Merge branch 'main' into docs/upstream-policy

.github/workflows/build.yml

@@ -178,7 +178,7 @@ jobs:
         if: always()
 
       - name: Upload Scan Results
-        uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
         continue-on-error: true
         with:
           name: scan-results-${{ inputs.image }}

.github/workflows/ci.yml

@@ -98,7 +98,7 @@ jobs:
           token: ${{ secrets.CODECOV_TOKEN }}
 
       - name: Upload Coverage Report
-        uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
         with:
           name: cover-${{ github.run_id }}.html
           path: ${{ github.workspace }}/cover.html

.github/workflows/docs-build-push.yml

@@ -41,7 +41,7 @@ jobs:
   call-docs-build-push:
     needs: [vars]
     if: ${{ github.event.repository.fork == false && needs.vars.outputs.azure_creds == 'true' }}
-    uses: nginxinc/docs-actions/.github/workflows/docs-build-push.yml@a733e84a262f8d5d885bfc8eac80bc85928da322 # v1.0.3
+    uses: nginxinc/docs-actions/.github/workflows/docs-build-push.yml@d20def4d420028a71f99863011c6de7325c4013e # v1.0.4
     permissions:
       pull-requests: write # needed to write preview url comment to PR
       contents: read

.github/workflows/nfr.yml

@@ -4,11 +4,11 @@ on:
   workflow_dispatch:
     inputs:
       test_label:
-        description: NFR test to run. Choose between performance, upgrade, scale, or all
+        description: NFR test to run. Choose between a specific test or all tests
         required: true
         default: all
         type: choice
-        options: [performance, upgrade, scale, all]
+        options: [performance, upgrade, scale, zero-downtime-scale, reconfiguration, all]
       version:
         description: Version of NGF under test
         required: true
@@ -129,7 +129,7 @@ jobs:
           fi
 
       - name: Upload Artifacts
-        uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
         with:
           name: results-${{ matrix.type }}
           path: tests/results/**/*-${{ matrix.type }}.*
@@ -160,7 +160,7 @@ jobs:
           merge-multiple: true
 
       - name: Open a PR with the results
-        uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6.1.0
+        uses: peter-evans/create-pull-request@4320041ed380b20e97d388d56a7fb4f9b8c20e79 # v7.0.0
         with:
           token: ${{ secrets.NGINX_PAT }}
           commit-message: NFR Test Results for NGF version ${{ needs.vars.outputs.version }}

.github/workflows/release-pr.yml

@@ -89,7 +89,7 @@ jobs:
           make generate-all
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6.1.0
+        uses: peter-evans/create-pull-request@4320041ed380b20e97d388d56a7fb4f9b8c20e79 # v7.0.0
         with:
           token: ${{ secrets.NGINX_PAT }}
           commit-message: Release ${{ inputs.version }}

.github/workflows/scorecards.yml

@@ -52,7 +52,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
         with:
           name: SARIF file
           path: results.sarif

docs/developer/release-process.md

@@ -66,7 +66,7 @@ To create a new release, follow these steps:
     4. `GW_API_PREV_VERSION` in tests Makefile, if necessary.
     5. Any references in the docs to the previous release.
     6. Any installation instructions to ensure that the supported Gateway API and NGF versions are correct. Specifically, helm README.
-8. Run the [docs workflow](https://github.com/nginxinc/nginx-gateway-fabric/actions/workflows/docs-build-push.yml) for **prod** on the **release branch**.
+8. Run the [docs workflow](https://github.com/nginxinc/nginx-gateway-fabric/actions/workflows/docs-build-push.yml) for **prod** on the **release branch**. Open a PR to the release branch to turn auto-deploy on for the docs workflow in this branch. See [this README](https://github.com/nginxinc/docs-actions/tree/v1.0.4?tab=readme-ov-file#caller-example) for how to do this. Docs should only be auto-published when changes to the `site/` directory are made.
 9. Close the issue created in Step 1.
 10. Ensure that the [associated milestone](https://github.com/nginxinc/nginx-gateway-fabric/milestones) is closed.
 11. Verify that published artifacts in the release can be installed properly.

go.mod

@@ -13,7 +13,7 @@ require (
 	github.com/onsi/ginkgo/v2 v2.20.2
 	github.com/onsi/gomega v1.34.2
 	github.com/prometheus/client_golang v1.20.2
-	github.com/prometheus/common v0.57.0
+	github.com/prometheus/common v0.58.0
 	github.com/spf13/cobra v1.8.1
 	github.com/spf13/pflag v1.0.5
 	go.opentelemetry.io/otel v1.29.0

go.sum

@@ -106,8 +106,8 @@ github.com/prometheus/client_golang v1.20.2 h1:5ctymQzZlyOON1666svgwn3s6IKWgfbjs
 github.com/prometheus/client_golang v1.20.2/go.mod h1:PIEt8X02hGcP8JWbeHyeZ53Y/jReSnHgO035n//V5WE=
 github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
 github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
-github.com/prometheus/common v0.57.0 h1:Ro/rKjwdq9mZn1K5QPctzh+MA4Lp0BuYk5ZZEVhoNcY=
-github.com/prometheus/common v0.57.0/go.mod h1:7uRPFSUTbfZWsJ7MHY56sqt7hLQu3bxXHDnNhl8E9qI=
+github.com/prometheus/common v0.58.0 h1:N+N8vY4/23r6iYfD3UQZUoJPnUYAo7v6LG5XZxjZTXo=
+github.com/prometheus/common v0.58.0/go.mod h1:GpWM7dewqmVYcd7SmRaiWVe9SSqjf0UrwnYnpEZNuT0=
 github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
 github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
 github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=

internal/mode/static/nginx/config/policies/clientsettings/generator_test.go

@@ -13,6 +13,7 @@ import (
 )
 
 func TestGenerate(t *testing.T) {
+	t.Parallel()
 	maxSize := helpers.GetPointer[ngfAPI.Size]("10m")
 	bodyTimeout := helpers.GetPointer[ngfAPI.Duration]("600ms")
 	keepaliveRequests := helpers.GetPointer[int32](900)
@@ -149,9 +150,9 @@ func TestGenerate(t *testing.T) {
 		},
 	}
 
-	g := NewWithT(t)
-
-	checkResults := func(resFiles policies.GenerateResultFiles, expStrings []string) {
+	checkResults := func(t *testing.T, resFiles policies.GenerateResultFiles, expStrings []string) {
+		t.Helper()
+		g := NewWithT(t)
 		g.Expect(resFiles).To(HaveLen(1))
 
 		for _, str := range expStrings {
@@ -160,22 +161,24 @@ func TestGenerate(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		t.Run(test.name, func(_ *testing.T) {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
 			generator := clientsettings.NewGenerator()
 
 			resFiles := generator.GenerateForServer([]policies.Policy{test.policy}, http.Server{})
-			checkResults(resFiles, test.expStrings)
+			checkResults(t, resFiles, test.expStrings)
 
 			resFiles = generator.GenerateForLocation([]policies.Policy{test.policy}, http.Location{})
-			checkResults(resFiles, test.expStrings)
+			checkResults(t, resFiles, test.expStrings)
 
 			resFiles = generator.GenerateForInternalLocation([]policies.Policy{test.policy})
-			checkResults(resFiles, test.expStrings)
+			checkResults(t, resFiles, test.expStrings)
 		})
 	}
 }
 
 func TestGenerateNoPolicies(t *testing.T) {
+	t.Parallel()
 	g := NewWithT(t)
 
 	generator := clientsettings.NewGenerator()

internal/mode/static/nginx/config/policies/clientsettings/validator_test.go

@@ -53,6 +53,7 @@ func createModifiedPolicy(mod policyModFunc) *ngfAPI.ClientSettingsPolicy {
 }
 
 func TestValidator_Validate(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
 		name          string
 		policy        *ngfAPI.ClientSettingsPolicy
@@ -133,6 +134,7 @@ func TestValidator_Validate(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
 			g := NewWithT(t)
 
 			conds := v.Validate(test.policy, nil)
@@ -142,6 +144,7 @@ func TestValidator_Validate(t *testing.T) {
 }
 
 func TestValidator_ValidatePanics(t *testing.T) {
+	t.Parallel()
 	v := clientsettings.NewValidator(nil)
 
 	validate := func() {
@@ -154,6 +157,7 @@ func TestValidator_ValidatePanics(t *testing.T) {
 }
 
 func TestValidator_Conflicts(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
 		polA      *ngfAPI.ClientSettingsPolicy
 		polB      *ngfAPI.ClientSettingsPolicy
@@ -256,6 +260,7 @@ func TestValidator_Conflicts(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
 			g := NewWithT(t)
 
 			g.Expect(v.Conflicts(test.polA, test.polB)).To(Equal(test.conflicts))
@@ -264,6 +269,7 @@ func TestValidator_Conflicts(t *testing.T) {
 }
 
 func TestValidator_ConflictsPanics(t *testing.T) {
+	t.Parallel()
 	v := clientsettings.NewValidator(nil)
 
 	conflicts := func() {

internal/mode/static/nginx/config/policies/observability/generator_test.go

@@ -15,6 +15,7 @@ import (
 )
 
 func TestGenerate(t *testing.T) {
+	t.Parallel()
 	ratio := helpers.GetPointer[int32](25)
 	zeroRatio := helpers.GetPointer[int32](0)
 	context := helpers.GetPointer[ngfAPI.TraceContext](ngfAPI.TraceContextExtract)
@@ -242,6 +243,7 @@ func TestGenerate(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
 			g := NewWithT(t)
 
 			generator := observability.NewGenerator(test.telemetryConf)
@@ -280,6 +282,7 @@ func TestGenerate(t *testing.T) {
 }
 
 func TestGenerateNoPolicies(t *testing.T) {
+	t.Parallel()
 	g := NewWithT(t)
 
 	generator := observability.NewGenerator(dataplane.Telemetry{})

internal/mode/static/nginx/config/policies/observability/validator_test.go

@@ -52,6 +52,7 @@ func createModifiedPolicy(mod policyModFunc) *ngfAPI.ObservabilityPolicy {
 }
 
 func TestValidator_Validate(t *testing.T) {
+	t.Parallel()
 	globalSettings := &policies.GlobalSettings{
 		NginxProxyValid:  true,
 		TelemetryEnabled: true,
@@ -185,6 +186,7 @@ func TestValidator_Validate(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
 			g := NewWithT(t)
 
 			conds := v.Validate(test.policy, test.globalSettings)
@@ -194,6 +196,7 @@ func TestValidator_Validate(t *testing.T) {
 }
 
 func TestValidator_ValidatePanics(t *testing.T) {
+	t.Parallel()
 	v := observability.NewValidator(nil)
 
 	validate := func() {
@@ -206,6 +209,7 @@ func TestValidator_ValidatePanics(t *testing.T) {
 }
 
 func TestValidator_Conflicts(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
 		polA      *ngfAPI.ObservabilityPolicy
 		polB      *ngfAPI.ObservabilityPolicy
@@ -244,6 +248,7 @@ func TestValidator_Conflicts(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
 			g := NewWithT(t)
 
 			g.Expect(v.Conflicts(test.polA, test.polB)).To(Equal(test.conflicts))
@@ -252,6 +257,7 @@ func TestValidator_Conflicts(t *testing.T) {
 }
 
 func TestValidator_ConflictsPanics(t *testing.T) {
+	t.Parallel()
 	v := observability.NewValidator(nil)
 
 	conflicts := func() {

internal/mode/static/nginx/config/policies/policies_suite_test.go

@@ -8,6 +8,7 @@ import (
 )
 
 func TestPolicies(t *testing.T) {
+	t.Parallel()
 	RegisterFailHandler(Fail)
 	RunSpecs(t, "Policies Suite")
 }

internal/mode/static/nginx/config/validation/common_test.go

@@ -6,6 +6,7 @@ import (
 )
 
 func TestValidateEscapedString(t *testing.T) {
+	t.Parallel()
 	validator := func(value string) error { return validateEscapedString(value, []string{"example"}) }
 
 	testValidValuesForSimpleValidator(
@@ -25,6 +26,7 @@ func TestValidateEscapedString(t *testing.T) {
 }
 
 func TestValidateEscapedStringNoVarExpansion(t *testing.T) {
+	t.Parallel()
 	validator := func(value string) error { return validateEscapedStringNoVarExpansion(value, []string{"example"}) }
 
 	testValidValuesForSimpleValidator(
@@ -45,6 +47,7 @@ func TestValidateEscapedStringNoVarExpansion(t *testing.T) {
 }
 
 func TestValidateValidHeaderName(t *testing.T) {
+	t.Parallel()
 	validator := func(value string) error { return validateHeaderName(value) }
 
 	testValidValuesForSimpleValidator(

internal/mode/static/nginx/config/validation/framework_test.go

@@ -79,6 +79,7 @@ func testInvalidValuesForSupportedValuesValidator[T configValue](
 }
 
 func TestValidateInSupportedValues(t *testing.T) {
+	t.Parallel()
 	supportedValues := map[string]struct{}{
 		"value1": {},
 		"value2": {},
@@ -105,6 +106,7 @@ func TestValidateInSupportedValues(t *testing.T) {
 }
 
 func TestValidateNoUnsupportedValues(t *testing.T) {
+	t.Parallel()
 	unsupportedValues := map[string]struct{}{
 		"badvalue1": {},
 		"badvalue2": {},
@@ -133,6 +135,7 @@ func TestValidateNoUnsupportedValues(t *testing.T) {
 }
 
 func TestGetSortedKeysAsString(t *testing.T) {
+	t.Parallel()
 	values := map[string]struct{}{
 		"value3": {},
 		"value1": {},

internal/mode/static/nginx/config/validation/generic_test.go

@@ -3,6 +3,7 @@ package validation
 import "testing"
 
 func TestGenericValidator_ValidateEscapedStringNoVarExpansion(t *testing.T) {
+	t.Parallel()
 	validator := GenericValidator{}
 
 	testValidValuesForSimpleValidator(
@@ -24,6 +25,7 @@ func TestGenericValidator_ValidateEscapedStringNoVarExpansion(t *testing.T) {
 }
 
 func TestValidateServiceName(t *testing.T) {
+	t.Parallel()
 	validator := GenericValidator{}
 
 	testValidValuesForSimpleValidator(
@@ -45,6 +47,7 @@ func TestValidateServiceName(t *testing.T) {
 }
 
 func TestValidateNginxDuration(t *testing.T) {
+	t.Parallel()
 	validator := GenericValidator{}
 
 	testValidValuesForSimpleValidator(
@@ -65,6 +68,7 @@ func TestValidateNginxDuration(t *testing.T) {
 }
 
 func TestValidateNginxSize(t *testing.T) {
+	t.Parallel()
 	validator := GenericValidator{}
 
 	testValidValuesForSimpleValidator(
@@ -86,6 +90,7 @@ func TestValidateNginxSize(t *testing.T) {
 }
 
 func TestValidateEndpoint(t *testing.T) {
+	t.Parallel()
 	validator := GenericValidator{}
 
 	testValidValuesForSimpleValidator(