auto-merge envoyproxy/envoy[main] into envoyproxy/envoy-openssl[main]

* upstream/main:
  address: removing some exceptions (#36754)
  api: HTTP APIKey Auth Filter (#36709)
  golang: provide method to refresh route cache (#36863)
  wasm: remove unused public interfaces (#36941)
  tools: updating oncall test triage location (#36937)
  ci/rbe: Boost cpus for more flakey tests (#36942)
  wasm: prevent stuck connections in case of multiple local replies (#36809)
  udp_proxy: Support dynamic cluster selection per session (#36868)
  srds: permit dynamic SRDS resources to contain inline RDS configuration (#36703)
  http: removing the default trusted address list (#36643)
  proto: reducing exceptions (#36872)
  ci/rbe: Boost cpus for some more integration tests (#36930)
  build(deps): bump envoy-base-utils from 0.5.6 to 0.5.7 in /tools/base (#36935)
  deps/api: Bump `com_github_bufbuild_buf` -> 1.46.0 (#36933)
  deps: Bump `build_bazel_rules_apple` -> 3.11.2 (#36932)
  build(deps): bump setuptools from 75.2.0 to 75.3.0 in /tools/base (#36906)
  build(deps): bump slack-sdk from 3.33.2 to 3.33.3 in /tools/base (#36905)
  tests: add integration test to quic_stats for long certificate chain (#36926)
  add OLM scaling for max_connection_duration (#36816)
  config: removing unpackToOrThrow in favor of unpackTo (#36821)
  srds: remove scope from scope_name_by_hash_ in case the scope key changes (#36702)
  test: fix os_sys_calls_test in some less common environments (#36923)
  tools/python: Fix macro format issue (#36916)
  router: converting internal_only_headers from list to vector (#36898)
  Remove unused listener FilterChain on_demand_configuration field (#36786)
  tools/python: Fix namespacing in entry_point macros (#36914)
  route: remove redundant loader reference in weighted cluster entries (#36836)
  wasm: removed automatical route refreshment and add a foreign function to clear the route cache (#36671)
  deps/api: Bump `envoy_toolshed` -> 0.1.13 (#36892)
  ci/rbe: Boost cpu for another integration test (#36901)
  tls: Expose well-known certificate subject fields in Lua filter (#35994)
  bazel/deps: Fix `rules_license` setup (#36900)
  [mobile]fix jni parameter type (#36896)
  quic: add debug visitor to export various quic stats from quiche (#36813)
  context: use server factory context as lb context (#36874)
  runtime: removed defer processing flag and legacy codepaths. (#36731)
  http2: protects client against stream not found (#36573)
  ci/rbe: Boost cpu for another integration test (#36885)
  build(deps): bump actions/dependency-review-action from 4.3.5 to 4.4.0 (#36883)
  fix typo in the code comment (#36875)
  Update QUICHE from 0d1ce7087 to 5621f6366 (#36869)
  mobile: Fix a PAC proxy error check bug (#36876)
  runtime: Enable UDP GRO by default (#36811)
  Deprecating and removing envoy.reloadable_features.edf_lb_locality_scheduler_init_fix (#36835)
  ci: Use repo settings for upload buckets (#36870)
  flow_control: Refactor setWatermark (#36738)
  bazel/ci: Add repo customizations (#36831)
  deps: Bump `bazel_features` -> 1.20.0 (#36855)
  deps: Bump `rules_python` -> 0.37.2 (#36854)
  dependabot: add missing contrib-golang group to some gomod (#36849)
  build(deps): bump distroless/base-nossl-debian12 from `e130c09` to `aa91f01` in /ci (#36847)
  ci/coverage: Fix accidental ws (#36839)
  oauth2: enable `use_refresh_token` by default (#36065)
  Update QUICHE from 408e786de to 0d1ce7087 (#36822)
  ci/rbe: Boost cpus for more integration tests (#36837)
  ci/coverage: Fix coverage flake in `source/extensions/common` (#36838)
  route: Downgrade advisory log message (#36797)
  runtime: deprecate validate_grpc_header (#36757)
  rbe/ci: Bump cpus for kv/store integration test (#36834)
  deps: Bump `build_bazel_rules_apple` -> 3.10.0 (#36833)
  protobuf.patch: a bunch of updates, mostly backports (#36823)
  coverage: loosen (#36830)
  ci/rbe: Boost cpu/mem for more integration tests (#36825)
  deps: Bump `com_github_awslabs_aws_c_auth` -> 0.8.0 (#36827)
  deps: Bump `aspect_bazel_lib` -> 2.9.3 (#36726)
  deps/api: Bump `dev_cel` -> 0.18.0 (#36826)
  build(deps): bump slack-sdk from 3.33.1 to 3.33.2 in /tools/base (#36824)
  router: clean up unnecessary field (#36814)
  request id: minor optimization or fix to the request id logic (#36773)
  deps: Bump `com_github_nghttp2_nghttp2` -> 1.64.0 (#36743)
  Set resource `telemetry.sdk.*` and scope `otel.scope.name|version` attributes for the OpenTelemetry tracer (#36787)
  Backport grpc change to fix some protoc warnings (#36795)
  wasm: restart wasm vm if it's failed because runtime error (#36456)
  deps: Bump `rules_python` -> 0.37.1 (#36817)
  proxy_protocol: use no-throw addresses to remove exception handling (#36815)
  tools/python: Remove unused loading of old py macro (#36820)
  tools/python: Use newer `entry_point` rule (#36803)
  ci/codeql: Only run on main branch (#36806)
  ci/rbe: Adjust keepalives for cache (envoy and mobile) (#36810)
  ci/rbe: Boost cpus for a couple more integration tests (#36807)
  tls: support IP SANs for IP versions not supported by host OS (#36770)
  dynamic_modules: scaffolds config API & HTTP Filter (#36448)
  Refactor UDP proxy to support deferred cluster selection (#36700)
  coverage: ratcheting (#36762)
  quic: remove runtime guard and code for legacy cert handling (#36772)
  Deprecating and removing envoy.reloadable_features.edf_lb_host_scheduler_init_fix (#36794)
  build(deps): bump actions/checkout from 4.2.1 to 4.2.2 (#36798)
  [balsa] Add runtime flag for http_inspector parser (#36672)
  tls: reduce memory use per connection by 712 bytes (#36767)
  ci/tests: Boost more worker cores for flakey integration tests (#36793)
  bump cel-cpp (#36661)
  ci/tests: Revert some integration tests to `2core` (#36784)
  mobile: resolving how forcev6 works on mobile platforms (#36732)
  build(deps): bump github/codeql-action from 3.26.13 to 3.27.0 (#36774)
  build(deps): bump protobuf from 5.28.2 to 5.28.3 in /tools/base (#36775)
  build(deps): bump orjson from 3.10.9 to 3.10.10 in /tools/base (#36776)
  ci/macos: Increase timeout to 120m (#36719)
  ci/coverage: Remove more cruft in diskspace hack (#36720)
  aws: async bugfix for multiple credential handlers in upstream mode (#36707)
  Allow empty resolver list for cares dns (#36735)
  runtime: removing dns_reresolve_on_eai_again (#36656)
  mobile: Adds proxy.pac to test PAC file URL (#36765)
  ci/rbe: Switch rbe pools `2core` -> `6gig` (#36761)
  ocsp/formatting: Fix format issue in generated cert (#36763)
  deps: Switch hosting server for kafka server binary download (#36748)
  test/ocsp: Renew certificates (#36755)
  upstream: removing exceptions from hostimpl (#36582)
  deps: Bump `rules_rust` -> 0.53.0 (#36727)
  deps: Bump `rules_jvm_external` -> 6.4 (#36721)
  build(deps): bump actions/dependency-review-action from 4.3.4 to 4.3.5 (#36740)
  Add support for OtherName, Email SAN substitution formatters (#36502)
  wasm: remove redundant xds attributes (#36619)
  apple_dns: Add DNS query trace (#36678)
  mobile: Fixes for the Apple PAC proxy resolver (#36698)
  mobile: change to being more aggressive about HTTP/3 retries (#36734)
  ci/rbe: Switch backend RBE cluster (#36730)
  deps/release: Bump Ubuntu -> 0e5e4a5 (#36723)
  Fix documentation for TcpProxy.metadata_match (#36683)
  build: fix compile commands generation (#36693)
  add test suites for classes in hash_policy.cc file (#36708)
  router: remove send_local_reply_when_no_buffer_and_upstream_request guard (#36620)
  mobile: add knob for h3 keepalive (#36646)
  test: Add a knob to disable admin server in IntegrationTestServer (#36684)
  build(deps): bump orjson from 3.10.7 to 3.10.9 in /tools/base (#36714)
  build(deps): bump envoy-base-utils from 0.5.5 to 0.5.6 in /tools/base (#36690)
  build(deps): bump cryptography from 43.0.1 to 43.0.3 in /tools/base (#36715)
  aws_signing: support for dynamically configurable credential (#36217)
  http: initializes a field of ConnectionManagerImpl::ActiveStream::State. (#36642)
  test: deflake an integration test (#36674)
  ci/rbe: Use engflow for non-coverage checks (#36687)
  xds-failover: fixing runtime feature flag in tests (#36659)
  security-release: update the q3 release record (#36689)

Signed-off-by: tedjpoole <[email protected]>

.bazelrc

@@ -505,7 +505,8 @@ build:rbe-engflow --remote_executor=grpcs://envoy.cluster.engflow.com
 build:rbe-engflow --bes_backend=grpcs://envoy.cluster.engflow.com/
 build:rbe-engflow --bes_results_url=https://envoy.cluster.engflow.com/invocation/
 build:rbe-engflow --credential_helper=*.engflow.com=%workspace%/bazel/engflow-bazel-credential-helper.sh
-build:rbe-engflow --grpc_keepalive_time=30s
+build:rbe-engflow --grpc_keepalive_time=60s
+build:rbe-engflow --grpc_keepalive_timeout=30s
 build:rbe-engflow --remote_timeout=3600s
 build:rbe-engflow --bes_timeout=3600s
 build:rbe-engflow --bes_upload_mode=fully_async
@@ -514,23 +515,23 @@ build:rbe-engflow --nolegacy_important_outputs
 # RBE (Engflow Envoy)
 build:common-envoy-engflow --google_default_credentials=false
 build:common-envoy-engflow --credential_helper=*.engflow.com=%workspace%/bazel/engflow-bazel-credential-helper.sh
-build:common-envoy-engflow --grpc_keepalive_time=30s
+build:common-envoy-engflow --grpc_keepalive_time=60s
+build:common-envoy-engflow --grpc_keepalive_timeout=30s
 
-build:cache-envoy-engflow --remote_cache=grpcs://morganite.cluster.engflow.com
+build:cache-envoy-engflow --remote_cache=grpcs://mordenite.cluster.engflow.com
 build:cache-envoy-engflow --remote_timeout=3600s
-build:bes-envoy-engflow --bes_backend=grpcs://morganite.cluster.engflow.com/
-build:bes-envoy-engflow --bes_results_url=https://morganite.cluster.engflow.com/invocation/
+build:bes-envoy-engflow --bes_backend=grpcs://mordenite.cluster.engflow.com/
+build:bes-envoy-engflow --bes_results_url=https://mordenite.cluster.engflow.com/invocation/
 build:bes-envoy-engflow --bes_timeout=3600s
 build:bes-envoy-engflow --bes_upload_mode=fully_async
 build:bes-envoy-engflow --nolegacy_important_outputs
-build:rbe-envoy-engflow --remote_executor=grpcs://morganite.cluster.engflow.com
+build:rbe-envoy-engflow --remote_executor=grpcs://mordenite.cluster.engflow.com
 build:rbe-envoy-engflow --remote_default_exec_properties=container-image=docker://gcr.io/envoy-ci/envoy-build@sha256:7adc40c09508f957624c4d2e0f5aeecb73a59207ee6ded53b107eac828c091b2
 build:rbe-envoy-engflow --jobs=200
 build:rbe-envoy-engflow --define=engflow_rbe=true
 
 build:remote-envoy-engflow --config=common-envoy-engflow
 build:remote-envoy-engflow --config=cache-envoy-engflow
-build:remote-envoy-engflow --config=bes-envoy-engflow
 build:remote-envoy-engflow --config=rbe-envoy-engflow
 
 #############################################################################
@@ -555,6 +556,7 @@ common:debug --config=debug-sandbox
 common:debug --config=debug-coverage
 common:debug --config=debug-tests
 
+try-import %workspace%/repo.bazelrc
 try-import %workspace%/clang.bazelrc
 try-import %workspace%/user.bazelrc
 try-import %workspace%/local_tsan.bazelrc

.github/dependabot.yml

@@ -41,7 +41,7 @@ updates:
     time: "06:00"
 
 - package-ecosystem: "gomod"
-  directory: "/contrib/golang/filters/http/test/test_data/basic"
+  directory: "/contrib/golang/filters/http/test/test_data/access_log"
   groups:
     contrib-golang:
       patterns:
@@ -51,7 +51,7 @@ updates:
     time: "06:00"
 
 - package-ecosystem: "gomod"
-  directory: "/contrib/golang/filters/http/test/test_data/dummy"
+  directory: "/contrib/golang/filters/http/test/test_data/action"
   groups:
     contrib-golang:
       patterns:
@@ -61,7 +61,7 @@ updates:
     time: "06:00"
 
 - package-ecosystem: "gomod"
-  directory: "/contrib/golang/filters/http/test/test_data/echo"
+  directory: "/contrib/golang/filters/http/test/test_data/basic"
   groups:
     contrib-golang:
       patterns:
@@ -71,7 +71,7 @@ updates:
     time: "06:00"
 
 - package-ecosystem: "gomod"
-  directory: "/contrib/golang/filters/http/test/test_data/metric"
+  directory: "/contrib/golang/filters/http/test/test_data/buffer"
   groups:
     contrib-golang:
       patterns:
@@ -81,7 +81,7 @@ updates:
     time: "06:00"
 
 - package-ecosystem: "gomod"
-  directory: "/contrib/golang/filters/http/test/test_data/passthrough"
+  directory: "/contrib/golang/filters/http/test/test_data/dummy"
   groups:
     contrib-golang:
       patterns:
@@ -91,7 +91,7 @@ updates:
     time: "06:00"
 
 - package-ecosystem: "gomod"
-  directory: "/contrib/golang/filters/http/test/test_data/access_log"
+  directory: "/contrib/golang/filters/http/test/test_data/echo"
   groups:
     contrib-golang:
       patterns:
@@ -101,7 +101,7 @@ updates:
     time: "06:00"
 
 - package-ecosystem: "gomod"
-  directory: "/contrib/golang/filters/http/test/test_data/action"
+  directory: "/contrib/golang/filters/http/test/test_data/metric"
   groups:
     contrib-golang:
       patterns:
@@ -111,7 +111,7 @@ updates:
     time: "06:00"
 
 - package-ecosystem: "gomod"
-  directory: "/contrib/golang/filters/http/test/test_data/buffer"
+  directory: "/contrib/golang/filters/http/test/test_data/passthrough"
   groups:
     contrib-golang:
       patterns:
@@ -121,7 +121,7 @@ updates:
     time: "06:00"
 
 - package-ecosystem: "gomod"
-  directory: "/contrib/golang/filters/http/test/test_data/routeconfig"
+  directory: "/contrib/golang/filters/http/test/test_data/property"
   groups:
     contrib-golang:
       patterns:
@@ -131,13 +131,21 @@ updates:
     time: "06:00"
 
 - package-ecosystem: "gomod"
-  directory: "/contrib/golang/filters/http/test/test_data/property"
+  directory: "/contrib/golang/filters/http/test/test_data/routeconfig"
+  groups:
+    contrib-golang:
+      patterns:
+      - "*"
   schedule:
     interval: daily
     time: "06:00"
 
 - package-ecosystem: "gomod"
   directory: "/contrib/golang/filters/http/test/test_data/websocket"
+  groups:
+    contrib-golang:
+      patterns:
+      - "*"
   schedule:
     interval: daily
     time: "06:00"

.github/workflows/_check_build.yml

@@ -5,9 +5,6 @@ permissions:
 
 on:
   workflow_call:
-    secrets:
-      gcp-key:
-        required: true
     inputs:
       request:
         type: string
@@ -23,15 +20,13 @@ concurrency:
 
 jobs:
   build:
-    secrets:
-      gcp-key: ${{ secrets.gcp-key }}
     permissions:
       contents: read
       packages: read
     uses: ./.github/workflows/_run.yml
     name: ${{ matrix.name ||matrix.target }}
     with:
-      # bazel-extra: '--config=remote-envoy-engflow'
+      bazel-extra: '--config=remote-envoy-engflow'
       cache-build-image: ${{ fromJSON(inputs.request).request.build-image.default }}
       concurrency-suffix: -${{ matrix.target }}
       error-match: |

.github/workflows/_check_coverage.yml

@@ -35,6 +35,7 @@ jobs:
       cache-build-image: ${{ fromJSON(inputs.request).request.build-image.default }}
       concurrency-suffix: -${{ matrix.target }}
       diskspace-hack: ${{ matrix.diskspace-hack || false }}
+      diskspace-hack-paths: ${{ matrix.diskspace-hack-paths || '' }}
       error-match: |
         ERROR
         error:
@@ -46,7 +47,7 @@ jobs:
         - run: ci/run_envoy_docker.sh 'ci/do_ci.sh ${{ matrix.target }}-upload'
           shell: bash
           env:
-            GCS_ARTIFACT_BUCKET: ${{ inputs.trusted && 'envoy-postsubmit' || 'envoy-pr' }}
+            GCS_ARTIFACT_BUCKET: ${{ inputs.trusted && vars.GCS_ARTIFACT_BUCKET_POST || vars.GCS_ARTIFACT_BUCKET_PRE }}
             GCS_REDIRECT_PATH: ${{ fromJSON(inputs.request).request.pr || fromJSON(inputs.request).request.target-branch }}
       target: ${{ matrix.target }}
       timeout-minutes: 180
@@ -58,5 +59,8 @@ jobs:
         - target: coverage
           name: Coverage
           diskspace-hack: true
+          diskspace-hack-paths: |
+            /opt/hostedtoolcache
+            /usr/local
         - target: fuzz_coverage
           name: Fuzz coverage

.github/workflows/_check_san.yml

@@ -5,9 +5,6 @@ permissions:
 
 on:
   workflow_call:
-    secrets:
-      gcp-key:
-        required: true
     inputs:
       request:
         type: string
@@ -23,15 +20,13 @@ concurrency:
 
 jobs:
   san:
-    secrets:
-      gcp-key: ${{ secrets.gcp-key }}
     permissions:
       contents: read
       packages: read
     uses: ./.github/workflows/_run.yml
     name: ${{ matrix.target }}
     with:
-      # bazel-extra: '--config=remote-envoy-engflow'
+      bazel-extra: '--config=remote-envoy-engflow'
       cache-build-image: ${{ fromJSON(inputs.request).request.build-image.default }}
       concurrency-suffix: -${{ matrix.target }}
       request: ${{ inputs.request }}

.github/workflows/_precheck_deps.yml

@@ -51,9 +51,9 @@ jobs:
     if: ${{ inputs.dependency-review }}
     steps:
     - name: Checkout Repository
-      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871  # v4.2.1
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
       with:
         ref: ${{ fromJSON(inputs.request).request.sha }}
         persist-credentials: false
     - name: Dependency Review
-      uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c  # v4.3.4
+      uses: actions/dependency-review-action@4081bf99e2866ebe428fc0477b69eb4fcda7220a  # v4.4.0

.github/workflows/_precheck_publish.yml

@@ -78,5 +78,5 @@ jobs:
             - run: ci/run_envoy_docker.sh 'ci/do_ci.sh docs-upload'
               shell: bash
               env:
-                GCS_ARTIFACT_BUCKET: ${{ inputs.trusted && 'envoy-postsubmit' || 'envoy-pr' }}
+                GCS_ARTIFACT_BUCKET: ${{ inputs.trusted && vars.GCS_ARTIFACT_BUCKET_POST || vars.GCS_ARTIFACT_BUCKET_PRE }}
                 GCS_REDIRECT_PATH: ${{ fromJSON(inputs.request).request.pr || fromJSON(inputs.request).request.target-branch }}

.github/workflows/_run.yml

@@ -286,6 +286,10 @@ jobs:
         BAZEL_BUILD_EXTRA_OPTIONS="--google_credentials=/build/${GCP_SERVICE_ACCOUNT_KEY_FILE} --config=remote-ci --config=rbe-google"
         echo "BAZEL_BUILD_EXTRA_OPTIONS=${BAZEL_BUILD_EXTRA_OPTIONS}" >> "$GITHUB_ENV"
 
+    - run: |
+        echo "${{ vars.ENVOY_CI_BAZELRC }}" > repo.bazelrc
+      if: ${{ vars.ENVOY_CI_BAZELRC }}
+
     - uses: envoyproxy/toolshed/gh-actions/github/[email protected]
       name: Run CI ${{ inputs.command }} ${{ inputs.target }}
       with:

.github/workflows/codeql-daily.yml

@@ -27,14 +27,14 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871  # v4.2.1
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
 
     - name: Free disk space
       uses: envoyproxy/toolshed/gh-actions/[email protected]
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@f779452ac5af1c261dce0346a8f964149f49322b  # codeql-bundle-v3.26.13
+      uses: github/codeql-action/init@662472033e021d55d94146f66f6058822b0b39fd  # codeql-bundle-v3.27.0
       # Override language selection by uncommenting this and choosing your languages
       with:
         languages: cpp
@@ -74,4 +74,4 @@ jobs:
         git clean -xdf
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@f779452ac5af1c261dce0346a8f964149f49322b  # codeql-bundle-v3.26.13
+      uses: github/codeql-action/analyze@662472033e021d55d94146f66f6058822b0b39fd  # codeql-bundle-v3.27.0

.github/workflows/codeql-push.yml

@@ -8,9 +8,11 @@ on:
     paths:
     - include/**
     - source/common/**
-    branches-ignore:
-    - dependabot/**
+    branches:
+    - main
   pull_request:
+    branches:
+    - main
 
 concurrency:
   group: ${{ github.head_ref || github.run_id }}-${{ github.workflow }}
@@ -32,7 +34,7 @@ jobs:
     if: github.repository == 'envoyproxy/envoy'
     steps:
     - name: Checkout repository
-      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871  # v4.2.1
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
       with:
         fetch-depth: 2
 
@@ -65,7 +67,7 @@ jobs:
 
     - name: Initialize CodeQL
       if: ${{ env.BUILD_TARGETS != '' }}
-      uses: github/codeql-action/init@f779452ac5af1c261dce0346a8f964149f49322b  # codeql-bundle-v3.26.13
+      uses: github/codeql-action/init@662472033e021d55d94146f66f6058822b0b39fd  # codeql-bundle-v3.27.0
       with:
         languages: cpp
 
@@ -109,4 +111,4 @@ jobs:
 
     - name: Perform CodeQL Analysis
       if: ${{ env.BUILD_TARGETS != '' }}
-      uses: github/codeql-action/analyze@f779452ac5af1c261dce0346a8f964149f49322b  # codeql-bundle-v3.26.13
+      uses: github/codeql-action/analyze@662472033e021d55d94146f66f6058822b0b39fd  # codeql-bundle-v3.27.0

.github/workflows/envoy-checks.yml

@@ -41,8 +41,6 @@ jobs:
       # head-sha: ${{ github.sha }}
 
   build:
-    secrets:
-      gcp-key: ${{ secrets.GCP_SERVICE_ACCOUNT_KEY }}
     permissions:
       actions: read
       contents: read
@@ -75,8 +73,6 @@ jobs:
       trusted: ${{ fromJSON(needs.load.outputs.trusted) }}
 
   san:
-    secrets:
-      gcp-key: ${{ secrets.GCP_SERVICE_ACCOUNT_KEY }}
     permissions:
       actions: read
       contents: read

.github/workflows/envoy-dependency.yml

@@ -146,7 +146,7 @@ jobs:
           path: envoy
           fetch-depth: 0
         token: ${{ steps.appauth.outputs.token }}
-    - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871  # v4.2.1
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
       name: Checkout Envoy build tools repository
       with:
         repository: envoyproxy/envoy-build-tools
@@ -238,7 +238,7 @@ jobs:
       issues: write
     steps:
     - name: Checkout repository
-      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871  # v4.2.1
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
     - name: Run dependency checker
       run: |
         TODAY_DATE=$(date -u -I"date")

.github/workflows/envoy-macos.yml

@@ -53,7 +53,7 @@ jobs:
       steps-pre: ${{ matrix.steps-pre }}
       target: ${{ matrix.target }}
       target-name: ${{ matrix.target-name }}
-      timeout-minutes: 90
+      timeout-minutes: 120
       trusted: ${{ fromJSON(needs.load.outputs.trusted) }}
     strategy:
       fail-fast: false

.github/workflows/mobile-release.yml

@@ -86,7 +86,7 @@ jobs:
         include:
         - output: envoy
     steps:
-    - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871  # v4.2.1
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
       with:
         fetch-depth: 0
     - name: Add safe directory

.github/workflows/mobile-traffic_director.yml

@@ -30,7 +30,7 @@ jobs:
     timeout-minutes: 120
     steps:
     - name: Checkout repository
-      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871  # v4.2.1
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
     - name: Add safe directory
       run: git config --global --add safe.directory /__w/envoy/envoy
     - name: 'Run GcpTrafficDirectorIntegrationTest'

.github/workflows/pr_notifier.yml

@@ -22,7 +22,7 @@ jobs:
               || !contains(github.actor, '[bot]'))
       }}
     steps:
-    - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871  # v4.2.1
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
     - name: Notify about PRs
       run: |
         ARGS=()