[Snyk] Fix for 22 vulnerabilities

.cloudbuild.yaml

@@ -170,10 +170,10 @@ steps:
   args: ['pull', 'gcr.io/cloudsql-docker/gce-proxy:1.25.0']
   id:   'pullCloudsqlProxy'
 - name: 'gcr.io/cloud-builders/docker'
-  args: ['pull', 'gcr.io/ml-pipeline/argoexec:v3.4.16-license-compliance']
+  args: ['pull', 'gcr.io/ml-pipeline/argoexec:v3.4.17-license-compliance']
   id:   'pullArgoExecutor'
 - name: 'gcr.io/cloud-builders/docker'
-  args: ['pull', 'gcr.io/ml-pipeline/workflow-controller:v3.4.16-license-compliance']
+  args: ['pull', 'gcr.io/ml-pipeline/workflow-controller:v3.4.17-license-compliance']
   id:   'pullArgoWorkflowController'
 
 # V2 related images

.github/OWNERS

@@ -0,0 +1,5 @@
+approvers:
+  - hbelmiro
+  - DharmitD
+reviewers:
+  - rimolive

.github/actions/kfp-cluster/action.yml

@@ -0,0 +1,21 @@
+name: "Set up KFP on KinD"
+description: "Step to start and configure KFP on KinD"
+
+runs:
+  using: "composite"
+  steps:
+    - name: Create k8s Kind Cluster
+      uses: container-tools/kind-action@v2
+      with:
+        cluster_name: kfp
+        kubectl_version: v1.29.2
+        version: v0.22.0
+        node_image: kindest/node:v1.29.2
+
+    - name: Build images
+      shell: bash
+      run: ./scripts/deploy/github/build-images.sh
+
+    - name: Deploy KFP
+      shell: bash
+      run: ./scripts/deploy/github/deploy-kfp.sh

.github/actions/kfp-tekton-cluster/action.yml

@@ -0,0 +1,21 @@
+name: "Set up KFP Tekton on KinD"
+description: "Step to start and configure KFP on KinD"
+
+runs:
+  using: "composite"
+  steps:
+    - name: Create k8s Kind Cluster
+      uses: container-tools/kind-action@v2
+      with:
+        cluster_name: kfp
+        kubectl_version: v1.29.2
+        version: v0.22.0
+        node_image: kindest/node:v1.29.2
+
+    - name: Build images
+      shell: bash
+      run: ./scripts/deploy/github/build-images.sh
+
+    - name: Deploy KFP
+      shell: bash
+      run: ./scripts/deploy/github/deploy-kfp-tekton.sh

.github/pull_request_template.md

@@ -2,6 +2,7 @@
 
 
 **Checklist:**
+- [ ] You have [signed off your commits](https://www.kubeflow.org/docs/about/contributing/#sign-off-your-commits)
 - [ ] The title for your pull request (PR) should follow our title convention. [Learn more about the pull request title convention used in this repository](https://github.com/kubeflow/pipelines/blob/master/CONTRIBUTING.md#pull-request-title-convention). 
 <!--
    PR titles examples:

.github/workflows/add-ci-passed-label.yml

@@ -0,0 +1,84 @@
+# This workflow adds the 'ci-passed' label to a pull request once the 'CI Check' workflow completes successfully.
+# Resets the 'ci-passed' label status when a pull request is synchronized or reopened, 
+# indicating that changes have been pushed and CI needs to rerun.
+name: Add CI Passed Label
+
+on:
+  workflow_run:
+    workflows: ["CI Check"]
+    types:
+      - completed
+
+permissions:
+  pull-requests: write
+  checks: read
+  actions: read
+
+jobs:
+  fetch_data:
+    name: Fetch workflow payload
+    runs-on: ubuntu-latest
+    if: >
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'success'
+    outputs:
+      pr_number: ${{ steps.extract.outputs.pr_number }}
+      event_action: ${{ steps.extract.outputs.event_action }}
+    steps:
+      - name: 'Download artifact'
+        uses: actions/github-script@v3.1.0        
+        with:
+          script: |
+            var artifacts = await github.actions.listWorkflowRunArtifacts({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              run_id: ${{github.event.workflow_run.id}},
+            });
+            var matchArtifact = artifacts.data.artifacts.filter((artifact) => {
+              return artifact.name == "pr"
+            })[0];
+            var download = await github.actions.downloadArtifact({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              artifact_id: matchArtifact.id,
+              archive_format: 'zip',
+            });
+            var fs = require('fs');
+            fs.writeFileSync('${{github.workspace}}/pr.zip', Buffer.from(download.data));
+
+      - name: Unzip artifact
+        run: unzip pr.zip
+
+      - name: Extract PR information
+        id: extract
+        run: |
+          pr_number=$(cat ./pr_number)
+          event_action=$(cat ./event_action)
+          echo "pr_number=${pr_number}" >> $GITHUB_OUTPUT
+          echo "event_action=${event_action}" >> $GITHUB_OUTPUT
+
+  add_ci_passed_label:
+    name: Add 'ci-passed' label
+    runs-on: ubuntu-latest    
+    needs: fetch_data
+    steps:
+      - name: Add 'ci-passed' label
+        run: |
+          echo "Adding 'ci-passed' label to PR #${{ needs.fetch_data.outputs.pr_number }}"
+          gh pr edit ${{ needs.fetch_data.outputs.pr_number }} --add-label "ci-passed" --repo $GITHUB_REPOSITORY
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  reset_ci_passed_label:
+    name: Reset 'ci-passed' label on PR Synchronization
+    runs-on: ubuntu-latest
+    needs: fetch_data
+    steps:
+      - name: Check and reset label
+        run: |
+          if [[ "${{ needs.fetch_data.outputs.event_action }}" == "synchronize" || "${{ needs.fetch_data.outputs.event_action }}" == "reopened" ]]; then
+            echo "Resetting 'ci-passed' label as changes were pushed (event: ${{ needs.fetch_data.outputs.event_action }})."
+            gh pr edit ${{ needs.fetch_data.outputs.pr_number }} --remove-label "ci-passed" --repo $GITHUB_REPOSITORY || echo "Label not present"
+          fi
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/backend-visualization.yml

@@ -0,0 +1,26 @@
+name: KFP backend visualization tests
+
+on:
+  push:
+    branches: [ master ]
+
+  pull_request:
+    paths:
+      - '.github/workflows/backend-visualization.yml'
+      - 'backend/src/apiserver/visualization/**'
+      - 'test/presubmit-backend-visualization.sh'
+
+jobs:
+  backend-visualization-test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.9'
+
+      - name: Run tests
+        run: ./test/presubmit-backend-visualization.sh

.github/workflows/backend.yml

@@ -7,6 +7,7 @@ on:
   # Run tests for any PRs which change the backend code
   pull_request:
     paths:
+      - '.github/workflows/backend.yml'
       - 'go.mod'
       - 'backend/**'
       - 'scripts/deploy/github/**'
@@ -23,7 +24,7 @@ jobs:
     - name: Install Go
       uses: actions/setup-go@v4
       with:
-        go-version: 1.20.x
+        go-version: 1.21.x
     - name: Checkout code
       uses: actions/checkout@v4
     - name: "run go unit tests"
@@ -33,26 +34,17 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
-      - name: Create k8s Kind Cluster
-        uses: container-tools/kind-action@v2
-        with:
-          cluster_name: kfp-tekton
-          kubectl_version: v1.29.2
-          version: v0.22.0
-          node_image: kindest/node:v1.29.2
-      - name: build images
-        run: ./scripts/deploy/github/build-images.sh
-      - name: Set up Python 3.10
+      - name: Set up Python 3.9
         uses: actions/setup-python@v4
         with:
-          python-version: '3.10'
-      - name: "deploy kfp-tekton"
-        run: ./scripts/deploy/github/deploy-kfp.sh
+          python-version: '3.9'
       - name: Install sdk
         run: |
           python3 -m venv .venv
           . .venv/bin/activate
           pip install -e sdk/python
+      - name: Create KFP cluster
+        uses: ./.github/actions/kfp-tekton-cluster
       - name: "flip coin test"
         run: |
           . .venv/bin/activate

.github/workflows/ci-checks.yml

@@ -0,0 +1,32 @@
+# This workflow checks if all CI checks have passed by polling every 5 minutes for a total of 7 attempts.
+name: CI Check
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  check_ci_status:
+    runs-on: ubuntu-latest
+    permissions:
+      checks: read  
+      pull-requests: write        
+    steps:    
+      - name: Check if all CI checks passed
+        uses: wechuli/allcheckspassed@0b68b3b7d92e595bcbdea0c860d05605720cf479
+        with:                                 
+          delay: '5'
+          retries: '7'
+          polling_interval: '5'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Save PR payload
+        shell: bash
+        run: |
+          mkdir -p ./pr
+          echo ${{ github.event.pull_request.number }} >> ./pr/pr_number          
+          echo ${{ github.event.action }} >> ./pr/event_action
+      - uses: actions/upload-artifact@v3.1.0
+        with:
+          name: pr
+          path: pr/