backport tests: test mitigation for the segfault of if-match 412

.bazelignore

@@ -0,0 +1,37 @@
+# NB: sematics here are not the same as .gitignore
+# see https://github.com/bazelbuild/bazel/issues/8106
+# Ignore backup files.
+*~
+# Ignore Vim swap files.
+.*.swp
+# Ignore files generated by IDEs.
+/.aswb/
+/.cache/
+/.classpath
+/.clwb/
+/.factorypath
+/.idea/
+/.ijwb/
+/.project
+/.settings
+/.vscode/
+/bazel.iml
+# Ignore all bazel-* symlinks. There is no full list since this can change
+# based on the name of the directory bazel is cloned into.
+/bazel-*
+# Ignore outputs generated during Bazel bootstrapping.
+/output/
+# Ignore jekyll build output.
+/production
+/.sass-cache
+# Bazelisk version file
+.bazelversion
+# User-specific .bazelrc
+user.bazelrc
+
+/t/
+/spec/
+/spec-ee/
+/servroot/
+/autodoc/
+/.github/

.bazelrc

@@ -0,0 +1,51 @@
+# Bazel doesn't need more than 200MB of memory for local build based on memory profiling:
+# https://docs.bazel.build/versions/master/skylark/performance.html#memory-profiling
+# The default JVM max heapsize is 1/4 of physical memory up to 32GB which could be large
+# enough to consume all memory constrained by cgroup in large host.
+# Limiting JVM heapsize here to let it do GC more when approaching the limit to
+# leave room for compiler/linker.
+# The number 3G is chosen heuristically to both support large VM and small VM with RBE.
+# Startup options cannot be selected via config.
+startup --host_jvm_args=-Xmx512m
+
+run --color=yes
+
+common --color=yes
+common --curses=auto
+
+build --experimental_ui_max_stdouterr_bytes=10485760
+
+build --show_progress_rate_limit=0
+build --show_timestamps
+build --worker_verbose
+
+build --incompatible_strict_action_env
+
+# Enable --platforms API based cpu,compiler,crosstool_top selection; remove this in 7.0.0 as it's enabled by default
+build --incompatible_enable_cc_toolchain_resolution
+
+# Pass PATH, CC, CXX variables from the environment.
+build --action_env=CC --host_action_env=CC
+build --action_env=CXX --host_action_env=CXX
+build --action_env=PATH --host_action_env=PATH
+
+build --action_env=BAZEL_BUILD=1
+
+# temporary fix for https://github.com/bazelbuild/bazel/issues/12905 on macOS
+build --features=-debug_prefix_map_pwd_is_dot
+
+# Build flags.
+build --action_env=BUILD_NAME=kong-dev
+build --action_env=INSTALL_DESTDIR=MANAGED
+build --strip=never
+
+# Release flags
+build:release --//:debug=false
+build:release --action_env=BUILD_NAME=kong-dev
+build:release --action_env=INSTALL_DESTDIR=/usr/local
+build:release --copt="-g"
+build:release --strip=never
+
+build --spawn_strategy=local
+
+build --action_env=GITHUB_TOKEN --host_action_env=GITHUB_TOKEN

.bazelversion

@@ -0,0 +1 @@
+6.1.0

.ci/luacov-stats-aggregator.lua

@@ -0,0 +1,62 @@
+-- Aggregates stats from multiple luacov stat files.
+-- Example stats for a 12 lines file `my/file.lua`
+-- that received hits on lines 3, 4, 9:
+-- 
+-- ["my/file.lua"] = {
+--   [3] = 1,
+--   [4] = 3,
+--   [9] = 2,
+--   max = 12,
+--   max_hits = 3
+-- }
+--
+
+local luacov_stats = require "luacov.stats"
+local luacov_reporter = require "luacov.reporter"
+local luacov_runner = require "luacov.runner"
+local lfs = require "lfs"
+
+
+-- load parameters
+local params = {...}
+local stats_folders_prefix = params[1] or "luacov-stats-out-"
+local file_name            = params[2] or "luacov.stats.out"
+local strip_prefix         = params[3] or ""
+local base_path            = "."
+
+
+-- load stats from different folders named using the format:
+-- luacov-stats-out-${timestamp}
+local loaded_stats = {}
+for folder in lfs.dir(base_path) do
+  if folder:find(stats_folders_prefix, 1, true) then
+    local stats_file = folder .. "/" .. file_name
+    local loaded = luacov_stats.load(stats_file)
+    if loaded then
+      loaded_stats[#loaded_stats + 1] = loaded
+      print("loading file: " .. stats_file)
+    end
+  end
+end
+
+
+-- aggregate
+luacov_runner.load_config()
+for _, stat_data in ipairs(loaded_stats) do
+  -- make all paths relative to ensure file keys have the same format
+  -- and avoid having separate counters for the same file
+  local rel_stat_data = {}
+  for f_name, data in pairs(stat_data) do
+    if f_name:sub(0, #strip_prefix) == strip_prefix then
+      f_name = f_name:sub(#strip_prefix + 1)
+    end
+    rel_stat_data[f_name] = data
+  end
+
+  luacov_runner.data = rel_stat_data
+  luacov_runner.save_stats()
+end
+
+
+-- generate report
+luacov_reporter.report()

.devcontainer/devcontainer.json

@@ -16,7 +16,7 @@
     // Use 'forwardPorts' to make a list of ports inside the container available locally.
     "forwardPorts": [8000, 8001, "db:5432"],
 
-    "postCreateCommand": "make dev",
+    "postCreateCommand": "make venv-dev",
 
     // Set *default* container specific settings.json values on container create.
     // "settings": {},

.devcontainer/docker-compose.yml

@@ -19,8 +19,8 @@ services:
       - ..:/workspace:cached
 
       # Uncomment the next line to use Docker from inside the container. See https://aka.ms/vscode-remote/samples/docker-from-docker-compose for details.
-      - /var/run/docker.sock:/var/run/docker.sock 
-    
+      - /var/run/docker.sock:/var/run/docker.sock
+
     # Uncomment the next four lines if you will use a ptrace-based debugger like C++, Go, and Rust.
     cap_add:
       - SYS_PTRACE
@@ -37,12 +37,12 @@ services:
       CRYPTO_DIR: /usr/local/kong
 
     # Overrides default command so things don't shut down after the process ends.
-    command: /bin/sh -c "while sleep 1000; do :; done" 
+    command: /bin/sh -c "while sleep 1000; do :; done"
 
     # Runs app on the same network as the service container, allows "forwardPorts" in devcontainer.json function.
     network_mode: service:db
 
-    # Use "forwardPorts" in **devcontainer.json** to forward an app port locally. 
+    # Use "forwardPorts" in **devcontainer.json** to forward an app port locally.
     # (Adding the "ports" property to this file will not forward from a Codespace.)
 
     # Uncomment the next line to use a non-root user for all processes - See https://aka.ms/vscode-remote/containers/non-root for details.

.github/ISSUE_TEMPLATE/bug_report.yaml

@@ -4,15 +4,15 @@ body:
 - type: checkboxes
   attributes:
     label: Is there an existing issue for this?
-    description: Please search to see if an issue already exists for the bug you encountered. Make sure you upgrade to the latest version of Kong.
+    description: Please search to see if an issue already exists for the bug you encountered. Make sure you are also using the latest version of Kong.
     options:
     - label: I have searched the existing issues
       required: true
 - type: input 
   attributes:
     label: Kong version (`$ kong version`)
     description: 'example: Kong 2.5'
-    placeholder: 'Please put the Kong Gateway version here.'
+    placeholder: 'Please provide the current Kong Gateway version you are using here.'
   validations:
     required: true
 - type: textarea
@@ -40,7 +40,6 @@ body:
       2. With this config...
       3. Run '...'
       4. See error...
-    render: markdown
   validations:
     required: false
 - type: textarea

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,7 @@
 blank_issues_enabled: true
 contact_links:
+  - name: Kong Gateway Open Source Community Pledge
+    url: https://github.com/Kong/kong/blob/master/COMMUNITY_PLEDGE.md
   - name: Feature Request
     url: https://github.com/Kong/kong/discussions/categories/ideas
     about: Propose your cool ideas and feature requests at the Kong discussion forum

.github/PULL_REQUEST_TEMPLATE.md

@@ -2,17 +2,25 @@
 NOTE: Please read the CONTRIBUTING.md guidelines before submitting your patch,
 and ensure you followed them all:
 https://github.com/Kong/kong/blob/master/CONTRIBUTING.md#contributing
+
+Refer to the Kong Gateway Community Pledge to understand how we work
+with the open source community:
+https://github.com/Kong/kong/blob/master/COMMUNITY_PLEDGE.md
 -->
 
 ### Summary
 
 <!--- Why is this change required? What problem does it solve? -->
 
+### Checklist
+
+- [ ] The Pull Request has tests
+- [ ] A changelog file has been created under `changelog/unreleased/kong` or `skip-changelog` label added on PR if changelog is unnecessary. [README.md](https://github.com/Kong/gateway-changelog/README.md)
+- [ ] There is a user-facing docs PR against https://github.com/Kong/docs.konghq.com - PUT DOCS PR HERE
+
 ### Full changelog
 
 * [Implement ...]
-* [Add related tests]
-* ...
 
 ### Issue reference
 

.github/actions/build-cache-key/action.yml

@@ -0,0 +1,62 @@
+name: Build Cache Key
+
+description: >
+  Generates a cache key suitable for save/restore of Kong builds.
+
+inputs:
+  prefix:
+    description: 'String prefix applied to the build cache key'
+    required: false
+    default: 'build'
+  extra:
+    description: 'Additional values/file hashes to use in the cache key'
+    required: false
+
+outputs:
+  cache-key:
+    description: 'The generated cache key'
+    value: ${{ steps.cache-key.outputs.CACHE_KEY }}
+
+runs:
+  using: composite
+  steps:
+    - name: Generate cache key
+      id: cache-key
+      shell: bash
+      env:
+        PREFIX: ${{ inputs.prefix }}
+        EXTRA: ${{ inputs.extra }}
+      run: |
+        # please keep these sorted
+        FILE_HASHES=(
+          ${{ hashFiles('.bazelignore') }}
+          ${{ hashFiles('.bazelrc') }}
+          ${{ hashFiles('.bazelversion') }}
+          ${{ hashFiles('.github/actions/build-cache-key/**') }}
+          ${{ hashFiles('.github/workflows/build.yml') }}
+          ${{ hashFiles('.requirements') }}
+          ${{ hashFiles('BUILD.bazel') }}
+          ${{ hashFiles('WORKSPACE') }}
+          ${{ hashFiles('bin/kong') }}
+          ${{ hashFiles('bin/kong-health') }}
+          ${{ hashFiles('build/**') }}
+          ${{ hashFiles('kong-*.rockspec') }}
+          ${{ hashFiles('kong.conf.default') }}
+        )
+
+        if [[ -n ${EXTRA:-} ]]; then
+          readarray \
+            -O "${#FILE_HASHES[@]}" \
+            -t \
+            FILE_HASHES \
+          <<< "$EXTRA"
+        fi
+
+        HASH=$(printf '%s\n' "${FILE_HASHES[@]}" \
+          | grep -vE '^$' \
+          | sort --stable --unique \
+          | sha256sum - \
+          | awk '{print $1}'
+        )
+
+        echo "CACHE_KEY=${PREFIX}::${HASH}" | tee -a $GITHUB_OUTPUT

.github/dependabot.yml

@@ -6,5 +6,5 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      # Check for updates to GitHub Actions every weekday
-      interval: "daily"
+      # Check for updates to GitHub Actions every week
+      interval: "weekly"