fix(actuator): use the gcsfuse.csi.storage.gke.io CSI driver for GCS …

…volumes (#1586)

* fix(actuator): use the gcsfuse.csi.storage.gke.io CSI driver for GCS volumes

GcsVolumeSource was rendered as a CSI volume with driver
gcs.csi.storage.gke.io, which GKE does not register. Pods using a GCS volume
stayed in ContainerCreating. The GKE GCS FUSE CSI driver is
gcsfuse.csi.storage.gke.io; use it in the actuator's volume builder and in the
GCS sidecar annotation check, and update the proto comment and tests.

* fix(actuator): annotate GCS FUSE pods only from job GCS volumes

The pod-spec fallback in annotateGCSVolumes could only match a CSI volume
that did not come from job.Volumes[].gcs, and the actuator never builds
one: generateVolumesForJob creates CSI volumes only from Gcs sources, and
component injection adds only Secret volumes after InjectOnJobSetCreation.
Removing it also removes the second copy of the driver name.

* fix(deploy): enable the GCS FUSE CSI driver in the CTK v2 blueprint

GcsVolumeSource volumes use the gcsfuse.csi.storage.gke.io driver. The
Cluster Toolkit gke-cluster module defaults enable_gcsfuse_csi to false,
so on a cluster built from this blueprint the driver and its sidecar
injection webhook are missing, and pods with a GCS volume stay in
ContainerCreating.

* docs: document GCS FUSE CSI driver prerequisites for GCS volumes

GCS volumes need the Cloud Storage FUSE CSI driver add-on on the cluster
and a Workload Identity binding for the job's Kubernetes service account.
The CTK v2 blueprint now enables the add-on, but clusters provisioned
directly with Terraform (Approach 3) do not get it. SDK users read the
GcsVolumeSource comment when they set the field, so document both
prerequisites there.

fix(actuator): use the gcsfuse.csi.storage.gke.io CSI driver for GCS …

…volumes (#1586)

* fix(actuator): use the gcsfuse.csi.storage.gke.io CSI driver for GCS volumes

GcsVolumeSource was rendered as a CSI volume with driver
gcs.csi.storage.gke.io, which GKE does not register. Pods using a GCS volume
stayed in ContainerCreating. The GKE GCS FUSE CSI driver is
gcsfuse.csi.storage.gke.io; use it in the actuator's volume builder and in the
GCS sidecar annotation check, and update the proto comment and tests.

* fix(actuator): annotate GCS FUSE pods only from job GCS volumes

The pod-spec fallback in annotateGCSVolumes could only match a CSI volume
that did not come from job.Volumes[].gcs, and the actuator never builds
one: generateVolumesForJob creates CSI volumes only from Gcs sources, and
component injection adds only Secret volumes after InjectOnJobSetCreation.
Removing it also removes the second copy of the driver name.

* fix(deploy): enable the GCS FUSE CSI driver in the CTK v2 blueprint

GcsVolumeSource volumes use the gcsfuse.csi.storage.gke.io driver. The
Cluster Toolkit gke-cluster module defaults enable_gcsfuse_csi to false,
so on a cluster built from this blueprint the driver and its sidecar
injection webhook are missing, and pods with a GCS volume stay in
ContainerCreating.

* docs: document GCS FUSE CSI driver prerequisites for GCS volumes

GCS volumes need the Cloud Storage FUSE CSI driver add-on on the cluster
and a Workload Identity binding for the job's Kubernetes service account.
The CTK v2 blueprint now enables the add-on, but clusters provisioned
directly with Terraform (Approach 3) do not get it. SDK users read the
GcsVolumeSource comment when they set the field, so document both
prerequisites there.

docs: address review feedback across metrics, helm, and gateway docs

- Omit `default.` database prefix in ClickHouse verification queries in `examples/metrics_job/README.md` and `examples/chart_artifact_job/README.md`, and update `examples/chart_artifact_job/README.md` (`statefulset/clickhouse` in `xmc-metrics`) and `docs/architecture/use_cases.md` (`svc/ingestion-gateway-service` in `xmc`) to eliminate remaining stale resource targets.
- Fix `xmc_bridge` (CMS naming and non-experimental 1P component phrasing), `dashboard_service` (Kubernetes API, Cloud Identity, and static fallback), `rod` (Resource Observability Dashboard expansion, Kueue CRs, and `experiment-db` dependencies), and `Microservice Deployment Settings` (`dashboardServiceDeployment`, `rodDeployment`, and mandatory `componentsDeployment`) in `deploy/helm/README.md`.
- Update `deploy/local/README.md` with `svc/redpanda` in the architecture diagram, `kubectl wait` / `kubectl rollout status` for asynchronous `xmc-bridge` actuation of `ingestion-gateway`, all five catalog `Component` CRs (`hpo` and `vizier` disabled) in the `xmc-diag` sample output, and event-time `(timestamp, created_at)` deduplication matching `internal/dashboard/dataengine/summary_box.go`.
- Clarify `-components_namespace` kubeconfig/per-field fallback semantics and add `COMPONENTS_NAMESPACE` to the `Environment Variables` table in `cmd/ingestion_gateway/README.md`.

Comment link: #1638 (comment)
Comment link: #1638 (comment)
Comment link: #1638 (comment)
Comment link: #1638 (comment)
Comment link: #1638 (comment)
Comment link: #1638 (comment)
Comment link: #1638 (comment)
Comment link: #1638 (comment)
Comment link: #1638 (comment)
Comment link: #1638 (comment)
Comment link: #1638 (comment)
Comment link: #1638 (comment)

TAG=agy
CONV=0d1e1e85-47f9-49da-a36c-92f916ef853f

feat(github): support date ranges in ABSENCE.md (#1612)

* feat(github): support date ranges in ABSENCE.md

Adds support for scheduling future absences using `NICK DD.MM.YYYY-DD.MM.YYYY` in `ABSENCE.md`.
Users are only skipped for review assignment if the current date falls inclusively within the range.

Updates `.github/scripts/assign-reviewers.js`, `.github/scripts/nightly-failure-alert.js`, and `.github/scripts/auto-approve-absence.js` to parse and validate this format.

TAG=agy
CONV=2cccb26b-6dd1-49cb-afb2-79f42479b115

* refactor(github): deduplicate parseAbsenceFile and add unit tests

Centralizes `parseDdMmYyyy`, `parseAbsenceLine`, and `parseAbsenceFile` in
`.github/scripts/assign-reviewers.js` and imports them in
`.github/scripts/nightly-failure-alert.js` and
`.github/scripts/auto-approve-absence.js` to eliminate duplicated parsing
and validation logic.

Also wires `parseAbsenceFile` into `assign-reviewers.js` `run()` and adds
unit test coverage across `assign-reviewers.test.js`,
`nightly-failure-alert.test.js`, and `auto-approve-absence.test.js`.

TAG=agy
CONV=2cccb26b-6dd1-49cb-afb2-79f42479b115

* test(github): use placeholder usernames in absence unit tests

Replaces real team nicknames in `assign-reviewers.test.js`,
`auto-approve-absence.test.js`, and `ABSENCE.md` header comments with
generic `alice`, `bob`, and `charlie` placeholders.

TAG=agy
CONV=2cccb26b-6dd1-49cb-afb2-79f42479b115

* refactor(github): extract absence-schedule module and log invalid lines

Extracts `USERNAME_PATTERN`, `parseDdMmYyyy`, `parseAbsenceDateRange`,
`parseAbsenceLine`, `parseAbsenceFile`, and `validateAbsenceContent` into
`.github/scripts/absence-schedule.js` (with unit tests in
`.github/scripts/absence-schedule.test.js`) so `assign-reviewers.js`,
`nightly-failure-alert.js`, and `auto-approve-absence.js` share a dedicated
domain module.

- Evaluates `DD.MM.YYYY` date ranges against UTC calendar days (`Date.UTC`)
  for deterministic behavior across GitHub Actions runner timezones.
- Returns `{ absentUsers, errors }` from `parseAbsenceFile` and logs each
  malformed entry via `core.warning` in `assign-reviewers.js` and
  `nightly-failure-alert.js`.
- Drops the unused `parseAbsenceFile` re-export from `nightly-failure-alert.js`.
- Documents UTC date-range evaluation in `ABSENCE.md`.

Comment link: #1612 (comment)
Comment link: #1612 (comment)
Comment link: #1612 (comment)
Comment link: #1612 (comment)
Comment link: #1612 (comment)

TAG=agy
CONV=2cccb26b-6dd1-49cb-afb2-79f42479b115

Release 0.18.0

docs(migrations): document xmc-profile upgrades after component cutov…

…er (#1606)

* docs(migrations): document xmc-profile upgrades after component cutover

Add an "After Migration: Upgrading XMC" section to the component
migration runbook: xmc-profile is a separate Helm release that gcluster
and umbrella upgrades do not touch, and `migrate.py prepare` pins the
gateway imageTag (and parameters.image when a custom gateway image is
set), which takes precedence over the xmc-bridge default image. Replace
the elided gcluster command in Step 3 with the exact create/deploy
commands from INSTALL.md, and link the new section from INSTALL.md
upgrade Step 6.

TAG=agy
CONV=5fd8cc79-e39e-4f23-8a80-e529a7076077

* docs(migrations): reference <IMAGE_TAG> in post-migration upgrade step

Comment link: #1606 (comment)

TAG=agy
CONV=5fd8cc79-e39e-4f23-8a80-e529a7076077

* docs(install): re-compile blueprint before gcluster deploy on upgrade

Comment link: #1606 (comment)

TAG=agy
CONV=5fd8cc79-e39e-4f23-8a80-e529a7076077

docs(migrations): document xmc-profile upgrades after component cutov…

…er (#1606)

* docs(migrations): document xmc-profile upgrades after component cutover

Add an "After Migration: Upgrading XMC" section to the component
migration runbook: xmc-profile is a separate Helm release that gcluster
and umbrella upgrades do not touch, and `migrate.py prepare` pins the
gateway imageTag (and parameters.image when a custom gateway image is
set), which takes precedence over the xmc-bridge default image. Replace
the elided gcluster command in Step 3 with the exact create/deploy
commands from INSTALL.md, and link the new section from INSTALL.md
upgrade Step 6.

TAG=agy
CONV=5fd8cc79-e39e-4f23-8a80-e529a7076077

* docs(migrations): reference <IMAGE_TAG> in post-migration upgrade step

Comment link: #1606 (comment)

TAG=agy
CONV=5fd8cc79-e39e-4f23-8a80-e529a7076077

* docs(install): re-compile blueprint before gcluster deploy on upgrade

Comment link: #1606 (comment)

TAG=agy
CONV=5fd8cc79-e39e-4f23-8a80-e529a7076077

docs(migrations): document xmc-profile upgrades after component cutov…

…er (#1606)

* docs(migrations): document xmc-profile upgrades after component cutover

Add an "After Migration: Upgrading XMC" section to the component
migration runbook: xmc-profile is a separate Helm release that gcluster
and umbrella upgrades do not touch, and `migrate.py prepare` pins the
gateway imageTag (and parameters.image when a custom gateway image is
set), which takes precedence over the xmc-bridge default image. Replace
the elided gcluster command in Step 3 with the exact create/deploy
commands from INSTALL.md, and link the new section from INSTALL.md
upgrade Step 6.

TAG=agy
CONV=5fd8cc79-e39e-4f23-8a80-e529a7076077

* docs(migrations): reference <IMAGE_TAG> in post-migration upgrade step

Comment link: #1606 (comment)

TAG=agy
CONV=5fd8cc79-e39e-4f23-8a80-e529a7076077

* docs(install): re-compile blueprint before gcluster deploy on upgrade

Comment link: #1606 (comment)

TAG=agy
CONV=5fd8cc79-e39e-4f23-8a80-e529a7076077

feat(rod): show running duration for running jobs in queue table (#1588)

* feat(rod): show running duration for running jobs in queue table

Add `int64 running_duration_seconds = 12` to `DashboardJob` and populate
it in `mapWorkUnitToDashboardJob` as `now - WorkUnitStatus.state_update_time`
when the current execution is `RUNNING`; it stays 0 for non-running jobs and
for missing, invalid, or future timestamps. `state_update_time` changes on
every state transition, so the value is the time since the job last entered
`RUNNING` and resets after a restart (`RESTARTING` -> `RUNNING`).

Add a "Running time" column to the queue jobs table, formatted by the pure
`QueueJobRunningTimePipe` (`45s`, `1m 30s`, `14h 22m`, `4d 19h`, or `–` for
jobs that are not running), with a header tooltip explaining the restart
reset. The pipe accepts the Proto3 JSON int64 string encoding. The
"Position" column is unchanged.

The column is shown in both the split view and the full-width view so
long-running jobs are visible as soon as a queue is selected, without
coupling the table to the dashboard's layout state; cells use `nowrap`
inside the existing horizontally scrollable container.

Bug: 582254269
TAG=agy
CONV=da847493-a56a-41af-821a-cd635a811ddd

* docs(rod): clarify running duration zero-value semantics

The gateway marshals with EmitUnpopulated, so a zero running duration is
sent as "0" rather than omitted; correct the pipe comment accordingly.
Document in the proto that the field is also zero for a RUNNING job whose
state_update_time is missing, invalid, or in the future.

TAG=agy
CONV=da847493-a56a-41af-821a-cd635a811ddd

* docs(rod): state precisely what running duration measures

Make the tooltip, proto comment and flow docs explicit that the value is the
time since XMC observed the job entering RUNNING (at least one pod ready),
trails the actual container start by the reconciliation delay, resets
whenever the job leaves RUNNING, and is not cumulative across restarts.

TAG=agy
CONV=da847493-a56a-41af-821a-cd635a811ddd

* docs(rod): describe running duration lag without readiness flapping

XMC jobs have no readiness probes, so a pod is ready as soon as its
containers run. State the real caveat instead: the value usually trails the
container start by a few seconds, and by longer only if the reconciler was
unavailable when the job started. Resets happen when a pod is replaced or
the job restarts.

TAG=agy
CONV=da847493-a56a-41af-821a-cd635a811ddd

chore(agents): route discovery and bazel wildcards and enforce file-n…

…aming lint (#1573)

* docs(agents): route file discovery, bazel wildcards, and scratch scripts

Surface three high-frequency cross-cutting routing conventions upfront in
.agents/AGENTS.md and TypeScript/Core Engineering rules so sessions stop
guessing file paths, Bazel package wildcards, or inline python3 -c strings:

- Route unfamiliar path discovery to `git ls-files <dir>` and `git grep`
  before file reads/edits, and index canonical `tools/` script locations in
  `.agents/AGENTS.md`.
- Clarify Angular/test file naming (`*.ng.html`, `*_test.ts`,
  `*.screenshot.spec.ts`, `*.test.js`) and the monolithic root
  `//cmd/ui:ui_unit_tests` Bazel package layout in
  `.agents/rules/languages/typescript_javascript.md`, alongside upfront
  `//<dir>/...` vs `:all` Bazel wildcard routing in `.agents/AGENTS.md`.
- Cross-link the existing standalone `.py` scratch-script rule from
  `python.md` §4 and `shell.md` §3 in `.agents/AGENTS.md` and
  `.agents/rules/core_engineering.md` §9 so non-Python sessions follow it too.

TAG=agy
CONV=5cd211b5-35b1-40f8-be9a-6bba26108f2b

* docs(agents): deduplicate routing bullets and enforce tool --help isolation

* chore(lint): enforce UI and workflow file-naming conventions

Add tools/lint/check_file_naming.py and wire it into .githooks/pre-commit
and .github/workflows/lint.yml to mechanically enforce the UI template,
UI test, and GitHub workflow script test naming conventions documented in
.agents/rules/languages/typescript_javascript.md:
- Angular component templates under cmd/ui/ must live under cmd/ui/app/
  and use *.ng.html (with root cmd/ui/index.html allowlisted and verified
  against stale entries).
- Angular Karma unit test specs must live under cmd/ui/app/ and use
  *_test.ts, closing the silent-skip gap where misnamed *.spec.ts or
  *.test.ts files compile without executing in Karma.
- Playwright visual regression specs under cmd/ui/screenshot_tests/ must
  use *.screenshot.spec.ts while preserving non-spec helpers such as
  test_utils.ts.
- Node workflow script tests under .github/scripts/ must be top-level
  *.test.js files matching CI's node --test .github/scripts/*.test.js
  invocation while preserving hyphenated production modules such as
  test-file-classifier.js.

Includes hermetic unit tests in tools/lint/check_file_naming_test.py,
Bazel targets in tools/lint/BUILD.bazel, and documentation updates in
.agents/rules/rule_authoring_standards.md, tools/README.md, and
docs/developer.md.

Comment link: #1573 (comment)
Comment link: #1573 (comment)

* fix(lint): allow test_* TypeScript fixtures and check git index paths directly

Remove the undocumented test_*.ts prohibition from
tools/lint/check_file_naming.py so test-support modules under
cmd/ui/app/testing/ and feature testing directories (such as
test_fixtures.ts) are not flagged as misnamed Karma specs.

Also tighten check_file_naming.py and its documentation/tests:
- Run _check_github_scripts before _check_ts_test_outside_screenshots so
  misnamed .github/scripts/*.test.ts files report the .github/scripts/
  *.test.js remediation message.
- Check tracked git-index paths directly without worktree .exists() or
  .is_file() filters so staged violations with unstaged worktree
  deletions cannot bypass .githooks/pre-commit.
- Require Karma _test specs under cmd/ui/app/ to end with .ts rather
  than .tsx/.mts/.cts, matching cmd/ui/angular.json (app/**/*_test.ts).
- Clarify repo-wide *.spec.ts / *.test.ts and cmd/ui/ *.html scope in
  tools/README.md and docs/developer.md, and assert the exact HandledError
  stderr JSON contract in check_file_naming_test.py.

Comment link: #1573 (comment)