fix(tests): fix 4 failing windows_event_log unit tests

.github/CODEOWNERS

@@ -3,8 +3,8 @@
 .github/workflows/regression.yml @vectordotdev/vector @vectordotdev/single-machine-performance
 regression/config.yaml @vectordotdev/vector @vectordotdev/single-machine-performance
 
-docs/ @vectordotdev/vector @vectordotdev/ux-team @vectordotdev/documentation
-website/ @vectordotdev/vector @vectordotdev/ux-team
+docs/ @vectordotdev/vector @vectordotdev/documentation
+website/ @vectordotdev/vector
 website/content @vectordotdev/vector @vectordotdev/documentation
 website/cue/reference @vectordotdev/vector @vectordotdev/documentation
 

.github/ISSUE_TEMPLATE/minor-release.md

@@ -37,23 +37,23 @@ cargo vdev release prepare --version "${NEW_VECTOR_VERSION}" --vrl-version "${NE
 ```
 
 Automated steps include:
-- [ ] Create a new release branch from master to freeze commits
+- Create a new release branch from master to freeze commits
   - `git fetch && git checkout origin/master && git checkout -b "${RELEASE_BRANCH}" && git push -u`
-- [ ] Create a new release preparation branch from `master`
+- Create a new release preparation branch from `master`
   - `git checkout -b "${PREP_BRANCH}" && git push -u`
-- [ ] Pin VRL to latest released version rather than `main`
-- [ ] Check if there is a newer version of [Alpine](https://alpinelinux.org/releases/) or [Debian](https://www.debian.org/releases/) available to update the release images in
+- Pin VRL to latest released version rather than `main`
+- Check if there is a newer version of [Alpine](https://alpinelinux.org/releases/) or [Debian](https://www.debian.org/releases/) available to update the release images in
       `distribution/docker/`. Update if so.
-- [ ] Run `cargo vdev build release-cue` to generate a new cue file for the release
-  - [ ] Copy VRL changelogs from the VRL version in the last Vector release as a new changelog entry
+- Run `cargo vdev build release-cue` to generate a new cue file for the release
+  - Copy VRL changelogs from the VRL version in the last Vector release as a new changelog entry
         ([example](https://github.com/vectordotdev/vector/blob/9c67bba358195f5018febca2f228dfcb2be794b5/website/cue/reference/releases/0.41.0.cue#L33-L64))
-- [ ] Update version number in `website/cue/reference/administration/interfaces/kubectl.cue`
-- [ ] Update version number in `distribution/install.sh`
-- [ ] Add new version to `website/cue/reference/versions.cue`
-- [ ] Create new release md file by copying an existing one in `./website/content/en/releases/` and
+- Update version number in `website/cue/reference/administration/interfaces/kubectl.cue`
+- Update version number in `distribution/install.sh`
+- Add new version to `website/cue/reference/versions.cue`
+- Create new release md file by copying an existing one in `./website/content/en/releases/` and
       updating version number
-- [ ] Commit these changes
-- [ ] Open PR against the release branch (`"${RELEASE_BRANCH}"`) for review
+- Commit these changes
+- Open PR against the release branch (`"${RELEASE_BRANCH}"`) for review
 
 ## 3. Manual Steps
 
@@ -94,7 +94,7 @@ Automated steps include:
 - [ ] Release updated Helm chart. See [releasing Helm chart](https://github.com/vectordotdev/helm-charts/blob/develop/RELEASING.md).
 - [ ] Release Homebrew. Refer to the internal releasing doc.
 - [ ] Create internal Docker images. Refer to the internal releasing doc.
-- [ ] Update the latest [release tag](https://github.com/vectordotdev/vector/release) description with the release announcement.
+- [ ] Update the latest [release tag](https://github.com/vectordotdev/vector/releases) description with the release announcement.
 - [ ] Create a new PR with title starting as `chore(releasing):`
   - [ ] Cherry-pick any release commits from the release branch that are not on `master`, to `master`.
   - [ ] Run `cargo vdev build manifests` and commit changes.

.github/actions/install-vdev/action.yml

@@ -20,7 +20,8 @@ runs:
       uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
       with:
         path: ~/.cargo/bin/vdev
-        key: ${{ runner.os }}-vdev-${{ hashFiles('vdev/**', 'Cargo.toml', 'Cargo.lock') }}
+        # WARNING: this key need to be in sync with the key in .github/actions/setup/action.yml
+        key: ${{ runner.os }}-vdev-${{ hashFiles('vdev/**', 'lib/vector-vrl/**', 'Cargo.toml', 'Cargo.lock') }}
         restore-keys: |
           ${{ runner.os }}-vdev-
 
@@ -36,7 +37,8 @@ runs:
       uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
       with:
         path: ~/.cargo/bin/vdev
-        key: ${{ runner.os }}-vdev-${{ hashFiles('vdev/**', 'Cargo.toml', 'Cargo.lock') }}
+        # WARNING: this key need to be in sync with the key in .github/actions/setup/action.yml
+        key: ${{ runner.os }}-vdev-${{ hashFiles('vdev/**', 'lib/vector-vrl/**', 'Cargo.toml', 'Cargo.lock') }}
 
     - name: Set VDEV environment variable
       shell: bash

.github/actions/setup/action.yml

@@ -90,7 +90,8 @@ runs:
       uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
       with:
         path: ~/.cargo/bin/vdev
-        key: ${{ runner.os }}-vdev-${{ hashFiles('vdev/**', 'Cargo.toml', 'Cargo.lock') }}
+        # WARNING: this key need to be in sync with the key in .github/actions/install-vdev/action.yml
+        key: ${{ runner.os }}-vdev-${{ hashFiles('vdev/**', 'lib/vector-vrl/**', 'Cargo.toml', 'Cargo.lock') }}
         restore-keys: |
           ${{ runner.os }}-vdev-
         lookup-only: true
@@ -211,7 +212,7 @@ runs:
         EOF
 
     - name: Install protoc
-      if: ${{ inputs.protoc == 'true' }}
+      if: ${{ inputs.protoc == 'true' || env.VDEV_NEEDS_COMPILE == 'true' }}
       shell: bash
       run: |
         echo "Installing protoc"

.github/actions/spelling/allow.txt

@@ -137,6 +137,7 @@ dsmith
 DVB
 ede
 emoji
+emojis
 emqx
 enableable
 Enot
@@ -145,7 +146,9 @@ EPC
 esbuild
 esensar
 etld
+eventcreate
 eventloop
+Evt
 Evercoss
 exactlyonce
 Explay
@@ -497,6 +500,7 @@ Telstra
 Tencent
 Texet
 Thl
+timediff
 timeframe
 timeseries
 timespan
@@ -558,3 +562,5 @@ ZTE
 Zync
 sighup
 CLAUDE
+linting
+lexers

.github/workflows/build-test-runner.yml

@@ -18,11 +18,14 @@ on:
         type: string
 
 permissions:
-  packages: write
+  contents: read
 
 jobs:
   build:
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read   # Required by actions/checkout
+      packages: write  # Required to push test runner image to GitHub Container Registry
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:

.github/workflows/build_preview_sites.yml

@@ -7,14 +7,17 @@ on:
       - completed
 
 permissions:
-  actions: read
-  issues: write
-  pull-requests: write
-  statuses: write
+  contents: read  # Restrictive default
 
 jobs:
   deploy_vector_preview_site:
     if: ${{ github.event.workflow_run.conclusion == 'success' && contains(github.event.workflow_run.head_branch, 'website') }}
+    permissions:
+      contents: read          # Required by the reusable workflow
+      actions: read           # Required to download artifacts
+      issues: write           # Required to post preview link comments
+      pull-requests: write    # Required to post preview link comments
+      statuses: write         # Required to update commit status
     uses: ./.github/workflows/create_preview_sites.yml
     with:
       APP_ID: "d1a7j77663uxsc"
@@ -26,6 +29,12 @@ jobs:
 
   deploy_rust_doc_preview_site:
     if: ${{ github.event.workflow_run.conclusion == 'success' && contains(github.event.workflow_run.head_branch, 'website') }}
+    permissions:
+      contents: read          # Required by the reusable workflow
+      actions: read           # Required to download artifacts
+      issues: write           # Required to post preview link comments
+      pull-requests: write    # Required to post preview link comments
+      statuses: write         # Required to update commit status
     uses: ./.github/workflows/create_preview_sites.yml
     with:
       APP_ID: "d1hoyoksbulg25"
@@ -37,6 +46,12 @@ jobs:
 
   deploy_vrl_playground_preview_site:
     if: ${{ github.event.workflow_run.conclusion == 'success' && contains(github.event.workflow_run.head_branch, 'website') }}
+    permissions:
+      contents: read          # Required by the reusable workflow
+      actions: read           # Required to download artifacts
+      issues: write           # Required to post preview link comments
+      pull-requests: write    # Required to post preview link comments
+      statuses: write         # Required to update commit status
     uses: ./.github/workflows/create_preview_sites.yml
     with:
       APP_ID: "d2lr4eds605rpz"

.github/workflows/changelog.yaml

@@ -9,7 +9,7 @@
 name: Changelog
 
 on:
-  pull_request_target:
+  pull_request:
     types: [opened, synchronize, reopened, labeled, unlabeled]
 
   # Required by GitHub merge queue due to branch protection rules. Should always be successful
@@ -44,31 +44,14 @@ jobs:
           echo "merge_group event – passing without running changelog validation."
           exit 0
 
-      # Checkout changelog script and changelog.d/ from master
+      # Checkout PR branch (includes script and changelog.d/)
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         if: env.SHOULD_RUN == 'true'
         with:
-          ref: master
-          sparse-checkout: |
-            scripts/check_changelog_fragments.sh
-            changelog.d/
-          sparse-checkout-cone-mode: false
-
-      # Checkout PR's changelog.d/ into tmp/
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        if: env.SHOULD_RUN == 'true'
-        with:
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
-          ref: ${{ github.event.pull_request.head.sha }}
-          path: tmp
-          sparse-checkout: changelog.d/
+          fetch-depth: 0
 
       - name: Run changelog fragment checker
         if: env.SHOULD_RUN == 'true'
         run: |
-          # Overwrite changelog.d/*.md
-          rm -rf changelog.d/*.md && mv tmp/changelog.d/*.md changelog.d/
-
-          # Add files and then compare with HEAD instead of origin/master
-          git add changelog.d/
-          MERGE_BASE=HEAD ./scripts/check_changelog_fragments.sh
+          # Compare against origin/master
+          ./scripts/check_changelog_fragments.sh

.github/workflows/changes.yml

@@ -149,6 +149,11 @@ on:
         value: ${{ jobs.int_tests.outputs.any }}
       e2e-tests-any:
         value: ${{ jobs.e2e_tests.outputs.any }}
+
+# Workflow-level permissions - read access to repository contents
+permissions:
+  contents: read  # Required to checkout code
+
 env:
   BASE_SHA: ${{ inputs.base_ref || (github.event_name == 'merge_group' && github.event.merge_group.base_sha) || github.event.pull_request.base.sha }}
   HEAD_SHA: ${{ inputs.head_ref || (github.event_name == 'merge_group' && github.event.merge_group.head_sha) || github.event.pull_request.head.sha }}
@@ -222,7 +227,11 @@ jobs:
           component_docs:
             - 'scripts/generate-component-docs.rb'
             - "vdev/**"
-            - 'website/cue/**/base/**.cue'
+            - 'website/cue/**/*.cue'
+            - 'docs/generated/**'
+            # If changes to the VRL sha is made the combined generated cue file will change which
+            # may cause issues
+            - 'Cargo.lock'
             - ".github/workflows/changes.yml"
           markdown:
             - '**/**.md'
@@ -282,8 +291,10 @@ jobs:
   # Detects changes that are specific to integration tests
   int_tests:
     runs-on: ubuntu-24.04
-    timeout-minutes: 5
+    timeout-minutes: 15
     if: ${{ inputs.int_tests }}
+    permissions:
+      contents: read
     outputs:
       amqp: ${{ steps.filter.outputs.amqp }}
       appsignal: ${{ steps.filter.outputs.appsignal}}
@@ -398,16 +409,18 @@ jobs:
           echo "any=$any_changed" >> $GITHUB_OUTPUT
 
       - name: Upload JSON artifact
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: int_tests_changes
           path: int_tests_changes.json
 
   # Detects changes that are specific to e2e tests
   e2e_tests:
     runs-on: ubuntu-24.04
-    timeout-minutes: 5
+    timeout-minutes: 15
     if: ${{ inputs.e2e_tests }}
+    permissions:
+      contents: read
     outputs:
       datadog-logs: ${{ steps.filter.outputs.datadog-logs }}
       datadog-metrics: ${{ steps.filter.outputs.datadog-metrics }}
@@ -458,7 +471,7 @@ jobs:
           echo "any=$any_changed" >> $GITHUB_OUTPUT
 
       - name: Upload JSON artifact
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: e2e_tests_changes
           path: e2e_tests_changes.json