Merge branch 'main' into helm/schema

.github/workflows/build.yml

@@ -178,7 +178,7 @@ jobs:
         if: always()
 
       - name: Upload Scan Results
-        uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
         continue-on-error: true
         with:
           name: scan-results-${{ inputs.image }}

.github/workflows/ci.yml

@@ -98,7 +98,7 @@ jobs:
           token: ${{ secrets.CODECOV_TOKEN }}
 
       - name: Upload Coverage Report
-        uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
         with:
           name: cover-${{ github.run_id }}.html
           path: ${{ github.workspace }}/cover.html

.github/workflows/nfr.yml

@@ -129,7 +129,7 @@ jobs:
           fi
 
       - name: Upload Artifacts
-        uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
         with:
           name: results-${{ matrix.type }}
           path: tests/results/**/*-${{ matrix.type }}.*
@@ -160,7 +160,7 @@ jobs:
           merge-multiple: true
 
       - name: Open a PR with the results
-        uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6.1.0
+        uses: peter-evans/create-pull-request@4320041ed380b20e97d388d56a7fb4f9b8c20e79 # v7.0.0
         with:
           token: ${{ secrets.NGINX_PAT }}
           commit-message: NFR Test Results for NGF version ${{ needs.vars.outputs.version }}

.github/workflows/release-pr.yml

@@ -89,7 +89,7 @@ jobs:
           make generate-all
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6.1.0
+        uses: peter-evans/create-pull-request@4320041ed380b20e97d388d56a7fb4f9b8c20e79 # v7.0.0
         with:
           token: ${{ secrets.NGINX_PAT }}
           commit-message: Release ${{ inputs.version }}

.github/workflows/scorecards.yml

@@ -52,7 +52,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
         with:
           name: SARIF file
           path: results.sarif

go.mod

@@ -13,7 +13,7 @@ require (
 	github.com/onsi/ginkgo/v2 v2.20.2
 	github.com/onsi/gomega v1.34.2
 	github.com/prometheus/client_golang v1.20.2
-	github.com/prometheus/common v0.57.0
+	github.com/prometheus/common v0.58.0
 	github.com/spf13/cobra v1.8.1
 	github.com/spf13/pflag v1.0.5
 	go.opentelemetry.io/otel v1.29.0

go.sum

@@ -106,8 +106,8 @@ github.com/prometheus/client_golang v1.20.2 h1:5ctymQzZlyOON1666svgwn3s6IKWgfbjs
 github.com/prometheus/client_golang v1.20.2/go.mod h1:PIEt8X02hGcP8JWbeHyeZ53Y/jReSnHgO035n//V5WE=
 github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
 github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
-github.com/prometheus/common v0.57.0 h1:Ro/rKjwdq9mZn1K5QPctzh+MA4Lp0BuYk5ZZEVhoNcY=
-github.com/prometheus/common v0.57.0/go.mod h1:7uRPFSUTbfZWsJ7MHY56sqt7hLQu3bxXHDnNhl8E9qI=
+github.com/prometheus/common v0.58.0 h1:N+N8vY4/23r6iYfD3UQZUoJPnUYAo7v6LG5XZxjZTXo=
+github.com/prometheus/common v0.58.0/go.mod h1:GpWM7dewqmVYcd7SmRaiWVe9SSqjf0UrwnYnpEZNuT0=
 github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
 github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
 github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=

internal/mode/static/nginx/config/policies/clientsettings/generator_test.go

@@ -13,6 +13,7 @@ import (
 )
 
 func TestGenerate(t *testing.T) {
+	t.Parallel()
 	maxSize := helpers.GetPointer[ngfAPI.Size]("10m")
 	bodyTimeout := helpers.GetPointer[ngfAPI.Duration]("600ms")
 	keepaliveRequests := helpers.GetPointer[int32](900)
@@ -149,9 +150,9 @@ func TestGenerate(t *testing.T) {
 		},
 	}
 
-	g := NewWithT(t)
-
-	checkResults := func(resFiles policies.GenerateResultFiles, expStrings []string) {
+	checkResults := func(t *testing.T, resFiles policies.GenerateResultFiles, expStrings []string) {
+		t.Helper()
+		g := NewWithT(t)
 		g.Expect(resFiles).To(HaveLen(1))
 
 		for _, str := range expStrings {
@@ -160,22 +161,24 @@ func TestGenerate(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		t.Run(test.name, func(_ *testing.T) {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
 			generator := clientsettings.NewGenerator()
 
 			resFiles := generator.GenerateForServer([]policies.Policy{test.policy}, http.Server{})
-			checkResults(resFiles, test.expStrings)
+			checkResults(t, resFiles, test.expStrings)
 
 			resFiles = generator.GenerateForLocation([]policies.Policy{test.policy}, http.Location{})
-			checkResults(resFiles, test.expStrings)
+			checkResults(t, resFiles, test.expStrings)
 
 			resFiles = generator.GenerateForInternalLocation([]policies.Policy{test.policy})
-			checkResults(resFiles, test.expStrings)
+			checkResults(t, resFiles, test.expStrings)
 		})
 	}
 }
 
 func TestGenerateNoPolicies(t *testing.T) {
+	t.Parallel()
 	g := NewWithT(t)
 
 	generator := clientsettings.NewGenerator()

internal/mode/static/nginx/config/policies/clientsettings/validator_test.go

@@ -53,6 +53,7 @@ func createModifiedPolicy(mod policyModFunc) *ngfAPI.ClientSettingsPolicy {
 }
 
 func TestValidator_Validate(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
 		name          string
 		policy        *ngfAPI.ClientSettingsPolicy
@@ -133,6 +134,7 @@ func TestValidator_Validate(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
 			g := NewWithT(t)
 
 			conds := v.Validate(test.policy, nil)
@@ -142,6 +144,7 @@ func TestValidator_Validate(t *testing.T) {
 }
 
 func TestValidator_ValidatePanics(t *testing.T) {
+	t.Parallel()
 	v := clientsettings.NewValidator(nil)
 
 	validate := func() {
@@ -154,6 +157,7 @@ func TestValidator_ValidatePanics(t *testing.T) {
 }
 
 func TestValidator_Conflicts(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
 		polA      *ngfAPI.ClientSettingsPolicy
 		polB      *ngfAPI.ClientSettingsPolicy
@@ -256,6 +260,7 @@ func TestValidator_Conflicts(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
 			g := NewWithT(t)
 
 			g.Expect(v.Conflicts(test.polA, test.polB)).To(Equal(test.conflicts))
@@ -264,6 +269,7 @@ func TestValidator_Conflicts(t *testing.T) {
 }
 
 func TestValidator_ConflictsPanics(t *testing.T) {
+	t.Parallel()
 	v := clientsettings.NewValidator(nil)
 
 	conflicts := func() {

internal/mode/static/nginx/config/policies/observability/generator_test.go

@@ -15,6 +15,7 @@ import (
 )
 
 func TestGenerate(t *testing.T) {
+	t.Parallel()
 	ratio := helpers.GetPointer[int32](25)
 	zeroRatio := helpers.GetPointer[int32](0)
 	context := helpers.GetPointer[ngfAPI.TraceContext](ngfAPI.TraceContextExtract)
@@ -242,6 +243,7 @@ func TestGenerate(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
 			g := NewWithT(t)
 
 			generator := observability.NewGenerator(test.telemetryConf)
@@ -280,6 +282,7 @@ func TestGenerate(t *testing.T) {
 }
 
 func TestGenerateNoPolicies(t *testing.T) {
+	t.Parallel()
 	g := NewWithT(t)
 
 	generator := observability.NewGenerator(dataplane.Telemetry{})

internal/mode/static/nginx/config/policies/observability/validator_test.go

@@ -52,6 +52,7 @@ func createModifiedPolicy(mod policyModFunc) *ngfAPI.ObservabilityPolicy {
 }
 
 func TestValidator_Validate(t *testing.T) {
+	t.Parallel()
 	globalSettings := &policies.GlobalSettings{
 		NginxProxyValid:  true,
 		TelemetryEnabled: true,
@@ -185,6 +186,7 @@ func TestValidator_Validate(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
 			g := NewWithT(t)
 
 			conds := v.Validate(test.policy, test.globalSettings)
@@ -194,6 +196,7 @@ func TestValidator_Validate(t *testing.T) {
 }
 
 func TestValidator_ValidatePanics(t *testing.T) {
+	t.Parallel()
 	v := observability.NewValidator(nil)
 
 	validate := func() {
@@ -206,6 +209,7 @@ func TestValidator_ValidatePanics(t *testing.T) {
 }
 
 func TestValidator_Conflicts(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
 		polA      *ngfAPI.ObservabilityPolicy
 		polB      *ngfAPI.ObservabilityPolicy
@@ -244,6 +248,7 @@ func TestValidator_Conflicts(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
 			g := NewWithT(t)
 
 			g.Expect(v.Conflicts(test.polA, test.polB)).To(Equal(test.conflicts))
@@ -252,6 +257,7 @@ func TestValidator_Conflicts(t *testing.T) {
 }
 
 func TestValidator_ConflictsPanics(t *testing.T) {
+	t.Parallel()
 	v := observability.NewValidator(nil)
 
 	conflicts := func() {

internal/mode/static/nginx/config/policies/policies_suite_test.go

@@ -8,6 +8,7 @@ import (
 )
 
 func TestPolicies(t *testing.T) {
+	t.Parallel()
 	RegisterFailHandler(Fail)
 	RunSpecs(t, "Policies Suite")
 }

internal/mode/static/nginx/config/validation/common_test.go

@@ -6,6 +6,7 @@ import (
 )
 
 func TestValidateEscapedString(t *testing.T) {
+	t.Parallel()
 	validator := func(value string) error { return validateEscapedString(value, []string{"example"}) }
 
 	testValidValuesForSimpleValidator(
@@ -25,6 +26,7 @@ func TestValidateEscapedString(t *testing.T) {
 }
 
 func TestValidateEscapedStringNoVarExpansion(t *testing.T) {
+	t.Parallel()
 	validator := func(value string) error { return validateEscapedStringNoVarExpansion(value, []string{"example"}) }
 
 	testValidValuesForSimpleValidator(
@@ -45,6 +47,7 @@ func TestValidateEscapedStringNoVarExpansion(t *testing.T) {
 }
 
 func TestValidateValidHeaderName(t *testing.T) {
+	t.Parallel()
 	validator := func(value string) error { return validateHeaderName(value) }
 
 	testValidValuesForSimpleValidator(

internal/mode/static/nginx/config/validation/framework_test.go

@@ -79,6 +79,7 @@ func testInvalidValuesForSupportedValuesValidator[T configValue](
 }
 
 func TestValidateInSupportedValues(t *testing.T) {
+	t.Parallel()
 	supportedValues := map[string]struct{}{
 		"value1": {},
 		"value2": {},
@@ -105,6 +106,7 @@ func TestValidateInSupportedValues(t *testing.T) {
 }
 
 func TestValidateNoUnsupportedValues(t *testing.T) {
+	t.Parallel()
 	unsupportedValues := map[string]struct{}{
 		"badvalue1": {},
 		"badvalue2": {},
@@ -133,6 +135,7 @@ func TestValidateNoUnsupportedValues(t *testing.T) {
 }
 
 func TestGetSortedKeysAsString(t *testing.T) {
+	t.Parallel()
 	values := map[string]struct{}{
 		"value3": {},
 		"value1": {},

internal/mode/static/nginx/config/validation/generic_test.go

@@ -3,6 +3,7 @@ package validation
 import "testing"
 
 func TestGenericValidator_ValidateEscapedStringNoVarExpansion(t *testing.T) {
+	t.Parallel()
 	validator := GenericValidator{}
 
 	testValidValuesForSimpleValidator(
@@ -24,6 +25,7 @@ func TestGenericValidator_ValidateEscapedStringNoVarExpansion(t *testing.T) {
 }
 
 func TestValidateServiceName(t *testing.T) {
+	t.Parallel()
 	validator := GenericValidator{}
 
 	testValidValuesForSimpleValidator(
@@ -45,6 +47,7 @@ func TestValidateServiceName(t *testing.T) {
 }
 
 func TestValidateNginxDuration(t *testing.T) {
+	t.Parallel()
 	validator := GenericValidator{}
 
 	testValidValuesForSimpleValidator(
@@ -65,6 +68,7 @@ func TestValidateNginxDuration(t *testing.T) {
 }
 
 func TestValidateNginxSize(t *testing.T) {
+	t.Parallel()
 	validator := GenericValidator{}
 
 	testValidValuesForSimpleValidator(
@@ -86,6 +90,7 @@ func TestValidateNginxSize(t *testing.T) {
 }
 
 func TestValidateEndpoint(t *testing.T) {
+	t.Parallel()
 	validator := GenericValidator{}
 
 	testValidValuesForSimpleValidator(

internal/mode/static/nginx/config/validation/http_filters_test.go

@@ -6,6 +6,7 @@ import (
 )
 
 func TestValidateRedirectScheme(t *testing.T) {
+	t.Parallel()
 	validator := HTTPRedirectValidator{}
 
 	testValidValuesForSupportedValuesValidator(
@@ -24,6 +25,7 @@ func TestValidateRedirectScheme(t *testing.T) {
 }
 
 func TestValidateRedirectPort(t *testing.T) {
+	t.Parallel()
 	validator := HTTPRedirectValidator{}
 
 	testValidValuesForSimpleValidator(
@@ -35,6 +37,7 @@ func TestValidateRedirectPort(t *testing.T) {
 }
 
 func TestValidateRedirectStatusCode(t *testing.T) {
+	t.Parallel()
 	validator := HTTPRedirectValidator{}
 
 	testValidValuesForSupportedValuesValidator(
@@ -52,6 +55,7 @@ func TestValidateRedirectStatusCode(t *testing.T) {
 }
 
 func TestValidateHostname(t *testing.T) {
+	t.Parallel()
 	validator := HTTPRedirectValidator{}
 
 	testValidValuesForSimpleValidator(
@@ -68,6 +72,7 @@ func TestValidateHostname(t *testing.T) {
 }
 
 func TestValidateRewritePath(t *testing.T) {
+	t.Parallel()
 	validator := HTTPURLRewriteValidator{}
 
 	testValidValuesForSimpleValidator(
@@ -89,6 +94,7 @@ func TestValidateRewritePath(t *testing.T) {
 }
 
 func TestValidateFilterHeaderName(t *testing.T) {
+	t.Parallel()
 	validator := HTTPHeaderValidator{}
 
 	testValidValuesForSimpleValidator(
@@ -102,6 +108,7 @@ func TestValidateFilterHeaderName(t *testing.T) {
 }
 
 func TestValidateFilterHeaderValue(t *testing.T) {
+	t.Parallel()
 	validator := HTTPHeaderValidator{}
 
 	testValidValuesForSimpleValidator(