[master] Merge forward from 3008.x

.github/workflows/build-deps-ci-action.yml

@@ -162,7 +162,7 @@ jobs:
 
   macos-dependencies:
     name: MacOS
-    runs-on: ${{ matrix.arch == 'x86_64' && 'macos-15-intel' || 'macos-14' }}
+    runs-on: ${{ matrix.arch == 'x86_64' && 'macos-15-intel' || 'macos-15' }}
     if: ${{ toJSON(fromJSON(inputs.matrix)['macos']) != '[]' }}
     timeout-minutes: 90
     strategy:

.github/workflows/build-packages.yml

@@ -372,7 +372,7 @@ jobs:
     env:
       PIP_INDEX_URL: https://pypi.org/simple
     runs-on:
-      - ${{ matrix.arch == 'arm64' && 'macos-14' || 'macos-15-intel' }}
+      - ${{ matrix.arch == 'arm64' && 'macos-15' || 'macos-15-intel' }}
 
     steps:
       - name: Check Package Signing Enabled

.github/workflows/build-salt-onedir.yml

@@ -109,7 +109,7 @@ jobs:
       matrix:
         include: ${{ fromJSON(inputs.matrix)['macos'] }}
     runs-on:
-      - ${{ matrix.arch == 'arm64' && 'macos-14' || 'macos-15-intel' }}
+      - ${{ matrix.arch == 'arm64' && 'macos-15' || 'macos-15-intel' }}
     env:
       PIP_INDEX_URL: https://pypi.org/simple
       USE_S3_CACHE: 'false'

.github/workflows/ci.yml

@@ -10,6 +10,8 @@ on:
       - 3006.x
       - 3007.x
       - 3008.x
+      - '[0-9][0-9][0-9][0-9].[0-9]*-[0-9]*'
+      - '[0-9][0-9][0-9][0-9].[0-9]*-patch'
       - master
   pull_request:
     types:
@@ -464,8 +466,8 @@ jobs:
     with:
       cache-seed: ${{ needs.prepare-workflow.outputs.cache-seed }}
       salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
-      relenv-version: "0.22.14"
-      python-version: "3.14.6"
+      relenv-version: "0.22.25"
+      python-version: "3.14.7"
       ci-python-version: "3.14"
       matrix: ${{ toJSON(fromJSON(needs.prepare-workflow.outputs.config)['build-matrix']) }}
       linux_arm_runner: ${{ fromJSON(needs.prepare-workflow.outputs.config)['linux_arm_runner'] }}
@@ -481,8 +483,8 @@ jobs:
     with:
       salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}
-      relenv-version: "0.22.14"
-      python-version: "3.14.6"
+      relenv-version: "0.22.25"
+      python-version: "3.14.7"
       ci-python-version: "3.14"
       source: "onedir"
       matrix: ${{ toJSON(fromJSON(needs.prepare-workflow.outputs.config)['build-matrix']) }}
@@ -498,8 +500,8 @@ jobs:
     with:
       salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}
-      relenv-version: "0.22.14"
-      python-version: "3.14.6"
+      relenv-version: "0.22.25"
+      python-version: "3.14.7"
       ci-python-version: "3.14"
       source: "src"
       matrix: ${{ toJSON(fromJSON(needs.prepare-workflow.outputs.config)['build-matrix']) }}
@@ -514,10 +516,10 @@ jobs:
     with:
       nox-session: ci-test-onedir
       nox-version: 2022.8.7
-      python-version: "3.14.6"
+      python-version: "3.14.7"
       ci-python-version: "3.14"
       salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
-      cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.14.6
+      cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.14.7
       nox-archive-hash: "${{ needs.prepare-workflow.outputs.nox-archive-hash }}"
       matrix: ${{ toJSON(fromJSON(needs.prepare-workflow.outputs.config)['build-matrix']) }}
       linux_arm_runner: ${{ fromJSON(needs.prepare-workflow.outputs.config)['linux_arm_runner'] }}
@@ -535,7 +537,7 @@ jobs:
       salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
       nox-version: 2022.8.7
       ci-python-version: "3.14"
-      cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.14.6
+      cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.14.7
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.config)['skip_code_coverage'] }}
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
       matrix: ${{ toJSON(fromJSON(needs.prepare-workflow.outputs.config)['pkg-test-matrix']) }}
@@ -554,7 +556,7 @@ jobs:
       ci-python-version: "3.14"
       testrun: ${{ toJSON(fromJSON(needs.prepare-workflow.outputs.config)['testrun']) }}
       salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
-      cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.14.6
+      cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.14.7
       skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.config)['skip_code_coverage'] }}
       workflow-slug: ci
       default-timeout: 180

.github/workflows/nightly-stress-test.yml

@@ -6,9 +6,33 @@ on:
   workflow_dispatch:
     inputs:
       duration:
-        description: 'Duration of the stress test (e.g., 30m, 1h)'
+        description: Stress test duration (GitHub-hosted runner caps at 6h)
         required: true
-        default: '30m'
+        default: '0.5h'
+        type: choice
+        options:
+          - '10m'
+          - '0.5h'
+          - '1h'
+          - '1.5h'
+          - '2h'
+          - '2.5h'
+          - '3h'
+          - '3.5h'
+          - '4h'
+          - '4.5h'
+          - '5h'
+          - '5.5h'
+      enable_metrics:
+        description: Enable OpenTelemetry metrics (metrics.enabled)
+        required: false
+        default: false
+        type: boolean
+      worker_threads:
+        description: Salt master worker_threads
+        required: false
+        default: '5'
+        type: string
 
 jobs:
   stress-test:
@@ -52,6 +76,59 @@ jobs:
           docker compose up -d
           sleep 30 # Wait for initialization
 
+      - name: Configure salt-master
+        # Apply the workflow_dispatch overrides to ``master.conf`` and,
+        # if anything actually changed, restart salt-master so it picks
+        # them up.  ``metrics.enabled`` gates the entire
+        # ``salt.utils.metrics`` stack (including the ``_load_otel``
+        # deferred OpenTelemetry import); the pip package on disk has
+        # zero runtime cost when this gate is off, so a config toggle
+        # is all that is needed to measure the OTel-on vs OTel-off
+        # profile.  ``worker_threads`` sizes the MWorker pool and lets
+        # a run sweep the parallelism / RSS trade-off.
+        env:
+          ENABLE_METRICS: ${{ github.event.inputs.enable_metrics || 'false' }}
+          WORKER_THREADS: ${{ github.event.inputs.worker_threads || '5' }}
+        run: |
+          cd tests/monitoring
+          need_restart=0
+
+          if [ "$ENABLE_METRICS" = "true" ]; then
+            echo "Enabling OpenTelemetry metrics on salt-master"
+            # Append the metrics block only if not already present so
+            # re-runs are idempotent.  ``printf`` (not a heredoc) keeps
+            # the YAML block-scalar indentation intact.
+            if ! grep -q '^metrics:' master.conf; then
+              printf '\nmetrics:\n  enabled: true\n' >> master.conf
+              need_restart=1
+            fi
+          else
+            echo "Leaving metrics.enabled at default (false); OTel package is"
+            echo "shipped but never imported by the lazy loader."
+          fi
+
+          # Update ``worker_threads`` only when it differs from the value
+          # already in the file, so unchanged defaults skip the restart.
+          current_workers=$(awk '/^worker_threads:/ {print $2}' master.conf)
+          if [ -n "$current_workers" ] && [ "$current_workers" != "$WORKER_THREADS" ]; then
+            echo "Setting worker_threads: $current_workers -> $WORKER_THREADS"
+            sed -i "s/^worker_threads:.*/worker_threads: $WORKER_THREADS/" master.conf
+            need_restart=1
+          fi
+
+          if [ "$need_restart" = "1" ]; then
+            docker restart salt-master
+            sleep 20
+          fi
+
+          if [ "$ENABLE_METRICS" = "true" ]; then
+            # Trigger a code path that calls ``metrics.configure`` so
+            # the OpenTelemetry import fires and any misconfiguration
+            # surfaces here rather than mid-stress.
+            docker exec salt-master python3 -c \
+              "import salt.utils.metrics as m; m._load_otel(); assert m._OTEL_AVAILABLE, 'OTel import failed'"
+          fi
+
       - name: Verify Connections
         # The salt CLI returns exit 0 even when the master returns an
         # error string (the legacy ``'str' object has no attribute
@@ -99,7 +176,7 @@ jobs:
           STRESS_PID=$!
 
           # Default to 30m if not workflow_dispatch
-          DURATION="${{ github.event.inputs.duration || '30m' }}"
+          DURATION="${{ github.event.inputs.duration || '0.5h' }}"
           echo "Running stress test for $DURATION..."
 
           # Use sleep with suffix support (m, h)

.github/workflows/nightly.yml

@@ -457,8 +457,8 @@ jobs:
     with:
       cache-seed: ${{ needs.prepare-workflow.outputs.cache-seed }}
       salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
-      relenv-version: "0.22.14"
-      python-version: "3.14.6"
+      relenv-version: "0.22.25"
+      python-version: "3.14.7"
       ci-python-version: "3.14"
       matrix: ${{ toJSON(fromJSON(needs.prepare-workflow.outputs.config)['build-matrix']) }}
       linux_arm_runner: ${{ fromJSON(needs.prepare-workflow.outputs.config)['linux_arm_runner'] }}
@@ -475,8 +475,8 @@ jobs:
     with:
       salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}
-      relenv-version: "0.22.14"
-      python-version: "3.14.6"
+      relenv-version: "0.22.25"
+      python-version: "3.14.7"
       ci-python-version: "3.14"
       source: "onedir"
       matrix: ${{ toJSON(fromJSON(needs.prepare-workflow.outputs.config)['build-matrix']) }}
@@ -498,8 +498,8 @@ jobs:
     with:
       salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}
-      relenv-version: "0.22.14"
-      python-version: "3.14.6"
+      relenv-version: "0.22.25"
+      python-version: "3.14.7"
       ci-python-version: "3.14"
       source: "src"
       matrix: ${{ toJSON(fromJSON(needs.prepare-workflow.outputs.config)['build-matrix']) }}
@@ -519,10 +519,10 @@ jobs:
     with:
       nox-session: ci-test-onedir
       nox-version: 2022.8.7
-      python-version: "3.14.6"
+      python-version: "3.14.7"
       ci-python-version: "3.14"
       salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
-      cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.14.6
+      cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.14.7
       nox-archive-hash: "${{ needs.prepare-workflow.outputs.nox-archive-hash }}"
       matrix: ${{ toJSON(fromJSON(needs.prepare-workflow.outputs.config)['build-matrix']) }}
       linux_arm_runner: ${{ fromJSON(needs.prepare-workflow.outputs.config)['linux_arm_runner'] }}
@@ -540,7 +540,7 @@ jobs:
       salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
       nox-version: 2022.8.7
       ci-python-version: "3.14"
-      cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.14.6
+      cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.14.7
       skip-code-coverage: true
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
       matrix: ${{ toJSON(fromJSON(needs.prepare-workflow.outputs.config)['pkg-test-matrix']) }}
@@ -559,7 +559,7 @@ jobs:
       ci-python-version: "3.14"
       testrun: ${{ toJSON(fromJSON(needs.prepare-workflow.outputs.config)['testrun']) }}
       salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
-      cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.14.6
+      cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.14.7
       skip-code-coverage: true
       workflow-slug: nightly
       default-timeout: 360

.github/workflows/release.yml

@@ -12,11 +12,15 @@ on:
           DO NOT prefix the version with a "v" (use 3006.0, not v3006.0).
           For prereleases use the PEP 440 form WITHOUT a hyphen
           (use 3008.0rc1, not 3008.0-rc1).
+          For patch releases use the post-release form with a hyphen and number
+          (use 3008.1-1 for the first patch of 3008.1).
           The Python sdist/wheel and the GitHub tag/release will use this
-          string verbatim (e.g. "salt-3008.0rc1.tar.gz" / "v3008.0rc1").
+          string verbatim (e.g. "salt-3008.0rc1.tar.gz" / "v3008.0rc1",
+          "salt-3008.1-1.tar.gz" / "v3008.1-1").
           The RPM "Version:" and the Debian changelog stanza substitute
           "rc" for "~rc" so prereleases sort before the GA version
-          (e.g. "3008.0~rc1" < "3008.0").
+          (e.g. "3008.0~rc1" < "3008.0").  Patch releases set RPM Release: N
+          so they sort after the base (e.g. "3008.1-1" > "3008.1-0").
       skip-salt-pkg-download-test-suite:
         type: boolean
         default: false
@@ -94,6 +98,12 @@ jobs:
           salt-version: "${{ inputs.salt-version }}"
           validate-version: true
 
+      - name: Check For Duplicate Draft Releases
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          tools ci check-draft-releases ${{ steps.setup-salt-version.outputs.salt-version }}
+
       - name: Get Salt Releases
         id: get-salt-releases
         env:
@@ -198,7 +208,7 @@ jobs:
 
   publish-pypi:
     name: Publish to PyPi
-    if: ${{ always() && ! failure() && ! cancelled() && github.event.repository.fork != true }}
+    if: ${{ always() && ! failure() && ! cancelled() && github.event.repository.fork != true && !contains(inputs.salt-version, '-') }}
     needs:
       - prepare-workflow
       - release
@@ -248,7 +258,7 @@ jobs:
 
   publish-draft:
     name: Publish Relase v${{ needs.prepare-workflow.outputs.salt-version }}
-    if: ${{ !cancelled() && always() }}
+    if: ${{ !cancelled() && !failure() }}
     runs-on: ubuntu-22.04
     needs:
       - check-requirements

.github/workflows/scheduled.yml

@@ -511,8 +511,8 @@ jobs:
     with:
       cache-seed: ${{ needs.prepare-workflow.outputs.cache-seed }}
       salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
-      relenv-version: "0.22.14"
-      python-version: "3.14.6"
+      relenv-version: "0.22.25"
+      python-version: "3.14.7"
       ci-python-version: "3.14"
       matrix: ${{ toJSON(fromJSON(needs.prepare-workflow.outputs.config)['build-matrix']) }}
       linux_arm_runner: ${{ fromJSON(needs.prepare-workflow.outputs.config)['linux_arm_runner'] }}
@@ -528,8 +528,8 @@ jobs:
     with:
       salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}
-      relenv-version: "0.22.14"
-      python-version: "3.14.6"
+      relenv-version: "0.22.25"
+      python-version: "3.14.7"
       ci-python-version: "3.14"
       source: "onedir"
       matrix: ${{ toJSON(fromJSON(needs.prepare-workflow.outputs.config)['build-matrix']) }}
@@ -545,8 +545,8 @@ jobs:
     with:
       salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}
-      relenv-version: "0.22.14"
-      python-version: "3.14.6"
+      relenv-version: "0.22.25"
+      python-version: "3.14.7"
       ci-python-version: "3.14"
       source: "src"
       matrix: ${{ toJSON(fromJSON(needs.prepare-workflow.outputs.config)['build-matrix']) }}
@@ -561,10 +561,10 @@ jobs:
     with:
       nox-session: ci-test-onedir
       nox-version: 2022.8.7
-      python-version: "3.14.6"
+      python-version: "3.14.7"
       ci-python-version: "3.14"
       salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
-      cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.14.6
+      cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.14.7
       nox-archive-hash: "${{ needs.prepare-workflow.outputs.nox-archive-hash }}"
       matrix: ${{ toJSON(fromJSON(needs.prepare-workflow.outputs.config)['build-matrix']) }}
       linux_arm_runner: ${{ fromJSON(needs.prepare-workflow.outputs.config)['linux_arm_runner'] }}
@@ -582,7 +582,7 @@ jobs:
       salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
       nox-version: 2022.8.7
       ci-python-version: "3.14"
-      cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.14.6
+      cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.14.7
       skip-code-coverage: true
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
       matrix: ${{ toJSON(fromJSON(needs.prepare-workflow.outputs.config)['pkg-test-matrix']) }}
@@ -601,7 +601,7 @@ jobs:
       ci-python-version: "3.14"
       testrun: ${{ toJSON(fromJSON(needs.prepare-workflow.outputs.config)['testrun']) }}
       salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
-      cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.14.6
+      cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.14.7
       skip-code-coverage: true
       workflow-slug: scheduled
       default-timeout: 360