Merge pull request #253 from kylape/sync-upstream

Author: kylape

.github/ISSUE_TEMPLATE/new-release.md

@@ -21,6 +21,10 @@ This document defines the process for releasing llm-d-router.
 
 1. Permissions to push to the llm-d-router repository.
 
+1. Membership in the `@llm-d/router-release-managers` team. Tag protection on
+   `refs/tags/v*` restricts who can push release tags, which is what triggers
+   the release build.
+
 1. Set the required environment variables based on the expected release number:
 
    ```shell

.github/actions/docker-build-and-push/action.yml

@@ -1,5 +1,5 @@
 name: Docker Build - ghcr
-description: Build image using buildx
+description: Build image using buildx. Supports pushing to a registry or exporting to an output.
 inputs:
   docker-file:
     required: true
@@ -11,43 +11,55 @@ inputs:
     required: true
     description: Image tag
   github-token:
-    required: true
-    description: GitHub token for login
+    required: false
+    description: GitHub token for registry login. Required when push is true.
+    default: ''
   registry:
     required: true
-    description: Container registry (e.g., ghcr.io/llm-d)
+    description: GHCR namespace (e.g., ghcr.io/llm-d)
   prerelease:
-    required: true
+    required: false
     description: indicates whether or not this is a pre-release (not a release) build
+    default: 'false'
+  push:
+    required: false
+    description: Push the built image to the registry. Set to false to export via buildx-outputs instead.
+    default: 'true'
+  buildx-outputs:
+    required: false
+    description: Buildx outputs value when push is false, such as type=docker,dest=<path>/image.tar.
+    default: ''
+  commit-sha:
+    required: false
+    description: Git commit SHA to embed via COMMIT_SHA build arg
+    default: ''
 runs:
   using: "composite"
   steps:
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v4
 
     - name: Login to GitHub Container Registry
-      run: echo "${{ inputs.github-token }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
-      shell: bash
-
-    - name: Print image info
-      run: |
-        echo "Image name: ${{ inputs.image-name }}"
-        echo "Tag: ${{ inputs.tag }}"
-        echo "Registry: ${{ inputs.registry }}"
-      shell: bash
+      if: inputs.push == 'true'
+      uses: docker/login-action@v4
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ inputs.github-token }}
 
-    - name: Build image and push
-      run: |
-        if [[ ${{ inputs.prerelease }} == "true" ]]; then
-          LATEST_TAG=""
-        else
-          LATEST_TAG="-t ${{ inputs.registry }}/${{ inputs.image-name }}:latest"
-        fi
-        docker buildx build \
-          --platform linux/amd64,linux/arm64 \
-          --cache-from type=gha,scope=${{ inputs.image-name }} \
-          --cache-to type=gha,mode=max,scope=${{ inputs.image-name }} \
-          --build-arg LDFLAGS="-s -w" \
-          -t ${{ inputs.registry }}/${{ inputs.image-name }}:${{ inputs.tag }} \
-          ${LATEST_TAG} -f ${{ inputs.docker-file }} --push .
-      shell: bash
+    - name: Build image
+      uses: docker/build-push-action@v6
+      with:
+        file: ${{ inputs.docker-file }}
+        push: ${{ inputs.push == 'true' }}
+        outputs: ${{ inputs.buildx-outputs }}
+        platforms: ${{ inputs.push != 'true' && 'linux/amd64' || 'linux/amd64,linux/arm64' }}
+        tags: |
+          ${{ inputs.registry }}/${{ inputs.image-name }}:${{ inputs.tag }}
+          ${{ inputs.push == 'true' && inputs.prerelease != 'true' && format('{0}/{1}:latest', inputs.registry, inputs.image-name) || '' }}
+        build-args: |
+          LDFLAGS=-s -w
+          COMMIT_SHA=${{ inputs.commit-sha || 'unknown' }}
+          BUILD_REF=${{ inputs.tag || 'unknown' }}
+        cache-from: type=gha,scope=${{ inputs.image-name }}
+        cache-to: type=gha,mode=max,scope=${{ inputs.image-name }}

.github/actions/e2e-runner-setup/action.yml

@@ -0,0 +1,47 @@
+name: E2E runner setup
+description: Frees disk space and restores Go module/build caches for an e2e runner.
+outputs:
+  go-mod-cache:
+    description: Absolute path to the Go module cache directory
+    value: ${{ steps.go-cache.outputs.mod }}
+  go-build-cache:
+    description: Absolute path to the Go build cache directory
+    value: ${{ steps.go-cache.outputs.build }}
+runs:
+  using: "composite"
+  steps:
+    # Custom profile with directory-only removals.
+    # cleanup-profile: max frees more space but takes longer.
+    - name: Free disk space
+      # justinthelaw/maximize-github-runner-space@v0.9.0
+      uses: justinthelaw/maximize-github-runner-space@ed391644e646cac4b88480d2f9b12d135f1ccf77
+      with:
+        cleanup-profile: custom
+        remove-android: 'true'
+        remove-dotnet: 'true'
+        remove-haskell: 'true'
+        remove-codeql: 'true'
+        remove-cached-tools: 'false'
+        remove-swift: 'true'
+        remove-julia: 'true'
+        remove-rust: 'true'
+        remove-miniconda: 'true'
+        swapfile-size: 0
+
+    - name: Create Go cache dirs
+      id: go-cache
+      shell: bash
+      run: |
+        mkdir -p "$HOME/.cache/llm-d-gomodcache" "$HOME/.cache/llm-d-gobuildcache"
+        echo "mod=$HOME/.cache/llm-d-gomodcache" >> "$GITHUB_OUTPUT"
+        echo "build=$HOME/.cache/llm-d-gobuildcache" >> "$GITHUB_OUTPUT"
+
+    - name: Cache Go modules and build cache
+      uses: actions/cache@v5
+      with:
+        path: |
+          ${{ steps.go-cache.outputs.mod }}
+          ${{ steps.go-cache.outputs.build }}
+        key: go-cache-${{ runner.os }}-${{ hashFiles('go.sum') }}
+        restore-keys: |
+          go-cache-${{ runner.os }}-

.github/actions/trivy-scan/action.yml

@@ -2,8 +2,17 @@ name: Trivy Scan
 description: Scan container image with official Aqua Security Trivy action
 inputs:
   image:
-    required: true
-    description: "Image to scan (e.g., 'my-repo/my-image:latest')"
+    required: false
+    default: ''
+    description: "Image reference to scan (e.g., 'my-repo/my-image:latest'). Mutually exclusive with 'tarball'."
+  tarball:
+    required: false
+    default: ''
+    description: "Path to a local image tarball to scan (e.g. /tmp/image.tar from buildx type=docker,dest=...). Mutually exclusive with 'image'."
+  severity:
+    required: false
+    default: 'HIGH,CRITICAL'
+    description: "Comma-separated severities that fail the scan (e.g. 'CRITICAL' or 'MEDIUM,HIGH,CRITICAL')."
 
 runs:
   using: "composite"
@@ -12,9 +21,10 @@ runs:
       uses: aquasecurity/trivy-action@v0.36.0 # v0.36.0 ed142fd0673e97e23eac54620cfb913e5ce36c25
       with:
         image-ref: ${{ inputs.image }}
+        input: ${{ inputs.tarball }}
         format: 'sarif'
         output: 'trivy-results.sarif'
-        severity: 'HIGH,CRITICAL'
+        severity: ${{ inputs.severity }}
         exit-code: '1'
 
     - name: Upload Trivy SARIF to Security tab

.github/dependabot.yml

@@ -53,3 +53,7 @@ updates:
       - "dependencies"
     commit-message:
       prefix: "deps(docker)"
+    ignore:
+      # dependabot covers patches only
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major", "version-update:semver-minor"]

.github/workflows/auto-assign.yaml

@@ -20,5 +20,5 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Check typos
-        uses: crate-ci/typos@v1.46.3
+        uses: crate-ci/typos@v1.47.2
 

.github/workflows/check-typos.yaml

@@ -32,41 +32,67 @@ jobs:
       - name: Checkout source
         uses: actions/checkout@v6
 
-      - name: Build and push EPP image
+      - name: Build AMD64 EPP image (no push)
         uses: ./.github/actions/docker-build-and-push
         with:
           docker-file: Dockerfile.epp
           tag: ${{ inputs.tag }}
           image-name: ${{ inputs.epp-image-name }}
           registry: ghcr.io/llm-d
-          github-token: ${{ github.token }}
-          prerelease: ${{ inputs.prerelease }}
+          push: 'false'
+          buildx-outputs: type=docker,dest=/tmp/epp-image.tar
 
-      - name: Run Trivy scan on EPP image
+      # Gate the push on the scan: a HIGH/CRITICAL by default when not set but configurable
+      - name: Run Trivy scan for EPP on AMD64
         uses: ./.github/actions/trivy-scan
         with:
-          image: ghcr.io/llm-d/${{ inputs.epp-image-name }}:${{ inputs.tag }}
+          tarball: /tmp/epp-image.tar
+
+      # Re-run the build with push enabled with: cache-to/cache-from type=gha
+      - name: Push EPP image for both AMD64 and ARM64
+        uses: ./.github/actions/docker-build-and-push
+        with:
+          docker-file: Dockerfile.epp
+          tag: ${{ inputs.tag }}
+          image-name: ${{ inputs.epp-image-name }}
+          registry: ghcr.io/llm-d
+          github-token: ${{ github.token }}
+          prerelease: ${{ inputs.prerelease }}
+          commit-sha: ${{ github.sha }}
+          push: 'true'
 
   build-sidecar:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source
         uses: actions/checkout@v6
 
-      - name: Build and push sidecar image
+      - name: Build sidecar AMD64 image (no push)
         uses: ./.github/actions/docker-build-and-push
         with:
           docker-file: Dockerfile.sidecar
           tag: ${{ inputs.tag }}
           image-name: ${{ inputs.sidecar-image-name }}
           registry: ghcr.io/llm-d
-          github-token: ${{ github.token }}
-          prerelease: ${{ inputs.prerelease }}
+          push: 'false'
+          buildx-outputs: type=docker,dest=/tmp/sidecar-image.tar
 
-      - name: Run Trivy scan on sidecar image
+      - name: Run Trivy scan on sidecar image on AMD64
         uses: ./.github/actions/trivy-scan
         with:
-          image: ghcr.io/llm-d/${{ inputs.sidecar-image-name }}:${{ inputs.tag }}
+          tarball: /tmp/sidecar-image.tar
+
+      - name: Push sidecar image for both AMD64 and ARM64
+        uses: ./.github/actions/docker-build-and-push
+        with:
+          docker-file: Dockerfile.sidecar
+          tag: ${{ inputs.tag }}
+          image-name: ${{ inputs.sidecar-image-name }}
+          registry: ghcr.io/llm-d
+          github-token: ${{ github.token }}
+          prerelease: ${{ inputs.prerelease }}
+          commit-sha: ${{ github.sha }}
+          push: 'true'
 
   push-helm-charts:
     needs: [build-epp, build-sidecar]

.github/workflows/ci-build-images.yaml

@@ -0,0 +1,20 @@
+name: CI - Dependency Review
+on:
+  pull_request:
+    branches:
+      - main
+permissions:
+  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v6
+      - name: Dependency review
+        uses: actions/dependency-review-action@v5
+        with:
+          fail-on-severity: high