ci: fix merge-conflict regressions from main pickup (runner labels, ui.bzl, fork cockpit)

The merge of main into ae-followup-auth (0c65751) silently took the
upstream version on a swath of files where the fork had previously
deviated. This commit reverts the merge's regressions back to the
fork-correct state (origin/ae-prod) AND completes the runner-label
sweep so every release/mirror/perf workflow uses the same -vm-16cpu
label the fork's runner pool actually has.

1. Runner labels — main re-introduced 'oracle-16cpu-64gb-x86-64' and
   'oracle-8cpu-32gb-x86-64' on 7 workflows. Fork's pool only resolves
   'oracle-vm-16cpu-64gb-x86-64'; both stale labels sit queued forever.
   Fixed: cli_release.yaml (L18+L212), cloud_release.yaml (L18),
   mirror_demos.yaml (L12), mirror_deps.yaml (L12),
   mirror_releases.yaml (L13), operator_release.yaml (L18+L143),
   perf_common.yaml (L37+L60). vizier_release.yaml L18 was fixed
   already in 0fd9c3f.

2. bazel/ui.bzl — main reverted PR #64's webpack-build fixes that
   broke release/cloud/v0.0.10 with 'export: `18': not a valid
   identifier'. Restored: 'set -x' for action-shell tracing, PATH
   that puts /opt/px_dev/tools/node/bin FIRST, 'hash -r', the
   STABLE_BUILD_TAG|BUILD_TIMESTAMP allowlist sed (vs the wildcard
   that word-splits FORMATTED_DATE), and use_default_shell_env=True
   so --incompatible_strict_action_env doesn't strip yarn from PATH.

3. 28 fork-cloud config files — main's PR pixie-io#2391 (cert-manager
   migration) deleted private/cockpit/*,
   terraform/kubernetes/auth0/*, terraform/kubernetes/cloud_deps/*,
   .sops.yaml, private/skaffold_cloud.yaml. These are still load-
   bearing for the AOCC pixie-cloud deployment; the fork hasn't
   migrated to cert-manager-compatible secrets yet (PR pixie-io#2391's
   monitor.go fallback path is in place, so adoption is the
   follow-up, not a blocker). Restored all 28 from origin/ae-prod.

Genuine main pickups that were CORRECT to keep (no fix needed): the
src/utils/shared/k8s/{apply,delete}.go import-order +
sets.New[string] generics migration,
src/operator/controllers/monitor.go's cert-manager secret fallback,
and the src/carnot/BUILD.bazel + src/carnot/exec/BUILD.bazel
additions.

Author: entlein

.github/workflows/cli_release.yaml

@@ -15,7 +15,7 @@ jobs:
       image-base-name: "dev_image_with_extras"
   build-release:
     name: Build Release
-    runs-on: oracle-16cpu-64gb-x86-64
+    runs-on: oracle-vm-16cpu-64gb-x86-64
     needs: get-dev-image
     permissions:
       contents: read
@@ -209,7 +209,7 @@ jobs:
   update-gh-artifacts-manifest:
     if: |
       always() && needs.create-github-release.result == 'success'
-    runs-on: oracle-8cpu-32gb-x86-64
+    runs-on: oracle-vm-16cpu-64gb-x86-64
     needs: [get-dev-image, create-github-release]
     container:
       image: ${{ needs.get-dev-image.outputs.image-with-tag }}

.github/workflows/cloud_release.yaml

@@ -15,7 +15,7 @@ jobs:
       image-base-name: "dev_image_with_extras"
   build-release:
     name: Build Release
-    runs-on: oracle-16cpu-64gb-x86-64
+    runs-on: oracle-vm-16cpu-64gb-x86-64
     needs: get-dev-image
     permissions:
       contents: read

.github/workflows/mirror_demos.yaml

@@ -9,7 +9,7 @@ jobs:
     permissions:
       contents: read
       packages: write
-    runs-on: oracle-16cpu-64gb-x86-64
+    runs-on: oracle-vm-16cpu-64gb-x86-64
     steps:
     - uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772  # v2
       with:

.github/workflows/mirror_deps.yaml

@@ -9,7 +9,7 @@ jobs:
     permissions:
       contents: read
       packages: write
-    runs-on: oracle-16cpu-64gb-x86-64
+    runs-on: oracle-vm-16cpu-64gb-x86-64
     steps:
     - uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772  # v2
       with:

.github/workflows/mirror_releases.yaml

@@ -10,7 +10,7 @@ jobs:
     permissions:
       contents: read
       packages: write
-    runs-on: oracle-16cpu-64gb-x86-64
+    runs-on: oracle-vm-16cpu-64gb-x86-64
     steps:
     - uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772  # v2
       with:

.github/workflows/operator_release.yaml

@@ -15,7 +15,7 @@ jobs:
       image-base-name: "dev_image_with_extras"
   build-release:
     name: Build Release
-    runs-on: oracle-16cpu-64gb-x86-64
+    runs-on: oracle-vm-16cpu-64gb-x86-64
     needs: get-dev-image
     permissions:
       contents: read
@@ -140,7 +140,7 @@ jobs:
         git commit -s -m "Release Helm chart ${VERSION}"
         git push origin "gh-pages"
   update-gh-artifacts-manifest:
-    runs-on: oracle-8cpu-32gb-x86-64
+    runs-on: oracle-vm-16cpu-64gb-x86-64
     needs: [get-dev-image, create-github-release]
     container:
       image: ${{ needs.get-dev-image.outputs.image-with-tag }}

.github/workflows/perf_common.yaml

@@ -34,7 +34,7 @@ jobs:
       ref: ${{ inputs.ref }}
   generate-perf-matrix:
     needs: get-dev-image-with-extras
-    runs-on: oracle-16cpu-64gb-x86-64
+    runs-on: oracle-vm-16cpu-64gb-x86-64
     container:
       image: ${{ needs.get-dev-image-with-extras.outputs.image-with-tag }}
     outputs:
@@ -57,7 +57,7 @@ jobs:
         echo "matrix=${matrix}" >> $GITHUB_OUTPUT
   run-perf-eval:
     needs: [get-dev-image-with-extras, generate-perf-matrix]
-    runs-on: oracle-16cpu-64gb-x86-64
+    runs-on: oracle-vm-16cpu-64gb-x86-64
     container:
       image: ${{ needs.get-dev-image-with-extras.outputs.image-with-tag }}
     strategy:

.sops.yaml

@@ -0,0 +1,5 @@
+---
+# az login -t 1e8a0c86-2410-4f48-91c3-dc1d164680ca
+creation_rules:
+- path_regex: terraform/credentials/cockpit
+  azure_keyvault: https://kv-pixie-cloud.vault.azure.net/keys/sops-key

bazel/ui.bzl

@@ -17,9 +17,11 @@
 # This file contains rules for for our UI builds.
 
 ui_shared_cmds_start = [
+    "set -x",
     'export BASE_PATH="$(pwd)"',
-    "export PATH=/usr/local/bin:/opt/px_dev/tools/node/bin:$PATH",
-    'export HOME="$(mktemp -d)"',  # This makes node-gyp happy.
+    "export PATH=/opt/px_dev/tools/node/bin:/usr/local/bin:$PATH",
+    "hash -r",
+    'export HOME="$(mktemp -d)"',
     'export TMPPATH="$(mktemp -d)"',
 ]
 
@@ -49,6 +51,7 @@ def _pl_webpack_deps_impl(ctx):
         execution_requirements = {tag: "" for tag in ctx.attr.tags},
         outputs = [out],
         command = " && ".join(cmd),
+        use_default_shell_env = True,
         progress_message =
             "Generating webpack deps %s" % out.short_path,
     )
@@ -72,8 +75,8 @@ def _pl_webpack_library_impl(ctx):
         # and apply it to the environment here. Hopefully,
         # no special characters/spaces/quotes in the results ...
         env_cmds = [
-            '$(sed -E "s/^([A-Za-z_]+)\\s*(.*)/export \\1=\\2/g" "{}")'.format(ctx.info_file.path),
-            '$(sed -E "s/^([A-Za-z_]+)\\s*(.*)/export \\1=\\2/g" "{}")'.format(ctx.version_file.path),
+            '$(sed -E -n "s/^(STABLE_BUILD_TAG|BUILD_TIMESTAMP)\\s+(.*)/export \\1=\\2/p" "{}")'.format(ctx.info_file.path),
+            '$(sed -E -n "s/^(STABLE_BUILD_TAG|BUILD_TIMESTAMP)\\s+(.*)/export \\1=\\2/p" "{}")'.format(ctx.version_file.path),
         ]
         all_files.append(ctx.info_file)
         all_files.append(ctx.version_file)
@@ -95,6 +98,7 @@ def _pl_webpack_library_impl(ctx):
         execution_requirements = {tag: "" for tag in ctx.attr.tags},
         outputs = [out],
         command = " && ".join(cmd),
+        use_default_shell_env = True,
         progress_message =
             "Generating webpack bundle %s" % out.short_path,
     )
@@ -170,6 +174,7 @@ def _pl_deps_licenses_impl(ctx):
         execution_requirements = {tag: "" for tag in ctx.attr.tags},
         outputs = [out],
         command = " && ".join(cmd),
+        use_default_shell_env = True,
         progress_message =
             "Generating licenses %s" % out.short_path,
     )

private/cockpit/artifact_config.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: pl-artifact-config
+data:
+  PL_ARTIFACT_MANIFEST_URL: https://k8sstormcenter.github.io/pixie/artifacts/manifest.json
+  PL_ARTIFACT_BUCKET: ""
+  PL_SA_KEY_PATH: ""