Sync release/v1.8 with main

.agents/skills/pr-review/SKILL.md

@@ -0,0 +1,55 @@
+---
+name: review-envoy-gateway-pr
+description: Review an Envoy Gateway pull request for essential API, implementation, status, and test coverage requirements.
+metadata:
+  short-description: Envoy Gateway PR review workflow
+  version: "0.1"
+---
+
+# Envoy Gateway PR Review Skill
+
+## Inputs
+- GitHub PR URL (e.g. review PR: https://github.com/envoyproxy/gateway/pull/8237), or
+- A local diff between commits (e.g. review change: git diff 4927877a HEAD)
+
+## Output
+- Lead with findings ordered by severity.
+- Include exact file and line references.
+- Separate required fixes from optional follow-ups.
+- If there are no findings, say that clearly and mention residual test or release-note risk.
+
+## Review
+- Check API changes, implementation changes, feature coverage, and release notes as applicable.
+- Keep findings concise and actionable, with file references when possible.
+
+## Checklist
+
+### API changes
+- Make sure changes under `api/` align with https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md
+- Make sure changes under `api/` are consistent with existing API patterns in the Gateway API project: https://github.com/kubernetes-sigs/gateway-api/tree/main/apis
+- Make sure changes under `api/` are consistent with existing API patterns in this project.
+- Try to reuse existing types.
+- Keep naming consistent with this project.
+- Try to add kubebuilder and CEL validations to catch errors.
+- Make sure API validations are tested in `/test/cel-validation`.
+- Check backward compatibility for API shape, CRD schema, defaults, versioned structs, and upgrade behavior.
+- If a PR mixes API and implementation changes, say whether it should be split into separate PRs.
+
+### Implementation changes
+- For changes under `internal/gatewayapi`, check that user-visible errors are surfaced in status.
+- For changes under `internal/gatewayapi`, check that status conditions follow the conventions in the Gateway API spec: https://gateway-api.sigs.k8s.io/geps/gep-1364/index.html
+- For changes under `internal/gatewayapi`, check that `internal/gatewayapi/testdata` has coverage.
+- For changes under `internal/xds/translator`, check that `internal/xds/translator/testdata` has coverage.
+
+### Feature coverage
+- For new user-facing features, check that `test/e2e` has coverage.
+- For bug fixes, check that `test/e2e` has coverage if the bug is in user-facing code or has user-facing impact.
+
+### Release notes
+Release notes should be added to `release-notes/current.yaml` for any of the following changes:
+- Bug fixes should be noted as "bug fix" and include a brief description of the issue and the fix.
+- New features should be noted as "new feature" and include a brief description of the feature.
+- Any breaking changes should be noted as "breaking change" and include a clear description of the change and its impact on users.
+- Any change to generated Envoy config (xDS) that moves, removes, or modifies existing config content would break EnvoyPatchPolicies and Extension Servers, so it should be noted as a breaking change. Additions to generated xDS config do not need to be called out.
+- Existing API changes should be noted.
+- Existing behavior changes should be noted.

.github/ISSUE_TEMPLATE/release.md

@@ -15,7 +15,10 @@ assignees: ''
 - [ ] push tag
     - [ ] Push tag https://github.com/envoyproxy/gateway/releases/tag/v1.x.x
     - [ ] wait for release CI
+- [ ] update benchmark dashboard
+    - [ ] `make sync-benchmark-dashboard VERSION=v1.x.x`
+    - [ ] open and merge PR with generated `site/tools/benchmark-dashboard/src/data/**` and `site/static/**` changes
 - [ ] verify quickstart
 - [ ] update doc
-- [ ] update release [announcement](https://github.com/envoyproxy/gateway/releases/tag/v1.x.x) 
-- [ ] GH Release, Slack announcement, [google group](https://groups.google.com/g/envoy-gateway-announce) announcement
+- [ ] update release [announcement](https://github.com/envoyproxy/gateway/releases/tag/v1.x.x)
+- [ ] GH Release, Slack announcement, [google group](https://groups.google.com/g/envoy-gateway-announce) announcement

.github/PULL_REQUEST_TEMPLATE.md

@@ -9,7 +9,7 @@ Examples:
 * "chore: change ci & build tools etc"
 * "api: add xxx fields in ClientTrafficPolicy"
 
-Before raising a PR, please go through this section of the developer guide, https://gateway.envoyproxy.io/contributions/develop/#raising-a-pr
+Before raising a PR, please go through this section of the developer guide, https://gateway.envoyproxy.io/community/develop/#raising-a-pr
 -->
 
 <!--

.github/dependabot.yml

@@ -61,8 +61,12 @@ updates:
   - package-ecosystem: npm
     directories:
       - /site
+      - /tools
     schedule:
       interval: weekly
+    ignore:
+      # fortawesome/fontawesome-free should be updated with docsy.
+      - dependency-name: "@fortawesome/fontawesome-free"
   - package-ecosystem: pip
     directories:
       - /tools/src/codespell

.github/workflows/build_and_test.yaml

@@ -39,9 +39,9 @@ jobs:
             - ".github/workflows/build_and_test.yaml"
 
   lint:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
     - uses: ./tools/github-actions/setup-deps
     # Generate the installation manifests first, so it can check
     # for errors while running `make -k lint`
@@ -50,16 +50,16 @@ jobs:
     - run: make -k lint
 
   gen-check:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
     - uses: ./tools/github-actions/setup-deps
     - run: make -k gen-check
 
   license-check:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
     - uses: ./tools/github-actions/setup-deps
     - run: make -k licensecheck
 
@@ -72,20 +72,20 @@ jobs:
     - changes
     if: ${{ github.event_name != 'pull_request' || needs.changes.outputs.run_test_workflow == 'true' }}
     steps:
-    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
     - uses: ./tools/github-actions/setup-deps
 
     # test
     - name: Run Coverage Tests
       run: make go.test.coverage
     - name: Upload coverage to Codecov
-      uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de  # v5.5.2
+      uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2  # v6.0.0
       with:
         fail_ci_if_error: true
         files: ./coverage.xml
         name: codecov-envoy-gateway
         verbose: true
-        use_oidc: ${{ !(github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork) }}
+        use_oidc: true
 
   go-benchmark-test:
     runs-on: ubuntu-latest
@@ -94,12 +94,11 @@ jobs:
     - build
     if: ${{ github.event_name != 'pull_request' || needs.changes.outputs.run_test_workflow == 'true' }}
     steps:
-    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       with:
         fetch-depth: 0  # Need main branch access for benchmark comparison
     - uses: ./tools/github-actions/setup-deps
     - name: Run Benchmark Comparison
-      continue-on-error: true
       run: |
         if [[ "${{ github.event_name }}" == "pull_request" ]]; then
           ./tools/hack/go-benchmark-compare.sh
@@ -112,18 +111,41 @@ jobs:
     needs: [changes, lint, gen-check, license-check, coverage-test]
     if: ${{ github.event_name != 'pull_request' || needs.changes.outputs.run_test_workflow == 'true' }}
     steps:
-    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      # For main branch builds, we need to fetch tags so go binary will be built with
+      # the recent vX.Y.Z-rc.0 tag, which helps avoid false positives in vulnerability scans.
+      # `fetch-tags: true` doesn't work: https://github.com/actions/checkout/issues/1471
+      # As a workaround `filter: tree:0` is used to create a treeless clone.
+      # See:
+      # https://github.com/actions/checkout/issues/1471#issuecomment-1755639487
+      # https://github.blog/open-source/git/get-up-to-speed-with-partial-clone-and-shallow-clone/
+      with:
+        fetch-depth: ${{ github.ref == 'refs/heads/main' && '0' || '1' }}
+        filter: ${{ github.ref == 'refs/heads/main' && 'tree:0' || '' }}
     - uses: ./tools/github-actions/setup-deps
 
-    - name: Build EG Multiarch Binaries
-      run: make build-multiarch PLATFORMS="linux_amd64 linux_arm64"
+    # Build both linux/amd64 and linux/arm64 on main (needed for multi-arch image publish),
+    # and only linux/amd64 on PRs and release branches.
+    - name: Build EG Binaries
+      run: make build-multiarch BINS="envoy-gateway" PLATFORMS="${{ github.ref == 'refs/heads/main' && 'linux_amd64 linux_arm64' || 'linux_amd64' }}"
 
     - name: Upload EG Binaries
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       with:
         name: envoy-gateway
         path: bin/
 
+  build-egctl:
+    runs-on: ubuntu-latest
+    needs: [changes, lint, gen-check, license-check, coverage-test]
+    if: ${{ github.event_name != 'pull_request' || needs.changes.outputs.run_test_workflow == 'true' }}
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+    - uses: ./tools/github-actions/setup-deps
+
+    - name: Build egctl Binary
+      run: make build BINS="egctl" PLATFORM="linux_amd64"
+
   conformance-test:
     runs-on: ubuntu-latest
     needs:
@@ -159,8 +181,12 @@ jobs:
           ipFamily: ipv4
           profile: xds-name-scheme-v2
           gwapiChannel: experimental
+        - version: v1.35.0
+          ipFamily: ipv4
+          profile: watch-namespaces
+          gwapiChannel: experimental
     steps:
-    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
     - uses: ./tools/github-actions/setup-deps
 
     - name: Download EG Binaries
@@ -170,9 +196,7 @@ jobs:
         path: bin/
 
     - name: Give Privileges To EG Binaries
-      run: |
-        chmod +x bin/linux/amd64/envoy-gateway
-        chmod +x bin/linux/arm64/envoy-gateway
+      run: chmod +x bin/linux/*/envoy-gateway
 
     # conformance
     - name: Run Standard Conformance Tests
@@ -185,6 +209,7 @@ jobs:
         # set ACTIONS_STEP_DEBUG to true if context runner.debug is '1',
         # which means to dump the current state when there's a case failed.
         ACTIONS_STEP_DEBUG: ${{ runner.debug == '1' }}
+        SKIP_GO_BUILD: "true"
       run: make conformance
 
   e2e-test:
@@ -216,9 +241,12 @@ jobs:
         - version: v1.35.0
           ipFamily: ipv4
           profile: xds-name-scheme-v2
+        - version: v1.35.0
+          ipFamily: ipv4
+          profile: watch-namespaces
 
     steps:
-    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
     - uses: ./tools/github-actions/setup-deps
     - uses: ./tools/github-actions/reclaim-storage
 
@@ -229,9 +257,7 @@ jobs:
         path: bin/
 
     - name: Give Privileges To EG Binaries
-      run: |
-        chmod +x bin/linux/amd64/envoy-gateway
-        chmod +x bin/linux/arm64/envoy-gateway
+      run: chmod +x bin/linux/*/envoy-gateway
 
     # E2E
     - name: Run E2E Tests
@@ -251,6 +277,7 @@ jobs:
         # set ACTIONS_STEP_DEBUG to true if context runner.debug is '1',
         # which means to dump the current state when there's a case failed.
         ACTIONS_STEP_DEBUG: ${{ runner.debug == '1' }}
+        SKIP_GO_BUILD: "true"
       run: make e2e
 
   benchmark-test:
@@ -262,9 +289,17 @@ jobs:
     # So we need to check if this is a pull request and changes.
     if: ${{ github.event_name == 'pull_request' && needs.changes.outputs.run_test_workflow == 'true' }}
     steps:
-    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
     - uses: ./tools/github-actions/setup-deps
 
+    - name: Download EG Binaries
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+      with:
+        name: envoy-gateway
+        path: bin/
+
+    - name: Give Privileges To EG Binaries
+      run: chmod +x bin/linux/*/envoy-gateway
 
     # Benchmark
     - name: Run Benchmark tests
@@ -278,10 +313,11 @@ jobs:
         BENCHMARK_MEMORY_LIMITS: 2000Mi
         BENCHMARK_REPORT_DIR: benchmark_report
         BENCHMARK_RENDER_PNG: "false"
+        SKIP_GO_BUILD: "true"
       run: make benchmark
 
     - name: Upload Benchmark report
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       with:
         name: benchmark_report
         path: ./test/benchmark/benchmark_report/
@@ -293,19 +329,31 @@ jobs:
     - build
     - changes
     steps:
-    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
     - uses: ./tools/github-actions/setup-deps
+
+    - name: Download EG Binaries
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+      with:
+        name: envoy-gateway
+        path: bin/
+
+    - name: Give Privileges To EG Binaries
+      run: chmod +x bin/linux/*/envoy-gateway
+
     - name: Resilience Test
       env:
         IMAGE_PULL_POLICY: IfNotPresent
         CUSTOM_CNI: "true"
+        SKIP_GO_BUILD: "true"
       run: make resilience
 
   publish:
     runs-on: ubuntu-latest
     needs: [conformance-test, e2e-test]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     steps:
-    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
     - uses: ./tools/github-actions/setup-deps
 
     - name: Download EG Binaries
@@ -315,34 +363,27 @@ jobs:
         path: bin/
 
     - name: Give Privileges To EG Binaries
-      run: |
-        chmod +x bin/linux/amd64/envoy-gateway
-        chmod +x bin/linux/arm64/envoy-gateway
+      run: chmod +x bin/linux/*/envoy-gateway
 
     # build and push image
     - name: Login to DockerHub
-      if: github.event_name == 'push'
-      uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2  # v4.0.0
+      uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  # v4.1.0
       with:
         username: ${{ vars.DOCKERHUB_USERNAME }}
         password: ${{ secrets.DOCKERHUB_PASSWORD }}
 
     - name: Setup Multiarch Environment
-      if: github.event_name == 'push'
       run: make image.multiarch.setup
 
     - name: Build and Push EG Commit Image
-      if: github.event_name == 'push'
       # tag is set to the short SHA of the commit
       run: make image.push.multiarch PLATFORMS="linux_amd64 linux_arm64" IMAGE=envoyproxy/gateway-dev
 
     - name: Build and Push EG Latest Image
-      if: github.event_name == 'push' && github.ref == 'refs/heads/main'
       # tag is set to `latest` when pushing to main branch
       run: make image.push.multiarch TAG=latest PLATFORMS="linux_amd64 linux_arm64" IMAGE=envoyproxy/gateway-dev
 
     - name: Build and Push EG Latest Helm Chart
-      if: github.event_name == 'push' && github.ref == 'refs/heads/main'
       # use `0.0.0` as the default latest version.
       # use `Always` image pull policy for latest version.
       run: |
@@ -358,6 +399,7 @@ jobs:
     - license-check
     - coverage-test
     - build
+    - build-egctl
     - conformance-test
     - e2e-test
     - benchmark-test