Merge branch 'master' into master

Author: Wavezy11

.github/actions/setup/action.yml

@@ -24,6 +24,10 @@ inputs:
     required: false
     default: false
     description: "Install cue."
+  libsasl2:
+    required: false
+    default: false
+    description: "Install libsasl2." # Required to fully build Vector
 
   # prepare.sh - rust
   rust: # rustup module
@@ -155,7 +159,7 @@ runs:
           ${{ runner.os }}-cargo-
 
     - name: Install mold
-      if: ${{ inputs.mold == 'true' || env.VDEV_NEEDS_COMPILE == 'true' }}
+      if: ${{ runner.os == 'Linux' && env.DISABLE_MOLD != 'true' && (inputs.mold == 'true' || env.VDEV_NEEDS_COMPILE == 'true') }}
       shell: bash
       run: |
         echo "Installing mold"
@@ -206,7 +210,11 @@ runs:
       shell: bash
       run: |
         echo "Installing protoc"
-        sudo bash ./scripts/environment/install-protoc.sh
+        if [[ "${{ runner.os }}" == "macOS" ]]; then
+          sudo bash ./scripts/environment/install-protoc.sh /usr/local/bin
+        else
+          sudo bash ./scripts/environment/install-protoc.sh
+        fi
 
     - name: Install cue
       if: ${{ inputs.cue == 'true' }}
@@ -223,6 +231,11 @@ runs:
         sudo cp "${TEMP}/cue" /usr/bin/cue
         rm -rf "$TEMP"
 
+    - name: Install libsasl2
+      if: ${{ inputs.libsasl2 == 'true' }}
+      shell: bash
+      run: sudo apt-get update && sudo apt-get install -y libsasl2-dev
+
     - name: Install vdev
       if: ${{ inputs.vdev == 'true' }}
       uses: ./.github/actions/install-vdev

.github/workflows/changelog.yaml

@@ -16,6 +16,9 @@ on:
   merge_group:
     types: [checks_requested]
 
+permissions:
+  contents: read
+
 jobs:
   validate-changelog:
     permissions:

.github/workflows/ci-review-trigger.yml

@@ -29,7 +29,7 @@ on:
     types: [submitted]
 
 permissions:
-  statuses: write
+  contents: read
 
 env:
   DD_ENV: "ci"
@@ -85,16 +85,18 @@ jobs:
         run: exit 1
 
   cli:
-    needs: validate
     if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-cli')
     uses: ./.github/workflows/cli.yml
+    with:
+      ref: ${{ github.event.review.commit_id }}
     secrets: inherit
 
   make-test-behavior:
     needs: validate
     if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-test-behavior')
     uses: ./.github/workflows/test-make-command.yml
     with:
+      ref: ${{ github.event.review.commit_id }}
       command: test-behavior
       job_name: make test-behavior
     secrets: inherit
@@ -104,6 +106,7 @@ jobs:
     if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-check-examples')
     uses: ./.github/workflows/test-make-command.yml
     with:
+      ref: ${{ github.event.review.commit_id }}
       command: check-examples
       job_name: make check-examples
     secrets: inherit
@@ -113,6 +116,7 @@ jobs:
     if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-test-docs')
     uses: ./.github/workflows/test-make-command.yml
     with:
+      ref: ${{ github.event.review.commit_id }}
       command: test-docs
       job_name: make test-docs
     secrets: inherit
@@ -121,40 +125,54 @@ jobs:
     needs: validate
     if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-deny')
     uses: ./.github/workflows/deny.yml
+    with:
+      ref: ${{ github.event.review.commit_id }}
     secrets: inherit
 
   component-features:
     needs: validate
     if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-component-features')
     uses: ./.github/workflows/component_features.yml
+    with:
+      ref: ${{ github.event.review.commit_id }}
     secrets: inherit
 
   cross:
     needs: validate
     if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-cross')
     uses: ./.github/workflows/cross.yml
+    with:
+      ref: ${{ github.event.review.commit_id }}
     secrets: inherit
 
   unit-mac:
     needs: validate
     if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-unit-mac')
     uses: ./.github/workflows/unit_mac.yml
+    with:
+      ref: ${{ github.event.review.commit_id }}
     secrets: inherit
 
   unit-windows:
     needs: validate
     if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-unit-windows')
     uses: ./.github/workflows/unit_windows.yml
+    with:
+      ref: ${{ github.event.review.commit_id }}
     secrets: inherit
 
   environment:
     needs: validate
     if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-environment')
     uses: ./.github/workflows/environment.yml
+    with:
+      ref: ${{ github.event.review.commit_id }}
     secrets: inherit
 
   k8s:
     needs: validate
     if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-k8s')
     uses: ./.github/workflows/k8s_e2e.yml
+    with:
+      ref: ${{ github.event.review.commit_id }}
     secrets: inherit

.github/workflows/cleanup-ghcr-images.yml

@@ -13,6 +13,9 @@ on:
     - cron: '0 2 * * 0'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   cleanup:
     runs-on: ubuntu-latest

.github/workflows/cli.yml

@@ -2,61 +2,30 @@ name: CLI - Linux
 
 on:
   workflow_call:
+    inputs:
+      ref:
+        description: 'Git ref to checkout'
+        required: false
+        type: string
 
 permissions:
-  statuses: write
+  contents: read
 
 jobs:
   test-cli:
     runs-on: ubuntu-24.04
     timeout-minutes: 30
-    env:
-      CARGO_INCREMENTAL: 0
     steps:
-      - name: (PR review) Set latest commit status as pending
-        if: ${{ github.event_name == 'pull_request_review' }}
-        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # v2.0.1
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
-          sha: ${{ github.event.review.commit_id }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          context: CLI - Linux
-          status: pending
-
-      - name: (PR review) Checkout review SHA
-        if: ${{ github.event_name == 'pull_request_review' }}
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-        with:
-          ref: ${{ github.event.review.commit_id }}
-
-      - name: Checkout branch
-        if: ${{ github.event_name != 'pull_request_review' }}
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-
-      - name: Cache Cargo registry + index
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+          ref: ${{ inputs.ref }}
+      - uses: ./.github/actions/setup
         with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/index/
-            ~/.cargo/registry/cache/
-            ~/.cargo/git/db/
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-
-
-      - run: sudo -E bash scripts/environment/bootstrap-ubuntu-24.04.sh
-      - run: bash scripts/environment/prepare.sh --modules=cargo-nextest,datadog-ci
-      - run: echo "::add-matcher::.github/matchers/rust.json"
+          rust: true
+          cargo-nextest: true
+          protoc: true
+          datadog-ci: true
       - run: make test-cli
       - name: Upload test results
         run: scripts/upload-test-results.sh
         if: always()
-
-      - name: (PR review) Set latest commit status as ${{ job.status }}
-        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # v2.0.1
-        if: always() && github.event_name == 'pull_request_review'
-        with:
-          sha: ${{ github.event.review.commit_id }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          context: CLI - Linux
-          status: ${{ job.status }}

.github/workflows/component_features.yml

@@ -11,49 +11,39 @@ name: Component Features - Linux
 
 on:
   workflow_call:
+    inputs:
+      ref:
+        description: 'Git ref to checkout'
+        required: false
+        type: string
   workflow_dispatch:
+    inputs:
+      ref:
+        description: 'Git ref to checkout'
+        required: false
+        type: string
   schedule:
     - cron: '0 10 * * 1' # 10:00 UTC Monday (6 AM EST NYC)
 
 permissions:
-  statuses: write
+  contents: read
 
 jobs:
   check-component-features:
     # use free tier on schedule and 8 core to expedite results on demand invocation
     runs-on: ${{ github.event_name == 'schedule' && 'ubuntu-24.04' || 'ubuntu-24.04-8core' }}
     timeout-minutes: 180 # Usually takes 2h but this prevents it from hanging for an indefinite time
-    if: github.event_name == 'pull_request_review' || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule'
     steps:
-      - name: (PR review) Set latest commit status as pending
-        if: github.event_name == 'pull_request_review'
-        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # v2.0.1
-        with:
-          sha: ${{ github.event.review.commit_id }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          context: Component Features - Linux
-          status: pending
-
-      - name: (PR review) Checkout PR branch
-        if: github.event_name == 'pull_request_review'
+      - name: Checkout branch
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
-          ref: ${{ github.event.review.commit_id }}
+          ref: ${{ inputs.ref }}
 
-      - name: Checkout branch
-        if: github.event_name != 'pull_request_review'
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: ./.github/actions/setup
+        with:
+          rust: true
+          cargo-nextest: true
+          protoc: true
+          libsasl2: true
 
-      - run: sudo -E bash scripts/environment/bootstrap-ubuntu-24.04.sh
-      - run: bash scripts/environment/prepare.sh --modules=rustup
-      - run: echo "::add-matcher::.github/matchers/rust.json"
       - run: make check-component-features
-
-      - name: (PR review) Set latest commit status as ${{ job.status }}
-        if: always() && github.event_name == 'pull_request_review'
-        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # v2.0.1
-        with:
-          sha: ${{ github.event.review.commit_id }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          context: Component Features - Linux
-          status: ${{ job.status }}

.github/workflows/cross.yml

@@ -2,9 +2,14 @@ name: Cross
 
 on:
   workflow_call:
+    inputs:
+      ref:
+        description: 'Git ref to checkout'
+        required: false
+        type: string
 
 permissions:
-  statuses: write
+  contents: read
 
 jobs:
   cross-linux:
@@ -25,24 +30,10 @@ jobs:
           - arm-unknown-linux-gnueabi
           - arm-unknown-linux-musleabi
     steps:
-      - name: (PR review) Set latest commit status as pending
-        if: ${{ github.event_name == 'pull_request_review' }}
-        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # v2.0.1
-        with:
-          sha: ${{ github.event.review.commit_id }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          context: Cross
-          status: pending
-
-      - name: (PR review) Checkout PR branch
-        if: ${{ github.event_name == 'pull_request_review' }}
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
-        with:
-          ref: ${{ github.event.review.commit_id }}
-
       - name: Checkout branch
-        if: ${{ github.event_name != 'pull_request_review' }}
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          ref: ${{ inputs.ref }}
 
       - uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
         name: Cache Cargo registry + index
@@ -68,27 +59,3 @@ jobs:
         with:
           name: "vector-debug-${{ matrix.target }}"
           path: "./target/${{ matrix.target }}/debug/vector"
-
-      - name: (PR review) Set latest commit status as failed
-        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # v2.0.1
-        if: failure() && github.event_name == 'pull_request_review'
-        with:
-          sha: ${{ steps.comment-branch.outputs.head_sha }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          context: Cross
-          status: 'failure'
-
-  update-pr-status:
-    name: (PR review) Signal result to PR
-    runs-on: ubuntu-24.04
-    timeout-minutes: 5
-    needs: cross-linux
-    if: needs.cross-linux.result == 'success' && github.event_name == 'pull_request_review'
-    steps:
-      - name: (PR review) Submit PR result as success
-        uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # v2.0.1
-        with:
-          sha: ${{ github.event.review.commit_id }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          context: Cross
-          status: 'success'