Merge branch 'master' into feat-next-upstream

.busted

@@ -3,5 +3,6 @@ return {
     lpath = "./?.lua;./?/init.lua;",
     -- make setup() and teardown() behave like their lazy_ variants
     lazy = true,
+    helper = "./spec/busted-ci-helper.lua",
   }
 }

.luacheckrc

@@ -30,7 +30,7 @@ exclude_files = {
     "bazel-kong",
 }
 
-files["kong/tools/kong-lua-sandbox.lua"] = {
+files["kong/tools/sandbox/kong.lua"] = {
      read_globals = {
         "_ENV",
         "table.pack",

README.md

@@ -11,12 +11,14 @@ Kong runs natively on Kubernetes thanks to its official [Kubernetes Ingress Cont
 
 ---
 
-[Installation](https://konghq.com/install/#kong-community) | [Documentation](https://docs.konghq.com) | [Discussions](https://github.com/Kong/kong/discussions) | [Forum](https://discuss.konghq.com) | [Blog](https://konghq.com/blog) | [Builds][kong-master-builds]
+[Installation](https://konghq.com/install/#kong-community) | [Documentation](https://docs.konghq.com) | [Discussions](https://github.com/Kong/kong/discussions) | [Forum](https://discuss.konghq.com) | [Blog](https://konghq.com/blog) | [Builds][kong-master-builds] | [Cloud Hosted Kong](https://konghq.com/kong-konnect/)
 
 ---
 
 ## Getting Started
 
+If you prefer to use a cloud-hosted Kong, you can [sign up for a free trial of Kong Konnect](https://konghq.com/products/kong-konnect/register?utm_medium=Referral&utm_source=Github&utm_campaign=kong-gateway&utm_content=konnect-promo-in-gateway&utm_term=get-started) and get started in minutes. If not, you can follow the instructions below to get started with Kong on your own infrastructure.
+
 Let’s test drive Kong by adding authentication to an API in under 5 minutes.
 
 We suggest using the docker-compose distribution via the instructions below, but there is also a [docker installation](https://docs.konghq.com/gateway/latest/install/docker/#install-kong-gateway-in-db-less-mode) procedure if you’d prefer to run the Kong API Gateway in DB-less mode.

build/build_system.bzl

@@ -171,6 +171,15 @@ def _copyright_header(ctx):
                 # while writing utf-8 content read by |ctx.read|, let's disable it
                 ctx.file(path, copyright_content_html + content, legacy_utf8 = False)
 
+_GITHUB_RELEASE_SINGLE_FILE_BUILD = """\
+package(default_visibility = ["//visibility:public"])
+
+filegroup(
+    name = "file",
+    srcs = ["{}"],
+)
+"""
+
 def _github_release_impl(ctx):
     ctx.file("WORKSPACE", "workspace(name = \"%s\")\n" % ctx.name)
 
@@ -195,20 +204,25 @@ def _github_release_impl(ctx):
         fail("Unsupported OS %s" % os_name)
 
     gh_bin = "%s" % ctx.path(Label("@gh_%s_%s//:bin/gh" % (os_name, os_arch)))
-    args = [gh_bin, "release", "download", ctx.attr.tag, "-R", ctx.attr.repo]
+    args = [gh_bin, "release", "download", ctx.attr.tag, "--repo", ctx.attr.repo]
     downloaded_file = None
     if ctx.attr.pattern:
         if "/" in ctx.attr.pattern or ".." in ctx.attr.pattern:
             fail("/ and .. are not allowed in pattern")
         downloaded_file = ctx.attr.pattern.replace("*", "_")
-        args += ["-p", ctx.attr.pattern]
+        args += ["--pattern", ctx.attr.pattern]
     elif ctx.attr.archive:
         args.append("--archive=" + ctx.attr.archive)
         downloaded_file = "gh-release." + ctx.attr.archive.split(".")[-1]
     else:
         fail("at least one of pattern or archive must be set")
 
-    args += ["-O", downloaded_file]
+    downloaded_file_path = downloaded_file
+    if not ctx.attr.extract:
+        ctx.file("file/BUILD", _GITHUB_RELEASE_SINGLE_FILE_BUILD.format(downloaded_file))
+        downloaded_file_path = "file/" + downloaded_file
+
+    args += ["--output", downloaded_file_path]
 
     ret = ctx.execute(args)
 
@@ -218,10 +232,23 @@ def _github_release_impl(ctx):
             gh_token_set = "GITHUB_TOKEN is not set, is this a private repo?"
         fail("Failed to download release (%s): %s, exit: %d" % (gh_token_set, ret.stderr, ret.return_code))
 
-    ctx.extract(downloaded_file, stripPrefix = ctx.attr.strip_prefix)
+    if ctx.attr.sha256:
+        if os_name == "macOS":
+            sha256_cmd = ["shasum", "-a", "256", downloaded_file_path]
+        else:
+            sha256_cmd = ["sha256sum", downloaded_file_path]
+        ret = ctx.execute(sha256_cmd)
+        checksum = ret.stdout.split(" ")[0]
+        if checksum != ctx.attr.sha256:
+            fail("Checksum mismatch: expected %s, got %s" % (ctx.attr.sha256, checksum))
+
+    if ctx.attr.extract:
+        ctx.extract(downloaded_file_path, stripPrefix = ctx.attr.strip_prefix)
 
     # only used in EE: always skip here in CE
     if not ctx.attr.skip_add_copyright_header and False:
+        if not ctx.attr.extract:
+            fail("Writing copyright header is only supported for extracted archives")
         _copyright_header(ctx)
 
 github_release = repository_rule(
@@ -231,11 +258,13 @@ github_release = repository_rule(
         "tag": attr.string(mandatory = True),
         "pattern": attr.string(mandatory = False),
         "archive": attr.string(mandatory = False, values = ["zip", "tar.gz"]),
+        "extract": attr.bool(default = True, doc = "Whether to extract the downloaded archive"),
         "strip_prefix": attr.string(default = "", doc = "Strip prefix from downloaded files"),
         "repo": attr.string(mandatory = True),
         "build_file": attr.label(allow_single_file = True),
         "build_file_content": attr.string(),
         "skip_add_copyright_header": attr.bool(default = False, doc = "Whether to inject COPYRIGHT-HEADER into downloaded files, only required for webuis"),
+        "sha256": attr.string(mandatory = False),
     },
 )
 

build/openresty/wasmx/filters/variables.bzl

@@ -2,17 +2,7 @@
 A list of wasm filters.
 """
 
-WASM_FILTERS = [
-    {
-        "name": "datakit-filter",
-        "repo": "Kong/datakit",
-        "tag": "0.3.1",
-        "files": {
-            "datakit.meta.json": "acd16448615ea23315e68d4516edd79135bae13469f7bf9129f7b1139cd2b873",
-            "datakit.wasm": "c086e6fb36a6ed8c9ff3284805485c7280380469b6a556ccf7e5bc06edce27e7",
-        },
-    },
-]
+WASM_FILTERS = []
 
 WASM_FILTERS_TARGETS = [
     "@%s-%s//file" % (filter["name"], file)