[patch] merge from stable

.secrets.baseline

@@ -3,7 +3,7 @@
     "files": "^.secrets.baseline$",
     "lines": null
   },
-  "generated_at": "2026-06-19T12:37:02Z",
+  "generated_at": "2026-07-03T11:02:31Z",
   "plugins_used": [
     {
       "name": "AWSKeyDetector"
@@ -178,7 +178,7 @@
         "hashed_secret": "a4b48a81cdab1e1a5dd37907d6c85ca1c61ddc7c",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 241,
+        "line_number": 247,
         "type": "Secret Keyword",
         "verified_result": null
       }

src/mas/devops/db2.py

@@ -189,6 +189,10 @@ def cr_pod_v_matches(cr_k: str, cr_v: str, pod_v: str) -> bool:
         # db2 appends something like "/NODE0000/LOGSTREAM0000/" to the cr_v in these cases
         return pod_v.startswith(cr_v)
 
+    # special case for ENCRLIB — DB2 resolves the symlink and stores the full absolute path, so just check if the library name is present
+    if cr_k == "ENCRLIB":
+        return cr_v in pod_v
+
     # Look for e.g. 8192 AUTOMATIC -> AUTOMATIC(8192)
     matches = re.search(r"(\d+)\s*AUTOMATIC", cr_v, re.IGNORECASE)
     if matches is not None:

src/mas/devops/templates/pipelinerun-install.yml.j2

@@ -1005,6 +1005,29 @@ spec:
       value: "{{ aiservice_certificate_issuer }}"
 {%- endif %}
 
+    # AI Service - Database Configuration
+    # -------------------------------------------------------------------------
+{%- if install_db2 is defined %}
+    - name: install_db2
+      value: "{{ install_db2 }}"
+{%- endif %}
+{%- if aiservice_db_jdbc_url is defined and aiservice_db_jdbc_url != "" %}
+    - name: aiservice_db_jdbc_url
+      value: "{{ aiservice_db_jdbc_url }}"
+{%- endif %}
+{%- if aiservice_db_username is defined and aiservice_db_username != "" %}
+    - name: aiservice_db_username
+      value: "{{ aiservice_db_username }}"
+{%- endif %}
+{%- if aiservice_db_password is defined and aiservice_db_password != "" %}
+    - name: aiservice_db_password
+      value: "{{ aiservice_db_password }}"
+{%- endif %}
+{%- if aiservice_db_ca_cert is defined and aiservice_db_ca_cert != "" %}
+    - name: aiservice_db_ca_cert
+      value: "{{ aiservice_db_ca_cert }}"
+{%- endif %}
+
 {%- endif %}
 
   workspaces:

test/src/test_db2.py

@@ -49,6 +49,12 @@
         ("X", "otherSTRING", "OTHERstring", False),
         ("X", "other string", "other string", True),
         ("X", "22", "22", True),
+        # ENCRLIB — short filename in CR, full absolute path in pod → should pass
+        ("ENCRLIB", "libdb2compr_encr.so", "/opt/ibm/db2/V11.5.0.0/lib64/libdb2compr_encr.so.1", True),
+        # ENCRLIB — future DB2 version path → should still pass
+        ("ENCRLIB", "libdb2compr_encr.so", "/opt/ibm/db2/V11.5.10.0/lib64/libdb2compr_encr.so.1", True),
+        # ENCRLIB — completely wrong library → should fail
+        ("ENCRLIB", "libdb2compr_encr.so", "/opt/ibm/db2/V11.5.0.0/lib64/somewronglibrary.so", False),
     ],
 )
 def test_cr_pod_v_matches(cr_k, cr_v, pod_v, expected):