Switch from deprecated u2004 to u2204 image for github actions

.github/actions/apt-packages/action.yaml

@@ -25,3 +25,9 @@ runs:
         # install dev dependencies for Python YAML and LDAP packages
         # https://github.com/StackStorm/st2-auth-ldap
         ./scripts/github/install-apt-packages-use-cache.sh
+
+    - name: Install Mongo Shell
+      shell: bash
+      run: |
+        # Required as part of switch to GHA image ubuntu-22.04
+        ./scripts/github/install-mongosh.sh

.github/workflows/checks.yaml

@@ -12,7 +12,7 @@ jobs:
   # See: https://keepachangelog.com/en/1.0.0/
   changelog-checker:
     name: Add CHANGELOG.rst
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
       - name: Changelog check

.github/workflows/ci.yaml

@@ -28,7 +28,7 @@ jobs:
   # same file set which has already passed, etc.
   pre_job:
     name: Skip Duplicate Jobs Pre Job
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     outputs:
       should_skip: ${{ steps.skip_check.outputs.should_skip }}
     steps:
@@ -45,7 +45,7 @@ jobs:
     # coverage, etc)
     # if: ${{ needs.pre_job.outputs.should_skip != 'true' || github.ref == 'refs/heads/master' }}
     name: '${{ matrix.make.name }} - Python ${{ matrix.python.version-short }}'
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     strategy:
       fail-fast: false
       matrix:
@@ -54,7 +54,7 @@ jobs:
         # NOTE: We need to use full Python version as part of Python deps cache key otherwise
         # setup virtualenv step will fail.
         python:
-          - {version-short: '3.8', version: '3.8.10'}
+          - {version-short: '3.8', version: '3.8.12'}
           - {version-short: '3.9', version: '3.9.14'}
           - {version-short: '3.10', version: '3.10.15'}
           - {version-short: '3.11', version: '3.11.10'}
@@ -103,12 +103,12 @@ jobs:
     needs: pre_job
     # FIXME: dropping the repetition in this name requires changing required checks on GitHub
     name: 'Self-check on Python ${{ matrix.python.version-short }} - Python ${{ matrix.python.version-short }}'
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     strategy:
       fail-fast: false
       matrix:
         python:
-          - {version-short: '3.8', version: '3.8.10'}
+          - {version-short: '3.8', version: '3.8.12'}
     services:
       mongo:
         image: mongo:7.0
@@ -240,14 +240,14 @@ jobs:
     # NB: disabled. See TODO above pre_job
     # if: ${{ needs.pre_job.outputs.should_skip != 'true' || github.ref == 'refs/heads/master' }}
     name: '${{ matrix.make.name }} - Python ${{ matrix.python.version-short }}'
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     strategy:
       fail-fast: false
       matrix:
         # NOTE: To speed the CI run, we split unit and integration tests into multiple jobs where
         # each job runs subset of tests.
         python:
-          - {version-short: '3.8', version: '3.8.10'}
+          - {version-short: '3.8', version: '3.8.12'}
           - {version-short: '3.9', version: '3.9.14'}
           - {version-short: '3.10', version: '3.10.15'}
           - {version-short: '3.11', version: '3.11.10'}
@@ -383,14 +383,14 @@ jobs:
     # coverage, etc)
     # if: ${{ needs.pre_job.outputs.should_skip != 'true' || github.ref == 'refs/heads/master' }}
     name: '${{ matrix.make.name }} - Python ${{ matrix.python.version-short }}'
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     strategy:
       fail-fast: false
       matrix:
         # NOTE: To speed the CI run, we split unit and integration tests into multiple jobs where
         # each job runs subset of tests.
         python:
-          - {version-short: '3.8', version: '3.8.10'}
+          - {version-short: '3.8', version: '3.8.12'}
           - {version-short: '3.9', version: '3.9.14'}
           - {version-short: '3.10', version: '3.10.15'}
           - {version-short: '3.11', version: '3.11.10'}
@@ -558,7 +558,7 @@ jobs:
       - self-check
       - unit-tests
       - integration-tests
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     steps:
       - name: Workflow conclusion
         # this step creates an environment variable WORKFLOW_CONCLUSION and is the most reliable way to check the status of previous jobs

.github/workflows/lint.yaml

@@ -26,7 +26,7 @@ jobs:
   # Lint checks which don't depend on any service containes, etc. to be running.
   lint-checks:
     name: 'Lint Checks (pants runs: shellcheck, bandit, black, flake8, pylint)'
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
 
     env:
       COLUMNS: '120'

.github/workflows/microbenchmarks.yaml

@@ -21,7 +21,7 @@ jobs:
   # same file set which has already passed, etc.
   pre_job:
     name: Skip Duplicate Jobs Pre Job
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     outputs:
       should_skip: ${{ steps.skip_check.outputs.should_skip }}
     steps:
@@ -37,14 +37,14 @@ jobs:
     # coverage, etc)
     if: ${{ needs.pre_job.outputs.should_skip != 'true' || github.ref == 'refs/heads/master' }}
     name: '${{ matrix.make.name }} - Python ${{ matrix.python.version-short }}'
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     strategy:
       fail-fast: false
       matrix:
         # NOTE: We need to use full Python version as part of Python deps cache key otherwise
         # setup virtualenv step will fail.
         python:
-          - {version-short: '3.8', version: '3.8.10'}
+          - {version-short: '3.8', version: '3.8.12'}
           - {version-short: '3.9', version: '3.9.14'}
           - {version-short: '3.10', version: '3.10.15'}
           - {version-short: '3.11', version: '3.11.10'}
@@ -113,7 +113,7 @@ jobs:
     if: always()
     needs:
       - micro-benchmarks
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     steps:
       - name: Workflow conclusion
         # this step creates an environment variable WORKFLOW_CONCLUSION and is the most reliable way to check the status of previous jobs

.github/workflows/orquesta-integration-tests.yaml

@@ -32,7 +32,7 @@ jobs:
   # same file set which has already passed, etc.
   pre_job:
     name: Skip Duplicate Jobs Pre Job
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     outputs:
       should_skip: ${{ steps.skip_check.outputs.should_skip }}
     steps:
@@ -48,14 +48,14 @@ jobs:
     # coverage, etc)
     # if: ${{ needs.pre_job.outputs.should_skip != 'true' || github.ref == 'refs/heads/master' }}
     name: '${{ matrix.make.name }} - Python ${{ matrix.python.version-short }}'
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     strategy:
       fail-fast: false
       matrix:
         # NOTE: We need to use full Python version as part of Python deps cache key otherwise
         # setup virtualenv step will fail.
         python:
-          - {version-short: '3.8', version: '3.8.10'}
+          - {version-short: '3.8', version: '3.8.12'}
           - {version-short: '3.9', version: '3.9.14'}
           - {version-short: '3.10', version: '3.10.15'}
           - {version-short: '3.11', version: '3.11.10'}
@@ -188,7 +188,7 @@ jobs:
     if: always()
     needs:
       - integration-tests
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     steps:
       - name: Workflow conclusion
         # this step creates an environment variable WORKFLOW_CONCLUSION and is the most reliable way to check the status of previous jobs

.github/workflows/pants.yaml

@@ -21,7 +21,7 @@ on:
 jobs:
   pants-tailor:
     name: Make sure pants BUILD files are up-to-date
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4

.github/workflows/test.yaml

@@ -38,7 +38,7 @@ env:
 jobs:
   pants-plugins-tests:
     name: 'Pants Plugins Tests (pants runs: pytest) - Python ${{ matrix.python.version-short }}'
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     strategy:
       fail-fast: false
       matrix:
@@ -121,14 +121,14 @@ jobs:
 
   unit-tests:
     name: 'Unit Tests Shard ${{ matrix.shard.k }}/${{ matrix.shard.n }} (pants runs: pytest) - Python ${{ matrix.python.version-short }}'
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     strategy:
       fail-fast: false
       matrix:
         # NOTE: We need to use full Python version as part of Python deps cache key otherwise
         # setup virtualenv step will fail.
         python:
-          - {version-short: '3.8', version: '3.8.10'}
+          - {version-short: '3.8', version: '3.8.12'}
           - {version-short: '3.9', version: '3.9.14'}
           - {version-short: '3.10', version: '3.10.15'}
           - {version-short: '3.11', version: '3.11.10'}
@@ -218,14 +218,14 @@ jobs:
 
   pack-tests:
     name: 'Pack Tests (pants runs: pytest) - Python ${{ matrix.python.version-short }}'
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     strategy:
       fail-fast: false
       matrix:
         # NOTE: We need to use full Python version as part of Python deps cache key otherwise
         # setup virtualenv step will fail.
         python:
-          - {version-short: '3.8', version: '3.8.10'}
+          - {version-short: '3.8', version: '3.8.12'}
           - {version-short: '3.9', version: '3.9.14'}
           - {version-short: '3.10', version: '3.10.15'}
           - {version-short: '3.11', version: '3.11.10'}
@@ -307,14 +307,14 @@ jobs:
 
   integration-tests:
     name: 'Integration Tests (pants runs: pytest) - Python ${{ matrix.python.version-short }}'
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     strategy:
       fail-fast: false
       matrix:
         # NOTE: We need to use full Python version as part of Python deps cache key otherwise
         # setup virtualenv step will fail.
         python:
-          - {version-short: '3.8', version: '3.8.10'}
+          - {version-short: '3.8', version: '3.8.12'}
           - {version-short: '3.9', version: '3.9.14'}
           - {version-short: '3.10', version: '3.10.15'}
           - {version-short: '3.11', version: '3.11.10'}
@@ -429,14 +429,14 @@ jobs:
 
   integration-st2cluster-tests:
     name: 'Integration Tests (Full Cluster)- Python ${{ matrix.python.version-short }}'
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     strategy:
       fail-fast: false
       matrix:
         # NOTE: We need to use full Python version as part of Python deps cache key otherwise
         # setup virtualenv step will fail.
         python:
-          - {version-short: '3.8', version: '3.8.10'}
+          - {version-short: '3.8', version: '3.8.12'}
           - {version-short: '3.9', version: '3.9.14'}
           - {version-short: '3.10', version: '3.10.15'}
           - {version-short: '3.11', version: '3.11.10'}
@@ -549,14 +549,14 @@ jobs:
 
   self-check:
     name: 'Self-Check - Python ${{ matrix.python.version-short }}'
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     strategy:
       fail-fast: false
       matrix:
         # NOTE: We need to use full Python version as part of Python deps cache key otherwise
         # setup virtualenv step will fail.
         python:
-          - {version-short: '3.8', version: '3.8.10'}
+          - {version-short: '3.8', version: '3.8.12'}
           - {version-short: '3.9', version: '3.9.14'}
           - {version-short: '3.10', version: '3.10.15'}
           - {version-short: '3.11', version: '3.11.10'}

CHANGELOG.rst

@@ -69,6 +69,9 @@ Changed
   So, all pack tests must be runnable by `pytest`, which may require migration. #6291
   Contributed by @nzlosh, @FileMagic, @guzzijones, and @cognifloyd.
 
+* Migrated github actions from image ubunutu 20.04 with python 3.8.10 to image ubuntu 22.04 with python 3.8.12. #6301
+  Contributed by @nzlosh
+
 Added
 ~~~~~
 * Continue introducing `pants <https://www.pantsbuild.org/docs>`_ to improve DX (Developer Experience)

Makefile

@@ -59,7 +59,7 @@ ST2TESTS_REDIS_PORT := 6379
 
 # Pin common pip version here across all the targets
 # Note! Periodic maintenance pip upgrades are required to be up-to-date with the latest pip security fixes and updates
-PIP_VERSION ?= 24.3.1
+PIP_VERSION ?= 25.0.1
 SETUPTOOLS_VERSION ?= 75.3.0
 PIP_OPTIONS := $(ST2_PIP_OPTIONS)
 

contrib/packs/tests/test_action_download.py

@@ -20,6 +20,10 @@
 import shutil
 import tempfile
 import hashlib
+import sys
+
+# TODO: Move keywords directly to hashlib.md5 call as part of dropping py3.8.
+hashlib_kwargs = {} if sys.version_info[0:2] < (3, 9) else {"usedforsecurity": False}
 
 from st2common.util.monkey_patch import use_select_poll_workaround
 
@@ -154,7 +158,9 @@ def tearDown(self):
     def test_run_pack_download(self):
         action = self.get_action_instance()
         result = action.run(packs=["test"], abs_repo_base=self.repo_base)
-        temp_dir = hashlib.md5(PACK_INDEX["test"]["repo_url"].encode()).hexdigest()
+        temp_dir = hashlib.md5(
+            PACK_INDEX["test"]["repo_url"].encode(), **hashlib_kwargs
+        ).hexdigest()  # nosec. remove nosec after py3.8 drop
 
         self.assertEqual(result, {"test": "Success."})
         self.clone_from.assert_called_once_with(
@@ -175,8 +181,12 @@ def test_run_pack_download_dependencies(self):
             abs_repo_base=self.repo_base,
         )
         temp_dirs = [
-            hashlib.md5(PACK_INDEX["test2"]["repo_url"].encode()).hexdigest(),
-            hashlib.md5(PACK_INDEX["test4"]["repo_url"].encode()).hexdigest(),
+            hashlib.md5(
+                PACK_INDEX["test2"]["repo_url"].encode(), **hashlib_kwargs
+            ).hexdigest(),  # nosec. remove nosec after py3.8 drop
+            hashlib.md5(
+                PACK_INDEX["test4"]["repo_url"].encode(), **hashlib_kwargs
+            ).hexdigest(),  # nosec. remove nosec after py3.8 drop
         ]
 
         self.assertEqual(result, {"test2": "Success.", "test4": "Success."})
@@ -205,8 +215,12 @@ def test_run_pack_download_multiple_packs(self):
         action = self.get_action_instance()
         result = action.run(packs=["test", "test2"], abs_repo_base=self.repo_base)
         temp_dirs = [
-            hashlib.md5(PACK_INDEX["test"]["repo_url"].encode()).hexdigest(),
-            hashlib.md5(PACK_INDEX["test2"]["repo_url"].encode()).hexdigest(),
+            hashlib.md5(
+                PACK_INDEX["test"]["repo_url"].encode(), **hashlib_kwargs
+            ).hexdigest(),  # nosec. remove nosec after py3.8 drop
+            hashlib.md5(
+                PACK_INDEX["test2"]["repo_url"].encode(), **hashlib_kwargs
+            ).hexdigest(),  # nosec. remove nosec after py3.8 drop
         ]
 
         self.assertEqual(result, {"test": "Success.", "test2": "Success."})
@@ -243,7 +257,9 @@ def test_run_pack_download_no_tag(self):
 
     def test_run_pack_lock_is_already_acquired(self):
         action = self.get_action_instance()
-        temp_dir = hashlib.md5(PACK_INDEX["test"]["repo_url"].encode()).hexdigest()
+        temp_dir = hashlib.md5(
+            PACK_INDEX["test"]["repo_url"].encode(), **hashlib_kwargs
+        ).hexdigest()  # nosec. remove nosec after py3.8 drop
 
         original_acquire = LockFile.acquire
 
@@ -274,7 +290,9 @@ def mock_acquire(self, timeout=None):
     def test_run_pack_lock_is_already_acquired_force_flag(self):
         # Lock is already acquired but force is true so it should be deleted and released
         action = self.get_action_instance()
-        temp_dir = hashlib.md5(PACK_INDEX["test"]["repo_url"].encode()).hexdigest()
+        temp_dir = hashlib.md5(
+            PACK_INDEX["test"]["repo_url"].encode(), **hashlib_kwargs
+        ).hexdigest()  # nosec. remove nosec after py3.8 drop
 
         original_acquire = LockFile.acquire
 
@@ -682,7 +700,9 @@ def test_run_pack_download_local_directory(self):
     def test_run_pack_download_with_tag(self):
         action = self.get_action_instance()
         result = action.run(packs=["test"], abs_repo_base=self.repo_base)
-        temp_dir = hashlib.md5(PACK_INDEX["test"]["repo_url"].encode()).hexdigest()
+        temp_dir = hashlib.md5(
+            PACK_INDEX["test"]["repo_url"].encode(), **hashlib_kwargs
+        ).hexdigest()  # nosec. remove nosec after py3.8 drop
 
         self.assertEqual(result, {"test": "Success."})
         self.clone_from.assert_called_once_with(