From 1a761d4d9d52de321efa12687273596823dab4fb Mon Sep 17 00:00:00 2001
From: Jeffery Utter <jeffery.utter@thescore.com>
Date: Wed, 16 Oct 2024 11:30:49 -0500
Subject: [PATCH 01/13] Relax validation on integers to support up to int64

---
 apollo-router/src/json_ext.rs         |  3 +-
 apollo-router/src/spec/query.rs       |  8 +---
 apollo-router/src/spec/query/tests.rs |  4 +-
 flake.lock                            | 61 +++++++++++++++++++++++++++
 flake.nix                             | 42 ++++++++++++++++++
 5 files changed, 107 insertions(+), 11 deletions(-)
 create mode 100644 flake.lock
 create mode 100644 flake.nix

diff --git a/apollo-router/src/json_ext.rs b/apollo-router/src/json_ext.rs
index c9e617635f..33237e460d 100644
--- a/apollo-router/src/json_ext.rs
+++ b/apollo-router/src/json_ext.rs
@@ -460,8 +460,7 @@ impl ValueExt for Value {
         // The Int scalar type represents a signed 32‐bit numeric non‐fractional value.
         // When expected as an input type, only integer input values are accepted.
         // All other input values, including strings with numeric content, must raise a query error indicating an incorrect type.
-        self.as_i64().and_then(|x| i32::try_from(x).ok()).is_some()
-            || self.as_u64().and_then(|x| i32::try_from(x).ok()).is_some()
+        self.as_i64().is_some() || self.as_u64().and_then(|x| i64::try_from(x).ok()).is_some()
     }
 
     #[track_caller]
diff --git a/apollo-router/src/spec/query.rs b/apollo-router/src/spec/query.rs
index 21f2914035..68539bc0e8 100644
--- a/apollo-router/src/spec/query.rs
+++ b/apollo-router/src/spec/query.rs
@@ -465,13 +465,7 @@ impl Query {
                 _ => Ok(()),
             },
             executable::Type::Named(name) if name == "Int" => {
-                let opt = if input.is_i64() {
-                    input.as_i64().and_then(|i| i32::try_from(i).ok())
-                } else if input.is_u64() {
-                    input.as_i64().and_then(|i| i32::try_from(i).ok())
-                } else {
-                    None
-                };
+                let opt = input.as_i64();
 
                 // if the value is invalid, we do not insert it in the output object
                 // which is equivalent to inserting null
diff --git a/apollo-router/src/spec/query/tests.rs b/apollo-router/src/spec/query/tests.rs
index bb13004402..98d1fd48ca 100644
--- a/apollo-router/src/spec/query/tests.rs
+++ b/apollo-router/src/spec/query/tests.rs
@@ -1464,12 +1464,12 @@ fn variable_validation() {
     assert_validation_error!(schema, "query($foo:Int){int(a:$foo)}", json!({"foo":true}));
     assert_validation_error!(schema, "query($foo:Int){int(a:$foo)}", json!({"foo":{}}));
     //  If the integer input value represents a value less than -231 or greater than or equal to 231, a query error should be raised.
-    assert_validation_error!(
+    assert_validation!(
         schema,
         "query($foo:Int){int(a:$foo)}",
         json!({ "foo": i32::MAX as i64 + 1 })
     );
-    assert_validation_error!(
+    assert_validation!(
         schema,
         "query($foo:Int){int(a:$foo)}",
         json!({ "foo": i32::MIN as i64 - 1 })
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 0000000000..b4702655ee
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,61 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1710146030,
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1722415718,
+        "narHash": "sha256-5US0/pgxbMksF92k1+eOa8arJTJiPvsdZj9Dl+vJkM4=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "c3392ad349a5227f4a3464dce87bcc5046692fce",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 0000000000..468c169ee2
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,42 @@
+{
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+  };
+
+  outputs =
+    {
+      # self,
+      nixpkgs,
+      flake-utils,
+      ...
+    }:
+    flake-utils.lib.eachDefaultSystem (
+      system:
+      let
+        pkgs = import nixpkgs { inherit system; };
+      in
+      with pkgs;
+      {
+        devShells.default = mkShell {
+          packages =
+            [
+              cmake
+              cargo-nextest
+              pkg-config
+              protobuf
+              libiconv
+            ]
+            ++ pkgs.lib.optionals pkgs.stdenv.isDarwin (
+              with pkgs.darwin.apple_sdk.frameworks;
+              [
+                Security
+                SystemConfiguration
+              ]
+            );
+        };
+
+        formatter = nixpkgs-fmt;
+      }
+    );
+}

From 9d78aa867c0f563bb6b52954df6cb39aa8ed5ba0 Mon Sep 17 00:00:00 2001
From: Jeffery Utter <jeffery.utter@thescore.com>
Date: Wed, 16 Oct 2024 11:47:26 -0500
Subject: [PATCH 02/13] Remove CI configs for windows and arm linux

---
 .circleci/config.yml | 136 +++++--------------------------------------
 1 file changed, 13 insertions(+), 123 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index d2be4bcd00..ed5a924795 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -29,18 +29,6 @@ executors:
     resource_class: xlarge
     environment:
       CARGO_BUILD_JOBS: 4
-  arm_linux_build: &arm_linux_build_executor
-    machine:
-      image: ubuntu-2004:2024.01.1
-    resource_class: arm.large
-    environment:
-      CARGO_BUILD_JOBS: 8
-  arm_linux_test: &arm_linux_test_executor
-    machine:
-      image: ubuntu-2004:2024.01.1
-    resource_class: arm.xlarge
-    environment:
-      CARGO_BUILD_JOBS: 8
   macos_build: &macos_build_executor
     macos:
       # See https://circleci.com/docs/xcode-policy along with the support matrix
@@ -53,22 +41,12 @@ executors:
       # See https://circleci.com/docs/xcode-policy along with the support matrix
       # at https://circleci.com/docs/using-macos#supported-xcode-versions.
       # We use the major.minor notation to bring in compatible patches.
-      # 
+      #
       # TODO: remove workaround added in https://github.com/apollographql/router/pull/5462
-      # once we update to Xcode >= 15.1.0 
+      # once we update to Xcode >= 15.1.0
       # See: https://github.com/apollographql/router/pull/5462
       xcode: "14.2.0"
     resource_class: macos.m1.large.gen1
-  windows_build: &windows_build_executor
-    machine:
-      image: "windows-server-2019-vs2019:2024.02.21"
-    resource_class: windows.xlarge
-    shell: bash.exe --login -eo pipefail
-  windows_test: &windows_test_executor
-    machine:
-      image: "windows-server-2019-vs2019:2024.02.21"
-    resource_class: windows.xlarge
-    shell: bash.exe --login -eo pipefail
 
 # We don't use {{ arch }} because on windows it is unstable https://discuss.circleci.com/t/value-of-arch-unstable-on-windows/40079
 parameters:
@@ -153,16 +131,6 @@ commands:
                 name: Write arch
                 command: |
                   echo 'amd_linux' >> ~/.arch
-      - when:
-          condition:
-            or:
-              - equal: [ *arm_linux_build_executor, << parameters.platform >> ]
-              - equal: [ *arm_linux_test_executor, << parameters.platform >> ]
-          steps:
-            - run:
-                name: Write arch
-                command: |
-                  echo 'arm_linux' >> ~/.arch
       - when:
           condition:
             or:
@@ -178,22 +146,6 @@ commands:
                 name: Write arch
                 command: |
                   echo 'osx' >> ~/.arch
-      - when:
-          condition:
-            or:
-              - equal: [ *windows_build_executor, << parameters.platform >> ]
-              - equal: [ *windows_test_executor, << parameters.platform >> ]
-          steps:
-            - run:
-                name: Create bash aliases
-                command: |
-                  echo 'alias find=/bin/find' >> "$BASH_ENV"
-                  echo 'alias sort=/bin/sort' >> "$BASH_ENV"
-                  echo 'export EXECUTABLE_SUFFIX=".exe"' >> "$BASH_ENV"
-            - run:
-                name: Write arch
-                command: |
-                  echo 'windows' >> ~/.arch
 
   # Create files that are useful for cache keys
   create_cache_keys:
@@ -224,8 +176,6 @@ commands:
             or:
               - equal: [ *amd_linux_build_executor, << parameters.platform >> ]
               - equal: [ *amd_linux_test_executor, << parameters.platform >> ]
-              - equal: [ *arm_linux_build_executor, << parameters.platform >> ]
-              - equal: [ *arm_linux_test_executor, << parameters.platform >> ]
           steps:
             - run:
                 name: Update and install dependencies
@@ -235,18 +185,6 @@ commands:
                     sudo apt-get --download-only -o Dir::Cache="$HOME/.deb" -o Dir::Cache::archives="$HOME/.deb" install libssl-dev libdw-dev cmake
                   fi
                   sudo dpkg -i $HOME/.deb/*.deb
-      - when:
-          condition:
-            or:
-              - equal: [ *windows_build_executor, << parameters.platform >> ]
-              - equal: [ *windows_test_executor, << parameters.platform >> ]
-          steps:
-            - run:
-                name: Install CMake
-                command: |
-                  choco install cmake.install -y
-                  echo 'export PATH="/c/Program Files/CMake/bin:$PATH"' >> "$BASH_ENV"
-                  exit $LASTEXITCODE
       - when:
           condition:
             or:
@@ -275,19 +213,6 @@ commands:
                     curl -L https://github.com/protocolbuffers/protobuf/releases/download/v<< pipeline.parameters.protoc_version >>/protoc-<< pipeline.parameters.protoc_version >>-linux-x86_64.zip --output protoc.zip
                     unzip protoc.zip -d $HOME/.local
                   fi
-      - when:
-          condition:
-            or:
-              - equal: [ *arm_linux_build_executor, << parameters.platform >> ]
-              - equal: [ *arm_linux_test_executor, << parameters.platform >> ]
-          steps:
-            - run:
-                name: Install protoc
-                command: |
-                  if [[ ! -f "$HOME/.local/bin/protoc" ]]; then
-                    curl -L https://github.com/protocolbuffers/protobuf/releases/download/v<< pipeline.parameters.protoc_version >>/protoc-<< pipeline.parameters.protoc_version >>-linux-aarch_64.zip --output protoc.zip
-                    unzip protoc.zip -d $HOME/.local
-                  fi
       - when:
           condition:
             or:
@@ -301,19 +226,6 @@ commands:
                     curl -L https://github.com/protocolbuffers/protobuf/releases/download/v<< pipeline.parameters.protoc_version >>/protoc-<< pipeline.parameters.protoc_version >>-osx-universal_binary.zip --output protoc.zip
                     unzip protoc.zip -d $HOME/.local
                   fi
-      - when:
-          condition:
-            or:
-              - equal: [ *windows_build_executor, << parameters.platform >> ]
-              - equal: [ *windows_test_executor, << parameters.platform >> ]
-          steps:
-            - run:
-                name: Install protoc
-                command: |
-                  if [[ ! -f "$HOME/.local/bin/protoc$EXECUTABLE_SUFFIX" ]]; then
-                    curl -L https://github.com/protocolbuffers/protobuf/releases/download/v<< pipeline.parameters.protoc_version >>/protoc-<< pipeline.parameters.protoc_version >>-win64.zip --output protoc.zip
-                    unzip protoc.zip -d $HOME/.local
-                  fi
 
   install_rust:
     parameters:
@@ -331,16 +243,6 @@ commands:
             fi
             echo 'export PATH="$HOME/.cargo/bin:$PATH"' >> "$BASH_ENV"
 
-      - when:
-          condition:
-            or:
-              - equal: [ *windows_build_executor, << parameters.platform >> ]
-              - equal: [ *windows_test_executor, << parameters.platform >> ]
-          steps:
-            - run:
-                name: Special case for Windows because of ssh-agent
-                command: |
-                  printf "[net]\ngit-fetch-with-cli = true" >> ~/.cargo/Cargo.toml
       - when:
           condition:
             or:
@@ -351,15 +253,6 @@ commands:
                 command: |
                   rustup target add x86_64-apple-darwin
 
-      - when:
-          condition:
-            equal: [ *arm_linux_test_executor, << parameters.platform >> ]
-          steps:
-            - run:
-                name: Install nightly-2024-09-22 Rust to build the fuzzers
-                command: |
-                  rustup install nightly-2024-09-22
-
   install_extra_tools:
     steps:
       - run:
@@ -502,7 +395,7 @@ commands:
             # Use the settings from the "ci" profile in nextest configuration.
             NEXTEST_PROFILE: ci
             # Temporary disable lib backtrace since it crashing on MacOS
-            # TODO: remove this workaround once we update to Xcode >= 15.1.0 
+            # TODO: remove this workaround once we update to Xcode >= 15.1.0
             # See: https://github.com/apollographql/router/pull/5462
             RUST_LIB_BACKTRACE: 0
           command: xtask test --workspace --locked --features ci
@@ -587,7 +480,6 @@ jobs:
           condition:
             and:
               - equal: [ true, << parameters.fuzz >> ]
-              - equal: [ *arm_linux_test_executor, << parameters.platform >> ]
           steps:
             - fuzz_build
 
@@ -705,8 +597,6 @@ jobs:
           condition:
             or:
               - equal: [ *amd_linux_build_executor, << parameters.platform >> ]
-              - equal: [ *arm_linux_build_executor, << parameters.platform >> ]
-              - equal: [ *windows_build_executor, << parameters.platform >> ]
           steps:
             # This will set the version to include current date and commit hash
             - when:
@@ -748,20 +638,20 @@ jobs:
                 command: |
                   # Source of the new image will be ser to the repo URL.
                   # This will have the effect of setting org.opencontainers.image.source and org.opencontainers.image.author to the originating pipeline
-                  # Therefore the docker image will have the same permissions as the originating project. 
+                  # Therefore the docker image will have the same permissions as the originating project.
                   # See: https://docs.github.com/en/packages/learn-github-packages/connecting-a-repository-to-a-package#connecting-a-repository-to-a-container-image-using-the-command-line
-                  
+
                   BASE_VERSION=$(cargo metadata --format-version=1 --no-deps | jq --raw-output '.packages[0].version')
                   ARTIFACT_URL="https://output.circle-artifacts.com/output/job/${CIRCLE_WORKFLOW_JOB_ID}/artifacts/0/artifacts/router-v${BASE_VERSION}-x86_64-unknown-linux-gnu.tar.gz"
                   VERSION="v$(echo "${BASE_VERSION}" | tr "+" "-")"
                   ROUTER_TAG=ghcr.io/apollographql/nightly/router
-                  
+
                   echo "REPO_URL: ${REPO_URL}"
                   echo "BASE_VERSION: ${BASE_VERSION}"
                   echo "ARTIFACT_URL: ${ARTIFACT_URL}"
                   echo "VERSION: ${VERSION}"
                   echo "ROUTER_TAG: ${ROUTER_TAG}"
-                  
+
                   # Create a multi-arch builder which works properly under qemu
                   docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
                   docker context create buildx-build
@@ -985,7 +875,7 @@ workflows:
           matrix:
             parameters:
               platform:
-                [ macos_test, windows_test, amd_linux_test, arm_linux_test ]
+                [ macos_test, amd_linux_test ]
 
   quick-nightly:
     when: << pipeline.parameters.quick_nightly >>
@@ -998,7 +888,7 @@ workflows:
           matrix:
             parameters:
               platform:
-                [ macos_build, windows_build, amd_linux_build, arm_linux_build ]
+                [ macos_build, amd_linux_build ]
   nightly:
     when: << pipeline.parameters.nightly >>
     jobs:
@@ -1032,7 +922,7 @@ workflows:
           matrix:
             parameters:
               platform:
-                [ macos_test, windows_test, amd_linux_test, arm_linux_test ]
+                [ macos_test, amd_linux_test ]
       - build_release:
           requires:
             - test
@@ -1044,7 +934,7 @@ workflows:
           matrix:
             parameters:
               platform:
-                [ macos_build, windows_build, amd_linux_build, arm_linux_build ]
+                [ macos_build, amd_linux_build ]
       - secops/wiz-docker:
           context:
             - platform-docker-ro
@@ -1122,7 +1012,7 @@ workflows:
           matrix:
             parameters:
               platform:
-                [ macos_test, windows_test, amd_linux_test, arm_linux_test ]
+                [ macos_test, amd_linux_test ]
           filters:
             branches:
               ignore: /.*/
@@ -1132,7 +1022,7 @@ workflows:
           matrix:
             parameters:
               platform:
-                [ macos_build, windows_build, amd_linux_build, arm_linux_build ]
+                [ macos_build, amd_linux_build ]
           filters:
             branches:
               ignore: /.*/

From 6e09c89e77ae7af63ce1b98de95692c334ad7299 Mon Sep 17 00:00:00 2001
From: Jeffery Utter <jeffery.utter@thescore.com>
Date: Wed, 16 Oct 2024 12:13:37 -0500
Subject: [PATCH 03/13] Remove CI publishing to slack

---
 .circleci/config.yml | 61 --------------------------------------------
 1 file changed, 61 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index ed5a924795..5538df1896 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -4,7 +4,6 @@ version: 2.1
 # across projects.  See https://circleci.com/orbs/ for more information.
 orbs:
   gh: circleci/github-cli@2.3.0
-  slack: circleci/slack@4.12.6
   secops: apollo/circleci-secops-orb@2.0.7
 
 executors:
@@ -686,66 +685,6 @@ jobs:
                   echo ${GITHUB_OCI_TOKEN} | helm registry login -u apollo-bot2 --password-stdin ghcr.io
                   # Push chart to repository
                   helm push ${CHART} oci://ghcr.io/apollographql/helm-charts-nightly
-      - when:
-          condition:
-            equal: [ true, << parameters.nightly >> ]
-          steps:
-            - slack/notify:
-                event: fail
-                custom: |
-                  {
-                    "blocks": [
-                      {
-                        "type": "section",
-                        "text": {
-                          "type": "mrkdwn",
-                          "text": ":x: A `nightly` release run has **failed** for `${CIRCLE_JOB}` on `${CIRCLE_PROJECT_REPONAME}`'s `${CIRCLE_BRANCH}`!"
-                        }
-                      },
-                      {
-                        "type": "actions",
-                        "elements": [
-                          {
-                            "type": "button",
-                            "action_id": "success_tagged_deploy_view",
-                            "text": {
-                              "type": "plain_text",
-                              "text": "View Job"
-                            },
-                            "url": "${CIRCLE_BUILD_URL}"
-                          }
-                        ]
-                      }
-                    ]
-                  }
-            - slack/notify:
-                event: pass
-                custom: |
-                  {
-                    "blocks": [
-                      {
-                        "type": "section",
-                        "text": {
-                          "type": "mrkdwn",
-                          "text": ":white_check_mark: A `nightly` build has completed for `${CIRCLE_JOB}` on `${CIRCLE_PROJECT_REPONAME}`'s `${CIRCLE_BRANCH}`."
-                        }
-                      },
-                      {
-                        "type": "actions",
-                        "elements": [
-                          {
-                            "type": "button",
-                            "action_id": "success_tagged_deploy_view",
-                            "text": {
-                              "type": "plain_text",
-                              "text": "View Job"
-                            },
-                            "url": "${CIRCLE_BUILD_URL}"
-                          }
-                        ]
-                      }
-                    ]
-                  }
 
   publish_github_release:
     docker:

From 7e72e73443fd54986c9266c44343267bc4094d46 Mon Sep 17 00:00:00 2001
From: Jeffery Utter <jeffery.utter@thescore.com>
Date: Wed, 16 Oct 2024 16:44:17 -0500
Subject: [PATCH 04/13] Skip integration tests that require a Graph Key

---
 apollo-router/tests/integration/operation_limits.rs | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/apollo-router/tests/integration/operation_limits.rs b/apollo-router/tests/integration/operation_limits.rs
index 79ad7d9f89..e9f4bab21e 100644
--- a/apollo-router/tests/integration/operation_limits.rs
+++ b/apollo-router/tests/integration/operation_limits.rs
@@ -12,6 +12,7 @@ use tower::ServiceExt;
 
 use crate::integration::IntegrationTest;
 
+#[ignore]
 #[tokio::test(flavor = "multi_thread")]
 async fn test_response_errors() {
     let (mut service, execution_count) = build_test_harness(json!({
@@ -156,7 +157,7 @@ async fn test_response_errors() {
                 averageReviews: reviews {
                     ...reviewsFragment
                 }
-            } 
+            }
         }
     }
 
@@ -165,7 +166,7 @@ async fn test_response_errors() {
         author {
             penname: name
         }
-    } 
+    }
     ";
     expect_errors!(
         query,
@@ -185,7 +186,7 @@ async fn test_response_errors() {
                 averageReviews: reviews {
                     ...reviewsFragment
                 }
-            } 
+            }
         }
     }
 
@@ -194,7 +195,7 @@ async fn test_response_errors() {
         author {
             penname: name
         }
-    } 
+    }
     ";
     expect_errors!(
         query,
@@ -203,6 +204,7 @@ async fn test_response_errors() {
     assert_eq!(execution_count(), 3);
 }
 
+#[ignore]
 #[tokio::test(flavor = "multi_thread")]
 async fn test_warn_only() {
     let (mut service, execution_count) = build_test_harness(json!({
@@ -300,6 +302,7 @@ fn expect_errors(response: graphql::Response, expected_error_codes: &[&str]) {
     }
 }
 
+#[ignore]
 #[tokio::test(flavor = "multi_thread")]
 async fn test_request_bytes_limit_with_coprocessor() -> Result<(), BoxError> {
     let mut router = IntegrationTest::builder()
@@ -316,6 +319,7 @@ async fn test_request_bytes_limit_with_coprocessor() -> Result<(), BoxError> {
     Ok(())
 }
 
+#[ignore]
 #[tokio::test(flavor = "multi_thread")]
 async fn test_request_bytes_limit() -> Result<(), BoxError> {
     let mut router = IntegrationTest::builder()

From 26b848e4b9b218b07def7d9ee9df3611ee3f112f Mon Sep 17 00:00:00 2001
From: Jeffery Utter <jeffery.utter@thescore.com>
Date: Wed, 16 Oct 2024 19:48:35 -0500
Subject: [PATCH 05/13] Remove 'test_updated' tests since we only care about
 the current build (and they seem flaky)

---
 .circleci/config.yml | 48 --------------------------------------------
 1 file changed, 48 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 5538df1896..a77e812de2 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -482,24 +482,6 @@ jobs:
           steps:
             - fuzz_build
 
-  test_updated:
-    environment:
-      <<: *common_job_environment
-    parameters:
-      platform:
-        type: executor
-    executor: << parameters.platform >>
-    steps:
-      - checkout
-      - setup_environment:
-          platform: << parameters.platform >>
-      - run:
-          name: Update all Rust dependencies
-          command: |
-            rm Cargo.lock
-            cargo fetch
-      - xtask_test:
-          variant: "updated"
   pre_verify_release:
     environment:
       <<: *common_job_environment
@@ -795,15 +777,6 @@ workflows:
             parameters:
               platform: [ amd_linux_build ]
 
-      - test_updated:
-          requires:
-            - lint
-            - check_helm
-            - check_compliance
-          matrix:
-            parameters:
-              platform:
-                [ amd_linux_test ]
       - test:
           # this should be changed back to true on dev after release
           fuzz: false
@@ -844,15 +817,6 @@ workflows:
             parameters:
               platform: [ amd_linux_build ]
 
-      - test_updated:
-          requires:
-            - lint
-            - check_helm
-            - check_compliance
-          matrix:
-            parameters:
-              platform:
-                [ amd_linux_test ]
       - test:
           requires:
             - lint
@@ -865,7 +829,6 @@ workflows:
       - build_release:
           requires:
             - test
-            - test_updated
           nightly: true
           context:
             - router
@@ -937,16 +900,6 @@ workflows:
               ignore: /.*/
             tags:
               only: /v.*/
-      - test_updated:
-          matrix:
-            parameters:
-              platform:
-                [ amd_linux_test ]
-          filters:
-            branches:
-              ignore: /.*/
-            tags:
-              only: /v.*/
       - test:
           matrix:
             parameters:
@@ -975,7 +928,6 @@ workflows:
             - check_compliance
             - pre_verify_release
             - test
-            - test_updated
           filters:
             branches:
               ignore: /.*/

From 92d11b45fbe25b3d76363fdba6a285fde27f9163 Mon Sep 17 00:00:00 2001
From: Jeffery Utter <jeffery.utter@thescore.com>
Date: Wed, 16 Oct 2024 22:10:38 -0500
Subject: [PATCH 06/13] Remove helm steps from CI

---
 .circleci/config.yml | 141 -------------------------------------------
 1 file changed, 141 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index a77e812de2..5a07f7cf66 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -14,10 +14,6 @@ executors:
     environment:
       CARGO_BUILD_JOBS: 4
       RUST_TEST_THREADS: 6
-  amd_linux_helm: &amd_linux_helm_executor
-    docker:
-      - image: cimg/base:stable
-    resource_class: small
   amd_linux_test: &amd_linux_test_executor
     docker:
       - image: cimg/base:stable
@@ -308,61 +304,6 @@ commands:
     steps:
       - run: xtask release pre-verify
 
-  xtask_check_helm:
-    steps:
-      - run:
-          name: Validate helm manifests
-          command: |
-            # Install Helm
-            curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
-
-            # Install kubeconform
-            KUBECONFORM_INSTALL=$(mktemp -d)
-            curl -L https://github.com/yannh/kubeconform/releases/latest/download/kubeconform-linux-amd64.tar.gz | tar xz -C "${KUBECONFORM_INSTALL}"
-
-            # Create list of kube versions
-            CURRENT_KUBE_VERSIONS=$(curl -s -L https://raw.githubusercontent.com/kubernetes/website/main/data/releases/schedule.yaml \
-              | yq -o json '.' \
-              | jq --raw-output '.schedules[] | select((now | strftime("%Y-%m-%dT00:00:00Z")) as $date | .releaseDate < $date and .endOfLifeDate > $date) | select(.previousPatches != null) | .previousPatches[].release')
-
-            TEMPLATE_DIR=$(mktemp -d)
-            MINOR_VERSION="${kube_version%.*}"
-            SUCCEEDED=false
-
-            # For each k8s minor version (e.g.: 1.28) we will try to validate against the most recent patch release (e.g. 1.28.3)
-            # We use curl --head to check if support is available. If it isn't we then try the next most recent release.
-            # As soon as we find an available release we try to use it. If we don't find an available release for a minor version, then we will ignore that silently
-            for kube_version in ${CURRENT_KUBE_VERSIONS}; do
-              if [[ "${kube_version%.*}" == "${MINOR_VERSION}" ]]; then
-                if [[ ${SUCCEEDED} == true ]]; then
-                  continue
-                fi
-              else
-                MINOR_VERSION="${kube_version%.*}"
-                SUCCEEDED=false
-              fi
-
-              # Sometimes the database has not been updated with schema details. If that happens, just skip the kubeconform checks until the database is updated"
-              if ! curl --head --silent --output /dev/null  --fail "https://github.com/yannh/kubernetes-json-schema/tree/master/v${kube_version}"; then
-                echo "Skipping validation for kubernetes version: ${kube_version} until the schema database is updated."
-                continue
-              fi
-
-              echo "Validating against schema version: ${kube_version}"
-
-              # Use helm to template our chart against kube_version
-              helm template --kube-version "${kube_version}" router helm/chart/router --set autoscaling.enabled=true > "${TEMPLATE_DIR}/router-${kube_version}.yaml"
-
-              # Execute kubeconform on our templated charts to ensure they are good
-              "${KUBECONFORM_INSTALL}/kubeconform" \
-                --kubernetes-version "${kube_version}" \
-                --strict \
-                --schema-location default \
-                --verbose \
-                "${TEMPLATE_DIR}/router-${kube_version}.yaml"
-              SUCCEEDED=true
-            done
-
   xtask_check_compliance:
     steps:
       - restore_cache:
@@ -432,21 +373,6 @@ jobs:
           platform: << parameters.platform >>
       - xtask_lint
 
-  check_helm:
-    environment:
-      <<: *common_job_environment
-    parameters:
-      platform:
-        type: executor
-    executor: << parameters.platform >>
-    steps:
-      - when:
-          condition:
-            equal: [ *amd_linux_helm_executor, << parameters.platform >> ]
-          steps:
-            - checkout
-            - xtask_check_helm
-
   check_compliance:
     environment:
       <<: *common_job_environment
@@ -555,25 +481,6 @@ jobs:
                   --keychain-password ${MACOS_KEYCHAIN_PASSWORD}
                   --notarization-password ${MACOS_NOTARIZATION_PASSWORD}
                   --output artifacts/
-      - when:
-          condition:
-            and:
-              - equal: [ *amd_linux_build_executor, << parameters.platform >> ]
-              - equal: [ true, << parameters.nightly >> ]
-          steps:
-            - run:
-                name: Helm install
-                command: |
-                  # Install Helm
-                  curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
-            - run:
-                name: helm-docs install
-                command: |
-                  # install golang (to ${HOME}/go)
-                  curl -OLs https://go.dev/dl/go1.21.3.linux-amd64.tar.gz
-                  tar -C "${HOME}" -xf go1.21.3.linux-amd64.tar.gz
-                  # install helm-docs
-                  PATH="${HOME}/go/bin" GOPATH="${HOME}/.local" GO111MODULE=on go install github.com/norwoodj/helm-docs/cmd/helm-docs@latest
       - when:
           condition:
             or:
@@ -656,17 +563,6 @@ jobs:
                 root: .
                 paths:
                   - "built-containers/*.tar"
-            - run:
-                name: Helm build
-                command: |
-                  # Package up the helm chart
-                  helm package helm/chart/router
-                  # Make sure we have the newest chart
-                  CHART=$(ls -t router*.tgz| head -1)
-                  # Note: GH Token owned by apollo-bot2, no expire
-                  echo ${GITHUB_OCI_TOKEN} | helm registry login -u apollo-bot2 --password-stdin ghcr.io
-                  # Push chart to repository
-                  helm push ${CHART} oci://ghcr.io/apollographql/helm-charts-nightly
 
   publish_github_release:
     docker:
@@ -738,23 +634,6 @@ jobs:
                   docker buildx build --platform linux/amd64,linux/arm64 --push --build-arg DEBUG_IMAGE="true" --build-arg ROUTER_RELEASE=${VERSION} -f dockerfiles/Dockerfile.router -t ${ROUTER_TAG}:${VERSION}-debug .
                   # Build and push release image
                   docker buildx build --platform linux/amd64,linux/arm64 --push --build-arg ROUTER_RELEASE=${VERSION} -f dockerfiles/Dockerfile.router -t ${ROUTER_TAG}:${VERSION} .
-            - run:
-                name: Helm build
-                command: |
-                  # Install Helm
-                  curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
-                  # Package up the helm chart
-                  helm package helm/chart/router
-                  # Make sure we have the newest chart
-                  CHART=$(ls -t router*.tgz| head -1)
-                  # Note: GH Token owned by apollo-bot2, no expire
-                  echo ${GITHUB_OCI_TOKEN} | helm registry login -u apollo-bot2 --password-stdin ghcr.io
-                  # To prevent overwrite, check to see if our chart already exists
-                  # If the show all command succeeds, the chart already exists
-                  VERSION=$(basename ${CHART} .tgz)
-                  helm show all oci://ghcr.io/apollographql/helm-charts/router --version ${VERSION} > /dev/null && exit 1
-                  # Push chart to repository
-                  helm push ${CHART} oci://ghcr.io/apollographql/helm-charts
 
 workflows:
   ci_checks:
@@ -768,10 +647,6 @@ workflows:
           matrix:
             parameters:
               platform: [ amd_linux_build ]
-      - check_helm:
-          matrix:
-            parameters:
-              platform: [ amd_linux_helm ]
       - check_compliance:
           matrix:
             parameters:
@@ -782,7 +657,6 @@ workflows:
           fuzz: false
           requires:
             - lint
-            - check_helm
             - check_compliance
           matrix:
             parameters:
@@ -808,10 +682,6 @@ workflows:
           matrix:
             parameters:
               platform: [ amd_linux_build ]
-      - check_helm:
-          matrix:
-            parameters:
-              platform: [ amd_linux_helm ]
       - check_compliance:
           matrix:
             parameters:
@@ -820,7 +690,6 @@ workflows:
       - test:
           requires:
             - lint
-            - check_helm
             - check_compliance
           matrix:
             parameters:
@@ -882,15 +751,6 @@ workflows:
               ignore: /.*/
             tags:
               only: /v.*/
-      - check_helm:
-          matrix:
-            parameters:
-              platform: [ amd_linux_helm ]
-          filters:
-            branches:
-              ignore: /.*/
-            tags:
-              only: /v.*/
       - check_compliance:
           matrix:
             parameters:
@@ -924,7 +784,6 @@ workflows:
           requires:
             - build_release
             - lint
-            - check_helm
             - check_compliance
             - pre_verify_release
             - test

From e14703a5c424fb573e9e9d9fa2e7e971dd244b1c Mon Sep 17 00:00:00 2001
From: Jeffery Utter <jeffery.utter@thescore.com>
Date: Wed, 16 Oct 2024 22:12:20 -0500
Subject: [PATCH 07/13] Remove apple notirization from CI

---
 .circleci/config.yml | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 5a07f7cf66..c500d38b99 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -463,23 +463,11 @@ jobs:
                 command: >
                   cargo xtask package
                   --target aarch64-apple-darwin
-                  --apple-team-id ${APPLE_TEAM_ID}
-                  --apple-username ${APPLE_USERNAME}
-                  --cert-bundle-base64 ${MACOS_CERT_BUNDLE_BASE64}
-                  --cert-bundle-password ${MACOS_CERT_BUNDLE_PASSWORD}
-                  --keychain-password ${MACOS_KEYCHAIN_PASSWORD}
-                  --notarization-password ${MACOS_NOTARIZATION_PASSWORD}
                   --output artifacts/
             - run:
                 command: >
                   cargo xtask package
                   --target x86_64-apple-darwin
-                  --apple-team-id ${APPLE_TEAM_ID}
-                  --apple-username ${APPLE_USERNAME}
-                  --cert-bundle-base64 ${MACOS_CERT_BUNDLE_BASE64}
-                  --cert-bundle-password ${MACOS_CERT_BUNDLE_PASSWORD}
-                  --keychain-password ${MACOS_KEYCHAIN_PASSWORD}
-                  --notarization-password ${MACOS_NOTARIZATION_PASSWORD}
                   --output artifacts/
       - when:
           condition:

From 1fcbc067b4ca96386ed69e9adb6f493fd6f31a1a Mon Sep 17 00:00:00 2001
From: Jeffery Utter <jeffery.utter@thescore.com>
Date: Wed, 16 Oct 2024 22:19:08 -0500
Subject: [PATCH 08/13] Build docker images and push to artifactory

---
 .circleci/config.yml | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index c500d38b99..4670000ae2 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -520,7 +520,7 @@ jobs:
                   BASE_VERSION=$(cargo metadata --format-version=1 --no-deps | jq --raw-output '.packages[0].version')
                   ARTIFACT_URL="https://output.circle-artifacts.com/output/job/${CIRCLE_WORKFLOW_JOB_ID}/artifacts/0/artifacts/router-v${BASE_VERSION}-x86_64-unknown-linux-gnu.tar.gz"
                   VERSION="v$(echo "${BASE_VERSION}" | tr "+" "-")"
-                  ROUTER_TAG=ghcr.io/apollographql/nightly/router
+                  ROUTER_TAG=thescore.jfrog.io/docker-prod/apollo-router-nightly
 
                   echo "REPO_URL: ${REPO_URL}"
                   echo "BASE_VERSION: ${BASE_VERSION}"
@@ -533,8 +533,8 @@ jobs:
                   docker context create buildx-build
                   docker buildx create --driver docker-container --use buildx-build
                   docker buildx inspect --bootstrap
-                  # Note: GH Token owned by apollo-bot2, no expire
-                  echo ${GITHUB_OCI_TOKEN} | docker login ghcr.io -u apollo-bot2 --password-stdin
+
+                  echo ${JFROG_ACCESS_TOKEN} | docker login thescore.jfrog.io -u ${JFROG_USERNAME} --password-stdin
                   # TODO: Can't figure out how to build multi-arch image from ARTIFACT_URL right now. Figure out later...
                   # Build and push debug image
                   docker buildx build --load --platform linux/amd64 --build-arg CIRCLE_TOKEN="${CIRCLE_TOKEN}" --build-arg REPO_URL="${REPO_URL}" --build-arg ARTIFACT_URL="${ARTIFACT_URL}" --build-arg DEBUG_IMAGE="true" --build-arg ROUTER_RELEASE=${VERSION} -f dockerfiles/Dockerfile.router -t ${ROUTER_TAG}:${VERSION}-debug .
@@ -563,14 +563,14 @@ jobs:
       - when:
           condition:
             not:
-              equal: [ "https://github.com/apollographql/router", << pipeline.project.git_url >> ]
+              equal: [ "https://github.com/scoremedia/router", << pipeline.project.git_url >> ]
           steps:
             - run:
                 command: >
                   echo "Not publishing any github release."
       - when:
           condition:
-            equal: [ "https://github.com/apollographql/router", << pipeline.project.git_url >> ]
+            equal: [ "https://github.com/scoremedia/router", << pipeline.project.git_url >> ]
           steps:
             - checkout
             - setup_remote_docker:
@@ -606,14 +606,14 @@ jobs:
             - run:
                 name: Docker build
                 command: |
-                  ROUTER_TAG=ghcr.io/apollographql/router
+                  ROUTER_TAG=thescore.jfrog.io/docker-prod/apollo-router
                   # Create a multi-arch builder which works properly under qemu
                   docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
                   docker context create buildx-build
                   docker buildx create --driver docker-container --use buildx-build
                   docker buildx inspect --bootstrap
-                  # Note: GH Token owned by apollo-bot2, no expire
-                  echo ${GITHUB_OCI_TOKEN} | docker login ghcr.io -u apollo-bot2 --password-stdin
+
+                  echo ${JFROG_ACCESS_TOKEN} | docker login thescore.jfrog.io -u ${JFROG_USERNAME} --password-stdin
                   # To prevent overwrite, check to see if our images already exists
                   # If the manifest command succeeds, the images already exist
                   docker manifest inspect ${ROUTER_TAG}:${VERSION}  > /dev/null && exit 1
@@ -780,6 +780,8 @@ workflows:
               ignore: /.*/
             tags:
               only: /v.*/
+          context:
+            - Artifactory-Credentials
 
   security-scans:
     when:

From 9f7ea1aaa0052fd6fe5b32000996833ad6803c04 Mon Sep 17 00:00:00 2001
From: Jeffery Utter <jeffery.utter@thescore.com>
Date: Wed, 16 Oct 2024 23:07:40 -0500
Subject: [PATCH 09/13] Don't release macos builds due to signing requirements

---
 .circleci/config.yml | 34 +---------------------------------
 1 file changed, 1 insertion(+), 33 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 4670000ae2..0f3b192c40 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -432,43 +432,11 @@ jobs:
     environment:
       <<: *common_job_environment
       RELEASE_BIN: router
-      APPLE_TEAM_ID: "YQK948L752"
-      APPLE_USERNAME: "opensource@apollographql.com"
       REPO_URL: << pipeline.project.git_url >>
     steps:
       - checkout
       - setup_environment:
           platform: << parameters.platform >>
-      - when:
-          condition:
-            or:
-              - equal: [ *macos_build_executor, << parameters.platform >> ]
-
-          steps:
-            - when:
-                condition:
-                  equal: [ true, << parameters.nightly >> ]
-                steps:
-                  - run: cargo xtask release prepare nightly
-            - run:
-                command: >
-                  cargo xtask dist --target aarch64-apple-darwin
-            - run:
-                command: >
-                  cargo xtask dist --target x86_64-apple-darwin
-            - run:
-                command: >
-                  mkdir -p artifacts
-            - run:
-                command: >
-                  cargo xtask package
-                  --target aarch64-apple-darwin
-                  --output artifacts/
-            - run:
-                command: >
-                  cargo xtask package
-                  --target x86_64-apple-darwin
-                  --output artifacts/
       - when:
           condition:
             or:
@@ -762,7 +730,7 @@ workflows:
           matrix:
             parameters:
               platform:
-                [ macos_build, amd_linux_build ]
+                [ amd_linux_build ]
           filters:
             branches:
               ignore: /.*/

From b4548a4b1083691f79c752041fc32fc0fec3fdfd Mon Sep 17 00:00:00 2001
From: Jeffery Utter <jeffery.utter@thescore.com>
Date: Thu, 17 Oct 2024 08:19:00 -0500
Subject: [PATCH 10/13] Don't publish releases to Github

---
 .circleci/config.yml | 23 ++++-------------------
 1 file changed, 4 insertions(+), 19 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 0f3b192c40..566e126c03 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -3,7 +3,6 @@ version: 2.1
 # These "CircleCI Orbs" are reusable bits of configuration that can be shared
 # across projects.  See https://circleci.com/orbs/ for more information.
 orbs:
-  gh: circleci/github-cli@2.3.0
   secops: apollo/circleci-secops-orb@2.0.7
 
 executors:
@@ -469,7 +468,7 @@ jobs:
               - equal: [ *amd_linux_build_executor, << parameters.platform >> ]
               - equal: [ true, << parameters.nightly >> ]
               - matches:
-                  pattern: "^https:\\/\\/github\\.com\\/apollographql\\/router.*$"
+                  pattern: "^https:\\/\\/github\\.com\\/scoremedia\\/router.*$"
                   value: << pipeline.project.git_url >>
           steps:
             - setup_remote_docker:
@@ -520,7 +519,7 @@ jobs:
                 paths:
                   - "built-containers/*.tar"
 
-  publish_github_release:
+  publish_docker_release:
     docker:
       - image: cimg/base:stable
     resource_class: small
@@ -535,7 +534,7 @@ jobs:
           steps:
             - run:
                 command: >
-                  echo "Not publishing any github release."
+                  echo "Not publishing any docker release."
       - when:
           condition:
             equal: [ "https://github.com/scoremedia/router", << pipeline.project.git_url >> ]
@@ -548,7 +547,6 @@ jobs:
                 docker_layer_caching: true
             - attach_workspace:
                 at: artifacts
-            - gh/setup
             - run:
                 command: >
                   cd artifacts && sha256sum *.tar.gz > sha256sums.txt
@@ -558,19 +556,6 @@ jobs:
             - run:
                 command: >
                   cd artifacts && sha1sum *.tar.gz > sha1sums.txt
-            - run:
-                name: Create GitHub Release
-                command: >
-                  case "$VERSION" in
-
-                    # If the VERSION contains a dash, consider it a pre-release version.
-                    # This is in-line with SemVer's expectations/designations!
-                    *-*) gh release create $VERSION --prerelease --notes-file /dev/null --title $VERSION artifacts/* ;;
-
-                    # In all other cases, publish it as the latest version.
-                    *) gh release create $VERSION --notes-file /dev/null --title $VERSION artifacts/* ;;
-
-                  esac
             - run:
                 name: Docker build
                 command: |
@@ -736,7 +721,7 @@ workflows:
               ignore: /.*/
             tags:
               only: /v.*/
-      - publish_github_release:
+      - publish_docker_release:
           requires:
             - build_release
             - lint

From 9b462166df9cc0ecbd090867dd128b009b0e6a2f Mon Sep 17 00:00:00 2001
From: Jeffery Utter <jeffery.utter@thescore.com>
Date: Thu, 17 Oct 2024 13:50:47 -0500
Subject: [PATCH 11/13] Use release from previous steps to build docker image
 rather than pulling from router.apollo.dev

---
 .circleci/config.yml | 30 ++++++++++++++++++++++++++----
 1 file changed, 26 insertions(+), 4 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 566e126c03..864d049a1d 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -504,10 +504,10 @@ jobs:
                   echo ${JFROG_ACCESS_TOKEN} | docker login thescore.jfrog.io -u ${JFROG_USERNAME} --password-stdin
                   # TODO: Can't figure out how to build multi-arch image from ARTIFACT_URL right now. Figure out later...
                   # Build and push debug image
-                  docker buildx build --load --platform linux/amd64 --build-arg CIRCLE_TOKEN="${CIRCLE_TOKEN}" --build-arg REPO_URL="${REPO_URL}" --build-arg ARTIFACT_URL="${ARTIFACT_URL}" --build-arg DEBUG_IMAGE="true" --build-arg ROUTER_RELEASE=${VERSION} -f dockerfiles/Dockerfile.router -t ${ROUTER_TAG}:${VERSION}-debug .
+                  docker buildx build --load --platform linux/amd64 --build-arg CIRCLE_TOKEN="${DOWNLOAD_ARTIFACT_TOKEN}" --build-arg REPO_URL="${REPO_URL}" --build-arg ARTIFACT_URL="${ARTIFACT_URL}" --build-arg DEBUG_IMAGE="true" --build-arg ROUTER_RELEASE=${VERSION} -f dockerfiles/Dockerfile.router -t ${ROUTER_TAG}:${VERSION}-debug .
                   docker push ${ROUTER_TAG}:${VERSION}-debug
                   # Build and push release image
-                  docker buildx build --load --platform linux/amd64 --build-arg CIRCLE_TOKEN="${CIRCLE_TOKEN}" --build-arg REPO_URL="${REPO_URL}" --build-arg ARTIFACT_URL="${ARTIFACT_URL}" --build-arg ROUTER_RELEASE=${VERSION} -f dockerfiles/Dockerfile.router -t ${ROUTER_TAG}:${VERSION} .
+                  docker buildx build --load --platform linux/amd64 --build-arg CIRCLE_TOKEN="${DOWNLOAD_ARTIFACT_TOKEN}" --build-arg REPO_URL="${REPO_URL}" --build-arg ARTIFACT_URL="${ARTIFACT_URL}" --build-arg ROUTER_RELEASE=${VERSION} -f dockerfiles/Dockerfile.router -t ${ROUTER_TAG}:${VERSION} .
                   docker push ${ROUTER_TAG}:${VERSION}
                   # save containers for analysis
                   mkdir built-containers
@@ -526,6 +526,9 @@ jobs:
     environment:
       <<: *common_job_environment
       VERSION: << pipeline.git.tag >>
+    parameters:
+      platform:
+        type: executor
     steps:
       - when:
           condition:
@@ -540,6 +543,8 @@ jobs:
             equal: [ "https://github.com/scoremedia/router", << pipeline.project.git_url >> ]
           steps:
             - checkout
+            - install_rust:
+                platform: << parameters.platform >>
             - setup_remote_docker:
                 # CircleCI Image Policy
                 #   https://circleci.com/docs/remote-docker-images-support-policy/
@@ -547,6 +552,8 @@ jobs:
                 docker_layer_caching: true
             - attach_workspace:
                 at: artifacts
+            - store_artifacts:
+                path: artifacts/
             - run:
                 command: >
                   cd artifacts && sha256sum *.tar.gz > sha256sums.txt
@@ -559,7 +566,18 @@ jobs:
             - run:
                 name: Docker build
                 command: |
+                  BASE_VERSION=$(cargo metadata --format-version=1 --no-deps | jq --raw-output '.packages[0].version')
+                  ARTIFACT_URL="https://output.circle-artifacts.com/output/job/${CIRCLE_WORKFLOW_JOB_ID}/artifacts/0/artifacts/router-v${BASE_VERSION}-x86_64-unknown-linux-gnu.tar.gz"
+                  VERSION="v$(echo "${BASE_VERSION}" | tr "+" "-")"
+
                   ROUTER_TAG=thescore.jfrog.io/docker-prod/apollo-router
+
+                  echo "REPO_URL: ${REPO_URL}"
+                  echo "BASE_VERSION: ${BASE_VERSION}"
+                  echo "ARTIFACT_URL: ${ARTIFACT_URL}"
+                  echo "VERSION: ${VERSION}"
+                  echo "ROUTER_TAG: ${ROUTER_TAG}"
+
                   # Create a multi-arch builder which works properly under qemu
                   docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
                   docker context create buildx-build
@@ -572,9 +590,9 @@ jobs:
                   docker manifest inspect ${ROUTER_TAG}:${VERSION}  > /dev/null && exit 1
                   docker manifest inspect ${ROUTER_TAG}:${VERSION}-debug  > /dev/null && exit 1
                   # Build and push debug image
-                  docker buildx build --platform linux/amd64,linux/arm64 --push --build-arg DEBUG_IMAGE="true" --build-arg ROUTER_RELEASE=${VERSION} -f dockerfiles/Dockerfile.router -t ${ROUTER_TAG}:${VERSION}-debug .
+                  docker buildx build --progress=plain --platform linux/amd64 --push --build-arg CIRCLE_TOKEN="${DOWNLOAD_ARTIFACT_TOKEN}" --build-arg REPO_URL="${REPO_URL}" --build-arg ARTIFACT_URL="${ARTIFACT_URL}" --build-arg DEBUG_IMAGE="true" --build-arg ROUTER_RELEASE=${VERSION} -f dockerfiles/Dockerfile.router -t ${ROUTER_TAG}:${VERSION}-debug .
                   # Build and push release image
-                  docker buildx build --platform linux/amd64,linux/arm64 --push --build-arg ROUTER_RELEASE=${VERSION} -f dockerfiles/Dockerfile.router -t ${ROUTER_TAG}:${VERSION} .
+                  docker buildx build --progress=plain --platform linux/amd64 --push --build-arg CIRCLE_TOKEN="${DOWNLOAD_ARTIFACT_TOKEN}" --build-arg REPO_URL="${REPO_URL}" --build-arg ARTIFACT_URL="${ARTIFACT_URL}" --build-arg ROUTER_RELEASE=${VERSION} -f dockerfiles/Dockerfile.router -t ${ROUTER_TAG}:${VERSION} .
 
 workflows:
   ci_checks:
@@ -722,6 +740,10 @@ workflows:
             tags:
               only: /v.*/
       - publish_docker_release:
+          matrix:
+            parameters:
+              platform:
+                [ amd_linux_build ]
           requires:
             - build_release
             - lint

From 791da2c12a01333ead5b61eb70e8f4d682b0c57c Mon Sep 17 00:00:00 2001
From: Jeffery Utter <jeffery.utter@thescore.com>
Date: Thu, 17 Oct 2024 16:17:27 -0500
Subject: [PATCH 12/13] Add logging on invalid integers

---
 apollo-router/src/spec/field_type.rs | 13 ++++++++++++-
 apollo-router/src/spec/query.rs      | 17 +++++++++++++++++
 2 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/apollo-router/src/spec/field_type.rs b/apollo-router/src/spec/field_type.rs
index b160aff214..a0e71e5bf4 100644
--- a/apollo-router/src/spec/field_type.rs
+++ b/apollo-router/src/spec/field_type.rs
@@ -112,7 +112,18 @@ fn validate_input_value(
     match type_name.as_str() {
         "String" => return from_bool(value.is_string()),
         // Spec: https://spec.graphql.org/June2018/#sec-Int
-        "Int" => return from_bool(value.is_valid_int_input()),
+        "Int" => {
+            let valid = value.is_valid_int_input();
+
+            if value.as_i32().is_none() {
+                tracing::warn!(
+                    "Input INT '{}' is larger than 32-bits and is not GraphQL spec-compliant.",
+                    value.to_string()
+                )
+            }
+
+            return from_bool(valid);
+        }
         // Spec: https://spec.graphql.org/draft/#sec-Float.Input-Coercion
         "Float" => return from_bool(value.is_valid_float_input()),
         // "The ID scalar type represents a unique identifier, often used to refetch an object
diff --git a/apollo-router/src/spec/query.rs b/apollo-router/src/spec/query.rs
index 68539bc0e8..f78247001a 100644
--- a/apollo-router/src/spec/query.rs
+++ b/apollo-router/src/spec/query.rs
@@ -12,6 +12,7 @@ use apollo_compiler::schema::ExtendedType;
 use apollo_compiler::ExecutableDocument;
 use derivative::Derivative;
 use indexmap::IndexSet;
+use itertools::Itertools;
 use serde::Deserialize;
 use serde::Serialize;
 use serde_json_bytes::ByteString;
@@ -467,6 +468,22 @@ impl Query {
             executable::Type::Named(name) if name == "Int" => {
                 let opt = input.as_i64();
 
+                if opt.is_some_and(|i| i32::try_from(i).is_err()) {
+                    let formatted_path: String = path
+                        .iter()
+                        .map(|part| match part {
+                            ResponsePathElement::Index(_) => "[]",
+                            ResponsePathElement::Key(s) => s,
+                        })
+                        .join(".");
+
+                    tracing::warn!(
+                        path = formatted_path,
+                        "INT '{:?}' is larger than 32-bits and is not GraphQL spec-compliant.",
+                        opt
+                    )
+                }
+
                 // if the value is invalid, we do not insert it in the output object
                 // which is equivalent to inserting null
                 if opt.is_some() {

From c7c2f256e2247b5f2c2b8391d98097f0159a187d Mon Sep 17 00:00:00 2001
From: Jeffery Utter <jeffery.utter@thescore.com>
Date: Fri, 18 Oct 2024 13:09:04 -0500
Subject: [PATCH 13/13] Release v1.56.0-thescore.1

---
 Cargo.lock               | 2 +-
 apollo-router/Cargo.toml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 8c5d20f688..1473c0cc25 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -229,7 +229,7 @@ dependencies = [
 
 [[package]]
 name = "apollo-router"
-version = "1.56.0"
+version = "1.56.0-thescore.1"
 dependencies = [
  "access-json",
  "ahash",
diff --git a/apollo-router/Cargo.toml b/apollo-router/Cargo.toml
index fc48d928eb..a79e671067 100644
--- a/apollo-router/Cargo.toml
+++ b/apollo-router/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "apollo-router"
-version = "1.56.0"
+version = "1.56.0-thescore.1"
 authors = ["Apollo Graph, Inc. <packages@apollographql.com>"]
 repository = "https://github.com/apollographql/router/"
 documentation = "https://docs.rs/apollo-router"