Merge branch 'master' into dhz/strip-finalizer

Author: GreyLilac09

.cargo/config.toml

@@ -8,6 +8,7 @@ JEMALLOC_SYS_WITH_LG_PAGE = "16"
 
 [target.'cfg(all())']
 rustflags = [
+  "-D", "warnings",
   "-Dclippy::print_stdout",
   "-Dclippy::print_stderr",
   "-Dclippy::dbg_macro",
@@ -35,4 +36,4 @@ rustflags = ["-C", "link-args=-rdynamic"]
 
 [target.x86_64-pc-windows-msvc]
 # https://github.com/dtolnay/inventory/issues/58
-rustflags = ["-C", "codegen-units=1"]
+rustflags = ["-C", "codegen-units=1", "-Ctarget-feature=+crt-static"]

.github/CODEOWNERS

@@ -3,7 +3,7 @@
 .github/workflows/regression.yml @vectordotdev/vector @vectordotdev/single-machine-performance
 regression/config.yaml @vectordotdev/vector @vectordotdev/single-machine-performance
 
-# Keep documentation team paths in sync with .github/workflows/add_wip_label.yml
+# Keep documentation team paths in sync with .github/workflows/add_docs_review_label.yml
 docs/ @vectordotdev/vector @vectordotdev/documentation
 website/ @vectordotdev/vector
 website/content @vectordotdev/vector @vectordotdev/documentation

.github/ISSUE_TEMPLATE/minor-release.md

@@ -45,7 +45,7 @@ Automated steps include:
 - Pin VRL to latest released version rather than `main`
 - Check if there is a newer version of [Alpine](https://alpinelinux.org/releases/) or [Debian](https://www.debian.org/releases/) available to update the release images in
       `distribution/docker/`. Update if so.
-- Run `cargo vdev build release-cue` to generate a new cue file for the release
+- Generate a new cue file for the release in `website/cue/reference/releases/`
   - Copy VRL changelogs from the VRL version in the last Vector release as a new changelog entry
         ([example](https://github.com/vectordotdev/vector/blob/9c67bba358195f5018febca2f228dfcb2be794b5/website/cue/reference/releases/0.41.0.cue#L33-L64))
 - Update version number in `website/cue/reference/administration/interfaces/kubectl.cue`
@@ -71,7 +71,8 @@ Automated steps include:
 # On the day of release
 
 - [ ] Make sure the release branch is in sync with origin/master and has only one squashed commit with all commits from the prepare branch. If you made a PR from the prepare branch into the release branch this should already be the case.
-  - [ ] `git checkout "${RELEASE_BRANCH}"`
+  - [ ] `git fetch origin`
+  - [ ] `git checkout "${RELEASE_BRANCH}" && git pull --ff-only origin "${RELEASE_BRANCH}"`
   - [ ] `git show --stat HEAD` - This should show the squashed prepare commit.
   - [ ] Ensure release date in `website/cue/reference/releases/0.XX.Y.cue` matches current date.
     - If this needs to be updated commit and squash it in the release branch.
@@ -88,7 +89,7 @@ Automated steps include:
 - [ ] Wait for release workflow to complete.
   - Discoverable via [release.yml](https://github.com/vectordotdev/vector/actions/workflows/release.yml)
 - [ ] Reset the `website` branch to the `HEAD` of the release branch to update https://vector.dev
-  - [ ] `git switch website && git reset --hard origin/"${RELEASE_BRANCH}" && git push`
+  - [ ] `git fetch origin && git switch website && git reset --hard origin/"${RELEASE_BRANCH}" && git push --force-with-lease`
   - [ ] Confirm that the release changelog was published to https://vector.dev/releases/
     - Refer to the internal releasing doc to monitor the deployment.
 - [ ] Release Linux packages. Refer to the internal releasing doc.

.github/ISSUE_TEMPLATE/patch-release.md

@@ -24,8 +24,10 @@ export PREP_BRANCH=prepare-v-0-"${CURRENT_MINOR_VERSION}"-"${NEW_PATCH_VERSION}"
 - [ ] Cherry-pick in all commits to be released from the associated release milestone
   - If any merge conflicts occur, attempt to solve them and if needed enlist the aid of those familiar with the conflicting commits.
 - [ ] Bump the release number in the `Cargo.toml` to the current version number
-- [ ] Run `cargo vdev build release-cue` to generate a new cue file for the release
-  - [ ] Add description key to the generated cue file with a description of the release (see
+- [ ] Add a new cue file for the release at `website/cue/reference/releases/${NEW_VERSION}.cue`
+      by copying the previous patch release file and editing the version, date, commits, and
+      changelog entries to match this release.
+  - [ ] Add a description key to the cue file with a description of the release (see
         previous releases for examples).
 - [ ] Update version number in `distribution/install.sh`
 - [ ] Add new version to `website/cue/reference/versions.cue`
@@ -62,5 +64,5 @@ export PREP_BRANCH=prepare-v-0-"${CURRENT_MINOR_VERSION}"-"${NEW_PATCH_VERSION}"
   - Follow the [instructions at the top of the mirror.yaml file](https://github.com/DataDog/images/blob/fbf12868e90d52e513ebca0389610dea8a3c7e1a/mirror.yaml#L33-L49).
 - [ ] Cherry-pick any release commits from the release branch that are not on `master`, to `master`
 - [ ] Reset the `website` branch to the `HEAD` of the release branch to update https://vector.dev
-  - [ ] `git checkout website && git reset --hard origin/"${RELEASE_BRANCH}" && git push`
+  - [ ] `git fetch origin && git checkout website && git reset --hard origin/"${RELEASE_BRANCH}" && git push --force-with-lease`
 - [ ] Kick-off post-mortems for any regressions resolved by the release

.github/actions/dd-token/action.yml

@@ -0,0 +1,45 @@
+name: "Datadog Short-Lived Token"
+description: "Federate a short-lived Datadog token via dd-sts-action and export DD_API_KEY (and DD_APP_KEY when available) to the job environment."
+
+inputs:
+  policy:
+    required: false
+    default: public-vectordotdev-vector
+    description: "dd-sts policy to federate against."
+
+runs:
+  using: "composite"
+  steps:
+    # Fork PRs don't get `id-token: write`, so ACTIONS_ID_TOKEN_REQUEST_URL is
+    # unset. Read it via shell (env context only covers YAML-declared vars) and
+    # skip federation when absent to avoid a hard failure.
+    - name: Check OIDC token availability
+      id: oidc
+      shell: bash
+      run: |
+        if [ -n "${ACTIONS_ID_TOKEN_REQUEST_URL}" ]; then
+          echo "available=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "available=false" >> "$GITHUB_OUTPUT"
+        fi
+
+    - name: Federate Datadog token
+      id: dd-sts
+      if: ${{ steps.oidc.outputs.available == 'true' }}
+      continue-on-error: true
+      uses: DataDog/dd-sts-action@2e8187910199bd93129520183c093e19aa585c75
+      with:
+        policy: ${{ inputs.policy }}
+
+    - name: Export Datadog credentials to environment
+      shell: bash
+      env:
+        DD_STS_API_KEY: ${{ steps.dd-sts.outputs.api_key }}
+        DD_STS_APP_KEY: ${{ steps.dd-sts.outputs.app_key }}
+      run: |
+        if [ -n "${DD_STS_API_KEY}" ]; then
+          echo "DD_API_KEY=${DD_STS_API_KEY}" >> "$GITHUB_ENV"
+        fi
+        if [ -n "${DD_STS_APP_KEY}" ]; then
+          echo "DD_APP_KEY=${DD_STS_APP_KEY}" >> "$GITHUB_ENV"
+        fi

.github/actions/setup/action.yml

@@ -142,24 +142,15 @@ runs:
           echo "RUST_BACKTRACE=full" >> "$GITHUB_ENV"
           # Set nice CI colors
           echo "CARGO_TERM_COLOR=always" >> "$GITHUB_ENV"
+          # Incremental compilation has no benefit because in our CI we always start from a clean state.
+          echo "CARGO_INCREMENTAL=0" >> "$GITHUB_ENV"
         fi
 
     - name: Enable rust matcher
       if: ${{ env.NEEDS_RUST == 'true' }}
       run: echo "::add-matcher::.github/matchers/rust.json"
       shell: bash
 
-    - name: Override warnings
-      if: ${{ env.NEEDS_RUST == 'true' }}
-      run: |
-        CARGO_OVERRIDE_DIR="${HOME}/.cargo"
-        CARGO_OVERRIDE_CONF="${CARGO_OVERRIDE_DIR}/config.toml"
-        cat <<EOF >>"$CARGO_OVERRIDE_CONF"
-        [target.'cfg(linux)']
-        rustflags = [ "-D", "warnings" ]
-        EOF
-      shell: bash
-
     - name: Cache Cargo registry, index, and git DB
       if: ${{ inputs.cargo-cache == 'true' || env.NEEDS_RUST == 'true' || env.VDEV_NEEDS_COMPILE == 'true' }}
       uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
@@ -237,10 +228,10 @@ runs:
         echo "Installing cue"
         TEMP=$(mktemp -d)
         curl \
-          -L https://github.com/cue-lang/cue/releases/download/v0.10.0/cue_v0.10.0_linux_amd64.tar.gz \
-          -o "${TEMP}/cue_v0.10.0_linux_amd64.tar.gz"
+          -L https://github.com/cue-lang/cue/releases/download/v0.16.1/cue_v0.16.1_linux_amd64.tar.gz \
+          -o "${TEMP}/cue_v0.16.1_linux_amd64.tar.gz"
         tar \
-          -xvf "${TEMP}/cue_v0.10.0_linux_amd64.tar.gz" \
+          -xvf "${TEMP}/cue_v0.16.1_linux_amd64.tar.gz" \
           -C "${TEMP}"
         sudo cp "${TEMP}/cue" /usr/bin/cue
         rm -rf "$TEMP"

.github/actions/spelling/allow.txt

@@ -154,6 +154,7 @@ Evercoss
 exactlyonce
 Explay
 Fabro
+fakedata
 fakeintake
 FAQs
 fargate
@@ -509,6 +510,7 @@ timeseries
 timespan
 timestamped
 Tizen
+TLDs
 Tmobile
 tobz
 Tomtec

.github/actions/spelling/expect.txt

@@ -124,6 +124,7 @@ customizability
 CVS
 cwl
 daschl
+databricks
 dataflows
 datafuselabs
 datasources
@@ -350,6 +351,7 @@ mezmo
 mfoo
 mgmt
 MIDP
+mij
 mingrammer
 mkto
 mlua
@@ -677,6 +679,7 @@ ytt
 YXRR
 yyy
 zieme
+zerobus
 zoog
 zork
 zorp

.github/dependabot.yml

@@ -176,3 +176,19 @@ updates:
       npm_and_yarn:
         patterns:
           - "*"
+  - package-ecosystem: "npm"
+    directory: "/scripts/environment/npm-tools"
+    schedule:
+      interval: "monthly"
+      time: "05:00" # UTC
+    labels:
+      - "domain: deps"
+      - "no-changelog"
+    commit-message:
+      prefix: "chore(deps)"
+    # Disable version updates; security updates bypass this limit
+    open-pull-requests-limit: 0
+    groups:
+      npm_and_yarn:
+        patterns:
+          - "*"

.github/workflows/add_docs_review_label.yml

@@ -0,0 +1,56 @@
+# Adds a label to PRs that touch documentation paths until a maintainer approves.
+# Currently dedicated to the docs review flow. If a second use case appears, promote
+# this into a reusable workflow (`workflow_call`) with the label as an input.
+name: Add Docs Review Label
+
+permissions:
+  pull-requests: write
+
+on:
+  pull_request_target:
+    types: [opened, reopened, synchronize]
+    # Keep these paths in sync with the documentation team entries in .github/CODEOWNERS
+    paths:
+      - "docs/**"
+      - "website/content/**"
+      - "website/cue/reference/**"
+
+env:
+  LABEL_NAME: "docs review on hold"
+
+jobs:
+  add_label:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - name: Check member review state
+        id: check
+        uses: actions/github-script@v9
+        with:
+          script: |
+            const { data: reviews } = await github.rest.pulls.listReviews({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.payload.pull_request.number,
+            });
+
+            const allowed = ['MEMBER', 'OWNER'];
+            const latestByUser = new Map();
+            for (const r of reviews) {
+              if (!allowed.includes(r.author_association)) continue;
+              if (r.state === 'COMMENTED') continue;
+              latestByUser.set(r.user.id, r.state);
+            }
+
+            const states = [...latestByUser.values()];
+            const hasApproved = states.includes('APPROVED');
+            const hasChangesRequested = states.includes('CHANGES_REQUESTED');
+            const skip = hasApproved && !hasChangesRequested;
+
+            core.info(`Latest member review states: ${states.join(', ') || '(none)'}`);
+            core.info(`skip=${skip}`);
+            core.setOutput('skip', skip);
+      - if: steps.check.outputs.skip != 'true'
+        uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # v1.1.3
+        with:
+          labels: ${{ env.LABEL_NAME }}