From 2feffd6efa1bb693cf0dbadfe953545ad50d69ac Mon Sep 17 00:00:00 2001 From: roshan <38771624+rohoswagger@users.noreply.github.com> Date: Thu, 8 Oct 2026 22:53:04 +0000 Subject: [PATCH] feat(llm): gate release-notes fetch behind ONYX_AIRGAPPED (#15691) --- .../feature-map/components/notifications.md | 5 ++++- .../server/features/release_notes/utils.py | 3 ++- backend/shared_configs/configs.py | 4 ++-- .../server/features/release_notes/__init__.py | 0 .../features/release_notes/test_utils.py | 20 +++++++++++++++++++ .../embedded/docker_compose/env.template | 3 ++- deployment/docker_compose/env.template | 3 ++- deployment/helm/charts/onyx/values.yaml | 3 ++- 8 files changed, 34 insertions(+), 7 deletions(-) create mode 100644 backend/tests/unit/onyx/server/features/release_notes/__init__.py create mode 100644 backend/tests/unit/onyx/server/features/release_notes/test_utils.py diff --git a/.agents/feature-map/components/notifications.md b/.agents/feature-map/components/notifications.md index 0067f8c5c7..8cc5992864 100644 --- a/.agents/feature-map/components/notifications.md +++ b/.agents/feature-map/components/notifications.md @@ -69,7 +69,10 @@ Release notes have no dedicated endpoint. `ensure_release_notes_fresh_and_notify ### Env / config -None. Release-note fetch cadence is Redis-cached +`ONYX_AIRGAPPED` (shared_configs): when true, release-note fetching is +skipped entirely — no GitHub fetch, no new release-note `Notification` rows. + +Release-note fetch cadence is otherwise Redis-cached (`release_notes/constants.py:AUTO_REFRESH_THRESHOLD_SECONDS`, 1 hour), not env-driven. --- diff --git a/backend/onyx/server/features/release_notes/utils.py b/backend/onyx/server/features/release_notes/utils.py index c96bab3b2b..3de0ede4d3 100644 --- a/backend/onyx/server/features/release_notes/utils.py +++ b/backend/onyx/server/features/release_notes/utils.py @@ -22,6 +22,7 @@ from onyx.server.features.release_notes.constants import ( from onyx.server.features.release_notes.models import ReleaseNoteEntry from onyx.utils.datetime import datetime_to_utc from onyx.utils.logger import setup_logger +from shared_configs.configs import ONYX_AIRGAPPED logger = setup_logger() @@ -177,7 +178,7 @@ def ensure_release_notes_fresh_and_notify(db_session: Session) -> None: Since all users will trigger this via notification fetch, uses Redis lock to prevent concurrent GitHub requests when cache is stale. """ - if not is_cache_stale(): + if ONYX_AIRGAPPED or not is_cache_stale(): return cache = get_shared_cache_backend() diff --git a/backend/shared_configs/configs.py b/backend/shared_configs/configs.py index 2b7ac83264..d709be0720 100644 --- a/backend/shared_configs/configs.py +++ b/backend/shared_configs/configs.py @@ -196,8 +196,8 @@ CORS_ALLOW_CREDENTIALS: bool = cors_allow_credentials(CORS_ALLOWED_ORIGIN) MULTI_TENANT = os.environ.get("MULTI_TENANT", "").lower() == "true" # Air-gapped deployment: no outbound calls to onyx-controlled endpoints -# (recommended-models sync, remote model catalog lookup). Inbound traffic and -# user-configured integrations are unaffected. +# (recommended-models sync, remote model catalog lookup, release notes). +# Inbound traffic and user-configured integrations are unaffected. ONYX_AIRGAPPED = os.environ.get("ONYX_AIRGAPPED", "").lower() == "true" # How often to check GitHub for updated onyx-published LLM config diff --git a/backend/tests/unit/onyx/server/features/release_notes/__init__.py b/backend/tests/unit/onyx/server/features/release_notes/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/backend/tests/unit/onyx/server/features/release_notes/test_utils.py b/backend/tests/unit/onyx/server/features/release_notes/test_utils.py new file mode 100644 index 0000000000..f0360f0793 --- /dev/null +++ b/backend/tests/unit/onyx/server/features/release_notes/test_utils.py @@ -0,0 +1,20 @@ +"""Unit tests for release notes fetch gating.""" + +from unittest.mock import Mock, patch + +from onyx.server.features.release_notes import utils + + +def test_airgapped_skips_github_fetch() -> None: + """ONYX_AIRGAPPED short-circuits before any fetch machinery runs.""" + with ( + patch.object(utils, "ONYX_AIRGAPPED", True), + patch.object(utils, "is_cache_stale") as stale, + patch.object( + utils.httpx, + "get", + side_effect=AssertionError("must not fetch when air-gapped"), + ), + ): + utils.ensure_release_notes_fresh_and_notify(db_session=Mock()) + stale.assert_not_called() diff --git a/cli/internal/deploy/deployfiles/embedded/docker_compose/env.template b/cli/internal/deploy/deployfiles/embedded/docker_compose/env.template index f514512b67..dbf6473c01 100644 --- a/cli/internal/deploy/deployfiles/embedded/docker_compose/env.template +++ b/cli/internal/deploy/deployfiles/embedded/docker_compose/env.template @@ -68,7 +68,8 @@ IMAGE_TAG=latest ## Air-gapped deployments: set to "true" to disable outbound calls to ## onyx-controlled endpoints (recommended-models sync, remote model catalog -## lookup). Inbound traffic and user-configured integrations are unaffected. +## lookup, release notes). Inbound traffic and user-configured integrations +## are unaffected. # ONYX_AIRGAPPED= ## Auth Settings diff --git a/deployment/docker_compose/env.template b/deployment/docker_compose/env.template index f514512b67..dbf6473c01 100644 --- a/deployment/docker_compose/env.template +++ b/deployment/docker_compose/env.template @@ -68,7 +68,8 @@ IMAGE_TAG=latest ## Air-gapped deployments: set to "true" to disable outbound calls to ## onyx-controlled endpoints (recommended-models sync, remote model catalog -## lookup). Inbound traffic and user-configured integrations are unaffected. +## lookup, release notes). Inbound traffic and user-configured integrations +## are unaffected. # ONYX_AIRGAPPED= ## Auth Settings diff --git a/deployment/helm/charts/onyx/values.yaml b/deployment/helm/charts/onyx/values.yaml index 0c9a746d15..97d2c46766 100644 --- a/deployment/helm/charts/onyx/values.yaml +++ b/deployment/helm/charts/onyx/values.yaml @@ -1661,7 +1661,8 @@ configMap: # See deployment/helm/README.md for the external-Redis / ElastiCache path. # Air-gapped deployments: set to "true" to disable outbound calls to # onyx-controlled endpoints (recommended-models sync, remote model catalog - # lookup). Inbound traffic and user-configured integrations are unaffected. + # lookup, release notes). Inbound traffic and user-configured integrations + # are unaffected. ONYX_AIRGAPPED: "" # Redis socket deadlines in seconds for the app client (not Celery), default # 30 and 10. A peer that stops replying but keeps the TCP session open raises