)                         |      ✅      |      🚧      |      🚧       |
+| [vllm](packages/vllm/)                         |      ✅      |      🚧      |      🚧       |
+
+Flavors with any components labelled as 🚧 are not available as a quick start bundle deployment yet. Please refer to the [DEVELOPMENT.md](./docs/DEVELOPMENT.md) for instructions on how to build a component's Zarf package for local testing.
+
 ## Usage
 
 To build a LeapfrogAI UDS bundle and deploy it, please refer to the [LeapfrogAI Documentation Website](https://docs.leapfrog.ai/docs/). In the documentation website, you'll find system requirements and instructions for all things LeapfrogAI that aren't associated to local development and contributing.

docs/DEVELOPMENT.md

@@ -70,7 +70,7 @@ For example, the LeapfrogAI API requires a `config.yaml` be supplied when spun u
 
 ## Package Development
 
-If you don't want to [build an entire bundle](#bundle-development), or you want to "dev-loop" on a single package in an existing [UDS Kubernetes cluster](../packages/k3d-gpu/README.md) you can do so by performing the following.
+If you don't want to [build an entire bundle](#bundle-development), or you want to "dev-loop" on a single package in an existing [UDS Kubernetes cluster](../packages/k3d-gpu/README.md) you can do so by following the instructions below.
 
 For example, this is how you build and (re)deploy a local DEV version of a package:
 
@@ -80,8 +80,9 @@ uds zarf package remove leapfrogai-api --confirm
 uds zarf tools registry prune --confirm
 
 # create and deploy the new package
-LOCAL_VERSION=dev REGISTRY_PORT=5000 ARCH=amd64 make build-api
-LOCAL_VERSION=dev REGISTRY_PORT=5000 ARCH=amd64 make deploy-api
+# FLAVOR can be registry1, upstream, or unicorn - see README for availability details
+LOCAL_VERSION=dev FLAVOR=upstream REGISTRY_PORT=5000 ARCH=amd64 make build-api
+LOCAL_VERSION=dev FLAVOR=upstream REGISTRY_PORT=5000 ARCH=amd64 make deploy-api
 ```
 
 For example, this is how you pull and deploy a LATEST version of a package:
@@ -103,25 +104,25 @@ uds zarf package deploy zarf-package-*.tar.zst --confirm
 2. Build all of the packages you need at once with **ONE** of the following Make targets:
 
     ```bash
-    LOCAL_VERSION=dev ARCH=amd64 make build-cpu    # ui, api, llama-cpp-python, text-embeddings, whisper, supabase
+    LOCAL_VERSION=dev FLAVOR=upstream ARCH=amd64 make build-cpu    # ui, api, llama-cpp-python, text-embeddings, whisper, supabase
     # OR
-    LOCAL_VERSION=dev ARCH=amd64 make build-gpu    # ui, api, vllm, text-embeddings, whisper, supabase
+    LOCAL_VERSION=dev FLAVOR=upstream ARCH=amd64 make build-gpu    # ui, api, vllm, text-embeddings, whisper, supabase
     # OR
-    LOCAL_VERSION=dev ARCH=amd64 make build-all    # all of the components
+    LOCAL_VERSION=dev FLAVOR=upstream ARCH=amd64 make build-all    # all of the components
     ```
 
     **OR**
 
     You can build components individually using the following Make targets:
 
     ```bash
-    LOCAL_VERSION=dev ARCH=amd64 make build-ui
-    LOCAL_VERSION=dev ARCH=amd64 make build-api
-    LOCAL_VERSION=dev ARCH=amd64 make build-supabase
-    LOCAL_VERSION=dev ARCH=amd64 make build-vllm                 # if you have NVIDIA GPUs (AMR64 not supported)
-    LOCAL_VERSION=dev ARCH=amd64 make build-llama-cpp-python     # if you have CPU only
-    LOCAL_VERSION=dev ARCH=amd64 make build-text-embeddings
-    LOCAL_VERSION=dev ARCH=amd64 make build-whisper
+    LOCAL_VERSION=dev FLAVOR=upstream ARCH=amd64 make build-ui
+    LOCAL_VERSION=dev FLAVOR=upstream ARCH=amd64 make build-api
+    LOCAL_VERSION=dev FLAVOR=upstream ARCH=amd64 make build-supabase
+    LOCAL_VERSION=dev FLAVOR=upstream ARCH=amd64 make build-vllm                 # if you have NVIDIA GPUs (AMR64 not supported)
+    LOCAL_VERSION=dev FLAVOR=upstream ARCH=amd64 make build-llama-cpp-python     # if you have CPU only
+    LOCAL_VERSION=dev FLAVOR=upstream ARCH=amd64 make build-text-embeddings
+    LOCAL_VERSION=dev FLAVOR=upstream ARCH=amd64 make build-whisper
     ```
 
 3. Create the UDS bundle, modifying the `uds-config.yaml` as required:
@@ -149,13 +150,13 @@ To run the same commands in MacOS, you will need to prepend your command with a
 To demonstrate what this would look like for an Apple Silicon Mac:
 
 ``` shell
-REG_PORT=5001 ARCH=arm64 LOCAL_VERSION=dev make build-cpu
+REG_PORT=5001 ARCH=arm64 LOCAL_VERSION=dev FLAVOR=upstream make build-cpu
 ```
 
 To demonstrate what this would look like for an older Intel Mac:
 
 ``` shell
-REG_PORT=5001 ARCH=arm64 LOCAL_VERSION=dev make build-cpu
+REG_PORT=5001 ARCH=arm64 LOCAL_VERSION=dev FLAVOR=upstream make build-cpu
 ```
 
 ## Access

packages/api/Dockerfile

@@ -2,8 +2,11 @@ ARG LOCAL_VERSION
 FROM ghcr.io/defenseunicorns/leapfrogai/leapfrogai-sdk:${LOCAL_VERSION} AS sdk
 
 FROM ghcr.io/defenseunicorns/leapfrogai/python:3.11-dev AS builder
+
 ARG SDK_DEST=src/leapfrogai_sdk/build
+
 USER root
+
 WORKDIR /leapfrogai
 
 # copy the api dependencies over
@@ -13,9 +16,9 @@ COPY src/leapfrogai_api src/leapfrogai_api
 RUN python -m venv .venv
 ENV PATH="/leapfrogai/.venv/bin:$PATH"
 
-RUN rm -f packages/api/build/*.whl
-RUN python -m pip wheel src/leapfrogai_api -w packages/api/build --find-links=${SDK_DEST}
-RUN pip install packages/api/build/leapfrogai_api*.whl --no-index --find-links=packages/api/build/
+RUN rm -f packages/api/build/*.whl && \
+    python -m pip wheel src/leapfrogai_api -w packages/api/build --find-links=${SDK_DEST} && \
+    pip install packages/api/build/leapfrogai_api*.whl --no-index --find-links=packages/api/build/
 
 FROM ghcr.io/defenseunicorns/leapfrogai/python:3.11
 ENV PATH="/leapfrogai/.venv/bin:$PATH"

packages/api/README.md

@@ -23,7 +23,7 @@ To build and deploy the API Zarf package into an existing [UDS Kubernetes cluste
 > Execute the following commands from the root of the LeapfrogAI repository
 
 ```bash
-make build-api LOCAL_VERSION=dev
+make build-api LOCAL_VERSION=dev FLAVOR=upstream
 uds zarf package deploy packages/api/zarf-package-leapfrogai-api-*-dev.tar.zst --confirm
 ```