From 7acac7bb587970b8d66f3ee7c87094f5ab9ccb57 Mon Sep 17 00:00:00 2001
From: Tomaz Muraus <tomaz@tomaz.me>
Date: Thu, 15 Apr 2021 23:33:55 +0200
Subject: [PATCH 1/5] Update more deps to various stable versions.

---
 CHANGELOG.rst                |  3 ++-
 fixed-requirements.txt       | 10 +++++-----
 requirements.txt             | 10 +++++-----
 st2actions/requirements.txt  |  4 ++--
 st2api/requirements.txt      |  2 +-
 st2client/requirements.txt   |  4 ++--
 st2common/requirements.txt   |  8 ++++----
 st2exporter/requirements.txt |  2 +-
 st2reactor/requirements.txt  |  2 +-
 st2stream/requirements.txt   |  2 +-
 st2tests/requirements.txt    |  2 +-
 test-requirements.txt        |  2 +-
 12 files changed, 26 insertions(+), 25 deletions(-)

diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index 40cfaf3e5a..5c717e5818 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -167,7 +167,8 @@ Changed
 
 * Update various dependencies to latest stable versions (``bcrypt``, ``appscheduler``, ``pytz``,
   ``python-dateutil``, ``psutil``, ``passlib``, ``gunicorn``, ``flex``, ``cryptography``.
-  ``eventlet``, ``greenlet``, ``webob`` , ``mongoengine``, ``pymongo``, ``requests``). #5215
+  ``eventlet``, ``greenlet``, ``webob`` , ``mongoengine``, ``pymongo``, ``requests``,
+  ``pyyaml``, ``kombu``, ``amqp``). #5215
 
   Contributed by @Kami.
 
diff --git a/fixed-requirements.txt b/fixed-requirements.txt
index ba2c8a09d1..d6142d5e4f 100644
--- a/fixed-requirements.txt
+++ b/fixed-requirements.txt
@@ -1,6 +1,6 @@
 # Packages versions fixed for the whole st2 stack
 # Note: amqp is used by kombu
-amqp==2.5.2
+amqp==5.0.6
 apscheduler==3.7.0
 # requests 2.23 requires chardet < 3.1.0
 chardet<3.1.0
@@ -17,7 +17,7 @@ greenlet==1.0.0
 gunicorn==20.1.0
 jsonpath-rw==1.4.0
 jsonschema==2.6.0
-kombu==4.6.6
+kombu==5.0.2
 lockfile==0.12.2
 mongoengine==0.23.0
 networkx==1.11
@@ -35,7 +35,7 @@ python-editor==1.0.4
 python-keyczar==0.716
 pytz==2021.1
 pywinrm==0.3.0
-pyyaml==5.4
+pyyaml==5.4.1
 redis==3.5.3
 requests[security]==2.25.1
 retrying==1.3.3
@@ -55,11 +55,11 @@ zake==0.2.2
 bcrypt==3.2.0
 jinja2==2.11.3
 mock==4.0.3
-nose-timer==0.7.5
+nose-timer==1.0.1
 nose-parallel==0.4.0
 psutil==5.8.0
 python-dateutil==2.8.1
 python-statsd==2.1.0
 ujson==1.35
-orjson==3.5.1
+orjson==3.5.2
 udatetime==0.0.16
diff --git a/requirements.txt b/requirements.txt
index 4cc169b892..6b518e4e70 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -6,7 +6,7 @@
 # in-requirements.txt for that component and then run 'make requirements' to
 # update the component requirements.txt
 RandomWords
-amqp==2.5.2
+amqp==5.0.6
 apscheduler==3.7.0
 argcomplete
 bcrypt==3.2.0
@@ -26,15 +26,15 @@ gunicorn==20.1.0
 jinja2==2.11.3
 jsonpath-rw==1.4.0
 jsonschema==2.6.0
-kombu==4.6.6
+kombu==5.0.2
 lockfile==0.12.2
 mock==4.0.3
 mongoengine==0.23.0
 networkx==1.11
 nose
 nose-parallel==0.4.0
-nose-timer==0.7.5
-orjson==3.5.1
+nose-timer==1.0.1
+orjson==3.5.2
 oslo.config>=1.12.1,<1.13
 oslo.utils<5.0,>=4.0.0
 paramiko==2.7.2
@@ -51,7 +51,7 @@ python-json-logger
 python-statsd==2.1.0
 pytz==2021.1
 pywinrm==0.3.0
-pyyaml==5.4
+pyyaml==5.4.1
 redis==3.5.3
 rednose
 requests[security]==2.25.1
diff --git a/st2actions/requirements.txt b/st2actions/requirements.txt
index f8ab2a2b4a..353faed776 100644
--- a/st2actions/requirements.txt
+++ b/st2actions/requirements.txt
@@ -11,13 +11,13 @@ eventlet==0.30.2
 git+https://github.com/StackStorm/logshipper.git@stackstorm_patched#egg=logshipper
 gitpython==2.1.15
 jinja2==2.11.3
-kombu==4.6.6
+kombu==5.0.2
 lockfile==0.12.2
 oslo.config>=1.12.1,<1.13
 oslo.utils<5.0,>=4.0.0
 pyinotify==0.9.6; platform_system=="Linux"
 python-dateutil==2.8.1
 python-json-logger
-pyyaml==5.4
+pyyaml==5.4.1
 requests[security]==2.25.1
 six==1.13.0
diff --git a/st2api/requirements.txt b/st2api/requirements.txt
index 09b9fc1353..c9f385ab4d 100644
--- a/st2api/requirements.txt
+++ b/st2api/requirements.txt
@@ -8,7 +8,7 @@
 eventlet==0.30.2
 gunicorn==20.1.0
 jsonschema==2.6.0
-kombu==4.6.6
+kombu==5.0.2
 mongoengine==0.23.0
 oslo.config>=1.12.1,<1.13
 oslo.utils<5.0,>=4.0.0
diff --git a/st2client/requirements.txt b/st2client/requirements.txt
index 5103232989..26e65215b4 100644
--- a/st2client/requirements.txt
+++ b/st2client/requirements.txt
@@ -10,13 +10,13 @@ chardet<3.1.0
 cryptography==3.4.7
 jsonpath-rw==1.4.0
 jsonschema==2.6.0
-orjson==3.5.1
+orjson==3.5.2
 prettytable
 prompt-toolkit==1.0.15
 python-dateutil==2.8.1
 python-editor==1.0.4
 pytz==2021.1
-pyyaml==5.4
+pyyaml==5.4.1
 requests[security]==2.25.1
 six==1.13.0
 sseclient-py==1.7
diff --git a/st2common/requirements.txt b/st2common/requirements.txt
index 78ae5b9a9e..fb520b69e0 100644
--- a/st2common/requirements.txt
+++ b/st2common/requirements.txt
@@ -5,7 +5,7 @@
 # If you want to update depdencies for a single component, modify the
 # in-requirements.txt for that component and then run 'make requirements' to
 # update the component requirements.txt
-amqp==2.5.2
+amqp==5.0.6
 apscheduler==3.7.0
 chardet<3.1.0
 cryptography==3.4.7
@@ -19,17 +19,17 @@ greenlet==1.0.0
 jinja2==2.11.3
 jsonpath-rw==1.4.0
 jsonschema==2.6.0
-kombu==4.6.6
+kombu==5.0.2
 lockfile==0.12.2
 mongoengine==0.23.0
 networkx==1.11
-orjson==3.5.1
+orjson==3.5.2
 oslo.config>=1.12.1,<1.13
 paramiko==2.7.2
 pymongo==3.11.3
 python-dateutil==2.8.1
 python-statsd==2.1.0
-pyyaml==5.4
+pyyaml==5.4.1
 redis==3.5.3
 requests[security]==2.25.1
 retrying==1.3.3
diff --git a/st2exporter/requirements.txt b/st2exporter/requirements.txt
index a713318929..9e00c8a9b0 100644
--- a/st2exporter/requirements.txt
+++ b/st2exporter/requirements.txt
@@ -6,6 +6,6 @@
 # in-requirements.txt for that component and then run 'make requirements' to
 # update the component requirements.txt
 eventlet==0.30.2
-kombu==4.6.6
+kombu==5.0.2
 oslo.config>=1.12.1,<1.13
 six==1.13.0
diff --git a/st2reactor/requirements.txt b/st2reactor/requirements.txt
index 851c811ad9..3388a8214b 100644
--- a/st2reactor/requirements.txt
+++ b/st2reactor/requirements.txt
@@ -9,7 +9,7 @@ apscheduler==3.7.0
 eventlet==0.30.2
 jsonpath-rw==1.4.0
 jsonschema==2.6.0
-kombu==4.6.6
+kombu==5.0.2
 oslo.config>=1.12.1,<1.13
 python-dateutil==2.8.1
 six==1.13.0
diff --git a/st2stream/requirements.txt b/st2stream/requirements.txt
index d41dc6d252..a7bb19887a 100644
--- a/st2stream/requirements.txt
+++ b/st2stream/requirements.txt
@@ -8,7 +8,7 @@
 eventlet==0.30.2
 gunicorn==20.1.0
 jsonschema==2.6.0
-kombu==4.6.6
+kombu==5.0.2
 mongoengine==0.23.0
 oslo.config>=1.12.1,<1.13
 oslo.utils<5.0,>=4.0.0
diff --git a/st2tests/requirements.txt b/st2tests/requirements.txt
index 51d8d75e69..4cc6d89e75 100644
--- a/st2tests/requirements.txt
+++ b/st2tests/requirements.txt
@@ -9,7 +9,7 @@ RandomWords
 mock==4.0.3
 nose
 nose-parallel==0.4.0
-nose-timer==0.7.5
+nose-timer==1.0.1
 psutil==5.8.0
 pyrabbit
 rednose
diff --git a/test-requirements.txt b/test-requirements.txt
index e3c56c26ab..e7eb4efb91 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -2,7 +2,7 @@
 coverage==4.5.2
 pep8==1.7.1
 st2flake8==0.1.0
-astroid==2.5.2
+astroid==2.5.3
 pylint==2.7.4
 pylint-plugin-utils>=0.4
 black==20.8b1

From e6d445b0fda638e0334f62ae8b24b8cea5e3152a Mon Sep 17 00:00:00 2001
From: Tomaz Muraus <tomaz@tomaz.me>
Date: Fri, 16 Apr 2021 22:55:05 +0200
Subject: [PATCH 2/5] Update tests - new version now (correctly) uses
 cert_required by default so we need to pass valid cert (or disable cert
 validation) for that test to pass.

---
 .../integration/test_rabbitmq_ssl_listener.py    | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/st2common/tests/integration/test_rabbitmq_ssl_listener.py b/st2common/tests/integration/test_rabbitmq_ssl_listener.py
index 224a50d4a4..03e75ac165 100644
--- a/st2common/tests/integration/test_rabbitmq_ssl_listener.py
+++ b/st2common/tests/integration/test_rabbitmq_ssl_listener.py
@@ -79,9 +79,20 @@ def test_non_ssl_connection_on_ssl_listener_port_failure(self):
                 connection.release()
 
     def test_ssl_connection_on_ssl_listener_success(self):
+        # NOTE: Older version uses to default so cert_reques=ssl.CERT_NONE so we also do that here.
+        # As an alternative, we could set a valid ca cert here (but we already have different tests
+        # which exercise those code paths).
+        connection_kwargs = {
+            "ssl": {
+                "cert_reqs": ssl.CERT_NONE,
+            }
+        }
+
         # Using query param notation
         urls = "amqp://guest:guest@127.0.0.1:5671/?ssl=true"
-        connection = transport_utils.get_connection(urls=urls)
+        connection = transport_utils.get_connection(
+            urls=urls, connection_kwargs=connection_kwargs
+        )
 
         try:
             self.assertTrue(connection.connect())
@@ -93,8 +104,9 @@ def test_ssl_connection_on_ssl_listener_success(self):
         # Using messaging.ssl config option
         cfg.CONF.set_override(name="ssl", override=True, group="messaging")
 
+        urls = "amqp://guest:guest@127.0.0.1:5671/"
         connection = transport_utils.get_connection(
-            urls="amqp://guest:guest@127.0.0.1:5671/"
+            urls=urls, connection_kwargs=connection_kwargs
         )
 
         try:

From 0fb42815f7450e7b46b2d9fc70d4f8acb07fd32e Mon Sep 17 00:00:00 2001
From: Tomaz Muraus <tomaz@tomaz.me>
Date: Fri, 16 Apr 2021 23:57:15 +0200
Subject: [PATCH 3/5] Remove test which doesn't work anymore out of the box
 with default cert due to the ssl.cert_reqs default value changing from
 ssl.NONE to ssl.CERT_REQUIRED.

---
 .../integration/test_rabbitmq_ssl_listener.py | 30 ++++---------------
 1 file changed, 5 insertions(+), 25 deletions(-)

diff --git a/st2common/tests/integration/test_rabbitmq_ssl_listener.py b/st2common/tests/integration/test_rabbitmq_ssl_listener.py
index 03e75ac165..b6c947e5fa 100644
--- a/st2common/tests/integration/test_rabbitmq_ssl_listener.py
+++ b/st2common/tests/integration/test_rabbitmq_ssl_listener.py
@@ -79,35 +79,15 @@ def test_non_ssl_connection_on_ssl_listener_port_failure(self):
                 connection.release()
 
     def test_ssl_connection_on_ssl_listener_success(self):
-        # NOTE: Older version uses to default so cert_reques=ssl.CERT_NONE so we also do that here.
-        # As an alternative, we could set a valid ca cert here (but we already have different tests
-        # which exercise those code paths).
-        connection_kwargs = {
-            "ssl": {
-                "cert_reqs": ssl.CERT_NONE,
-            }
-        }
-
-        # Using query param notation
-        urls = "amqp://guest:guest@127.0.0.1:5671/?ssl=true"
-        connection = transport_utils.get_connection(
-            urls=urls, connection_kwargs=connection_kwargs
-        )
-
-        try:
-            self.assertTrue(connection.connect())
-            self.assertTrue(connection.connected)
-        finally:
-            if connection:
-                connection.release()
+        ca_cert_path = os.path.join(CERTS_FIXTURES_PATH, "ca/ca_certificate_bundle.pem")
 
-        # Using messaging.ssl config option
         cfg.CONF.set_override(name="ssl", override=True, group="messaging")
+        cfg.CONF.set_override(
+            name="ssl_ca_certs", override=ca_cert_path, group="messaging"
+        )
 
         urls = "amqp://guest:guest@127.0.0.1:5671/"
-        connection = transport_utils.get_connection(
-            urls=urls, connection_kwargs=connection_kwargs
-        )
+        connection = transport_utils.get_connection(urls=urls)
 
         try:
             self.assertTrue(connection.connect())

From c9fb05caf41d2f51282273d3fbdfd74d0d4c2978 Mon Sep 17 00:00:00 2001
From: Tomaz Muraus <tomaz@tomaz.me>
Date: Sat, 17 Apr 2021 11:05:19 +0200
Subject: [PATCH 4/5] Upload st2 launchdev service logs on orquests tests
 failure.

---
 .github/workflows/orquesta-integration-tests.yaml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/orquesta-integration-tests.yaml b/.github/workflows/orquesta-integration-tests.yaml
index babb2599f6..fbc5638856 100644
--- a/.github/workflows/orquesta-integration-tests.yaml
+++ b/.github/workflows/orquesta-integration-tests.yaml
@@ -226,9 +226,15 @@ jobs:
           set -e
           echo "Failed after ${MAX_ATTEMPTS} attempts, failing the job."
           exit 1
+      - name: Upload StackStorm services Logs
+        if: ${{ failure() }}
+        uses: actions/upload-artifact@v2
+        with:
+          name: logs
+          path: logs/
       - name: Codecov
         # NOTE: We only generate and submit coverage report for master and version branches and only when the build succeeds (default on GitHub Actions, this was not the case on Travis so we had to explicitly check success)
-        if: "${{ success() && env.ENABLE_COVERAGE == 'yes' && env.TASK == 'ci-integration' }}"
+        if: "${{ success() && env.ENABLE_COVERAGE == 'yes' }}"
         run: |
           ./scripts/ci/submit-codecov-coverage.sh
       - name: Stop Redis Service Container

From 6cb581ca05b98fd6a73e3edf0ba73629bcf27dab Mon Sep 17 00:00:00 2001
From: Tomaz Muraus <tomaz@tomaz.me>
Date: Sat, 17 Apr 2021 14:09:52 +0200
Subject: [PATCH 5/5] Also test uploading service logs on success.

---
 .github/workflows/orquesta-integration-tests.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/orquesta-integration-tests.yaml b/.github/workflows/orquesta-integration-tests.yaml
index fbc5638856..83271a03bc 100644
--- a/.github/workflows/orquesta-integration-tests.yaml
+++ b/.github/workflows/orquesta-integration-tests.yaml
@@ -227,7 +227,7 @@ jobs:
           echo "Failed after ${MAX_ATTEMPTS} attempts, failing the job."
           exit 1
       - name: Upload StackStorm services Logs
-        if: ${{ failure() }}
+        #if: ${{ failure() }}
         uses: actions/upload-artifact@v2
         with:
           name: logs