fix(scripts): fix update-copyright in venv and remove unused repos

.github/actions/build-cache-key/action.yml

@@ -0,0 +1,45 @@
+name: Build Cache Key
+
+description: >
+  Generates a cache key suitable for save/restore of Kong builds.
+
+inputs:
+  prefix:
+    description: 'String prefix applied to the build cache key'
+    required: false
+    default: 'build'
+
+outputs:
+  cache-key:
+    description: 'The generated cache key'
+    value: ${{ steps.cache-key.outputs.CACHE_KEY }}
+
+runs:
+  using: composite
+  steps:
+    - name: Generate cache key
+      id: cache-key
+      shell: bash
+      run: |
+        # please keep these sorted
+        FILE_HASHES=(
+          ${{ hashFiles('.bazelignore') }}
+          ${{ hashFiles('.bazelrc') }}
+          ${{ hashFiles('.bazelversion') }}
+          ${{ hashFiles('.github/actions/build-cache-key/**') }}
+          ${{ hashFiles('.github/workflows/build.yml') }}
+          ${{ hashFiles('.requirements') }}
+          ${{ hashFiles('BUILD.bazel') }}
+          ${{ hashFiles('WORKSPACE') }}
+          ${{ hashFiles('bin/kong') }}
+          ${{ hashFiles('bin/kong-health') }}
+          ${{ hashFiles('build/**') }}
+          ${{ hashFiles('kong-*.rockspec') }}
+          ${{ hashFiles('kong.conf.default') }}
+          ${{ hashFiles('kong/**') }}
+        )
+
+        HASH=$(sha256sum - <<< "${FILE_HASHES[*]}" | awk '{print $1}' )
+        CACHE_KEY=${{ inputs.prefix }}::${HASH}
+        echo "cache-key: ${CACHE_KEY}"
+        echo "CACHE_KEY=${CACHE_KEY}" >> $GITHUB_OUTPUT

.github/labeler.yml

@@ -57,6 +57,10 @@ core/tracing:
 - kong/tracing/**/*
 - kong/pdk/tracing.lua
 
+core/wasm:
+- changed-files:
+  - any-glob-to-any-file: ['kong/runloop/wasm.lua', 'kong/runloop/wasm/**/*']
+
 chore:
 - .github/**/*
 - .devcontainer/**/*

.github/matrix-full.yml

@@ -1,6 +1,5 @@
 build-packages:
 # label: used to distinguish artifacts for later use
-# os: the github actions runner label to pick from
 # image: docker image name if the build is running in side a container
 # package: package type
 # package-type: the nfpm packaging target, //:kong_{package} target; only used when package is rpm
@@ -9,73 +8,66 @@ build-packages:
 
 # Ubuntu
 - label: ubuntu-20.04
-  os: ubuntu-22.04
   image: ubuntu:20.04
   package: deb
   check-manifest-suite: ubuntu-20.04-amd64
 - label: ubuntu-22.04
-  os: ubuntu-22.04
   package: deb
   check-manifest-suite: ubuntu-22.04-amd64
 - label: ubuntu-22.04-arm64
-  os: ubuntu-22.04
   package: deb
-  bazel-args: --platforms=//:generic-crossbuild-aarch64 --//:wasmx=false
+  bazel-args: --platforms=//:generic-crossbuild-aarch64
   check-manifest-suite: ubuntu-22.04-arm64
 
 # Debian
 - label: debian-10
-  os: ubuntu-22.04
   image: debian:10
   package: deb
   check-manifest-suite: debian-10-amd64
 - label: debian-11
-  os: ubuntu-22.04
   image: debian:11
   package: deb
   check-manifest-suite: debian-11-amd64
 
-# CentOS
-- label: centos-7
-  os: ubuntu-22.04
-  image: centos:7
-  package: rpm
-  package-type: el7
-  check-manifest-suite: el7-amd64
-
 # RHEL
 - label: rhel-7
-  os: ubuntu-22.04
   image: centos:7
   package: rpm
   package-type: el7
+  bazel-args: --//:wasmx_el7_workaround=true
   check-manifest-suite: el7-amd64
 - label: rhel-8
-  os: ubuntu-22.04
   image: rockylinux:8
   package: rpm
   package-type: el8
   check-manifest-suite: el8-amd64
 - label: rhel-9
-  os: ubuntu-22.04
   image: rockylinux:9
   package: rpm
   package-type: el9
   check-manifest-suite: el9-amd64
+- label: rhel-9-arm64
+  package: rpm
+  package-type: el9
+  bazel-args: --platforms=//:rhel9-crossbuild-aarch64
+  check-manifest-suite: el9-arm64
 
-# Amazon Linux
+  # Amazon Linux
 - label: amazonlinux-2
-  os: ubuntu-22.04
   image: amazonlinux:2
   package: rpm
   package-type: aws2
   check-manifest-suite: amazonlinux-2-amd64
 - label: amazonlinux-2023
-  os: ubuntu-22.04
   image: amazonlinux:2023
   package: rpm
   package-type: aws2023
   check-manifest-suite: amazonlinux-2023-amd64
+- label: amazonlinux-2023-arm64
+  package: rpm
+  package-type: aws2023
+  bazel-args: --platforms=//:aws2023-crossbuild-aarch64
+  check-manifest-suite: amazonlinux-2023-arm64
 
 build-images:
 # Only build images for the latest version of each major release.
@@ -107,6 +99,8 @@ build-images:
   package: rpm
   rpm_platform: el9
   artifact-from: rhel-9
+  artifact-from-alt: rhel-9-arm64
+  docker-platforms: linux/amd64, linux/arm64
 
 smoke-tests:
 - label: ubuntu
@@ -153,14 +147,6 @@ release-packages:
   artifact-type: debian
   artifact: kong.amd64.deb
 
-# CentOS
-- label: centos-7
-  package: rpm
-  artifact-from: centos-7
-  artifact-version: 7
-  artifact-type: centos
-  artifact: kong.el7.amd64.rpm
-
 # RHEL
 - label: rhel-7
   package: rpm
@@ -180,6 +166,12 @@ release-packages:
   artifact-version: 9
   artifact-type: rhel
   artifact: kong.el9.amd64.rpm
+- label: rhel-9-arm64
+  package: rpm
+  artifact-from: rhel-9-arm64
+  artifact-version: 9
+  artifact-type: rhel
+  artifact: kong.el9.arm64.rpm
 
 # Amazon Linux
 - label: amazonlinux-2
@@ -194,6 +186,12 @@ release-packages:
   artifact-version: 2023
   artifact-type: amazonlinux
   artifact: kong.aws2023.amd64.rpm
+- label: amazonlinux-2023-arm64
+  package: rpm
+  artifact-from: amazonlinux-2023-arm64
+  artifact-version: 2023
+  artifact-type: amazonlinux
+  artifact: kong.aws2023.arm64.rpm
 
 release-images:
 - label: ubuntu

.github/workflows/backport-fail-bot.yml

@@ -8,30 +8,44 @@ jobs:
   check_comment:
     runs-on: ubuntu-latest
     if: github.event.issue.pull_request != null && contains(github.event.comment.body, 'To backport manually, run these commands in your terminal')
+
     steps:
-      - name: Generate Slack Payload
-        id: generate-payload
-        uses: actions/github-script@v6
-        with:
-          script: |
-            const slack_mapping = JSON.parse(process.env.SLACK_MAPPING);
-            const pr_url = "${{ github.event.issue.pull_request.html_url}}";
-            const pr_author_github_id = "${{ github.event.issue.user.login }}"
-            const pr_author_slack_id = slack_mapping[pr_author_github_id];
-            const author = (pr_author_slack_id ? `<@${pr_author_slack_id}>` : pr_author_github_id);
-            const payload = {
-              text: `Backport failed in PR: ${pr_url}. Please check it ${author}.`,
-              channel: process.env.SLACK_CHANNEL,
-            };
-            return JSON.stringify(payload);
-          result-encoding: string
-        env:
-          SLACK_CHANNEL: gateway-notifications
-          SLACK_MAPPING: "${{ vars.GH_ID_2_SLACK_ID_MAPPING }}"
+    - name: Fetch mapping file
+      id: fetch_mapping
+      uses: actions/github-script@v6
+      env:
+        ACCESS_TOKEN: ${{ secrets.PAT }}
+      with:
+        script: |
+          const url = 'https://raw.githubusercontent.com/Kong/github-slack-mapping/main/mapping.json';
+          const headers = {Authorization: `token ${process.env.ACCESS_TOKEN}`};
+          const response = await fetch(url, {headers});
+          const mapping = await response.json();
+          return mapping;
+
+    - name: Generate Slack Payload
+      id: generate-payload
+      uses: actions/github-script@v6
+      env:
+        SLACK_CHANNEL: gateway-notifications
+        SLACK_MAPPING: "${{ steps.fetch_mapping.outputs.result }}"
+      with:
+        script: |
+          const pr_url = ${{ github.event.issue.pull_request.html_url }};
+          const slack_mapping = JSON.parse(process.env.SLACK_MAPPING);
+          const pr_author_github_id = ${{ github.event.issue.user.login }};
+          const pr_author_slack_id = slack_mapping[pr_author_github_id];
+          const author = pr_author_slack_id ? `<@${pr_author_slack_id}>` : pr_author_github_id;
+          const payload = {
+            text: `${pr_url} from ${author} failed to backport.`,
+            channel: process.env.SLACK_CHANNEL,
+          };
+          return JSON.stringify(payload);
+        result-encoding: string
 
-      - name: Send Slack Message
-        uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117 # v1.24.0
-        with:
-          payload: ${{ steps.generate-payload.outputs.result }}
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_GATEWAY_NOTIFICATIONS_WEBHOOK }}
+    - name: Send Slack Message
+      uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117 # v1.24.0
+      with:
+        payload: ${{ steps.generate-payload.outputs.result }}
+      env:
+        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_GATEWAY_NOTIFICATIONS_WEBHOOK }}

.github/workflows/backport.yml

@@ -1,24 +1,27 @@
 name: Backport
 on:
   pull_request_target:
-    types:
-      - closed
-      - labeled
-
+    types: [closed]
+permissions:
+  contents: write # so it can comment
+  pull-requests: write # so it can create pull requests
 jobs:
   backport:
     name: Backport
     runs-on: ubuntu-latest
-    if: >
-      github.event.pull_request.merged
-      && (
-        github.event.action == 'closed'
-        || (
-          github.event.action == 'labeled'
-          && contains(github.event.label.name, 'backport')
-        )
-      )
+    if: github.event.pull_request.merged
     steps:
-      - uses: tibdex/backport@2e217641d82d02ba0603f46b1aeedefb258890ac # v2.0.3
+      - uses: actions/checkout@v4
+      - name: Create backport pull requests
+        uses: korthout/backport-action@cb79e4e5f46c7d7d653dd3d5fa8a9b0a945dfe4b # v2.1.0
         with:
           github_token: ${{ secrets.PAT }}
+          pull_title: '[backport -> ${target_branch}] ${pull_title}'
+          merge_commits: 'skip'
+          copy_labels_pattern: ^(?!backport ).* # copies all labels except those starting with "backport "
+          label_pattern: ^backport (release\/[^ ]+)$ # filters for labels starting with "backport " and extracts the branch name
+          pull_description: |-
+            Automated backport to `${target_branch}`, triggered by a label in #${pull_number}.
+          copy_assignees: true
+          copy_milestone: true
+          copy_requested_reviewers: true

.github/workflows/build.yml

@@ -5,6 +5,10 @@ on:
       relative-build-root:
         required: true
         type: string
+    outputs:
+      cache-key:
+        description: 'Computed cache key, used for restoring cache in other workflows'
+        value: ${{ jobs.build.outputs.cache-key }}
 
 env:
   BUILD_ROOT: ${{ github.workspace }}/${{ inputs.relative-build-root }}
@@ -14,6 +18,9 @@ jobs:
     name: Build dependencies
     runs-on: ubuntu-22.04
 
+    outputs:
+      cache-key: ${{ steps.cache-key.outputs.cache-key }}
+
     steps:
     - name: Checkout Kong source code
       uses: actions/checkout@v3
@@ -24,13 +31,16 @@ jobs:
     - name: Build WASM Test Filters
       uses: ./.github/actions/build-wasm-test-filters
 
+    - name: Generate cache key
+      id: cache-key
+      uses: ./.github/actions/build-cache-key
+
     - name: Lookup build cache
       id: cache-deps
       uses: actions/cache@v3
       with:
-        path: |
-          ${{ env.BUILD_ROOT }}
-        key: ${{ hashFiles('.requirements', 'kong-*.rockspec', '.bazelversion', '.bazelrc', 'build/**', 'BUILD.bazel', 'WORKSPACE', '.github/workflows/build_and_test.yml') }}
+        path: ${{ env.BUILD_ROOT }}
+        key: ${{ steps.cache-key.outputs.cache-key }}
 
     - name: Install packages
       if: steps.cache-deps.outputs.cache-hit != 'true'