Sync upstream main through 94e0a26ac

.agents/skills/security-status-report/scripts/compile_report.py

@@ -1,4 +1,4 @@
-# Copyright 2026 Google LLC
+# Copyright 2026 The Agent Substrate Authors
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

.agents/skills/security-status-report/scripts/render_chart.py

@@ -1,4 +1,4 @@
-# Copyright 2026 Google LLC
+# Copyright 2026 The Agent Substrate Authors
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

.agents/skills/security-status-report/scripts/render_table.py

@@ -1,4 +1,4 @@
-# Copyright 2026 Google LLC
+# Copyright 2026 The Agent Substrate Authors
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

.agents/skills/security-status-report/scripts/report_test.py

@@ -1,4 +1,4 @@
-# Copyright 2026 Google LLC
+# Copyright 2026 The Agent Substrate Authors
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

.agents/skills/security-status-report/scripts/template_dispatch.py

@@ -1,4 +1,4 @@
-# Copyright 2026 Google LLC
+# Copyright 2026 The Agent Substrate Authors
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,4 +1,4 @@
-# Copyright 2026 Google LLC
+# Copyright 2026 The Agent Substrate Authors
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

.github/release.yml

@@ -1,4 +1,4 @@
-# Copyright 2026 Google LLC
+# Copyright 2026 The Agent Substrate Authors
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

.github/scripts/helm-verify/install-helm-unittest.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-# Copyright 2026 Google LLC
+# Copyright 2026 The Agent Substrate Authors
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

.github/scripts/release/attach-binaries.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-# Copyright 2026 Google LLC
+# Copyright 2026 The Agent Substrate Authors
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

.github/scripts/release/ghcr-login.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-# Copyright 2026 Google LLC
+# Copyright 2026 The Agent Substrate Authors
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

.github/scripts/release/publish-charts.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-# Copyright 2026 Google LLC
+# Copyright 2026 The Agent Substrate Authors
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

.github/scripts/release/refuse-published-release.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-# Copyright 2026 Google LLC
+# Copyright 2026 The Agent Substrate Authors
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

.github/scripts/upgrade-e2e/dump-diagnostics.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+
+# Copyright 2026 The Agent Substrate Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Prints the state of the kind cluster after a failed upgrade: the worker
+# pools and pods, the system workloads, and the logs of the system pods and of
+# every worker pod. The actors' worker logs say what happened to each actor.
+#
+# Used by .github/workflows/upgrade-e2e.yaml. Every command is best effort.
+
+set -o nounset -o pipefail
+
+kubectl --context kind-kind get workerpool,pods -A -o wide || true
+kubectl --context kind-kind get ds,deploy -n ate-system -o wide || true
+dump() {
+  echo "=== logs: $1/$2 ==="
+  kubectl --context kind-kind logs -n "$1" "$2" --all-containers --tail=300 2>/dev/null || true
+}
+for ns in ate-system podcertificate-controller-system; do
+  for p in $(kubectl --context kind-kind get pods -n "${ns}" -o name 2>/dev/null); do
+    dump "${ns}" "${p}"
+  done
+done
+kubectl --context kind-kind get pods -A -l ate.dev/worker-pool \
+  -o 'custom-columns=:.metadata.namespace,:.metadata.name' --no-headers 2>/dev/null \
+  | while read -r ns name; do dump "${ns}" "${name}"; done

.github/scripts/upgrade-e2e/enable-kvm.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+
+# Copyright 2026 The Agent Substrate Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Grants the runner access to /dev/kvm, so hack/create-kind-cluster.sh mounts
+# it into the kind node for microVM workers.
+#
+# Used by .github/workflows/upgrade-e2e.yaml.
+
+set -o errexit -o nounset -o pipefail
+
+echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' \
+  | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+sudo udevadm control --reload-rules
+sudo udevadm trigger --name-match=kvm

.github/scripts/upgrade-e2e/install-old.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+
+# Copyright 2026 The Agent Substrate Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Installs the release to upgrade from with its own installer, so the cluster
+# starts out as that release left it, plus the counter demo of SANDBOX
+# (gvisor or microvm) that the suite's actors run on.
+#
+#   (cd <old checkout> && <new checkout>/.github/scripts/upgrade-e2e/install-old.sh SANDBOX)
+#
+# Runs in the checkout of the old release. A release whose deploy ate-system
+# does not install the microVM dependencies has
+# hack/run-microvm-demo-kind.sh, which installs them, the control plane and
+# counter-microvm.
+#
+# Used by .github/workflows/upgrade-e2e.yaml.
+
+set -o errexit -o nounset -o pipefail
+
+sandbox="${1:?usage: install-old.sh gvisor|microvm}"
+
+case "${sandbox}" in
+gvisor)
+  demo=counter
+  ;;
+microvm)
+  if [[ -x hack/run-microvm-demo-kind.sh ]]; then
+    exec hack/run-microvm-demo-kind.sh
+  fi
+  demo=counter-microvm
+  ;;
+*)
+  echo "unknown sandbox ${sandbox}, want gvisor or microvm" >&2
+  exit 1
+  ;;
+esac
+
+go run ./cmd/ate-setup --kind deploy ate-system
+go run ./cmd/ate-setup --kind deploy demo "${demo}"

.github/scripts/upgrade-e2e/pick-from.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+
+# Copyright 2026 The Agent Substrate Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Picks the release to upgrade from and writes it to GITHUB_OUTPUT as tag=.
+#
+#   FROM=<tag or commit, may be empty> TO=<branch> EVENT=<event name> \
+#     .github/scripts/upgrade-e2e/pick-from.sh
+#
+# FROM wins when set. Otherwise, on a release-X.Y branch, it is the newest
+# earlier vX.Y.Z release: a release branch only takes patch releases, and
+# users upgrade from a release. A minor with no release yet, such as one
+# between its release candidates, starts from its newest pre-release. With
+# nothing to upgrade from, a push writes an empty tag and the job skips its
+# steps, and a manual run fails.
+#
+# Runs in the checkout of the release under test. Used by
+# .github/workflows/upgrade-e2e.yaml.
+
+set -o errexit -o nounset -o pipefail
+
+if [[ -z "${FROM}" && "${TO}" =~ ^release-[0-9]+\.[0-9]+$ ]]; then
+  # The minor's tags, newest first. versionsort.suffix sorts a pre-release
+  # (v1.0.0-rc.1) below its release.
+  tags="$(git -c versionsort.suffix=- tag -l "v${TO#release-}.*" --merged HEAD --no-contains HEAD --sort=-v:refname)"
+  FROM="$(grep -v -e - <<<"${tags}" | head -n 1 || true)"
+  if [[ -z "${FROM}" ]]; then
+    FROM="$(head -n 1 <<<"${tags}")"
+  fi
+fi
+if [[ -z "${FROM}" ]]; then
+  if [[ "${EVENT}" == workflow_dispatch ]]; then
+    echo "::error::Nothing to upgrade ${TO} from: set the from input."
+    exit 1
+  fi
+  echo "::notice::No earlier release on ${TO} to upgrade from yet."
+  echo "tag=" >> "${GITHUB_OUTPUT}"
+  exit 0
+fi
+echo "Upgrading ${FROM} -> ${TO}"
+echo "tag=${FROM}" >> "${GITHUB_OUTPUT}"

.github/scripts/upgrade-e2e/run-suite.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+
+# Copyright 2026 The Agent Substrate Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Runs the upgrade suite (internal/e2e/upgrade) from a copy of the old
+# release's install record, so this checkout's ate-setup upgrades the cluster
+# in the runbook's order.
+#
+#   ATE_RECORD_DIR=<dir> E2E_ATE_SETUP_CONFIG=<file> E2E_JUNIT_FILE=<file> \
+#     .github/scripts/upgrade-e2e/run-suite.sh
+#
+# Runs in the checkout of the release under test. The old release is installed
+# with no preview gates, and CI has to say so. Used by
+# .github/workflows/upgrade-e2e.yaml.
+
+set -o errexit -o nounset -o pipefail
+
+cp "${ATE_RECORD_DIR}"/installs/*.yaml "${E2E_ATE_SETUP_CONFIG}"
+hack/run-e2e-kind.sh ./internal/e2e/upgrade -timeout 90m -args --no-color --preview=""

.github/workflows/agentgateway-image.yaml

@@ -1,4 +1,4 @@
-# Copyright 2026 Google LLC
+# Copyright 2026 The Agent Substrate Authors
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

.github/workflows/govulncheck.yaml

@@ -1,4 +1,4 @@
-#  Copyright 2026 Google LLC
+#  Copyright 2026 The Agent Substrate Authors
 #
 #  Licensed under the Apache License, Version 2.0 (the "License");
 #  you may not use this file except in compliance with the License.

.github/workflows/helm-e2e.yaml

@@ -1,4 +1,4 @@
-# Copyright 2026 Google LLC
+# Copyright 2026 The Agent Substrate Authors
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

.github/workflows/helm-verify.yaml

@@ -1,4 +1,4 @@
-# Copyright 2026 Google LLC
+# Copyright 2026 The Agent Substrate Authors
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

.github/workflows/pr-workflow.yaml

@@ -1,4 +1,4 @@
-# Copyright 2026 Google LLC
+# Copyright 2026 The Agent Substrate Authors
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

.github/workflows/release.yaml

@@ -1,4 +1,4 @@
-# Copyright 2026 Google LLC
+# Copyright 2026 The Agent Substrate Authors
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

.github/workflows/site.yaml

@@ -1,4 +1,4 @@
-# Copyright 2026 Google LLC
+# Copyright 2026 The Agent Substrate Authors
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -22,6 +22,7 @@ on:
       - 'docs/**'
       - 'demos/*/README.md'
       - 'api/ateapi/v1/**'
+      - 'manifests/ate-install/generated/ate.dev_*.yaml'
       - 'tools/apitool/**'
       - 'tools/site-content/**'
       - 'tools/site-release-data/**'
@@ -35,6 +36,7 @@ on:
       - 'docs/**'
       - 'demos/*/README.md'
       - 'api/ateapi/v1/**'
+      - 'manifests/ate-install/generated/ate.dev_*.yaml'
       - 'tools/apitool/**'
       - 'tools/site-content/**'
       - 'tools/site-release-data/**'