ci(deps): Bump the actions group with 4 updates

.github/workflows/conformance.yaml

@@ -21,7 +21,7 @@ env:
   CARGO_TERM_COLOR: always
   CONTAINER_ENGINE: docker
   KIND_CLUSTER_NAME: praxis-conformance
-  PRAXIS_IMAGE: ghcr.io/praxis-proxy/praxis:0.3.1
+  PRAXIS_IMAGE: ghcr.io/praxis-proxy/praxis:0.5.2
   OPERATOR_IMAGE: praxis-operator:dev
 
 jobs:
@@ -38,7 +38,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Login to GHCR
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -48,19 +48,24 @@ jobs:
         run: docker build -t ${{ env.OPERATOR_IMAGE }} -f Containerfile .
 
       - name: Pull praxis image
-        run: docker pull ${{ env.PRAXIS_IMAGE }}
+        run: bash hack/retry.sh docker pull ${{ env.PRAXIS_IMAGE }}
 
       - name: Install KIND
         run: |
-          curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.27.0/kind-linux-amd64
+          # --fail matters as much as the retries: without it an HTTP error
+          # page is written to ./kind, chmod +x succeeds, and the failure
+          # surfaces later as an unreadable exec format error.
+          bash hack/retry.sh curl --fail --location --show-error --silent \
+            --retry 3 --retry-all-errors --retry-delay 2 \
+            --output ./kind https://kind.sigs.k8s.io/dl/v0.27.0/kind-linux-amd64
           chmod +x ./kind
           sudo mv ./kind /usr/local/bin/kind
 
       - name: Setup KIND cluster
         run: bash hack/setup-kind.sh
 
       - name: Install Go
-        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: "1.24"
           cache: false

.github/workflows/integration.yaml

@@ -29,7 +29,7 @@ env:
   KIND_CLUSTER_NAME: ci
   V: ${{ inputs.debug && '1' || '' }}
   OPERATOR_IMAGE: praxis-operator:dev
-  PRAXIS_IMAGE: ghcr.io/praxis-proxy/praxis:0.3.1
+  PRAXIS_IMAGE: ghcr.io/praxis-proxy/praxis:0.5.2
 
 jobs:
   # ---------------------------------------------------------------------------
@@ -45,7 +45,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Login to GHCR
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -57,11 +57,16 @@ jobs:
         run: docker build -t ${{ env.OPERATOR_IMAGE }} -f Containerfile .
 
       - name: Pull praxis image
-        run: docker pull ${{ env.PRAXIS_IMAGE }}
+        run: bash hack/retry.sh docker pull ${{ env.PRAXIS_IMAGE }}
 
       - name: Install KIND
         run: |
-          curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.27.0/kind-linux-amd64
+          # --fail matters as much as the retries: without it an HTTP error
+          # page is written to ./kind, chmod +x succeeds, and the failure
+          # surfaces later as an unreadable exec format error.
+          bash hack/retry.sh curl --fail --location --show-error --silent \
+            --retry 3 --retry-all-errors --retry-delay 2 \
+            --output ./kind https://kind.sigs.k8s.io/dl/v0.27.0/kind-linux-amd64
           chmod +x ./kind
           sudo mv ./kind /usr/local/bin/kind
 

.github/workflows/release.yaml

@@ -0,0 +1,81 @@
+name: Release
+
+# ------------------------------------------------------------------------------
+# Workflow Settings
+# ------------------------------------------------------------------------------
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Tag to build and publish"
+        required: true
+        type: string
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions: {}
+
+env:
+  CARGO_TERM_COLOR: always
+  REGISTRY: ghcr.io
+
+jobs:
+  # ---------------------------------------------------------------------------
+  # Verify before publishing
+  # ---------------------------------------------------------------------------
+
+  verify:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: praxis-proxy/conventions/.github/actions/setup-rust@7e1e8d97c2dc820d24b31f9a65b119c4d0e5342c # v0.1.0
+
+      - name: Tests
+        run: make test
+
+  # ---------------------------------------------------------------------------
+  # Build and publish the operator image
+  # ---------------------------------------------------------------------------
+
+  image:
+    needs: verify
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Login to GHCR
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Derive image tags
+        id: tags
+        run: |
+          version="${{ inputs.tag || github.ref_name }}"
+          image="${REGISTRY}/${GITHUB_REPOSITORY,,}"
+          echo "version=${version}" >> "$GITHUB_OUTPUT"
+          echo "tags=${image}:${version},${image}:latest" >> "$GITHUB_OUTPUT"
+
+      - name: Build and push
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          file: Containerfile
+          push: true
+          tags: ${{ steps.tags.outputs.tags }}
+          labels: |
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.version=${{ steps.tags.outputs.version }}

.github/workflows/tests.yaml

@@ -66,6 +66,27 @@ jobs:
       - name: Tests
         run: make test
 
+  # ---------------------------------------------------------------------------
+  # Coverage floor
+  # ---------------------------------------------------------------------------
+
+  coverage:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: praxis-proxy/conventions/.github/actions/setup-rust@7e1e8d97c2dc820d24b31f9a65b119c4d0e5342c # v0.1.0
+
+      - name: Install cargo-llvm-cov
+        uses: taiki-e/install-action@7f4eb899022d8fe70b20c4f3de697aa85c309026 # v2.62.44
+        with:
+          tool: cargo-llvm-cov
+
+      - name: Coverage
+        run: make coverage-check
+
   # ---------------------------------------------------------------------------
   # Supply-chain audit
   # ---------------------------------------------------------------------------

CHANGELOG.md

@@ -0,0 +1,47 @@
+# Changelog
+
+All notable changes to this project are documented here.
+
+The format follows [Keep a Changelog], and this project adheres to
+[Semantic Versioning].
+
+[Keep a Changelog]: https://keepachangelog.com/en/1.1.0/
+[Semantic Versioning]: https://semver.org/spec/v2.0.0.html
+
+## [Unreleased]
+
+### Added
+
+- Health, readiness and metrics endpoints on port 8080, with matching
+  probes on the operator Deployment.
+- Leader election over a coordination `Lease`, so the operator can run
+  more than one replica safely.
+- Kubernetes events explaining why a Gateway was rejected.
+- Configurable data-plane replicas via the `praxis.sh/replicas`
+  annotation, a `PodDisruptionBudget`, and pod spread across nodes.
+- `method` and `queryParams` route matches are now detected and
+  reported rather than silently ignored.
+- Listener protocol and hostname conflict detection.
+
+### Fixed
+
+- Status writes no longer restamp unchanged conditions, which had kept
+  the operator in a permanent reconcile loop.
+- Endpoint weight distribution no longer overflows `i32` and aborts the
+  process.
+- The Gateway and HTTPRoute controllers no longer overwrite each other's
+  entries in `status.parents`.
+- Unsupported route matchers and filters are rejected instead of being
+  widened into something the author did not ask for.
+- Hostname matching is case-insensitive, per RFC 1123.
+- Named `targetPort`s resolve by port name instead of picking an
+  arbitrary port on multi-port Services.
+- Terminating endpoints are excluded from the data-plane config.
+- Route parent status is cleared when its Gateway is deleted.
+- Redirect statuses outside the set Praxis accepts no longer produce a
+  config the data plane refuses to load.
+
+### Security
+
+- RBAC no longer grants write access to Secrets and Endpoints.
+- The operator pod is hardened to match the data-plane pods it creates.