Refresh v23 fork with upstream release-23.0 patches since v23.0.8

.github/actions/build-bootstrap/action.yml

@@ -10,21 +10,25 @@ inputs:
     description: "Bootstrap image flavor (e.g. mysql84)"
     required: false
     default: "mysql84"
+  cache-export:
+    description: "Export the build cache to the GitHub Actions cache. Only one job per push should do this, and only on branches whose cache other builds can read (main and release branches)."
+    required: false
+    default: "false"
 
 runs:
   using: "composite"
   steps:
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+      uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
 
     - name: Build bootstrap images
-      uses: docker/bake-action@5be5f02ff8819ecd3092ea6b2e6261c31774f2b4 # v6.10.0
+      uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
       with:
         files: docker/bootstrap/docker-bake.hcl
         load: true
         set: |
           *.cache-from=type=gha,scope=bootstrap
-          *.cache-to=type=gha,scope=bootstrap,mode=max
+          ${{ inputs.cache-export == 'true' && '*.cache-to=type=gha,scope=bootstrap,mode=max' || '' }}
       env:
         BOOTSTRAP_VERSION: ${{ inputs.bootstrap-version }}
         BOOTSTRAP_FLAVOR: ${{ inputs.bootstrap-flavor }}

.github/actions/setup-go/action.yml

@@ -1,8 +1,8 @@
 name: "Set up Go"
-description: "Set up Go with shared module caching"
+description: "Set up Go with shared module and build caching"
 inputs:
   cache:
-    description: "Whether to cache Go modules"
+    description: "Whether to restore and save the Go module and build caches"
     default: "true"
 runs:
   using: "composite"
@@ -12,19 +12,89 @@ runs:
       uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
         go-version-file: go.mod
-        # Disable built-in caching; its key includes ImageOS which
-        # creates duplicate cache entries across runner types.
+        # Disable built-in caching: its key includes ImageOS, which duplicates
+        # entries across runner types, it stores the platform-independent
+        # module cache once per platform, and it saves from pull request runs,
+        # which crowds the branch-scoped entries pull requests restore from
+        # out of the repository cache quota.
         cache: false
 
-    - name: Cache Go modules
-      if: inputs.cache == 'true' && (github.base_ref == 'main' || (github.base_ref == '' && github.ref_name == 'main'))
-      uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+    # Only pushes to main and the release branches save caches; everything
+    # else restores. Caches saved from any other run are scoped to a ref that
+    # pull requests do not restore from, while still counting against the
+    # repository quota and evicting the shared entries.
+    - name: Determine cache mode
+      id: cache-mode
+      shell: bash
+      env:
+        SAVE: ${{ github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release-')) }}
+      run: echo "save=${SAVE}" >> "${GITHUB_OUTPUT}"
+
+    - name: Restore Go module cache
+      if: inputs.cache == 'true' && steps.cache-mode.outputs.save == 'false'
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ~/go/pkg/mod
+        key: go-mod-${{ hashFiles('go.sum', 'tools/**/go.sum') }}
+        restore-keys: |
+          go-mod-
+
+    - name: Restore Go build cache
+      if: inputs.cache == 'true' && steps.cache-mode.outputs.save == 'false'
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
-        # Same paths cached by actions/setup-go internally.
-        path: |
-          ~/go/pkg/mod
-          ~/.cache/go-build
-        # Cache by version/arch/hash. Construct hash using same method as actions/setup-go.
-        key: go-${{ steps.setup-go.outputs.go-version }}-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum', 'tools/**/go.sum') }}
+        path: ~/.cache/go-build
+        key: go-build-${{ runner.os }}-${{ runner.arch }}-go${{ steps.setup-go.outputs.go-version }}-${{ hashFiles('go.sum', 'tools/**/go.sum') }}
         restore-keys: |
-          go-${{ steps.setup-go.outputs.go-version }}-${{ runner.os }}-${{ runner.arch }}-
+          go-build-${{ runner.os }}-${{ runner.arch }}-go${{ steps.setup-go.outputs.go-version }}-
+
+    # Pushes to main and the release branches save the entries every other run
+    # restores from. The saves deliberately start from an empty cache instead
+    # of a restored one, so a go.sum change produces a minimal entry without
+    # stale module versions or dead build cache contents. actions/cache saves
+    # in its post step, after the job has populated the caches, and only when
+    # the job succeeds and the key does not exist yet.
+    - name: Cache Go modules
+      if: inputs.cache == 'true' && steps.cache-mode.outputs.save == 'true'
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ~/go/pkg/mod
+        key: go-mod-${{ hashFiles('go.sum', 'tools/**/go.sum') }}
+
+    - name: Cache Go build cache
+      if: inputs.cache == 'true' && steps.cache-mode.outputs.save == 'true'
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ~/.cache/go-build
+        key: go-build-${{ runner.os }}-${{ runner.arch }}-go${{ steps.setup-go.outputs.go-version }}-${{ hashFiles('go.sum', 'tools/**/go.sum') }}
+
+    # Download the root module and every tool module, so a saved module cache
+    # always contains the full dependency set its key covers, no matter which
+    # job saves it first; the tool modules are otherwise only fetched on first
+    # use. On a cache hit this is a fast no-op. Retried because
+    # proxy.golang.org occasionally drops connections mid-download.
+    - name: Download Go modules
+      shell: bash
+      run: |
+        download() {
+          go mod download || return 1
+          local modfile
+          for modfile in tools/*/go.mod; do
+            # Older release trees, which the upgrade/downgrade workflows also
+            # set up, have no tool modules; the unmatched glob stays literal.
+            [ -f "${modfile}" ] || continue
+            go mod download -modfile="${modfile}" || return 1
+          done
+        }
+
+        for attempt in 1 2 3; do
+          if download; then
+            break
+          fi
+          if [ "${attempt}" = 3 ]; then
+            echo "go mod download failed after ${attempt} attempts"
+            exit 1
+          fi
+          echo "go mod download failed (attempt ${attempt}); retrying"
+          sleep 10
+        done

.github/actions/tune-os/action.yml

@@ -6,6 +6,9 @@ runs:
     - name: Tune the OS
       shell: bash -e {0}
       run: |
+        # Before the first apt run, so that all of the job's apt runs use it.
+        "${GITHUB_ACTION_PATH}/pin-ubuntu-mirror.sh"
+
         # Install eatmydata and ensure it's used for every operation
         sudo apt-get update && sudo apt-get install -y eatmydata
         echo "/usr/\${LIB}/libeatmydata.so" | sudo tee -a /etc/ld.so.preload

.github/actions/tune-os/pin-ubuntu-mirror.sh

@@ -0,0 +1,110 @@
+#!/bin/bash
+
+# Copyright 2026 The Vitess Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Points apt at a responsive Ubuntu archive server before the job's first apt
+# run. The archive's host name resolves to several servers, some of which
+# intermittently answer only after 10-20 seconds and then send 50 kB/s, and apt
+# keeps downloading from them however long that takes. The Azure mirror that
+# the runner images list first sometimes does not answer at all, or sends
+# packages at 40 kB/s while it serves the release file instantly, so a probe
+# cannot tell when to trust it. This times a download of the release file over
+# HTTP and HTTPS from each of the archive's addresses, pins the archive's host
+# names in /etc/hosts to every address that answered both within 1 second or
+# within 3 times the fastest one's time, so that whatever resolves them still
+# has other addresses to fail over to even when one address is much closer than
+# the others, and points apt at the archive instead of the Azure mirror.
+# When no address answers, the archive itself is down, so it leaves apt on the
+# Azure mirror.
+
+set -uo pipefail
+
+if [[ "$(dpkg --print-architecture)" == "arm64" ]]; then
+	archive=ports.ubuntu.com
+	path=ubuntu-ports
+else
+	archive=archive.ubuntu.com
+	path=ubuntu
+fi
+codename="$(awk -F= '$1 == "VERSION_CODENAME" {print $2}' /etc/os-release)"
+
+# Prints HOST's IPv4 addresses. The resolver of GitHub's hosted runners returns
+# only one of the archive's addresses, which may be a slow one, so this also
+# asks two public resolvers over HTTPS for all of them.
+resolve() {
+	local host="$1"
+	{
+		getent ahostsv4 "${host}" | awk '{print $1}'
+		curl -fsS --max-time 3 -H 'accept: application/dns-json' \
+			"https://cloudflare-dns.com/dns-query?name=${host}&type=A" 2> /dev/null |
+			grep -oE '"data": ?"[0-9.]+"' | grep -oE '[0-9.]+'
+		curl -fsS --max-time 3 "https://dns.google/resolve?name=${host}&type=A" 2> /dev/null |
+			grep -oE '"data": ?"[0-9.]+"' | grep -oE '[0-9.]+'
+	} | grep -xE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | sort -u
+}
+
+# Prints the seconds it took to download the release file from HOST via IP
+# over SCHEME, or nothing if that failed or took longer than 3 seconds.
+probe() {
+	local host="$1" ip="$2" root="$3" scheme="$4" port=80
+	if [[ "${scheme}" == https ]]; then
+		port=443
+	fi
+	curl -fsS -o /dev/null --connect-timeout 2 --max-time 3 --resolve "${host}:${port}:${ip}" \
+		-w '%{time_total}\n' "${scheme}://${host}/${root}/dists/${codename}/InRelease" 2> /dev/null
+}
+
+# Prints the slower of the HTTP and HTTPS times, or nothing if either failed.
+probe_both() {
+	local http https
+	http="$(probe "$@" http)" && https="$(probe "$@" https)" &&
+		awk -v a="${http}" -v b="${https}" 'BEGIN { print (a > b ? a : b) }'
+}
+
+results="$(mktemp)"
+trap 'rm -f "${results}"' EXIT
+for ip in $(resolve "${archive}"); do
+	(
+		if t="$(probe_both "${archive}" "${ip}" "${path}")"; then
+			echo "${t} ${ip}" >> "${results}"
+		else
+			echo "Ubuntu archive probe: ${ip} did not answer within 3 seconds"
+		fi
+	) &
+done
+wait
+
+sort -n "${results}" | sed 's/^/Ubuntu archive probe: /'
+best="$(sort -n "${results}" | head -1 | cut -d' ' -f2)"
+if [[ -z "${best}" ]]; then
+	echo "No Ubuntu archive server answered within 3 seconds; leaving apt as it is."
+	exit 0
+fi
+# security.ubuntu.com is served by the same servers as archive.ubuntu.com.
+security="$(resolve security.ubuntu.com)"
+fastest="$(sort -n "${results}" | head -1 | cut -d' ' -f1)"
+sort -n "${results}" | awk -v max="$(awk -v t="${fastest}" 'BEGIN { print (3 * t > 1 ? 3 * t : 1) }')" '$1 <= max { print $2 }' |
+	while read -r ip; do
+		names="${archive}"
+		if grep -qx "${ip}" <<< "${security}"; then
+			names="${names} security.ubuntu.com"
+		fi
+		echo "Pinning ${names} to ${ip}"
+		echo "${ip} ${names}" | sudo tee -a /etc/hosts > /dev/null
+	done
+files="$(sudo grep -rlF azure.archive.ubuntu.com /etc/apt 2> /dev/null || true)"
+if [[ -n "${files}" ]]; then
+	echo "${files}" | xargs sudo sed -i 's|azure\.archive\.ubuntu\.com|archive.ubuntu.com|g'
+fi

.github/workflows/assign_milestone.yml

@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # We must explicitly checkout the base's SHA to avoid executing any code coming from
           # the PR's SHA - Which would be executed in the base branch's context.

.github/workflows/auto_approve_pr.yml

@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: 'false'
 

.github/workflows/check_make_vtadmin_authz_testgen.yml

@@ -23,15 +23,27 @@
         fi
 
     - name: Check out code
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
+        # The merge commit and its first parent, for the path filter.
+        fetch-depth: 2
         persist-credentials: 'false'
 
+    - name: Find the base of the pull request's merge commit
+      # github.event.pull_request.base.sha is not updated when the base branch
+      # moves, so paths-filter would also count the base branch's newer commits.
+      # With token: '', paths-filter diffs against `base` on pull_request
+      # events too (see its README); action.yml's input description is stale.
+      id: merge-base
+      if: github.event_name == 'pull_request'
+      run: echo "sha=$(git rev-parse HEAD^1)" >> "$GITHUB_OUTPUT"
+
     - name: Check for changes in relevant files
-      uses: dorny/paths-filter@ebc4d7e9ebcb0b1eb21480bb8f43113e996ac77a # v3.0.1
+      uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
       id: changes
       with:
         token: ''
+        base: ${{ steps.merge-base.outputs.sha }}
         filters: |
           vtadmin_changes:
             - 'bootstrap.sh'
@@ -45,11 +57,11 @@
 
     - name: Tune the OS
       if: steps.changes.outputs.vtadmin_changes == 'true'
       uses: $/.github/actions/tune-os
 
     - name: Set up Go
       # zizmor: ignore[cache-poisoning] this workflow publishes no artifacts
-      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       if: steps.changes.outputs.vtadmin_changes == 'true'
       with:
         go-version-file: go.mod

.github/workflows/check_make_vtadmin_web_proto.yml

@@ -23,18 +23,30 @@
         fi
 
     - name: Check out code
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
+        # The merge commit and its first parent, for the path filter.
+        fetch-depth: 2
         persist-credentials: 'false'
 
     - name: Tune the OS
       uses: $/.github/actions/tune-os
 
+    - name: Find the base of the pull request's merge commit
+      # github.event.pull_request.base.sha is not updated when the base branch
+      # moves, so paths-filter would also count the base branch's newer commits.
+      # With token: '', paths-filter diffs against `base` on pull_request
+      # events too (see its README); action.yml's input description is stale.
+      id: merge-base
+      if: github.event_name == 'pull_request'
+      run: echo "sha=$(git rev-parse HEAD^1)" >> "$GITHUB_OUTPUT"
+
     - name: Check for changes in relevant files
-      uses: dorny/paths-filter@ebc4d7e9ebcb0b1eb21480bb8f43113e996ac77a # v3.0.1
+      uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
       id: changes
       with:
         token: ''
+        base: ${{ steps.merge-base.outputs.sha }}
         filters: |
           proto_changes:
             - 'bootstrap.sh'
@@ -50,7 +62,7 @@
 
     - name: Set up Go
       # zizmor: ignore[cache-poisoning] this workflow publishes no artifacts
-      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       if: steps.changes.outputs.proto_changes == 'true'
       with:
         go-version-file: go.mod
@@ -59,7 +71,7 @@
     - name: Setup Node
       if: steps.changes.outputs.proto_changes == 'true'
       # zizmor: ignore[cache-poisoning] this workflow publishes no artifacts
-      uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         # node-version should match package.json
         node-version: '22.13.1'

.github/workflows/close_stale_pull_requests.yml

@@ -15,7 +15,7 @@ jobs:
       pull-requests: write
 
     steps:
-      - uses: actions/stale@f7176fd3007623b69d27091f9b9d4ab7995f0a06 # v5.2.1
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
         with:
           days-before-stale: 30
           # Do not handle issues at all. We only want to handle PRs.