Merge branch 'main' into feat/ctp-host-normalization

Signed-off-by: zirain <zirain2009@gmail.com>

Author: zirain

.github/dependabot.yml

@@ -81,3 +81,139 @@ updates:
       helm:
         patterns:
           - "*"
+  # release/v1.8 branch updates — remove when release/v1.8 reaches EOL
+  - package-ecosystem: docker
+    target-branch: "release/v1.8"
+    directories:
+      - /tools/docker/envoy-gateway/
+      - /site
+    schedule:
+      interval: weekly
+  - package-ecosystem: github-actions
+    target-branch: "release/v1.8"
+    directories:
+      - /
+      - /tools/github-actions/setup-deps
+    schedule:
+      interval: weekly
+    ignore:
+      - dependency-name: "envoyproxy/toolshed/gh-actions/retest"
+    groups:
+      actions:
+        patterns:
+          - "*"
+  - package-ecosystem: gomod
+    target-branch: "release/v1.8"
+    directories:
+      - "/"
+      - "examples/*"
+    schedule:
+      interval: weekly
+    ignore:
+      - dependency-name: "github.com/google/cel-go"
+      - dependency-name: "github.com/google/go-containerregistry"
+      - dependency-name: "k8s.io/apimachinery"
+    groups:
+      gomod:
+        patterns:
+          - "github.com*"
+          - "go.opentelemetry.io*"
+          - "golang*"
+          - "golang.org*"
+          - "google*"
+          - "google.golang.org*"
+          - "fortio.org*"
+          - "gopkg.in*"
+          - "helm.sh*"
+          - "gomodules.xyz*"
+        exclude-patterns:
+          - "github.com/envoyproxy/go-control-plane*"
+      k8s.io:
+        patterns:
+          - "k8s.io/*"
+  - package-ecosystem: pip
+    target-branch: "release/v1.8"
+    directories:
+      - /tools/src/codespell
+      - /tools/src/sphinx-build
+      - /tools/src/yamllint
+    schedule:
+      interval: weekly
+  - package-ecosystem: "helm"
+    target-branch: "release/v1.8"
+    directories:
+      - "/charts/gateway-addons-helm"
+    schedule:
+      interval: "weekly"
+    groups:
+      helm:
+        patterns:
+          - "*"
+  # release/v1.7 branch updates — remove when release/v1.7 reaches EOL
+  - package-ecosystem: docker
+    target-branch: "release/v1.7"
+    directories:
+      - /tools/docker/envoy-gateway/
+      - /site
+    schedule:
+      interval: weekly
+  - package-ecosystem: github-actions
+    target-branch: "release/v1.7"
+    directories:
+      - /
+      - /tools/github-actions/setup-deps
+    schedule:
+      interval: weekly
+    ignore:
+      - dependency-name: "envoyproxy/toolshed/gh-actions/retest"
+    groups:
+      actions:
+        patterns:
+          - "*"
+  - package-ecosystem: gomod
+    target-branch: "release/v1.7"
+    directories:
+      - "/"
+      - "examples/*"
+    schedule:
+      interval: weekly
+    ignore:
+      - dependency-name: "github.com/google/cel-go"
+      - dependency-name: "github.com/google/go-containerregistry"
+      - dependency-name: "k8s.io/apimachinery"
+    groups:
+      gomod:
+        patterns:
+          - "github.com*"
+          - "go.opentelemetry.io*"
+          - "golang*"
+          - "golang.org*"
+          - "google*"
+          - "google.golang.org*"
+          - "fortio.org*"
+          - "gopkg.in*"
+          - "helm.sh*"
+          - "gomodules.xyz*"
+        exclude-patterns:
+          - "github.com/envoyproxy/go-control-plane*"
+      k8s.io:
+        patterns:
+          - "k8s.io/*"
+  - package-ecosystem: pip
+    target-branch: "release/v1.7"
+    directories:
+      - /tools/src/codespell
+      - /tools/src/sphinx-build
+      - /tools/src/yamllint
+    schedule:
+      interval: weekly
+  - package-ecosystem: "helm"
+    target-branch: "release/v1.7"
+    directories:
+      - "/charts/gateway-addons-helm"
+    schedule:
+      interval: "weekly"
+    groups:
+      helm:
+        patterns:
+          - "*"

.github/workflows/build_and_test.yaml

@@ -41,7 +41,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
     - uses: ./tools/github-actions/setup-deps
     # Generate the installation manifests first, so it can check
     # for errors while running `make -k lint`
@@ -52,14 +52,14 @@ jobs:
   gen-check:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
     - uses: ./tools/github-actions/setup-deps
     - run: make -k gen-check
 
   license-check:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
     - uses: ./tools/github-actions/setup-deps
     - run: make -k licensecheck
 
@@ -72,20 +72,21 @@ jobs:
     - changes
     if: ${{ github.event_name != 'pull_request' || needs.changes.outputs.run_test_workflow == 'true' }}
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
     - uses: ./tools/github-actions/setup-deps
 
     # test
     - name: Run Coverage Tests
       run: make go.test.coverage
     - name: Upload coverage to Codecov
-      uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354  # v6.0.1
+      uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v7.0.0
       with:
         fail_ci_if_error: true
         files: ./coverage.xml
         name: codecov-envoy-gateway
         verbose: true
         use_oidc: true
+        version: v11.2.8
 
   go-benchmark-test:
     runs-on: ubuntu-latest
@@ -94,7 +95,7 @@ jobs:
     - build
     if: ${{ github.event_name != 'pull_request' || needs.changes.outputs.run_test_workflow == 'true' }}
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
       with:
         fetch-depth: 0  # Need main branch access for benchmark comparison
     - uses: ./tools/github-actions/setup-deps
@@ -111,7 +112,7 @@ jobs:
     needs: [changes, lint, gen-check, license-check, coverage-test]
     if: ${{ github.event_name != 'pull_request' || needs.changes.outputs.run_test_workflow == 'true' }}
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
       # For main branch builds, we need to fetch tags so go binary will be built with
       # the recent vX.Y.Z-rc.0 tag, which helps avoid false positives in vulnerability scans.
       # `fetch-tags: true` doesn't work: https://github.com/actions/checkout/issues/1471
@@ -140,7 +141,7 @@ jobs:
     needs: [changes, lint, gen-check, license-check, coverage-test]
     if: ${{ github.event_name != 'pull_request' || needs.changes.outputs.run_test_workflow == 'true' }}
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
     - uses: ./tools/github-actions/setup-deps
 
     - name: Build egctl Binary
@@ -186,7 +187,7 @@ jobs:
           profile: watch-namespaces
           gwapiChannel: experimental
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
     - uses: ./tools/github-actions/setup-deps
 
     - name: Download EG Binaries
@@ -246,7 +247,7 @@ jobs:
           profile: watch-namespaces
 
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
     - uses: ./tools/github-actions/setup-deps
     - uses: ./tools/github-actions/reclaim-storage
 
@@ -289,7 +290,7 @@ jobs:
     # So we need to check if this is a pull request and changes.
     if: ${{ github.event_name == 'pull_request' && needs.changes.outputs.run_test_workflow == 'true' }}
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
     - uses: ./tools/github-actions/setup-deps
 
     - name: Download EG Binaries
@@ -329,7 +330,7 @@ jobs:
     - build
     - changes
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
     - uses: ./tools/github-actions/setup-deps
 
     - name: Download EG Binaries
@@ -353,7 +354,7 @@ jobs:
     needs: [conformance-test, e2e-test]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
     - uses: ./tools/github-actions/setup-deps
 
     - name: Download EG Binaries

.github/workflows/codeql.yml

@@ -32,18 +32,18 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
     - uses: ./tools/github-actions/setup-deps
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa  # v3.29.5
+      uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v3.29.5
       with:
         languages: ${{ matrix.language }}
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@7211b7c8077ea37d8641b6271f6a365a22a5fbfa  # v3.29.5
+      uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v3.29.5
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa  # v3.29.5
+      uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v3.29.5
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/docs.yaml

@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Check out code
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
       with:
         ref: ${{ github.event.pull_request.head.sha }}
 
@@ -40,7 +40,7 @@ jobs:
       contents: write
     steps:
     - name: Git checkout
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
       with:
         submodules: true
         ref: ${{ github.event.pull_request.head.sha }}

.github/workflows/experimental_conformance.yaml

@@ -49,7 +49,7 @@ jobs:
             ipFamily: ipv4
             profile: watch-namespaces
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
       - uses: ./tools/github-actions/setup-deps
 
       # gateway api experimental conformance

.github/workflows/license-scan.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout code
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
     - name: Run scanner
       uses: google/osv-scanner-action/osv-scanner-action@9a498708959aeaef5ef730655706c5a1df1edbc2  # v2.3.8
       with:

.github/workflows/monthly-release-issue.yaml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
 
       - name: Collect supported versions from hugo.toml
         id: versions

.github/workflows/release.yaml

@@ -14,7 +14,7 @@ jobs:
   verify-build-and-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
       - name: Verify Build and Test Success
         env:
           GH_TOKEN: ${{ github.token }}
@@ -56,7 +56,7 @@ jobs:
     if: ${{ !contains(github.ref, '-rc.0') }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
       - uses: ./tools/github-actions/setup-deps
 
 
@@ -93,7 +93,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
       - uses: ./tools/github-actions/reclaim-storage
 
       - name: Extract Release Tag and Commit SHA

.github/workflows/scorecard.yml

@@ -21,7 +21,7 @@ jobs:
 
     steps:
     - name: "Checkout code"
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
       with:
         persist-credentials: false
 
@@ -40,6 +40,6 @@ jobs:
         retention-days: 5
 
     - name: "Upload to code-scanning"
-      uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa  # v3.29.5
+      uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v3.29.5
       with:
         sarif_file: results.sarif

.github/workflows/trivy.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout code
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
       # We need to fetch tags so go binary will be built with the recent vX.Y.Z-rc.0 tag,
       # which will help to avoid false positives in trivy scan.
       # `fetch-tags: true` doesn't work: https://github.com/actions/checkout/issues/1471