Merge branch 'main' into fix/reschedule-start-date-context

Author: hkc-8010

.github/CODEOWNERS

@@ -162,8 +162,15 @@ Dockerfile.ci @potiuk @ashb @gopidesupavan @amoghrajesh @jscheffl @bugraoz93 @ja
 # Python SDK
 /task-sdk/ @ashb @kaxil @amoghrajesh
 
+# AIP-108 - Coordinators
+/task-sdk/src/airflow/sdk/coordinators/ @jason810496 @uranusjr
+/task-sdk/src/airflow/sdk/execution_time/coordinator.py @jason810496 @uranusjr
+
 # Golang SDK
-/go-sdk/ @ashb @amoghrajesh
+/go-sdk/ @ashb @amoghrajesh @jason810496
+
+# Java SDK
+/java-sdk/ @uranusjr @jason810496
 
 # Shared Libraries
 /shared/ @ashb @amoghrajesh @potiuk

.github/dependabot.yml

@@ -42,19 +42,6 @@ updates:
         patterns:
           - "*"
 
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    cooldown:
-      default-days: 4
-    schedule:
-      # Check for updates to GitHub Actions every week
-      interval: "weekly"
-    target-branch: v2-11-test
-    groups:
-      github-actions-updates:
-        patterns:
-          - "*"
-
   - package-ecosystem: pip
     cooldown:
       default-days: 4
@@ -260,39 +247,6 @@ updates:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
 
-  # Repeat dependency updates on 2.11 branch as well
-  - package-ecosystem: pip
-    cooldown:
-      default-days: 4
-    directories:
-      - /clients/python
-      - /dev/breeze
-      - /docker_tests
-      - /
-    schedule:
-      interval: "weekly"
-    target-branch: v2-11-test
-    groups:
-      pip-dependency-updates:
-        patterns:
-          - "*"
-
-  - package-ecosystem: npm
-    cooldown:
-      default-days: 4
-    directories:
-      - /airflow/www/
-    schedule:
-      interval: "weekly"
-    target-branch: v2-11-test
-    groups:
-      legacy-ui-package-updates:
-        patterns:
-          - "*"
-    ignore:
-      - dependency-name: "*"
-        update-types: ["version-update:semver-major"]
-
   - package-ecosystem: "uv"
     cooldown:
       default-days: 4

.github/workflows/ci-amd.yml

@@ -26,10 +26,11 @@
 name: Tests (AMD)
 on:  # yamllint disable-line rule:truthy
   schedule:
-    # Mirror of the previous AMD canary cron from before the AMD/ARM split (PR #66348),
-    # offset by 30 min from ARM's `:28` slot in `ci-arm.yml` so the two scheduled
-    # canaries don't compete for runners at exactly the same minute.
-    - cron: '58 1,7,13,19 * * *'
+    # AMD canary runs 2x/day (01:58, 13:58), interleaved with ARM's 2x/day (07:28, 19:28)
+    # in `ci-arm.yml` so a full-matrix canary still runs roughly every ~6h (alternating
+    # architecture) while halving the scheduled AMD compute. The `:58` vs ARM's `:28`
+    # offset keeps the two from competing for runners at exactly the same minute.
+    - cron: '58 1,13 * * *'
   pull_request:
     branches:
       - main

.github/workflows/ci-arm.yml

@@ -26,7 +26,11 @@
 name: Tests (ARM)
 on:  # yamllint disable-line rule:truthy
   schedule:
-    - cron: '28 1,3,7,9,13,15,19,21 * * *'
+    # ARM canary runs 2x/day (07:28, 19:28), interleaved with AMD's 2x/day (01:58, 13:58)
+    # in `ci-amd.yml` so a full-matrix canary still runs roughly every ~6h (alternating
+    # architecture). The `:28` vs AMD's `:58` offset keeps the two from competing for
+    # runners at exactly the same minute.
+    - cron: '28 7,19 * * *'
   push:
     # Post-merge pushes to release-prep / providers branches run on both
     # AMD and ARM (the matching block lives in the other wrapper too —

.github/workflows/publish-docs-to-s3.yml

@@ -88,7 +88,7 @@ jobs:
       AIRFLOW_VERSION: ${{ inputs.airflow-version || '' }}
       APPLY_COMMITS: ${{ inputs.apply-commits || '' }}
     outputs:
-      include-docs: ${{ inputs.include-docs == 'all' && '' || inputs.include-docs }}
+      include-docs: ${{ case(inputs.include-docs == 'all', '', inputs.include-docs) }}
       destination-location: ${{ steps.parameters.outputs.destination-location }}
       destination: ${{ steps.parameters.outputs.destination }}
       extra-build-options: ${{ steps.parameters.outputs.extra-build-options }}

.github/workflows/run-unit-tests.yml

@@ -136,8 +136,8 @@ jobs:
     timeout-minutes: 65
     # yamllint disable rule:line-length
     name: "\
-      ${{ inputs.test-scope == 'All' && '' || inputs.test-scope == 'Quarantined' && 'Qrnt' || inputs.test-scope }}\
-      ${{ inputs.test-scope == 'All' && '' || '-' }}\
+      ${{ case(inputs.test-scope == 'Quarantined', 'Qrnt', inputs.test-scope == 'All', '', inputs.test-scope) }}\
+      ${{ case(inputs.test-scope == 'All', '', '-') }}\
       ${{ inputs.test-group == 'providers' && 'prov' || inputs.test-group}}:\
       ${{ inputs.test-name }}${{ inputs.test-name-separator }}${{ matrix.backend-version }}:\
       ${{ matrix.python-version}}:${{ matrix.test-types.description }}"

.pre-commit-config.yaml

@@ -249,6 +249,21 @@ repos:
           ^pyproject\.toml$
         pass_filenames: false
         require_serial: true
+      - id: ts-sdk-lint
+        name: Lint TypeScript SDK
+        entry: ./ts-sdk/scripts/ci/prek/ts_sdk_lint.py
+        language: node
+        files: |
+          (?x)
+          ^ts-sdk/.*\.(js|ts|json)$
+        exclude: |
+          (?x)
+          ^ts-sdk/node_modules/.*|
+          ^ts-sdk/.pnpm-store/.*|
+          ^ts-sdk/dist/.*
+        additional_dependencies: ['pnpm@10.28.1']
+        pass_filenames: false
+        require_serial: true
       - id: check-ci-workflows-in-sync
         name: Check ci-arm.yml and ci-amd.yml stay in sync
         entry: ./scripts/ci/prek/check_ci_workflows_in_sync.py

AGENTS.md

@@ -160,6 +160,11 @@ reported as such are described in "What is NOT considered a security vulnerabili
 - Test location mirrors source: `airflow/cli/cli_parser.py` → `tests/cli/test_cli_parser.py`.
 - Do not use `caplog` in tests, prefer checking logic and not log output.
 
+## Output conventions
+
+- Put any files you generate (PR reviews, reports, scratch output) under `files/`.
+- Create `files/` if it doesn't exist.
+
 
 ## Commits and PRs
 

airflow-core/docs/administration-and-deployment/dag-bundles.rst

@@ -61,6 +61,24 @@ Configuring Dag bundles
 
 Dag bundles are configured in :ref:`config:dag_processor__dag_bundle_config_list`. You can add one or more Dag bundles here.
 
+.. warning:: Reference credentials through a Connection — do not inline them
+
+    Bundle ``kwargs`` are stored in the ``[dag_processor] dag_bundle_config_list``
+    configuration, which Airflow exposes through the Config API when
+    :ref:`config:api__expose_config` is enabled. Any user authorized to read the
+    configuration can read these values verbatim, so they must not contain secrets.
+
+    Do **not** embed credentials directly in bundle ``kwargs`` — for example a
+    token placed directly in a ``repo_url`` like
+    ``https://x-access-token:<token>@github.com/org/repo.git``. Instead reference
+    an Airflow :doc:`Connection <../authoring-and-scheduling/connections>`
+    (``git_conn_id`` for Git, ``aws_conn_id`` for S3, ``gcp_conn_id`` for GCS) and
+    keep the credential in your
+    :doc:`secrets backend <../security/secrets/secrets-backend/index>`. Connection
+    fields are resolved at runtime and are not written into
+    ``dag_bundle_config_list``.
+
+
 By default, Airflow adds a ``LocalDagBundle`` pointing at the configured Dags folder, maintaining the same behaviour as Airflow 2's Dags folder. The only kwarg is ``path``, which defaults to the value of :ref:`config:core__dags_folder` when omitted:
 
 .. code-block:: ini

airflow-core/docs/administration-and-deployment/logging-monitoring/metrics.rst

@@ -115,6 +115,42 @@ You need to configure the SSL certificate and key within the OpenTelemetry colle
              cert_file: "/path/to/cert/cert.crt"
              key_file: "/path/to/key/key.pem"
 
+Histogram Metrics and Backend Requirements
+------------------------------------------
+
+Airflow's timing metrics (``timing()`` / ``timer()``) are emitted as OpenTelemetry
+histograms aggregated with
+`exponential bucket histograms <https://opentelemetry.io/docs/specs/otel/metrics/data-model/#exponentialhistogram>`_,
+so bucket boundaries adapt automatically to the observed range and you do not have to
+hand-tune explicit buckets for metrics that span very different scales (milliseconds to
+hours).
+
+To ingest these correctly end-to-end, the metrics backend you connect to must support
+OpenTelemetry exponential histograms and (for Prometheus) their conversion to native
+histograms:
+
+* **OpenTelemetry Collector** — use ``opentelemetry-collector-contrib`` version 0.115.0
+  or above. Older versions do not translate OTLP exponential histograms into Prometheus
+  native histograms.
+* **Prometheus** — native histograms must be enabled explicitly, and how you do that
+  depends on the Prometheus version:
+
+  * **2.40 to 3.8** — start Prometheus with the ``--enable-feature=native-histograms``
+    flag.
+  * **3.8 and above** — set ``scrape_native_histograms: true`` in the scrape
+    configuration (this option was added in 3.8, and from 3.9 the feature flag is a
+    no-op so the config setting is required):
+
+    .. code-block:: yaml
+
+        global:
+            scrape_native_histograms: true
+
+If the backend does not support native histograms, exponential-histogram data points may
+be dropped or rendered incorrectly. A reference stack (Collector, Prometheus, and Grafana)
+wired up for local development is available via ``breeze start-airflow --integration otel``;
+see the contributor docs for details.
+
 Allow/Block Lists
 -----------------