Merge remote-tracking branch 'upstream/main' into adam--add-admission-control

Signed-off-by: Adam Buran <aburan28@gmail.com>

Author: aburan28

.agents/skills/pr-review/SKILL.md

@@ -0,0 +1,55 @@
+---
+name: review-envoy-gateway-pr
+description: Review an Envoy Gateway pull request for essential API, implementation, status, and test coverage requirements.
+metadata:
+  short-description: Envoy Gateway PR review workflow
+  version: "0.1"
+---
+
+# Envoy Gateway PR Review Skill
+
+## Inputs
+- GitHub PR URL (e.g. review PR: https://github.com/envoyproxy/gateway/pull/8237), or
+- A local diff between commits (e.g. review change: git diff 4927877a HEAD)
+
+## Output
+- Lead with findings ordered by severity.
+- Include exact file and line references.
+- Separate required fixes from optional follow-ups.
+- If there are no findings, say that clearly and mention residual test or release-note risk.
+
+## Review
+- Check API changes, implementation changes, feature coverage, and release notes as applicable.
+- Keep findings concise and actionable, with file references when possible.
+
+## Checklist
+
+### API changes
+- Make sure changes under `api/` align with https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md
+- Make sure changes under `api/` are consistent with existing API patterns in the Gateway API project: https://github.com/kubernetes-sigs/gateway-api/tree/main/apis
+- Make sure changes under `api/` are consistent with existing API patterns in this project.
+- Try to reuse existing types.
+- Keep naming consistent with this project.
+- Try to add kubebuilder and CEL validations to catch errors.
+- Make sure API validations are tested in `/test/cel-validation`.
+- Check backward compatibility for API shape, CRD schema, defaults, versioned structs, and upgrade behavior.
+- If a PR mixes API and implementation changes, say whether it should be split into separate PRs.
+
+### Implementation changes
+- For changes under `internal/gatewayapi`, check that user-visible errors are surfaced in status.
+- For changes under `internal/gatewayapi`, check that status conditions follow the conventions in the Gateway API spec: https://gateway-api.sigs.k8s.io/geps/gep-1364/index.html
+- For changes under `internal/gatewayapi`, check that `internal/gatewayapi/testdata` has coverage.
+- For changes under `internal/xds/translator`, check that `internal/xds/translator/testdata` has coverage.
+
+### Feature coverage
+- For new user-facing features, check that `test/e2e` has coverage.
+- For bug fixes, check that `test/e2e` has coverage if the bug is in user-facing code or has user-facing impact.
+
+### Release notes
+Release notes should be added to `release-notes/current.yaml` for any of the following changes:
+- Bug fixes should be noted as "bug fix" and include a brief description of the issue and the fix.
+- New features should be noted as "new feature" and include a brief description of the feature.
+- Any breaking changes should be noted as "breaking change" and include a clear description of the change and its impact on users.
+- Any change to generated Envoy config (xDS) that moves, removes, or modifies existing config content would break EnvoyPatchPolicies and Extension Servers, so it should be noted as a breaking change. Additions to generated xDS config do not need to be called out.
+- Existing API changes should be noted.
+- Existing behavior changes should be noted.

.github/PULL_REQUEST_TEMPLATE.md

@@ -9,7 +9,7 @@ Examples:
 * "chore: change ci & build tools etc"
 * "api: add xxx fields in ClientTrafficPolicy"
 
-Before raising a PR, please go through this section of the developer guide, https://gateway.envoyproxy.io/contributions/develop/#raising-a-pr
+Before raising a PR, please go through this section of the developer guide, https://gateway.envoyproxy.io/community/develop/#raising-a-pr
 -->
 
 <!--

.github/workflows/build_and_test.yaml

@@ -128,7 +128,7 @@ jobs:
       run: make build-multiarch PLATFORMS="linux_amd64 linux_arm64"
 
     - name: Upload EG Binaries
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       with:
         name: envoy-gateway
         path: bin/
@@ -290,7 +290,7 @@ jobs:
       run: make benchmark
 
     - name: Upload Benchmark report
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       with:
         name: benchmark_report
         path: ./test/benchmark/benchmark_report/

.github/workflows/codex-review.yml

@@ -47,23 +47,17 @@ jobs:
 
     - uses: ./tools/github-actions/setup-deps
 
-    - name: Setup Hugo
-      uses: peaceiris/actions-hugo@75d2e84710de30f6ff7268e08f310b60ef14033f  # v3.0.0
-      with:
-        hugo-version: 'latest'
-        extended: true
-
     - name: Setup Node
       uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f  # v6.3.0
       with:
-        node-version: '18'
+        node-version-file: site/.nvmrc
 
     - name: Install Site Dependencies and Build Site
       run: make docs
 
     # Upload docs for GitHub Pages
     - name: Upload GitHub Pages artifact
-      uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b  # v4.0.0
+      uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9  # v5.0.0
       with:
         # Path of the directory containing the static assets.
         path: site/public

.github/workflows/docs.yaml

@@ -60,7 +60,7 @@ jobs:
         run: make experimental-conformance
 
       - name: Upload Conformance Report
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: conformance-report-k8s-${{ matrix.target.version }}-${{ matrix.target.profile }}
           path: ./test/conformance/conformance-report-k8s-${{ matrix.target.version }}-${{ matrix.target.profile }}.yaml

.github/workflows/experimental_conformance.yaml

@@ -16,94 +16,71 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
-      - name: Calculate current release month and versions
-        id: release_info
+      - name: Collect supported versions from hugo.toml
+        id: versions
         run: |
-          # Get current date
-          CURRENT_MONTH=$(date +%m)
-          CURRENT_YEAR=$(date +%Y)
-
-          # Get current month name
-          MONTH_NAME=$(date +%B)
-
-          # Read current version from VERSION file
-          CURRENT_VERSION=$(cat VERSION | tr -d 'v' | tr -d '\n')
-
-          # Parse version (assuming format X.Y.Z)
-          MAJOR=$(echo $CURRENT_VERSION | cut -d. -f1)
-          MINOR=$(echo $CURRENT_VERSION | cut -d. -f2)
-          PATCH=$(echo $CURRENT_VERSION | cut -d. -f3)
-
-          # Calculate N version (current minor version)
-          N_VERSION="v${MAJOR}.${MINOR}"
-
-          # Calculate N-1 version (previous minor version)
-          if [ $MINOR -gt 0 ]; then
-            N_MINUS_1_MINOR=$((MINOR - 1))
-            N_MINUS_1_VERSION="v${MAJOR}.${N_MINUS_1_MINOR}"
-          else
-            # If minor is 0, go to previous major version
-            if [ $MAJOR -gt 0 ]; then
-              N_MINUS_1_MAJOR=$((MAJOR - 1))
-              N_MINUS_1_VERSION="v${N_MINUS_1_MAJOR}.0"
-            else
-              N_MINUS_1_VERSION="v0.0"
+          TODAY=$(date +%Y-%m-%d)
+
+          # Extract version/eol pairs from hugo.toml, skipping "latest"
+          ACTIVE_VERSIONS=()
+          VERSION=""
+          VERSION_RE='version[[:space:]]*=[[:space:]]*"([^"]+)"'
+          EOL_RE='eol[[:space:]]*=[[:space:]]*"([^"]+)"'
+          while IFS= read -r line; do
+            if [[ "$line" =~ $VERSION_RE ]]; then
+              VERSION="${BASH_REMATCH[1]}"
+            fi
+            if [[ "$line" =~ $EOL_RE ]]; then
+              EOL="${BASH_REMATCH[1]}"
+              if [[ "$VERSION" != "latest" && ! "$EOL" < "$TODAY" ]]; then
+                ACTIVE_VERSIONS+=("$VERSION")
+              fi
+              VERSION=""
             fi
-          fi
+          done < site/hugo.toml
 
-          echo "month=${CURRENT_MONTH}" >> $GITHUB_OUTPUT
-          echo "year=${CURRENT_YEAR}" >> $GITHUB_OUTPUT
-          echo "month_name=${MONTH_NAME}" >> $GITHUB_OUTPUT
-          echo "n_version=${N_VERSION}" >> $GITHUB_OUTPUT
-          echo "n_minus_1_version=${N_MINUS_1_VERSION}" >> $GITHUB_OUTPUT
+          printf '%s\n' "Supported versions (EOL on or after ${TODAY}):" "${ACTIVE_VERSIONS[@]}"
+
+          # Export as JSON array for the matrix
+          JSON=$(printf '%s\n' "${ACTIVE_VERSIONS[@]}" | jq -R . | jq -sc .)
+          echo "matrix=${JSON}" >> $GITHUB_OUTPUT
+          echo "month_name=$(date +%B)" >> $GITHUB_OUTPUT
+          echo "year=$(date +%Y)" >> $GITHUB_OUTPUT
 
       - name: Read issue template
         id: template
         run: |
-          # Read the template file and skip the YAML front matter
           TEMPLATE_CONTENT=$(awk '/^---$/,/^---$/{if (!/^---$/) next} /^---$/{p++; next} p==2' .github/ISSUE_TEMPLATE/release.md)
 
-          # Save to output using multiline format
           {
             echo 'content<<EOF'
             echo "$TEMPLATE_CONTENT"
             echo 'EOF'
           } >> $GITHUB_OUTPUT
 
-      - name: Create release issue for N version
+      - name: Create release issues for supported versions
         env:
           GH_TOKEN: ${{ github.token }}
+          TEMPLATE_CONTENT: ${{ steps.template.outputs.content }}
         run: |
-          MONTH_NAME="${{ steps.release_info.outputs.month_name }}"
-          YEAR="${{ steps.release_info.outputs.year }}"
-          N_VERSION="${{ steps.release_info.outputs.n_version }}"
-          TEMPLATE_CONTENT="${{ steps.template.outputs.content }}"
+          MONTH_NAME="${{ steps.versions.outputs.month_name }}"
+          YEAR="${{ steps.versions.outputs.year }}"
+          VERSIONS='${{ steps.versions.outputs.matrix }}'
 
-          gh issue create \
-            --title "Patch Release ${N_VERSION}.x for ${MONTH_NAME} ${YEAR}" \
-            --label "release-process" \
-            --body "## Patch Release Checklist for ${N_VERSION}.x (${MONTH_NAME} ${YEAR})
+          for VERSION in $(echo "$VERSIONS" | jq -r '.[]'); do
+            echo "Creating release issue for ${VERSION}.x ..."
+            BODY="## Patch Release Checklist for ${VERSION}.x (${MONTH_NAME} ${YEAR})
 
           ${TEMPLATE_CONTENT}
 
           ---
           *This issue was automatically created by the monthly release workflow.*"
 
-      - name: Create release issue for N-1 version
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          MONTH_NAME="${{ steps.release_info.outputs.month_name }}"
-          YEAR="${{ steps.release_info.outputs.year }}"
-          N_MINUS_1_VERSION="${{ steps.release_info.outputs.n_minus_1_version }}"
-          TEMPLATE_CONTENT="${{ steps.template.outputs.content }}"
+            # Replace placeholder version with the actual release version
+            BODY="${BODY//v1.x.x/${VERSION}.x}"
 
-          gh issue create \
-            --title "Patch Release ${N_MINUS_1_VERSION}.x for ${MONTH_NAME} ${YEAR}" \
-            --label "release-process" \
-            --body "## Patch Release Checklist for ${N_MINUS_1_VERSION}.x (${MONTH_NAME} ${YEAR})
-
-          ${TEMPLATE_CONTENT}
-
-          ---
-          *This issue was automatically created by the monthly release workflow.*"
+            gh issue create \
+              --title "Patch Release ${VERSION}.x for ${MONTH_NAME} ${YEAR}" \
+              --label "release-process" \
+              --body "$BODY"
+          done

.github/workflows/monthly-release-issue.yaml

@@ -78,7 +78,7 @@ jobs:
         run: cd test/benchmark && zip -r benchmark_report.zip benchmark_report
 
       - name: Upload Benchmark Report
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: benchmark_report
           path: test/benchmark/benchmark_report.zip
@@ -155,7 +155,7 @@ jobs:
 
       - name: Upload Release Manifests
         if: ${{ !contains(github.ref, '-rc.0') }}
-        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe  # v2.6.1
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda  # v3.0.0
         with:
           files: |
             release-artifacts/install.yaml