openstack/mistral — Week of 2026-06-06

Publicize policy overhaul. The week is almost entirely one coordinated effort: introducing publicize policies and enforcement across Mistral's cross-tenant-shareable resources, and locking the relevant policies down to admin by default. New publicize policy + enforcement landed for workbooks, environments, cron_triggers, code_sources, and dynamic_actions, and the existing publicize paths were restricted to admin-only. A companion change also restricts the code_sources and dynamic_actions policies themselves to admins. Each patch was carried across master plus three stable backport branches, accounting for most of the ~7,100 lines of churn. See the workbooks policy addition as the representative change.

Hardening. A separate fix strips sensitive information from the workflow execution context so it no longer leaks through execution data, also backported across the supported branches. Policy tests were tidied to drop unnecessary expect_errors=True usage now that the new enforcement returns proper status codes.

Tooling and CI. A small change disables currently failing jobs to unstick the gate.