Merge branch 'main' into proposal/auth-filter

Author: shaun-nx

.github/workflows/build.yml

@@ -50,7 +50,7 @@ jobs:
       - name: Checkout Repository
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
-          ref: ${{ (inputs.tag != '' && !inputs.dry_run ) && format('refs/tags/v{0}', inputs.tag) || github.ref }}
+          ref: ${{ (inputs.tag != '' && !inputs.dry_run ) && format('refs/tags/{0}', inputs.tag) || github.ref }}
 
       - name: Download Artifacts
         uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
@@ -187,7 +187,7 @@ jobs:
           fail-build: false
 
       - name: Upload scan result to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@f443b600d91635bebf5b0d9ebc620189c0d6fba5 # v4.30.8
+        uses: github/codeql-action/upload-sarif@16140ae1a102900babc80a33c44059580f687047 # v4.30.9
         if: ${{ !inputs.dry_run }}
         continue-on-error: true
         with:

.github/workflows/ci.yml

@@ -464,6 +464,7 @@ jobs:
     with:
       image: ${{ matrix.image }}
       k8s-version: ${{ matrix.k8s-version }}
+      tag: ${{ inputs.release_version || '' }}
     secrets: inherit
     if: ${{ needs.vars.outputs.helm_changes == 'true' || github.event_name == 'schedule' }}
 

.github/workflows/helm.yml

@@ -9,6 +9,10 @@ on:
       k8s-version:
         required: true
         type: string
+      tag:
+        required: false
+        type: string
+        default: ''
 
 permissions:
   contents: read
@@ -44,6 +48,8 @@ jobs:
             type=edge
             type=schedule
             type=ref,event=pr
+            type=ref,event=branch,suffix=-rc,enable=${{ startsWith(github.ref, 'refs/heads/release') && inputs.tag == '' }}
+            type=raw,value=${{ inputs.tag }},enable=${{ inputs.tag != '' }}
 
       - name: NGINX Docker meta
         id: nginx-meta
@@ -56,6 +62,8 @@ jobs:
             type=edge
             type=schedule
             type=ref,event=pr
+            type=ref,event=branch,suffix=-rc,enable=${{ startsWith(github.ref, 'refs/heads/release') && inputs.tag == '' }}
+            type=raw,value=${{ inputs.tag }},enable=${{ inputs.tag != '' }}
 
       - name: Build NGF Docker Image
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0

.github/workflows/nfr.yml

@@ -149,6 +149,7 @@ jobs:
         run: make create-gke-router || true
 
       - name: Run Tests
+        continue-on-error: true
         working-directory: ./tests
         run: |
           if ${{ needs.vars.outputs.test_label != 'all' }}; then

.github/workflows/production-release.yml

@@ -99,3 +99,4 @@ jobs:
       packages: write
       id-token: write
       security-events: write
+      issues: write

.github/workflows/scorecards.yml

@@ -60,6 +60,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@f443b600d91635bebf5b0d9ebc620189c0d6fba5 # v4.30.8
+        uses: github/codeql-action/upload-sarif@16140ae1a102900babc80a33c44059580f687047 # v4.30.9
         with:
           sarif_file: results.sarif

build/ubi/Dockerfile.nginx

@@ -6,7 +6,7 @@ ADD --link --chown=101:1001 https://nginx.org/keys/nginx_signing.key nginx_signi
 ADD --link --chown=101:1001 build/ubi/repos/nginx.repo nginx.repo
 ADD --link --chown=101:1001 build/ubi/repos/agent.repo agent.repo
 
-FROM ghcr.io/nginx/dependencies/nginx-ubi:ubi9@sha256:001103e68586ef592de573bd3cbeb0ac84343a00d892f8d42f612e49f89b1e63 AS ubi9-packages
+FROM ghcr.io/nginx/dependencies/nginx-ubi:ubi9@sha256:77b206aed605f2dca010cd150846a4ab95189460524f82705393771f5047f635 AS ubi9-packages
 
 FROM redhat/ubi9-minimal:9.6 AS ubi-nginx
 

build/ubi/Dockerfile.nginxplus

@@ -6,7 +6,7 @@ ADD --link --chown=101:1001 https://cs.nginx.com/static/files/plus-9.repo nginx-
 ADD --link --chown=101:1001 https://nginx.org/keys/nginx_signing.key nginx_signing.key
 ADD --link --chown=101:1001 build/ubi/repos/agent.repo agent.repo
 
-FROM ghcr.io/nginx/dependencies/nginx-ubi:ubi9@sha256:001103e68586ef592de573bd3cbeb0ac84343a00d892f8d42f612e49f89b1e63 AS ubi9-packages
+FROM ghcr.io/nginx/dependencies/nginx-ubi:ubi9@sha256:77b206aed605f2dca010cd150846a4ab95189460524f82705393771f5047f635 AS ubi9-packages
 
 FROM redhat/ubi9-minimal:9.6 AS ubi-nginx-plus
 

examples/advanced-routing/regex-route.yaml

@@ -0,0 +1,17 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: coffee-regex
+spec:
+  parentRefs:
+  - name: cafe
+  hostnames:
+  - cafe.example.com
+  rules:
+  - matches:
+    - path:
+        type: RegularExpression
+        value: /coffee/[a-z]+
+    backendRefs:
+    - name: coffee-v1-svc
+      port: 80