[pull] master from Kong:master

.bazelignore

@@ -35,3 +35,5 @@ user.bazelrc
 /servroot/
 /autodoc/
 /.github/
+
+.DS_Store

.bazelrc

@@ -13,37 +13,42 @@ run --color=yes
 common --color=yes
 common --curses=auto
 
+# TODO: remove after bump to bazel >= 8
+common --enable_workspace
+
 build --experimental_ui_max_stdouterr_bytes=10485760
 
 build --show_progress_rate_limit=0
-build --show_task_finish
 build --show_timestamps
 build --worker_verbose
 
-# build --incompatible_strict_action_env
+build --incompatible_strict_action_env
+
+# make output files and directories 0755 instead of 0555
+build --experimental_writable_outputs
 
-# Enable --platforms API based cpu,compilter,crosstool_top selection
-build --incompatible_enable_cc_toolchain_resolution
 
 # Pass PATH, CC, CXX variables from the environment.
 build --action_env=CC --host_action_env=CC
 build --action_env=CXX --host_action_env=CXX
 build --action_env=PATH --host_action_env=PATH
 
-build --action_env=BAZEL_BUILD=1
-
 # temporary fix for https://github.com/bazelbuild/bazel/issues/12905 on macOS
 build --features=-debug_prefix_map_pwd_is_dot
 
 # Build flags.
 build --action_env=BUILD_NAME=kong-dev
 build --action_env=INSTALL_DESTDIR=MANAGED
+build --strip=never
 
 # Release flags
 build:release --//:debug=false
 build:release --//:licensing=true
 build:release --action_env=BUILD_NAME=kong-dev
 build:release --action_env=INSTALL_DESTDIR=/usr/local
+build:release --compilation_mode=opt
+build:release --copt="-g"
+build:release --strip=never
 
 build --spawn_strategy=local
 

.bazelversion

@@ -1 +1 @@
-5.3.2
+7.3.1

.busted

@@ -1,5 +1,8 @@
 return {
   default = {
-    lpath = "./?.lua;./?/init.lua;"
+    lpath = "./?.lua;./?/init.lua;",
+    -- make setup() and teardown() behave like their lazy_ variants
+    lazy = true,
+    helper = "./spec/busted-ci-helper.lua",
   }
 }

.ci/ast-grep/README.md

@@ -0,0 +1,43 @@
+# ast-grep
+
+`ast-grep` is a tool for querying source code in a (relatively)
+language-agnostic manner. It allows us to write lint rules that target patterns
+that are specific to our codebase and therefore not covered by tools like
+`luacheck`.
+
+## Installing ast-grep
+
+See the [installation docs](https://ast-grep.github.io/guide/quick-start.html#installation)
+for guidance.
+
+
+## Crafting a New Lint Rule
+
+The workflow for writing a new lint rule looks like this:
+
+1. Draft your rule at `.ci/ast-grep/rules/${name}.yml`
+    * Use `ast-grep scan --filter ${name} [paths...]` to evaluate your rule's behavior
+2. Write tests for the rule in `.ci/ast-grep/tests/${name}-test.yml`
+    * Make sure to fill out several `valid` and `invalid` code snippets
+    * Use `ast-grep test --interactive`* to test the rule
+3. `git add .gi/ast-grep && git commit ...`
+
+\* `ast-grep test` uses a file snapshot testing pattern. Almost any time a rule
+or test is created/modified, the snapshots must be updated. The `--interactive`
+flag for `ast-grep test` will prompt you to accept these updates. The snapshots
+provide very granular testing for rule behavior, but for many cases where we
+just care about whether or not a rule matches a certain snippet of code, they
+can be overkill. Use `ast-grep --update-all` to automatically accept and save
+new snapshots.
+
+## CI
+
+`ast-grep` is executed in the ([ast-grep lint
+workflow](/.github/workflows/ast-grep.yml)). In addition to running the linter,
+this workflow also performs self-tests and ensures that all existing rules are
+well-formed and have tests associated with them.
+
+### Links
+
+* [ast-grep website and documentation](https://ast-grep.github.io)
+* [ast-grep source code](https://github.com/ast-grep/ast-grep)

.ci/ast-grep/rules/assert-eventually-terminated.yml

@@ -0,0 +1,36 @@
+id: assert-eventually-terminated
+language: lua
+message: Unterminated eventual assertion
+severity: error
+note: |
+  `assert.eventually()` does not perform any assertion unless followed
+  by one of its terminator methods:
+    * `is_truthy(message)`
+    * `is_falsy(message)`
+    * `has_error(message)`
+    * `has_no_error(message)`
+
+files:
+  - '**/*_spec.lua'
+
+rule:
+  all:
+    - kind: function_call
+      pattern: $$$.eventually($$$)
+
+    - has:
+        kind: dot_index_expression
+        any:
+          - pattern: assert.$$$
+          - pattern: luassert.$$$
+        stopBy: end
+
+    - not:
+        inside:
+          kind: function_call
+          any:
+            - pattern: $$$.is_truthy($$$)
+            - pattern: $$$.is_falsy($$$)
+            - pattern: $$$.has_error($$$)
+            - pattern: $$$.has_no_error($$$)
+          stopBy: end

.ci/ast-grep/rules/helpers-outside-of-setup.yml

@@ -0,0 +1,126 @@
+id: helpers-outside-of-setup
+language: lua
+message: Calling test setup helper function in the wrong scope
+severity: warning
+note: |
+  Avoid calling test setup functions outside of `setup()`/`lazy_setup()`.
+
+  ## good
+  ```lua
+  describe("my test", function()
+    local port_a
+    local port_b
+
+    lazy_setup(function()
+      port_a = helpers.get_available_port()
+    end)
+
+    it("my test case", function()
+      port_b = helpers.get_available_port()
+    end)
+  end)
+
+  ## bad
+  ```lua
+  local port_a = helpers.get_available_port()
+  describe("my test", function()
+    local port_b = helpers.get_available_port()
+
+    it("my test case", function()
+    end)
+  end)
+
+
+files:
+  - '**/*_spec.lua'
+
+utils:
+  function-scope:
+    any:
+      - kind: function_call
+      - kind: function_declaration
+      - kind: function_definition
+
+  module-scope:
+    not:
+      inside:
+        matches: function-scope
+        stopBy: end
+
+  busted-test-case:
+    inside:
+      kind: function_call
+      any:
+        - pattern: it($$$)
+        - pattern: pending($$$)
+
+        # aliases for it/pending seen in test files
+        - pattern: do_it($$$)
+        - pattern: postgres_only($$$)
+
+  busted-lifecycle:
+    inside:
+      kind: function_call
+      any:
+        - pattern: setup($$$)
+        - pattern: lazy_setup($$$)
+        - pattern: teardown($$$)
+        - pattern: lazy_teardown($$$)
+        - pattern: before_each($$$)
+        - pattern: after_each($$$)
+
+  in-upgrade-helper-setup:
+    pattern: $IDENT.setup($$$)
+    inside:
+      kind: chunk
+      stopBy: end
+      has:
+        any:
+          - pattern: $IDENT = require "spec.upgrade_helpers"
+          - pattern: $IDENT = require("spec.upgrade_helpers")
+        stopBy: end
+
+  in-function-scope:
+    any:
+      # local function my_setup()
+      #   helpers.get_available_port()
+      # end
+      - kind: function_declaration
+
+      # local my_setup = function()
+      #   helpers.get_available_port()
+      # end
+      - pattern: $IDENT = function($$$) $$$ end
+
+  busted-describe:
+    inside:
+      kind: function_call
+      pattern: describe($$$)
+      stopBy:
+        any:
+          - matches: busted-test-case
+          - matches: busted-lifecycle
+          - matches: in-function-scope
+          - matches: in-upgrade-helper-setup
+
+  non-setup-scope:
+    any:
+      - matches: module-scope
+      - matches: busted-describe
+
+rule:
+  kind: function_call
+  pattern: helpers.$FUNC($$$)
+  matches: non-setup-scope
+
+constraints:
+  FUNC:
+    kind: identifier
+    any:
+      - pattern: admin_client
+      - pattern: generate_keys
+      - pattern: get_available_port
+      - pattern: get_db_utils
+      - pattern: setenv
+      - pattern: start_kong
+      - pattern: tcp_server

.ci/ast-grep/rules/ngx-log-string-concat.yml

@@ -0,0 +1,65 @@
+id: ngx-log-string-concat
+language: lua
+message: Using string concatenation to build arguments for ngx.log()
+severity: error
+note: |
+  When invoking `ngx.log()` with some variable as input, prefer vararg-style
+  calls rather than using the string concatenation operator (`..`):
+
+  ## bad
+  ```lua
+  ngx.log(ngx.DEBUG, "if `my_var` is nil, this code throws an exception: " .. my_var)
+  ```
+
+  ## good
+  ```lua
+  ngx.log(ngx.DEBUG, "if `my_var` is nil, this code is fine: ", my_var)
+  ```
+
+files:
+  - kong/**
+  - test*.lua
+
+rule:
+  all:
+    - matches: string-concat
+      inside:
+        kind: arguments
+        inside:
+          matches: ngx-log-call
+    - not:
+        matches: string-literal-concat
+
+utils:
+  ngx-log-call:
+    any:
+      # direct invocation of `_G.ngx.log()`
+      - pattern: ngx.log($_LEVEL, $$$)
+
+      # track local var assignments of `_G.ngx.log`
+      - pattern: $IDENT($_LEVEL, $$$)
+        inside:
+          kind: chunk
+          stopBy: end
+          has:
+            pattern: $IDENT = ngx.log
+            stopBy: end
+
+  string-concat:
+    kind: binary_expression
+    pattern: $LHS .. $RHS
+
+  string-literal-concat:
+    kind: binary_expression
+    all:
+      - has:
+          nthChild: 1
+          any:
+            - kind: string
+            - matches: string-literal-concat
+
+      - has:
+          nthChild: 2
+          any:
+            - kind: string
+            - matches: string-literal-concat