Merge remote-tracking branch 'upstream/main' into api-request-buffer-limit

# Conflicts:
#	release-notes/current.yaml

Author: zhaohuabing

.agents/skills/pr-review/SKILL.md

@@ -46,8 +46,8 @@ metadata:
 - For bug fixes, check that `test/e2e` has coverage if the bug is in user-facing code or has user-facing impact.
 
 ### Release notes
-Release notes should be added to `release-notes/current.yaml` for any of the following changes:
-- Bug fixes should be noted as "bug fix" and include a brief description of the issue and the fix.
+Release notes should be added as a new fragment file under `release-notes/current/<section>/<pr-number>-<slug>.md` (see `release-notes/current/README.md`) for any of the following changes. One change per file; the section directory determines the category.
+- Bug fixes should be noted as "bug fix" (`bug_fixes/`) and include a brief description of the issue and the fix.
 - New features should be noted as "new feature" and include a brief description of the feature.
 - Any breaking changes should be noted as "breaking change" and include a clear description of the change and its impact on users.
 - Any change to generated Envoy config (xDS) that moves, removes, or modifies existing config content would break EnvoyPatchPolicies and Extension Servers, so it should be noted as a breaking change. Additions to generated xDS config do not need to be called out.

.github/PULL_REQUEST_TEMPLATE.md

@@ -28,6 +28,7 @@ Fixes #
 
 <!--
 For any non-trivial changes, you need to provide a brief description of the changes in the release notes.
-Please add the description to the release-notes/current.yaml file and include this file in the PR.
+Please add a new fragment file under release-notes/current/<section>/<pr-number>-<slug>.md and include it in the PR.
+See release-notes/current/README.md for the available sections and the naming convention.
 -->
 Release Notes: Yes/No

.github/dependabot.yml

@@ -68,7 +68,6 @@ updates:
   - package-ecosystem: pip
     directories:
       - /tools/src/codespell
-      - /tools/src/sphinx-build
       - /tools/src/yamllint
     schedule:
       interval: weekly
@@ -81,3 +80,129 @@ updates:
       helm:
         patterns:
           - "*"
+  # release/v1.8 branch updates — remove when release/v1.8 reaches EOL
+  - package-ecosystem: docker
+    target-branch: "release/v1.8"
+    directories:
+      - /tools/docker/envoy-gateway/
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "[release-1.8]"
+  - package-ecosystem: github-actions
+    target-branch: "release/v1.8"
+    directories:
+      - /
+      - /tools/github-actions/setup-deps
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "[release-1.8]"
+    ignore:
+      - dependency-name: "envoyproxy/toolshed/gh-actions/retest"
+    groups:
+      actions:
+        patterns:
+          - "*"
+  - package-ecosystem: gomod
+    target-branch: "release/v1.8"
+    directories:
+      - "/"
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "[release-1.8]"
+    ignore:
+      - dependency-name: "github.com/google/cel-go"
+      - dependency-name: "github.com/google/go-containerregistry"
+      - dependency-name: "k8s.io/apimachinery"
+    groups:
+      gomod:
+        patterns:
+          - "github.com*"
+          - "go.opentelemetry.io*"
+          - "golang*"
+          - "golang.org*"
+          - "google*"
+          - "google.golang.org*"
+          - "fortio.org*"
+          - "gopkg.in*"
+          - "helm.sh*"
+          - "gomodules.xyz*"
+        exclude-patterns:
+          - "github.com/envoyproxy/go-control-plane*"
+      k8s.io:
+        patterns:
+          - "k8s.io/*"
+  - package-ecosystem: pip
+    target-branch: "release/v1.8"
+    directories:
+      - /tools/src/codespell
+      - /tools/src/yamllint
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "[release-1.8]"
+  # release/v1.7 branch updates — remove when release/v1.7 reaches EOL
+  - package-ecosystem: docker
+    target-branch: "release/v1.7"
+    directories:
+      - /tools/docker/envoy-gateway/
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "[release-1.7]"
+  - package-ecosystem: github-actions
+    target-branch: "release/v1.7"
+    directories:
+      - /
+      - /tools/github-actions/setup-deps
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "[release-1.7]"
+    ignore:
+      - dependency-name: "envoyproxy/toolshed/gh-actions/retest"
+    groups:
+      actions:
+        patterns:
+          - "*"
+  - package-ecosystem: gomod
+    target-branch: "release/v1.7"
+    directories:
+      - "/"
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "[release-1.7]"
+    ignore:
+      - dependency-name: "github.com/google/cel-go"
+      - dependency-name: "github.com/google/go-containerregistry"
+      - dependency-name: "k8s.io/apimachinery"
+    groups:
+      gomod:
+        patterns:
+          - "github.com*"
+          - "go.opentelemetry.io*"
+          - "golang*"
+          - "golang.org*"
+          - "google*"
+          - "google.golang.org*"
+          - "fortio.org*"
+          - "gopkg.in*"
+          - "helm.sh*"
+          - "gomodules.xyz*"
+        exclude-patterns:
+          - "github.com/envoyproxy/go-control-plane*"
+      k8s.io:
+        patterns:
+          - "k8s.io/*"
+  - package-ecosystem: pip
+    target-branch: "release/v1.7"
+    directories:
+      - /tools/src/codespell
+      - /tools/src/yamllint
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "[release-1.7]"

.github/workflows/build_and_test.yaml

@@ -41,7 +41,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
     - uses: ./tools/github-actions/setup-deps
     # Generate the installation manifests first, so it can check
     # for errors while running `make -k lint`
@@ -52,14 +52,14 @@ jobs:
   gen-check:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
     - uses: ./tools/github-actions/setup-deps
     - run: make -k gen-check
 
   license-check:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
     - uses: ./tools/github-actions/setup-deps
     - run: make -k licensecheck
 
@@ -72,7 +72,7 @@ jobs:
     - changes
     if: ${{ github.event_name != 'pull_request' || needs.changes.outputs.run_test_workflow == 'true' }}
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
     - uses: ./tools/github-actions/setup-deps
 
     # test
@@ -95,7 +95,7 @@ jobs:
     - build
     if: ${{ github.event_name != 'pull_request' || needs.changes.outputs.run_test_workflow == 'true' }}
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       with:
         fetch-depth: 0  # Need main branch access for benchmark comparison
     - uses: ./tools/github-actions/setup-deps
@@ -112,7 +112,7 @@ jobs:
     needs: [changes, lint, gen-check, license-check, coverage-test]
     if: ${{ github.event_name != 'pull_request' || needs.changes.outputs.run_test_workflow == 'true' }}
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       # For main branch builds, we need to fetch tags so go binary will be built with
       # the recent vX.Y.Z-rc.0 tag, which helps avoid false positives in vulnerability scans.
       # `fetch-tags: true` doesn't work: https://github.com/actions/checkout/issues/1471
@@ -141,7 +141,7 @@ jobs:
     needs: [changes, lint, gen-check, license-check, coverage-test]
     if: ${{ github.event_name != 'pull_request' || needs.changes.outputs.run_test_workflow == 'true' }}
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
     - uses: ./tools/github-actions/setup-deps
 
     - name: Build egctl Binary
@@ -187,7 +187,7 @@ jobs:
           profile: watch-namespaces
           gwapiChannel: experimental
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
     - uses: ./tools/github-actions/setup-deps
 
     - name: Download EG Binaries
@@ -247,7 +247,7 @@ jobs:
           profile: watch-namespaces
 
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
     - uses: ./tools/github-actions/setup-deps
     - uses: ./tools/github-actions/reclaim-storage
 
@@ -290,7 +290,7 @@ jobs:
     # So we need to check if this is a pull request and changes.
     if: ${{ github.event_name == 'pull_request' && needs.changes.outputs.run_test_workflow == 'true' }}
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
     - uses: ./tools/github-actions/setup-deps
 
     - name: Download EG Binaries
@@ -330,7 +330,7 @@ jobs:
     - build
     - changes
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
     - uses: ./tools/github-actions/setup-deps
 
     - name: Download EG Binaries
@@ -354,7 +354,7 @@ jobs:
     needs: [conformance-test, e2e-test]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
     - uses: ./tools/github-actions/setup-deps
 
     - name: Download EG Binaries

.github/workflows/codeql.yml

@@ -32,7 +32,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
     - uses: ./tools/github-actions/setup-deps
 
     - name: Initialize CodeQL

.github/workflows/docs.yaml

@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Check out code
-      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       with:
         ref: ${{ github.event.pull_request.head.sha }}
 
@@ -40,7 +40,7 @@ jobs:
       contents: write
     steps:
     - name: Git checkout
-      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       with:
         submodules: true
         ref: ${{ github.event.pull_request.head.sha }}

.github/workflows/experimental_conformance.yaml

@@ -49,7 +49,7 @@ jobs:
             ipFamily: ipv4
             profile: watch-namespaces
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       - uses: ./tools/github-actions/setup-deps
 
       # gateway api experimental conformance

.github/workflows/license-scan.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout code
-      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
     - name: Run scanner
       uses: google/osv-scanner-action/osv-scanner-action@9a498708959aeaef5ef730655706c5a1df1edbc2  # v2.3.8
       with:

.github/workflows/monthly-release-issue.yaml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Collect supported versions from hugo.toml
         id: versions

.github/workflows/release.yaml

@@ -14,7 +14,7 @@ jobs:
   verify-build-and-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       - name: Verify Build and Test Success
         env:
           GH_TOKEN: ${{ github.token }}
@@ -56,7 +56,7 @@ jobs:
     if: ${{ !contains(github.ref, '-rc.0') }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       - uses: ./tools/github-actions/setup-deps
 
 
@@ -93,7 +93,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       - uses: ./tools/github-actions/reclaim-storage
 
       - name: Extract Release Tag and Commit SHA
@@ -159,7 +159,7 @@ jobs:
 
       - name: Upload Release Manifests
         if: ${{ !contains(github.ref, '-rc.0') }}
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda  # v3.0.0
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b  # v3.0.1
         with:
           files: |
             release-artifacts/install.yaml