feat(frontend): modernize Pipelines UI workflows

.github/resources/ci-workflow-inventory.json

@@ -357,12 +357,16 @@
     {
       "path": ".github/workflows/frontend.yml",
       "name": "Frontend Tests",
-      "header_sha256": "ad213cb370af3e573a7e0c7bdcec60c0a93cb6c882ac2fe3b148934ba46d964b",
+      "header_sha256": "7db5b97ddafe4c0580c8d61ec01af6170b5bd274f7820316b43351b8adacd608",
       "pull_request": {
         "branches": [
           "master"
         ],
         "paths": [
+          ".github/actions/download-artifact-with-retry/**",
+          ".github/resources/scripts/artifact-files.sh",
+          ".github/resources/scripts/configure_frontend_apt*",
+          ".github/resources/scripts/ci-image-artifacts.sh",
           "frontend/**",
           "manifests/kustomize/base/installs/multi-user/pipelines-profile-controller/sync.py",
           "api/v2alpha1/*.proto",

.github/resources/scripts/artifact-files.sh

@@ -31,12 +31,32 @@ if [[ -z "${required_files//[[:space:]]/}" ]]; then
 fi
 # Preparation and download must resolve the destination identically. Unlike
 # the download action, shell paths do not expand a tilde stored in a variable.
-case "$DOWNLOAD_PATH" in
+case "${DOWNLOAD_PATH:-}" in
   ""|"~"*)
     echo "::error::required-files needs an absolute or workspace-relative destination without tilde expansion"
     exit 2
     ;;
 esac
+# The download action returns native Windows paths even for relative inputs.
+# Git Bash needs the equivalent POSIX path before physical-ancestor checks.
+case "$DOWNLOAD_PATH" in
+  [[:alpha:]]:[\\/]*)
+    # cygpath collapses parent components; reject them before conversion so
+    # cleanup cannot hide traversal into a different directory.
+    windows_destination="${DOWNLOAD_PATH//\\//}"
+    case "$windows_destination/" in
+      */../*)
+        echo "::error::Artifact destination must not contain parent traversal: $DOWNLOAD_PATH"
+        exit 2
+        ;;
+    esac
+    if ! command -v cygpath >/dev/null 2>&1; then
+      echo "::error::Windows artifact destinations require Git Bash cygpath"
+      exit 2
+    fi
+    DOWNLOAD_PATH="$(cygpath -u -- "$DOWNLOAD_PATH")"
+    ;;
+esac
 # Check the destination before following it or creating anything. Relative
 # paths start at the physical working directory; absolute paths must already
 # use physical ancestors (for example /private/tmp, not macOS's /tmp alias).

.github/resources/scripts/artifact_download_callers_test.py

@@ -29,7 +29,8 @@
 
 ROOT = Path(__file__).resolve().parents[3]
 WRAPPER = './.github/actions/download-artifact-with-retry'
-CALLERS = {
+CALLERS = [
+    ('.github/workflows/frontend.yml', 'browser-tests'),
     ('.github/actions/deploy/action.yml', 'composite'),
     ('.github/workflows/arm64-presubmit.yml', 'smoke'),
     ('.github/workflows/build-tools-images.yml', 'compare-generated'),
@@ -38,7 +39,7 @@
     ('.github/workflows/image-builds-master.yml', 'arm64-smoke'),
     ('.github/workflows/image-builds-release.yml', 'validate-release-images'),
     ('.github/workflows/image-builds.yml', 'runtime-base-images'),
-}
+]
 
 
 def workflow(name):
@@ -155,6 +156,21 @@ def test_every_maintained_download_has_a_manifest_and_no_raw_bypass(self):
                         callers.append(location)
         self.assertCountEqual(callers, CALLERS)
 
+    def test_browser_bundle_uses_workspace_relative_paths_on_windows(self):
+        steps = workflow('frontend.yml')['jobs']['browser-tests']['steps']
+        download = next(step for step in steps if step.get('uses') == WRAPPER)
+        self.assertEqual(download['with']['path'], 'frontend/.ci-bundle')
+        self.assertEqual(
+            download['with']['required-files'], 'frontend-bundle.tar.gz'
+        )
+        extract = next(
+            step
+            for step in steps
+            if step.get('name') == 'Extract complete production bundle'
+        )
+        self.assertIn('.ci-bundle/frontend-bundle.tar.gz', extract['run'])
+        self.assertNotIn('RUNNER_TEMP', extract['run'])
+
     def test_deploy_manifest_matches_ci_producers_and_modelcar_selection(self):
         built_images = {
             item['image']

.github/resources/scripts/artifact_download_completeness_test.py

@@ -20,6 +20,7 @@
 import tempfile
 import unittest
 from pathlib import Path
+from unittest import mock
 
 import yaml
 from artifact_workflow_test_support import evaluate, render
@@ -51,6 +52,7 @@ def __init__(self, path, attempts, required_files=None):
         self.path = path
         self.attempts = attempts
         self.downloads = []
+        self.download_output_path = None
         self.steps = {}
         self.failed = False
         self.cancelled = False
@@ -119,7 +121,10 @@ def run(self):
                 destination.mkdir(parents=True, exist_ok=True)
                 outcome = attempt(destination, download_inputs)
                 if outcome == 'success':
-                    outputs['download-path'] = os.path.abspath(destination)
+                    outputs['download-path'] = (
+                        self.download_output_path
+                        or os.path.abspath(destination)
+                    )
             else:
                 if step['shell'] != 'bash':
                     raise AssertionError(f'Unexpected shell: {step}')
@@ -213,6 +218,36 @@ def test_complete_first_attempt_does_not_retry(self):
         output = runner.action['outputs']['download-path']['value']
         self.assertEqual(runner.render(output), str(self.path))
 
+    def test_windows_native_action_output_validates_complete_download(self):
+        tools = Path(self.directory.name) / 'bin'
+        tools.mkdir()
+        converter = tools / 'cygpath'
+        converter.write_text(
+            '#!/bin/sh\n'
+            '[ "$1" = "-u" ] && [ "$2" = "--" ] && '
+            '[ "$3" = "$CYGPATH_INPUT" ] || exit 9\n'
+            'printf "%s\\n" "$CYGPATH_TARGET"\n'
+        )
+        converter.chmod(0o755)
+        runner = CompositeAction(
+            self.path, [download(files=self.complete)], self.required
+        )
+        runner.download_output_path = r'D:\a\pipelines\downloads'
+        with mock.patch.dict(
+            os.environ,
+            {
+                'PATH': str(tools) + os.pathsep + os.environ['PATH'],
+                'CYGPATH_TARGET': str(self.path),
+                'CYGPATH_INPUT': runner.download_output_path,
+            },
+        ):
+            result = runner.run()
+        self.assertEqual(result, 'success', runner.log)
+        self.assertEqual(runner.downloads, ['primary'])
+        self.assertEqual(
+            runner.steps['verify-primary']['outputs']['complete'], 'true'
+        )
+
     def test_download_defaults_resolve_the_github_context(self):
         received = []
 
@@ -527,6 +562,146 @@ def test_physical_absolute_and_relative_destinations_are_supported(self):
                 )
                 self.assertTrue((self.path / 'new/nested').is_dir())
 
+    def test_native_windows_download_output_uses_actual_destination(self):
+        tools = self.path / 'bin'
+        tools.mkdir()
+        converter = tools / 'cygpath'
+        converter.write_text('#!/bin/sh\nprintf "%s\\n" "$CYGPATH_TARGET"\n')
+        converter.chmod(0o755)
+        target = self.path / 'download'
+        target.mkdir()
+        with mock.patch.dict(
+            os.environ,
+            {
+                'PATH': str(tools) + os.pathsep + os.environ['PATH'],
+                'CYGPATH_TARGET': str(target),
+            },
+        ):
+            for destination in (r'D:\a\_temp\download', 'D:/a/_temp/download'):
+                with self.subTest(destination=destination):
+                    archive = target / 'archive.tar'
+                    archive.write_text('complete')
+                    result = self.run_helper(
+                        'verify', 'archive.tar', destination
+                    )
+                    self.assertEqual(
+                        result.returncode, 0, result.stdout + result.stderr
+                    )
+                    result = self.run_helper(
+                        'prepare', 'archive.tar', destination
+                    )
+                    self.assertEqual(
+                        result.returncode, 0, result.stdout + result.stderr
+                    )
+                    self.assertFalse(archive.exists())
+
+    def test_normalized_windows_destinations_keep_symlink_and_traversal_guards(
+        self,
+    ):
+        tools = self.path / 'bin'
+        tools.mkdir()
+        converter = tools / 'cygpath'
+        converter.write_text('#!/bin/sh\nprintf "%s\\n" "$CYGPATH_TARGET"\n')
+        converter.chmod(0o755)
+        outside = self.path / 'outside'
+        outside.mkdir()
+        sentinel = outside / 'archive.tar'
+        sentinel.write_text('keep')
+        link = self.path / 'link'
+        link.symlink_to(outside, target_is_directory=True)
+        for target in (str(link), str(self.path / 'missing/../outside')):
+            with mock.patch.dict(
+                os.environ,
+                {
+                    'PATH': str(tools) + os.pathsep + os.environ['PATH'],
+                    'CYGPATH_TARGET': target,
+                },
+            ):
+                for mode in ('prepare', 'verify', 'check'):
+                    result = self.run_helper(
+                        mode, 'archive.tar', r'D:\a\download'
+                    )
+                    self.assertEqual(
+                        result.returncode, 2, result.stdout + result.stderr
+                    )
+                    self.assertEqual(sentinel.read_text(), 'keep')
+                    self.assertFalse((self.path / 'missing').exists())
+
+    def test_windows_parent_traversal_is_rejected_before_normalization(self):
+        tools = self.path / 'bin'
+        tools.mkdir()
+        converter = tools / 'cygpath'
+        converter.write_text(
+            '#!/bin/sh\ntouch "$CONVERSION_MARKER"\nprintf "%s\\n" "$CYGPATH_TARGET"\n'
+        )
+        converter.chmod(0o755)
+        outside = self.path / 'outside'
+        outside.mkdir()
+        sentinel = outside / 'archive.tar'
+        sentinel.write_text('keep')
+        marker = self.path / 'converted'
+        with mock.patch.dict(
+            os.environ,
+            {
+                'PATH': str(tools) + os.pathsep + os.environ['PATH'],
+                'CYGPATH_TARGET': str(outside),
+                'CONVERSION_MARKER': str(marker),
+            },
+        ):
+            for destination in (
+                r'D:\allowed\..\outside',
+                'D:/allowed/../outside',
+            ):
+                for mode in ('prepare', 'verify', 'check'):
+                    result = self.run_helper(mode, 'archive.tar', destination)
+                    self.assertEqual(
+                        result.returncode, 2, result.stdout + result.stderr
+                    )
+                    self.assertFalse(marker.exists())
+                    self.assertEqual(sentinel.read_text(), 'keep')
+
+    def test_windows_conversion_failure_preserves_existing_files(self):
+        tools = self.path / 'bin'
+        tools.mkdir()
+        converter = tools / 'cygpath'
+        converter.write_text('#!/bin/sh\nexit 7\n')
+        converter.chmod(0o755)
+        sentinel = self.path / 'archive.tar'
+        sentinel.write_text('keep')
+        with mock.patch.dict(
+            os.environ,
+            {
+                'PATH': str(tools) + os.pathsep + os.environ['PATH'],
+            },
+        ):
+            result = self.run_helper('prepare', 'archive.tar', r'D:\a\download')
+        self.assertEqual(result.returncode, 7, result.stdout + result.stderr)
+        self.assertEqual(sentinel.read_text(), 'keep')
+
+    def test_unset_destination_fails_before_touching_files(self):
+        sentinel = self.path / 'archive.tar'
+        sentinel.write_text('keep')
+        environment = dict(os.environ, REQUIRED_FILES='archive.tar')
+        environment.pop('DOWNLOAD_PATH', None)
+        for mode in ('prepare', 'verify', 'check'):
+            with self.subTest(mode=mode):
+                result = subprocess.run(
+                    ['bash', str(ARTIFACT_FILES), mode],
+                    env=environment,
+                    cwd=self.path,
+                    capture_output=True,
+                    text=True,
+                    check=False,
+                )
+                self.assertEqual(
+                    result.returncode, 2, result.stdout + result.stderr
+                )
+                self.assertIn(
+                    'absolute or workspace-relative destination', result.stdout
+                )
+                self.assertNotIn('unbound variable', result.stderr)
+                self.assertEqual(sentinel.read_text(), 'keep')
+
     def test_empty_or_parent_traversal_destination_is_rejected(self):
         for destination in ('', '../outside', 'new/../outside'):
             with self.subTest(destination=destination):

.github/resources/scripts/artifact_download_triggers_test.py

@@ -73,8 +73,28 @@ def test_changes_trigger_all_pr_consumers(self):
                         cwd=ROOT,
                     )
                     triggered = set(json.loads(result.stdout))
+                    # Master-only qualification must not be required on release PRs.
+                    branch_script = f"""
+const gate = require({json.dumps(str(MODULE))});
+const {{inventory}} = gate.loadLocalInventory(process.cwd());
+console.log(JSON.stringify(inventory.workflows.filter(workflow =>
+  workflow.pull_request !== null && gate.applicable(
+    Object.fromEntries(Object.entries(workflow.pull_request).filter(
+      ([key]) => key !== 'paths' && key !== 'paths-ignore')),
+    {json.dumps(branch)}, []))
+  .map(workflow => workflow.path)));
+"""
+                    eligible = subprocess.run(
+                        ['node'],
+                        input=branch_script,
+                        check=True,
+                        capture_output=True,
+                        text=True,
+                        cwd=ROOT,
+                    )
+                    required = consumers & set(json.loads(eligible.stdout))
                     self.assertTrue(
-                        consumers.issubset(triggered), consumers - triggered
+                        required.issubset(triggered), required - triggered
                     )
 
 

.github/resources/scripts/configure_frontend_apt.py

@@ -0,0 +1,60 @@
+# Copyright 2026 The Kubeflow Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Bound browser dependency acquisition on disposable hosted Ubuntu runners."""
+
+import os
+import re
+from pathlib import Path
+
+AZURE_MIRROR = re.compile(
+    r'https?://azure\.archive\.ubuntu\.com/ubuntu(?=[/\s]|$)'
+)
+APT_LIMITS = """Acquire::http::Timeout "30";
+Acquire::https::Timeout "30";
+Acquire::Retries "2";
+"""
+
+
+def configure(root):
+    sources = [root / 'apt-mirrors.txt', root / 'sources.list']
+    for pattern in ('*.list', '*.sources'):
+        sources.extend((root / 'sources.list.d').glob(pattern))
+    for source in sources:
+        if source.is_file():
+            before = source.read_text()
+            after = AZURE_MIRROR.sub(
+                'https://archive.ubuntu.com/ubuntu', before
+            )
+            if after != before:
+                source.write_text(after)
+                print(
+                    f'Replaced unavailable Azure Ubuntu mirror in {source.name}'
+                )
+    (root / 'apt.conf.d' / '99-kfp-browser-acquisition').write_text(APT_LIMITS)
+
+
+def main():
+    if not (
+        os.environ.get('CI') == 'true'
+        and os.environ.get('GITHUB_ACTIONS') == 'true'
+        and os.environ.get('RUNNER_ENVIRONMENT') == 'github-hosted'
+    ):
+        raise RuntimeError(
+            'APT configuration requires a disposable GitHub runner'
+        )
+    configure(Path('/etc/apt'))
+
+
+if __name__ == '__main__':
+    main()