feat(llm): gate release-notes fetch behind ONYX_AIRGAPPED (#15691)

.agents/feature-map/components/notifications.md

@@ -69,7 +69,10 @@ Release notes have no dedicated endpoint. `ensure_release_notes_fresh_and_notify
 
 ### Env / config
 
-None. Release-note fetch cadence is Redis-cached
+`ONYX_AIRGAPPED` (shared_configs): when true, release-note fetching is
+skipped entirely — no GitHub fetch, no new release-note `Notification` rows.
+
+Release-note fetch cadence is otherwise Redis-cached
 (`release_notes/constants.py:AUTO_REFRESH_THRESHOLD_SECONDS`, 1 hour), not env-driven.
 
 ---

backend/onyx/server/features/release_notes/utils.py

@@ -22,6 +22,7 @@ from onyx.server.features.release_notes.constants import (
 from onyx.server.features.release_notes.models import ReleaseNoteEntry
 from onyx.utils.datetime import datetime_to_utc
 from onyx.utils.logger import setup_logger
+from shared_configs.configs import ONYX_AIRGAPPED
 
 logger = setup_logger()
 
@@ -177,7 +178,7 @@ def ensure_release_notes_fresh_and_notify(db_session: Session) -> None:
     Since all users will trigger this via notification fetch,
     uses Redis lock to prevent concurrent GitHub requests when cache is stale.
     """
-    if not is_cache_stale():
+    if ONYX_AIRGAPPED or not is_cache_stale():
         return
 
     cache = get_shared_cache_backend()

backend/shared_configs/configs.py

@@ -196,8 +196,8 @@ CORS_ALLOW_CREDENTIALS: bool = cors_allow_credentials(CORS_ALLOWED_ORIGIN)
 MULTI_TENANT = os.environ.get("MULTI_TENANT", "").lower() == "true"
 
 # Air-gapped deployment: no outbound calls to onyx-controlled endpoints
-# (recommended-models sync, remote model catalog lookup). Inbound traffic and
-# user-configured integrations are unaffected.
+# (recommended-models sync, remote model catalog lookup, release notes).
+# Inbound traffic and user-configured integrations are unaffected.
 ONYX_AIRGAPPED = os.environ.get("ONYX_AIRGAPPED", "").lower() == "true"
 
 # How often to check GitHub for updated onyx-published LLM config

backend/tests/unit/onyx/server/features/release_notes/test_utils.py

@@ -0,0 +1,20 @@
+"""Unit tests for release notes fetch gating."""
+
+from unittest.mock import Mock, patch
+
+from onyx.server.features.release_notes import utils
+
+
+def test_airgapped_skips_github_fetch() -> None:
+    """ONYX_AIRGAPPED short-circuits before any fetch machinery runs."""
+    with (
+        patch.object(utils, "ONYX_AIRGAPPED", True),
+        patch.object(utils, "is_cache_stale") as stale,
+        patch.object(
+            utils.httpx,
+            "get",
+            side_effect=AssertionError("must not fetch when air-gapped"),
+        ),
+    ):
+        utils.ensure_release_notes_fresh_and_notify(db_session=Mock())
+        stale.assert_not_called()

cli/internal/deploy/deployfiles/embedded/docker_compose/env.template

@@ -68,7 +68,8 @@ IMAGE_TAG=latest
 
 ## Air-gapped deployments: set to "true" to disable outbound calls to
 ## onyx-controlled endpoints (recommended-models sync, remote model catalog
-## lookup). Inbound traffic and user-configured integrations are unaffected.
+## lookup, release notes). Inbound traffic and user-configured integrations
+## are unaffected.
 # ONYX_AIRGAPPED=
 
 ## Auth Settings

deployment/docker_compose/env.template

@@ -68,7 +68,8 @@ IMAGE_TAG=latest
 
 ## Air-gapped deployments: set to "true" to disable outbound calls to
 ## onyx-controlled endpoints (recommended-models sync, remote model catalog
-## lookup). Inbound traffic and user-configured integrations are unaffected.
+## lookup, release notes). Inbound traffic and user-configured integrations
+## are unaffected.
 # ONYX_AIRGAPPED=
 
 ## Auth Settings

deployment/helm/charts/onyx/values.yaml

@@ -1661,7 +1661,8 @@ configMap:
   # See deployment/helm/README.md for the external-Redis / ElastiCache path.
   # Air-gapped deployments: set to "true" to disable outbound calls to
   # onyx-controlled endpoints (recommended-models sync, remote model catalog
-  # lookup). Inbound traffic and user-configured integrations are unaffected.
+  # lookup, release notes). Inbound traffic and user-configured integrations
+  # are unaffected.
   ONYX_AIRGAPPED: ""
   # Redis socket deadlines in seconds for the app client (not Celery), default
   # 30 and 10. A peer that stops replying but keeps the TCP session open raises