Fix compressed streaming responses at the kernel

.github/workflows/gateway-integration-test-postgres.yml

@@ -5,6 +5,7 @@ on:
   pull_request:
     branches:
       - main
+      - gateway/1.2.0-agent-manager
     paths:
       - 'gateway/**'
       - '.github/workflows/gateway-integration-test-postgres.yml'

.github/workflows/gateway-integration-test-sqlserver.yml

@@ -5,6 +5,7 @@ on:
   pull_request:
     branches:
       - main
+      - gateway/1.2.0-agent-manager
     paths:
       - 'gateway/**'
       - 'common/**'

.github/workflows/gateway-integration-test.yml

@@ -5,6 +5,7 @@ on:
   pull_request:
     branches:
       - main
+      - gateway/1.2.0-agent-manager
     paths:
       - 'gateway/**'
       - 'common/**'

.github/workflows/k8s-gateway-api-conformance.yml

@@ -17,6 +17,7 @@ on:
   pull_request:
     branches:
       - main
+      - gateway/1.2.0-agent-manager
     paths:
       - 'kubernetes/**'
       - 'gateway/gateway-controller/**'

.github/workflows/operator-integration-test.yml

@@ -5,6 +5,7 @@ on:
   pull_request:
     branches:
       - main
+      - gateway/1.2.0-agent-manager
     paths:
       - 'gateway/**'
       - 'kubernetes/**'

.github/workflows/platform-api-gateway-e2e.yml

@@ -11,6 +11,7 @@ on:
   pull_request:
     branches:
       - main
+      - gateway/1.2.0-agent-manager
 
 permissions:
   contents: read

gateway/VERSION

@@ -1 +1 @@
-1.2.0-SNAPSHOT
+1.2.1

gateway/build-manifest.yaml

@@ -13,7 +13,7 @@ policies:
       version: v0.10.0
       gomodule: github.com/wso2/gateway-controllers/policies/aws-authentication@v0
     - name: aws-bedrock-guardrail
-      version: v1.1.0
+      version: v1.2.0
       gomodule: github.com/wso2/gateway-controllers/policies/aws-bedrock-guardrail@v1
     - name: azure-content-safety-content-moderation
       version: v1.0.2
@@ -94,7 +94,7 @@ policies:
       version: v1.0.1
       gomodule: github.com/wso2/gateway-controllers/policies/opaque-token-auth@v1
     - name: openai-to-anthropic-transformer
-      version: v0.9.0
+      version: v0.9.1
       gomodule: github.com/wso2/gateway-controllers/policies/openai-to-anthropic-transformer@v0
     - name: openai-to-azure-openai-transformer
       version: v0.9.0
@@ -103,13 +103,13 @@ policies:
       version: v0.9.1
       gomodule: github.com/wso2/gateway-controllers/policies/openai-to-bedrock-transformer@v0
     - name: openai-to-gemini-transformer
-      version: v0.9.0
+      version: v0.9.1
       gomodule: github.com/wso2/gateway-controllers/policies/openai-to-gemini-transformer@v0
     - name: openai-to-mistral-transformer
       version: v0.9.0
       gomodule: github.com/wso2/gateway-controllers/policies/openai-to-mistral-transformer@v0
     - name: pii-masking-regex
-      version: v1.0.3
+      version: v1.0.4
       gomodule: github.com/wso2/gateway-controllers/policies/pii-masking-regex@v1
     - name: prompt-compressor
       version: v0.9.0

gateway/build.yaml

@@ -1,6 +1,6 @@
 version: v1
 gateway:
-  version: 1.2.0-SNAPSHOT
+  version: 1.2.1
 policies:
   - name: advanced-ratelimit
     gomodule: github.com/wso2/gateway-controllers/policies/advanced-ratelimit@v1

gateway/distribution/docker-compose.yaml

@@ -18,7 +18,7 @@
 
 services:
   gateway-controller:
-    image: ghcr.io/wso2/api-platform/gateway-controller:1.2.0-SNAPSHOT
+    image: ghcr.io/wso2/api-platform/gateway-controller:1.2.1
     mem_limit: 60m
     mem_reservation: 60m
     cpus: 0.025
@@ -43,7 +43,7 @@ services:
       - gateway-network
 
   gateway-runtime:
-    image: ghcr.io/wso2/api-platform/gateway-runtime:1.2.0-SNAPSHOT
+    image: ghcr.io/wso2/api-platform/gateway-runtime:1.2.1
     mem_limit: 180m
     mem_reservation: 180m
     cpus: 0.175

gateway/docker-compose.yaml

@@ -23,7 +23,7 @@
 
 services:
   gateway-controller:
-    image: ghcr.io/wso2/api-platform/gateway-controller:1.2.0-SNAPSHOT
+    image: ghcr.io/wso2/api-platform/gateway-controller:1.2.1
     mem_limit: 60m
     mem_reservation: 60m
     cpus: 0.025
@@ -48,7 +48,7 @@ services:
       - gateway-network
 
   gateway-runtime:
-    image: ghcr.io/wso2/api-platform/gateway-runtime:1.2.0-SNAPSHOT
+    image: ghcr.io/wso2/api-platform/gateway-runtime:1.2.1
     mem_limit: 180m
     mem_reservation: 180m
     cpus: 0.175

gateway/gateway-builder/Makefile

@@ -28,6 +28,10 @@ BUILD_DATE := $(shell date -u +"%Y-%m-%dT%H:%M:%SZ")
 # Docker configuration
 DOCKER_REGISTRY ?= ghcr.io/wso2/api-platform
 IMAGE_NAME := $(DOCKER_REGISTRY)/gateway-builder
+
+# Extra ':latest' tag applied on multi-arch pushes. Set PUSH_LATEST=false to skip it,
+# so a side-branch release pipeline can publish a version tag without moving :latest.
+LATEST_TAG_ARG := $(if $(filter false,$(PUSH_LATEST)),,-t $(IMAGE_NAME):latest)
 IMAGE_TAG := $(VERSION)
 FULL_IMAGE := $(IMAGE_NAME):$(IMAGE_TAG)
 
@@ -101,7 +105,7 @@ build-and-push-multiarch: ## Build and push multi-architecture Docker image (lin
 		--build-arg VERSION=$(VERSION) \
 		--build-arg GIT_COMMIT=$(GIT_COMMIT) \
 		-t $(IMAGE_NAME):$(VERSION) \
-		-t $(IMAGE_NAME):latest \
+		$(LATEST_TAG_ARG) \
 		--push \
 		.
 

gateway/gateway-controller/Makefile

@@ -29,6 +29,10 @@ LDFLAGS := -X $(VERSION_PKG).Version=$(VERSION) -X $(VERSION_PKG).FunctionalityT
 DOCKER_REGISTRY ?= ghcr.io/wso2/api-platform
 IMAGE_NAME := $(DOCKER_REGISTRY)/gateway-controller
 
+# Extra ':latest' tag applied on multi-arch pushes. Set PUSH_LATEST=false to skip it,
+# so a side-branch release pipeline can publish a version tag without moving :latest.
+LATEST_TAG_ARG := $(if $(filter false,$(PUSH_LATEST)),,-t $(IMAGE_NAME):latest)
+
 # Policy definitions are produced by the gateway-runtime build (policy-compiler stage)
 # and extracted via `make -C ../gateway-runtime extract-policies`.
 POLICIES_BUILD_CONTEXT ?= ../target/build/gateway-controller/policies
@@ -115,7 +119,7 @@ build-and-push-multiarch: ## Build and push multi-architecture Docker image (lin
 		--build-arg GIT_COMMIT=$(GIT_COMMIT) \
 		--target production \
 		-t $(IMAGE_NAME):$(VERSION) \
-		-t $(IMAGE_NAME):latest \
+		$(LATEST_TAG_ARG) \
 		--push \
 		.
 	@rm -rf target

gateway/gateway-runtime/Makefile

@@ -26,6 +26,10 @@ GIT_COMMIT := $(shell git rev-parse --short HEAD 2>/dev/null || echo "unknown")
 DOCKER_REGISTRY ?= ghcr.io/wso2/api-platform
 IMAGE_NAME := $(DOCKER_REGISTRY)/gateway-runtime
 
+# Extra ':latest' tag applied on multi-arch pushes. Set PUSH_LATEST=false to skip it,
+# so a side-branch release pipeline can publish a version tag without moving :latest.
+LATEST_TAG_ARG := $(if $(filter false,$(PUSH_LATEST)),,-t $(IMAGE_NAME):latest)
+
 # Controller policy YAMLs extracted from the policy-compiler stage.
 # EXPORT_DIR feeds the controller image build; DEV_LAUNCH_DIR feeds the local "Gateway Controller" VS Code launch.
 POLICIES_EXPORT_DIR ?= ../target/build/gateway-controller/policies
@@ -193,7 +197,7 @@ build-and-push-multiarch: ## Build and push Gateway Runtime Docker image for mul
 		--build-arg PYTHON_SDK_SOURCE=$(PYTHON_SDK_SOURCE) \
 		--target production \
 		-t $(IMAGE_NAME):$(VERSION) \
-		-t $(IMAGE_NAME):latest \
+		$(LATEST_TAG_ARG) \
 		--push \
 		.
 	@$(MAKE) extract-policies

gateway/gateway-runtime/policy-engine/go.mod

@@ -8,6 +8,7 @@ require (
 	github.com/go-viper/mapstructure/v2 v2.5.0
 	github.com/google/cel-go v0.26.1
 	github.com/google/uuid v1.6.0
+	github.com/klauspost/compress v1.19.2
 	github.com/knadh/koanf/parsers/toml/v2 v2.2.0
 	github.com/knadh/koanf/providers/confmap v1.0.0
 	github.com/knadh/koanf/providers/file v1.2.1
@@ -40,7 +41,6 @@ require (
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
-	github.com/klauspost/compress v1.18.6 // indirect
 	github.com/knadh/koanf/maps v0.1.2 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect

gateway/gateway-runtime/policy-engine/go.sum

@@ -39,8 +39,8 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs=
-github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao=
-github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.19.2 h1:hMRETovs/pu/dVWN7zIT1PGG8t509MwT6bO7XSi26R8=
+github.com/klauspost/compress v1.19.2/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/knadh/koanf/maps v0.1.2 h1:RBfmAW5CnZT+PJ1CVc1QSJKf4Xu9kxfQgYVQSu8hpbo=
 github.com/knadh/koanf/maps v0.1.2/go.mod h1:npD/QZY3V6ghQDdcQzl1W4ICNVTkohC8E73eI2xW4yI=
 github.com/knadh/koanf/parsers/toml/v2 v2.2.0 h1:2nV7tHYJ5OZy2BynQ4mOJ6k5bDqbbCzRERLUKBytz3A=

gateway/gateway-runtime/policy-engine/internal/constants/constants.go

@@ -117,6 +117,7 @@ const (
 	TerminalReasonNoPolicyChain        = "no_policy_chain"        // route resolved but no chain registered
 	TerminalReasonUnknownMessageType   = "unknown_message_type"   // unrecognised ext_proc message
 	TerminalReasonProcessingFailed     = "processing_failed"      // a phase returned a fatal (stream-ending) error with no ImmediateResponse to classify
+	TerminalReasonUnsupportedEncoding  = "unsupported_encoding"   // Content-Encoding the kernel cannot round-trip, on a body the policy chain requires
 
 	// TerminalReasonResolutionFailed marks a request whose logical operation could not
 	// be resolved to a policy chain. It exists because the status alone cannot identify