Merge branch 'main' into luacounter

Signed-off-by: code <[email protected]>

Author: wbpcode

.bazelrc

@@ -64,8 +64,6 @@ build --incompatible_enforce_config_setting_visibility
 test --test_verbose_timeout_warnings
 test --experimental_ui_max_stdouterr_bytes=11712829 #default 1048576
 
-test --test_tag_filters=-runtime-cpu
-
 # Allow tags to influence execution requirements
 common --experimental_allow_tags_propagation
 
@@ -92,6 +90,7 @@ build --@com_googlesource_googleurl//build_config:system_icu=0
 # Common flags for sanitizers
 build:sanitizer --define tcmalloc=disabled
 build:sanitizer --linkopt -ldl
+test:sanitizer --build_tests_only
 
 # Common flags for Clang (shared between all clang variants)
 build:clang-common --action_env=BAZEL_COMPILER=clang
@@ -148,7 +147,7 @@ build:asan-common --config=sanitizer
 build:asan-common --define signal_trace=disabled
 build:asan-common --define ENVOY_CONFIG_ASAN=1
 build:asan-common --build_tag_filters=-no_san
-build:asan-common --test_tag_filters=-no_san,-runtime-cpu
+build:asan-common --test_tag_filters=-no_san
 build:asan-common --copt -fsanitize=address,undefined
 build:asan-common --linkopt -fsanitize=address,undefined
 # vptr and function sanitizer are enabled in asan if it is set up via bazel/setup_clang.sh.
@@ -199,7 +198,7 @@ build:tsan --copt -fsanitize=thread
 build:tsan --linkopt -fsanitize=thread
 build:tsan --copt -DTHREAD_SANITIZER=1
 build:tsan --build_tag_filters=-no_san,-no_tsan
-build:tsan --test_tag_filters=-no_san,-no_tsan,-runtime-cpu
+build:tsan --test_tag_filters=-no_san,-no_tsan
 # Needed due to https://github.com/libevent/libevent/issues/777
 build:tsan --copt -DEVENT__DISABLE_DEBUG_MODE
 # https://github.com/abseil/abseil-cpp/issues/760
@@ -211,7 +210,7 @@ build:tsan --test_timeout=120,600,1500,4800
 build:msan --action_env=ENVOY_MSAN=1
 build:msan --config=sanitizer
 build:msan --build_tag_filters=-no_san
-build:msan --test_tag_filters=-no_san,-runtime-cpu
+build:msan --test_tag_filters=-no_san
 build:msan --define ENVOY_CONFIG_MSAN=1
 build:msan --copt -fsanitize=memory
 build:msan --linkopt -fsanitize=memory
@@ -272,10 +271,10 @@ build:coverage --coverage_report_generator=@envoy//tools/coverage:report_generat
 
 build:test-coverage --test_arg="-l trace"
 build:test-coverage --test_arg="--log-path /dev/null"
-build:test-coverage --test_tag_filters=-nocoverage,-fuzz_target,-runtime-cpu
+build:test-coverage --test_tag_filters=-nocoverage,-fuzz_target
 build:fuzz-coverage --config=plain-fuzzer
 build:fuzz-coverage --run_under=@envoy//bazel/coverage:fuzz_coverage_wrapper.sh
-build:fuzz-coverage --test_tag_filters=-nocoverage,-runtime-cpu
+build:fuzz-coverage --test_tag_filters=-nocoverage
 # Existing fuzz tests don't need a full WASM runtime and in generally we don't really want to
 # fuzz dependencies anyways. On the other hand, disabling WASM reduces the build time and
 # resources required to build and run the tests.

.github/workflows/scorecard.yml

@@ -15,6 +15,7 @@ jobs:
   analysis:
     name: Scorecard analysis
     runs-on: ubuntu-24.04
+    if: github.repository == 'envoyproxy/envoy'
     permissions:
       security-events: write
       id-token: write

CODEOWNERS

@@ -274,6 +274,8 @@ extensions/upstreams/tcp @ggreenway @mattklein123
 /*/extensions/compression/zstd @rainingmaster @mattklein123
 # cel
 /*/extensions/access_loggers/filters/cel @kyessenov @douglas-reid @adisuissa
+# process rate limit
+/*/extensions/access_loggers/filters/process_ratelimit @taoxuy @kyessenov
 # health check
 /*/extensions/filters/http/health_check @mattklein123 @adisuissa
 # lua
@@ -366,6 +368,8 @@ extensions/upstreams/tcp @ggreenway @mattklein123
 /*/extensions/string_matcher/ @ggreenway @cpakulski
 # Header mutation
 /*/extensions/filters/http/header_mutation @wbpcode @yanavlasov
+# Body transform
+/*/extensions/filters/http/transform @wbpcode @UNOWNED
 # Health checkers
 /*/extensions/health_checkers/grpc @zuercher @botengyao
 /*/extensions/health_checkers/http @zuercher @botengyao
@@ -411,6 +415,7 @@ extensions/upstreams/tcp @ggreenway @mattklein123
 /*/source/extensions/api_listeners/default_api_listener @UNOWNED @UNOWNED
 /*/source/extensions/listener_managers/listener_manager @yanavlasov @ggreenway
 /*/source/extensions/listener_managers/validation_listener_manager @adisuissa @ggreenway
+/*/source/extensions/matching/common_inputs/transport_socket @agrawroh @kyessenov
 /*/source/extensions/config_subscription/ @adisuissa @UNOWNED
 /*/source/extensions/config_subscription/grpc @adisuissa @UNOWNED
 

OWNERS.md

@@ -54,6 +54,8 @@ routing PRs, questions, etc. to the right place.
   * Request mirroring, data plane
 * Mike Krinkin ([krinkinmu](https://github.com/krinkinmu)) ([email protected])
   * Build, tooling.
+* Jonh Wendell ([jwendell](https://github.com/jwendell)) ([email protected])
+  * CI, Build.
 
 # Envoy mobile maintainers
 

SECURITY-INSIGHTS.yml

@@ -22,6 +22,7 @@ project-lifecycle:
   - github:adisuissa
   - github:agrawroh
   - github:botengyao
+  - github:jwendell
   - github:KBaichoo
   - github:keith
   - github:krinkinmu

WORKSPACE

@@ -16,6 +16,10 @@ load("//bazel:repositories.bzl", "envoy_dependencies")
 
 envoy_dependencies()
 
+load("//bazel:bazel_deps.bzl", "envoy_bazel_dependencies")
+
+envoy_bazel_dependencies()
+
 load("//bazel:repositories_extra.bzl", "envoy_dependencies_extra")
 
 envoy_dependencies_extra()

api/BUILD

@@ -132,6 +132,7 @@ proto_library(
         "//envoy/data/tap/v3:pkg",
         "//envoy/extensions/access_loggers/file/v3:pkg",
         "//envoy/extensions/access_loggers/filters/cel/v3:pkg",
+        "//envoy/extensions/access_loggers/filters/process_ratelimit/v3:pkg",
         "//envoy/extensions/access_loggers/fluentd/v3:pkg",
         "//envoy/extensions/access_loggers/grpc/v3:pkg",
         "//envoy/extensions/access_loggers/open_telemetry/v3:pkg",
@@ -225,6 +226,7 @@ proto_library(
         "//envoy/extensions/filters/http/stateful_session/v3:pkg",
         "//envoy/extensions/filters/http/tap/v3:pkg",
         "//envoy/extensions/filters/http/thrift_to_metadata/v3:pkg",
+        "//envoy/extensions/filters/http/transform/v3:pkg",
         "//envoy/extensions/filters/http/upstream_codec/v3:pkg",
         "//envoy/extensions/filters/http/wasm/v3:pkg",
         "//envoy/extensions/filters/listener/http_inspector/v3:pkg",

api/bazel/BUILD

@@ -12,6 +12,7 @@ load(":repository_locations_utils.bzl", "load_repository_locations_spec")
 licenses(["notice"])  # Apache 2
 
 exports_files([
+    "extensions.bzl",
     "repository_locations.bzl",
     "repository_locations_utils.bzl",
     "utils.bzl",

api/bazel/api_build_system.bzl

@@ -1,9 +1,11 @@
 load("@com_envoyproxy_protoc_gen_validate//bazel:pgv_proto_library.bzl", "pgv_cc_proto_library")
 load("@com_github_grpc_grpc//bazel:cc_grpc_library.bzl", "cc_grpc_library")
 load("@com_github_grpc_grpc//bazel:python_rules.bzl", _py_proto_library = "py_proto_library")
+load("@com_google_protobuf//bazel:java_proto_library.bzl", "java_proto_library")
 load("@com_google_protobuf//bazel:proto_library.bzl", "proto_library")
 load("@io_bazel_rules_go//go:def.bzl", "go_test")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+load("@rules_cc//cc:defs.bzl", "cc_test")
 load(
     "//bazel:external_proto_deps.bzl",
     "EXTERNAL_PROTO_CC_BAZEL_DEP_MAP",
@@ -23,6 +25,7 @@ _CC_GRPC_SUFFIX = "_cc_grpc"
 _GO_PROTO_SUFFIX = "_go_proto"
 _GO_IMPORTPATH_PREFIX = "github.com/envoyproxy/go-control-plane/"
 _JAVA_PROTO_SUFFIX = "_java_proto"
+_IS_BZLMOD = str(Label("//:invalid")).startswith("@@")
 
 _COMMON_PROTO_DEPS = [
     "@com_google_protobuf//:any_proto",
@@ -42,7 +45,8 @@ _COMMON_PROTO_DEPS = [
 def _proto_mapping(dep, proto_dep_map, proto_suffix):
     mapped = proto_dep_map.get(dep)
     if mapped == None:
-        prefix = "@" + Label(dep).workspace_name if not dep.startswith("//") else ""
+        prefix = "@@" if _IS_BZLMOD else "@"
+        prefix = prefix + Label(dep).repo_name if not dep.startswith("//") else ""
         return prefix + "//" + Label(dep).package + ":" + Label(dep).name + proto_suffix
     return mapped
 
@@ -112,7 +116,7 @@ def api_cc_py_proto_library(
     )
 
     if java:
-        native.java_proto_library(
+        java_proto_library(
             name = name + _JAVA_PROTO_SUFFIX,
             visibility = ["//visibility:public"],
             deps = [relative_name],
@@ -126,7 +130,7 @@ def api_cc_py_proto_library(
         _api_cc_grpc_library(name = cc_grpc_name, proto = relative_name, deps = cc_proto_deps)
 
 def api_cc_test(name, **kwargs):
-    native.cc_test(
+    cc_test(
         name = name,
         **kwargs
     )

api/bazel/cc_proto_descriptor_library/BUILD

@@ -37,7 +37,6 @@ cc_library(
         "@com_google_absl//absl/strings:str_format",
         "@com_google_protobuf//:protobuf",
         "@com_google_protobuf//src/google/protobuf/compiler:code_generator",
-        "@com_google_protobuf//src/google/protobuf/compiler:retention",
     ],
 )