chore: merge upstream

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/vscode/devcontainers/go:1-1.23
+FROM mcr.microsoft.com/vscode/devcontainers/go:1-1.26
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 

.github/FUNDING.yml

@@ -0,0 +1,15 @@
+# These are supported funding model platforms
+
+github: tuunit # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
+patreon: # Replace with a single Patreon username
+open_collective: oauth2-proxy # Replace with a single Open Collective username
+ko_fi: # Replace with a single Ko-fi username
+tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
+community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
+liberapay: # Replace with a single Liberapay username
+issuehunt: # Replace with a single IssueHunt username
+lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
+polar: # Replace with a single Polar username
+buy_me_a_coffee: # Replace with a single Buy Me a Coffee username
+thanks_dev: # Replace with a single thanks.dev username
+custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']

.github/ISSUE_TEMPLATE/config.yml

@@ -1,6 +1,6 @@
 blank_issues_enabled: false
 contact_links:
-  - name: OAuth2-Proxy Slack
-    url: https://gophers.slack.com/messages/CM2RSS25N
+  - name: OAuth2 Proxy Slack
+    url: https://cloud-native.slack.com/archives/C098Y5URZ2N
     about: Feel free to ask any questions here.
 

.github/PULL_REQUEST_TEMPLATE.md

@@ -20,7 +20,8 @@
 <!--- Go over all the following points, and put an `x` in all the boxes that apply. -->
 <!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! -->
 
-- [ ] My change requires a change to the documentation or CHANGELOG.
-- [ ] I have updated the documentation/CHANGELOG accordingly.
+- [ ] I have added an entry for my changes to the [CHANGELOG.md](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/CHANGELOG.md).
+- [ ] I have [signed off](https://github.com/apps/dco) all my commits.
 - [ ] I have created a feature (non-master) branch for my PR.
+- [ ] I have used [conventional commits](https://www.conventionalcommits.org/en/v1.0.0/#examples) for the PR title.
 - [ ] I have written tests for my code changes.

.github/workflows/ci.yml

@@ -7,29 +7,39 @@ on:
   pull_request:
     branches:
       - '**'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+  security-events: write
+
 jobs:
   build:
     runs-on: ubuntu-latest
-    env:
-      COVER: true
     steps:
     - name: Check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
+      with:
+        fetch-depth: 0
+
+    - name: Get Go version
+      run: |
+        version=$(grep "^go " go.mod | cut -d' ' -f2 | cut -d. -f1,2)
+        echo "version=${version}" >> "$GITHUB_OUTPUT"
+      id: go-version
 
     - name: Set up Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@v6
       with:
-        go-version-file: go.mod
-      id: go
+        go-version: ${{ steps.go-version.outputs.version }}
+        check-latest: true
 
-    - name: Get dependencies
-      env:
-        # renovate: datasource=github-tags depName=golangci/golangci-lint
-        GOLANGCI_LINT_VERSION: v1.64.8
-      run: |
-        curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin ${GOLANGCI_LINT_VERSION}
-        curl -L https://codeclimate.com/downloads/test-reporter/test-reporter-latest-linux-amd64 > ./cc-test-reporter
-        chmod +x ./cc-test-reporter
+    - name: Install golangci-lint
+      uses: golangci/golangci-lint-action@v9
+      with:
+        install-only: true
+        version: v2.11.4 # renovate: datasource=github-tags depName=golangci/golangci-lint
 
     - name: Verify Code Generation
       run: |
@@ -52,15 +62,48 @@ jobs:
 
     - name: Test
       env:
-        CC_TEST_REPORTER_ID: ${{ secrets.CC_TEST_REPORTER_ID }}
+        COVER: true
+      run: |
+        make test
+
+    - name: Generate Coverage Report
+      if: github.event_name == 'push'
       run: |
-        ./.github/workflows/test.sh
+        go install github.com/jandelgado/gcov2lcov@25681830fb515e3d4c117e136b4f049e21efb4d0
+        gcov2lcov -infile=c.out -outfile=lcov.info
+
+    - name: Upload Coverage Report
+      if: github.event_name == 'push'
+      uses: qltysh/qlty-action/coverage@v2
+      with:
+        oidc: true
+        files: lcov.info
+
+    - name: Run Trivy vulnerability scanner
+      if: (!startsWith(github.head_ref, 'release'))
+      uses: aquasecurity/trivy-action@0.35.0
+      with:
+        scan-type: 'rootfs'
+        scan-ref: './oauth2-proxy'
+        severity: 'CRITICAL,HIGH'
+        hide-progress: true
+        format: 'sarif'
+        output: 'trivy-results.sarif'
+        exit-code: '0'
+
+    - name: Upload Trivy scan results
+      if: (!startsWith(github.head_ref, 'release'))
+      uses: github/codeql-action/upload-sarif@v4
+      with:
+        sarif_file: 'trivy-results.sarif'
 
   docker:
     runs-on: ubuntu-latest
     steps:
     - name: Check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
+      with:
+        fetch-depth: 0
 
     - name: Set up QEMU
       uses: docker/setup-qemu-action@v3
@@ -72,10 +115,10 @@ jobs:
     - name: Docker Build
       if: (!startsWith(github.head_ref, 'release'))
       run: |
-        make docker
+        make build-docker
 
     # For release testing
     - name: Docker Build All
       if: github.base_ref == 'master' && startsWith(github.head_ref, 'release')
       run: |
-        make docker-all
+        make build-docker-all

.github/workflows/codeql.yml

@@ -32,7 +32,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

.github/workflows/create-release.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
       with:
         ref: master
         fetch-depth: 0
@@ -54,7 +54,7 @@ jobs:
         git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"
 
     - name: Setup node
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v6
       with:
         node-version-file: docs/package.json
 

.github/workflows/docs.yml

@@ -14,16 +14,16 @@ jobs:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Setup Pages
         id: pages
         uses: actions/configure-pages@v5
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           # renovate: datasource=node-version depName=node
-          node-version: 22
+          node-version: 24
 
       - name: Test Build
         working-directory: ./docs
@@ -35,12 +35,12 @@ jobs:
     if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           # renovate: datasource=node-version depName=node
-          node-version: 22
+          node-version: 24
 
       - name: Build docusaurus
         working-directory: ./docs
@@ -49,7 +49,7 @@ jobs:
           npm run build
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v5
         with:
           path: ./docs/build
 

.github/workflows/e2e.yml

@@ -0,0 +1,14 @@
+name: E2E
+
+on:
+  issue_comment:
+    types: [created]
+
+jobs:
+  e2e:
+    uses: oauth2-proxy/e2e-suite/.github/workflows/e2e.yml@main
+    permissions:
+      contents: read
+      statuses: write
+      issues: write
+      pull-requests: write

.github/workflows/labeler.yml

@@ -9,7 +9,7 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/labeler@v5
+      - uses: actions/labeler@v6
         with:
           sync-labels: true
           dot: true

.github/workflows/nightly.yml

@@ -12,7 +12,7 @@ jobs:
     if: github.repository == 'oauth2-proxy/oauth2-proxy'
     steps:
     - name: Check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
       with:
         ref: master
         fetch-depth: 0
@@ -34,8 +34,8 @@ jobs:
 
     - name: Build images
       run: |
-        make docker-nightly-build
+        make nightly-build
 
     - name: Push images
       run: |
-        make docker-nightly-push
+        make nightly-push

.github/workflows/publish-release.yml

@@ -14,57 +14,63 @@ permissions:
 
 jobs:
   publish:
-    if: github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/')
+    if: github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/') && github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     outputs:
       tag: ${{ steps.tag.outputs.version }}
     steps:
     - name: Check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
       with:
         ref: ${{ github.event.pull_request.merge_commit_sha }}
         fetch-depth: 0
         fetch-tags: true
 
     - name: Tag release
+      env:
+        BRANCH: ${{ github.event.pull_request.head.ref }}
       run: |
         # Set up github-actions[bot] user
         git config --local user.name "github-actions[bot]"
         git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"
 
         # Get the version from the branch name
-        branch="${{ github.event.pull_request.head.ref }}"
-        version="${branch#release/}"
+        version="${BRANCH#release/}"
         echo ${version}
 
         # Tag and create release
         git tag -a "${version}" -m "Release ${version}"
         echo "version=${version}" >> $GITHUB_OUTPUT
       id: tag
-
-    - name: Set up go
-      uses: actions/setup-go@v5
-      with:
-        go-version-file: go.mod
 
-    - name: Get dependencies
-      env:
-        # renovate: datasource=github-tags depName=golangci/golangci-lint
-        GOLANGCI_LINT_VERSION: v1.64.8
+    - name: Get Go version
       run: |
-        curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin ${GOLANGCI_LINT_VERSION}
-        curl -L https://codeclimate.com/downloads/test-reporter/test-reporter-latest-linux-amd64 > ./cc-test-reporter
-        chmod +x ./cc-test-reporter
+        version=$(grep "^go " go.mod | cut -d' ' -f2 | cut -d. -f1,2)
+        echo "version=${version}" >> "$GITHUB_OUTPUT"
+      id: go-version
 
-        # Install go dependencies
+    - name: Set up Go
+      uses: actions/setup-go@v6
+      with:
+        go-version: ${{ steps.go-version.outputs.version }}
+        check-latest: true
+
+    - name: Install golangci-lint
+      uses: golangci/golangci-lint-action@v9
+      with:
+        install-only: true
+        version: v2.11.4 # renovate: datasource=github-tags depName=golangci/golangci-lint
+
+    - name: Get go dependencies
+      run: |
         go mod download
 
     - name: Build Artifacts
       run: make release
 
     # Upload artifacts in case of workflow failure
     - name: Upload Artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: oauth2-proxy-artifacts
         path: |
@@ -100,7 +106,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
       with:
         ref: ${{ needs.publish.outputs.tag }}
         fetch-depth: 0
@@ -122,8 +128,8 @@ jobs:
 
     - name: Build images
       run: |
-        make docker-all
+        make build-docker-all
 
     - name: Push images
       run: |
-        make docker-push-all
+        make push-docker-all

.github/workflows/stale.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/stale@v9
+    - uses: actions/stale@v10
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         days-before-stale: 180