_run.yml

name: Envoy CI

permissions:
  contents: read

on:
  workflow_call:
    secrets:
      app-id:
      app-key:
      dockerhub-username:
      dockerhub-password:
      gcp-key:
      gcs-cache-key:
      gpg-key:
      gpg-key-password:
      rbe-key:
      ssh-key:
      ssh-key-extra:
    inputs:
      args:
        type: string
      arch:
        type: string
      bazel-extra:
        type: string
      bazel-rbe-jobs:
        type: number
        default: 200
      cache-build-image:
        type: string
      cache-build-image-key-suffix:
        type: string
      catch-errors:
        type: boolean
        default: false
      checkout-extra:
        type: string
      concurrency-suffix:
        type: string
        default:
      container-command:
        type: string
        default: ./ci/run_envoy_docker.sh
      container-output:
        type: string
        default:
      command:
        type: string
        default: ./ci/do_ci.sh
      diskspace-hack:
        type: boolean
        default: false
      diskspace-hack-paths:
        type: string
        default:
      docker-ipv6:
        default: true
        type: boolean
      downloads:
        type: string
      entrypoint:
        type: string
        default:
      error-match:
        type: string
        default: |
          ERROR
          error:
          Error:
      fail-match:
        type: string
      gcs-cache-bucket:
        type: string
      import-gpg:
        type: boolean
        default: false
      notice-match:
        type: string
        default: |
          NOTICE
          Streaming build results
      output-path:
        type: string
        default:
      rbe:
        type: boolean
        default: true
      rbe-google:
        type: boolean
        default: false
      repo-fetch-depth:
        type: number
        default: 1
      report-pre:
        type: string
        default: |
          - run: |
              # Pre build report
              df -h > "${TMP_REPORT}/df-pre"
              if [[ ! -e "${ENVOY_DOCKER_BUILD_DIR}/repository_cache/content_addressable/sha256/" ]]; then
                  exit 0
              fi
              find "${ENVOY_DOCKER_BUILD_DIR}/repository_cache/content_addressable/sha256/" -maxdepth 1 -type d \
                  | rev \
                  | cut -d/ -f1 \
                  | rev \
                  > "${TMP_REPORT}/shas-pre"
              if [[ ! -e "${ENVOY_DOCKER_BUILD_DIR}/repository_cache/content_addressable/sha384/" ]]; then
                  exit 0
              fi
              find "${ENVOY_DOCKER_BUILD_DIR}/repository_cache/content_addressable/sha384/" -maxdepth 1 -type d \
                  | rev \
                  | cut -d/ -f1 \
                  | rev \
                  >> "${TMP_REPORT}/shas-pre"
            shell: bash
      report-post:
        type: string
        default: |
          - run: |
              # Post build report
              df -h > "${TMP_REPORT}/df-post"
              (du -ch "%{{ inputs.temp-dir || runner.temp }}" | grep -E "[0-9]{2,}M|[0-9]G" || :) > "${TMP_REPORT}/du-post"
              if [[ ! -e "${ENVOY_DOCKER_BUILD_DIR}/repository_cache/content_addressable/sha256/" ]]; then
                  exit 0
              fi
              find "${ENVOY_DOCKER_BUILD_DIR}/repository_cache/content_addressable/sha256/" -maxdepth 1 -type d \
                  | rev \
                  | cut -d/ -f1 \
                  | rev \
                  > "${TMP_REPORT}/shas-post"
              if [[ ! -e "${ENVOY_DOCKER_BUILD_DIR}/repository_cache/content_addressable/sha384/" ]]; then
                  exit 0
              fi
              find "${ENVOY_DOCKER_BUILD_DIR}/repository_cache/content_addressable/sha384/" -maxdepth 1 -type d \
                  | rev \
                  | cut -d/ -f1 \
                  | rev \
                  >> "${TMP_REPORT}/shas-post"
            shell: bash
      request:
        type: string
        required: true
      runs-on:
        type: string
        default:
      skip:
        type: boolean
        default: false
      source:
        type: string
      summary-post:
        type: string
        default: |
          - uses: envoyproxy/toolshed/gh-actions/envoy/run/summary@actions-v0.3.13
            with:
              context: %{{ inputs.context }}
      steps-pre:
        type: string
      steps-pre-name:
        type: string
      steps-post:
        type: string
      steps-post-name:
        type: string
      target:
        type: string
        required: true
      target-name:
        type: string
      target-suffix:
        type: string
      temp-dir:
        type: string
      timeout-minutes:
        type: number
        default: 60
      trusted:
        type: boolean
        required: true
      upload-name:
        type: string
      upload-path:
        type: string
      warning-match:
        type: string
        default: |
          WARNING
          warning:
          Warning:
      working-directory:
        type: string
        default: .

concurrency:
  group: >-
    ${{ github.actor != 'trigger-release-envoy[bot]'
        && github.head_ref
        || github.run_id
    }}-${{ github.workflow }}-${{ inputs.target }}${{ inputs.concurrency-suffix }}
  cancel-in-progress: true

env:
  CI_DEBUG: ${{ vars.CI_DEBUG }}


jobs:
  ci:
    permissions:
      contents: read
      packages: read
    if: ${{ ! inputs.skip }}
    runs-on: ${{ inputs.runs-on || fromJSON(inputs.request).config.ci.agent-ubuntu }}
    name: ${{ inputs.target-suffix && format('[{0}] ', inputs.target-suffix) || '' }}${{ inputs.command }} ${{ inputs.target }}
    timeout-minutes: ${{ inputs.timeout-minutes }}
    steps:
    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.3.14
      id: started
      name: Create timestamp
      with:
        options: -r
        filter: |
          now
    # This controls which input vars are exposed to the run action (and related steps)
    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.3.14
      name: Context
      id: context
      with:
        print-result: ${{ fromJSON(env.CI_DEBUG || 'false') && true || false }}
        input: ${{ inputs.request }}
        filter: |
          .
          | (.check // {name: "${{ github.workflow }}"}) as $check
          | .config as $config
          | if "${{ inputs.runs-on }}" != "" then
              "${{ inputs.runs-on }}"
            else .config.ci["agent-ubuntu"] end
          | . as $runsOn
          | {"target": "${{ inputs.target }}",
             "catch-errors": ${{ inputs.catch-errors }},
             "runs-on": $runsOn,
             "job-started": ${{ steps.started.outputs.value }}}
          | . * {$config, $check}


    - run: |
        sudo mkdir -p /etc/docker
        echo '{
          "ipv6": true,
          "fixed-cidr-v6": "2001:db8:1::/64"
          }' | sudo tee /etc/docker/daemon.json
        sudo service docker restart
      name: Configure Docker ipv6
      if: ${{ inputs.docker-ipv6 }}

    # Caches
    - uses: envoyproxy/toolshed/gh-actions/gcp/setup@actions-v0.3.14
      name: Setup GCP (cache)
      if: ${{ inputs.gcs-cache-bucket }}
      with:
        key: ${{ secrets.gcs-cache-key }}
        force-install: ${{ contains(fromJSON('["envoy-arm64-medium", "github-arm64-2c-8gb"]'), inputs.runs-on) }}
    - uses: envoyproxy/toolshed/gh-actions/cache/restore@actions-v0.3.14
      if: ${{ inputs.gcs-cache-bucket }}
      name: >-
        Restore Bazel cache
        (${{ fromJSON(inputs.request).config.ci.cache.bazel }})
      with:
        gcs-bucket: ${{ inputs.gcs-cache-bucket }}
        key: ${{ fromJSON(inputs.request).config.ci.cache.bazel }}-${{ inputs.arch || 'x64' }}
        path: ${{ runner.temp }}/bazel_root

    # HACK/WORKAROUND for cache scope issue (https://github.com/envoyproxy/envoy/issues/37603)
    - if: ${{ inputs.cache-build-image }}
      id: cache-lookup
      uses: actions/cache/restore@6849a6489940f00c2f30c0fb92c6274307ccb58a  # v4.1.2
      with:
        lookup-only: true
        path: /tmp/cache
        key: ${{ inputs.cache-build-image }}${{ inputs.cache-build-image-key-suffix }}
    - if: ${{ inputs.cache-build-image && steps.cache-lookup.outputs.cache-hit == 'true' }}
      name: Restore Docker cache ${{ inputs.cache-build-image && format('({0})', inputs.cache-build-image) || '' }}
      uses: envoyproxy/toolshed/gh-actions/docker/cache/restore@actions-v0.3.14
      with:
        image-tag: ${{ inputs.cache-build-image }}
        key-suffix: ${{ inputs.cache-build-image-key-suffix }}

    - uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.3.14
      id: appauth
      name: Appauth
      if: ${{ inputs.trusted }}
      with:
        app_id: ${{ secrets.app-id }}
        key: ${{ secrets.app-key }}
        # You cant use a secret as a condition so this always runs even if the app id/key are empty
        # - the workaround is to allow the token to be passed through.
        token: ${{ github.token }}
        token-ok: true
    - uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.3.14
      id: checkout
      name: Checkout Envoy repository
      with:
        branch: ${{ fromJSON(inputs.request).request.target-branch }}
        config: |
          fetch-depth: ${{ inputs.repo-fetch-depth }}
          # WARNING: This allows untrusted code to run!!!
          #  If this is set to run untrusted code, then anything before or after in the job should be regarded as
          #  compromisable.
          ref: ${{ inputs.trusted && fromJSON(inputs.request).request.sha || fromJSON(inputs.request).request.ref }}
        fetch-merge-commit: false
        pr: ${{ fromJSON(inputs.request).request.pr }}
        ssh-key: ${{ inputs.trusted && inputs.ssh-key || '' }}
        token: ${{ inputs.trusted && steps.appauth.outputs.token || github.token }}

    # This is currently only use by mobile-docs and can be removed once they are updated to the newer website
    - uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.3.14
      id: checkout-extra
      name: Checkout extra repository (for publishing)
      if: ${{ inputs.checkout-extra }}
      with:
        config: ${{ inputs.checkout-extra }}
        ssh-key: ${{ inputs.trusted && inputs.ssh-key-extra || '' }}

    - name: Import GPG key
      uses: envoyproxy/toolshed/gh-actions/gpg/import@actions-v0.3.14
      if: ${{ inputs.import-gpg }}
      with:
        key: ${{ secrets.gpg-key }}
        passphrase: ${{ secrets.gpg-key-password }}
        passphrase-path: "${{ runner.temp }}/gpg-passphrase"
        configured-passphrase-path: /build/gpg-passphrase

    - run: |
        echo "e3b4a6e9570da15ac1caffdded17a8bebdc7dfc9" > .BAZEL_FAKE_SCM_REVISION
      name: Configure PR Bazel settings
      if: >-
        ${{ fromJSON(inputs.request).request.pr != '' }}
    - uses: envoyproxy/toolshed/gh-actions/gcp/setup@actions-v0.3.14
      name: Setup GCP (artefacts/rbe)
      id: gcp
      with:
        key: ${{ secrets.gcp-key }}
        key-copy: ${{ inputs.rbe-google && runner.temp || '' }}
    - run: |
        GCP_SERVICE_ACCOUNT_KEY_FILE="$(basename "${{ steps.gcp.outputs.key-copy-path }}")"
        echo "GCP_SERVICE_ACCOUNT_KEY_PATH=/build/${GCP_SERVICE_ACCOUNT_KEY_FILE}" >> "$GITHUB_ENV"
        BAZEL_BUILD_EXTRA_OPTIONS="--google_credentials=/build/${GCP_SERVICE_ACCOUNT_KEY_FILE} --config=rbe-google"
        echo "BAZEL_BUILD_EXTRA_OPTIONS=${BAZEL_BUILD_EXTRA_OPTIONS}" >> "$GITHUB_ENV"
      if: ${{ steps.gcp.outputs.key-copy-path }}
      name: Setup Google RBE
    - run: |
        echo "${{ vars.ENVOY_CI_BAZELRC }}" > repo.bazelrc
      if: ${{ vars.ENVOY_CI_BAZELRC }}
      name: Configure repo Bazel settings

    - uses: envoyproxy/toolshed/gh-actions/github/run@actions-v0.3.14
      name: Run CI ${{ inputs.command }} ${{ inputs.target }}
      with:
        args: ${{ inputs.args != '--' && inputs.args || inputs.target }}
        catch-errors: ${{ inputs.catch-errors }}
        command: ${{ inputs.command }}
        container-command: ${{ env.CONTAINER_COMMAND || inputs.container-command }}
        container-output: ${{ inputs.container-output }}
        context: ${{ steps.context.outputs.value }}
        diskspace-hack: ${{ inputs.diskspace-hack }}
        diskspace-hack-paths: ${{ inputs.diskspace-hack-paths }}
        downloads: ${{ inputs.downloads }}
        entrypoint: ${{ inputs.entrypoint }}
        error-match: ${{ inputs.error-match }}
        fail-match: ${{ inputs.fail-match }}
        notice-match: ${{ inputs.notice-match }}
        output-path: ${{ inputs.output-path }}
        report-name: >-
          ci-report-${{
            inputs.target-suffix
            && format('{0}-', inputs.target-suffix)
            || '' }}${{ inputs.target-name || inputs.target }}.json
        report-pre: ${{ inputs.report-pre }}
        report-post: ${{ inputs.report-post }}
        source: ${{ inputs.source }}
        steps-pre: ${{ inputs.steps-pre }}
        steps-pre-name: ${{ inputs.steps-pre-name }}
        steps-post: ${{ inputs.steps-post }}
        steps-post-name: ${{ inputs.steps-post-name }}
        summary-post: ${{ inputs.summary-post }}
        upload-name: ${{ inputs.upload-name }}
        upload-path: ${{ inputs.upload-path }}
        warning-match: ${{ inputs.warning-match }}
        working-directory: ${{ inputs.working-directory }}
      env:
        GITHUB_TOKEN: ${{ inputs.trusted && steps.appauth.outputs.token || github.token }}
        DOCKERHUB_USERNAME: ${{ secrets.dockerhub-username }}
        DOCKERHUB_PASSWORD: ${{ secrets.dockerhub-password }}
        ENVOY_DOCKER_BUILD_DIR: ${{ runner.temp }}
        ENVOY_RBE: ${{ inputs.rbe == true && 1 || '' }}
        RBE_KEY: ${{ secrets.rbe-key }}
        BAZEL_BUILD_EXTRA_OPTIONS: >-
          ${{ env.BAZEL_BUILD_EXTRA_OPTIONS }}
          --config=remote-ci
          ${{ inputs.bazel-extra }}
          ${{ inputs.rbe == true && format('--jobs={0}', inputs.bazel-rbe-jobs) || '' }}
          ${{ github.event_name == 'schedule' && '--nocache_test_results' || '' }}
        CI_BRANCH: >-
          ${{ inputs.trusted
              && format('refs/heads/{0}', fromJSON(inputs.request).request.target-branch)
              || '' }}
        CI_SHA1: ${{ github.sha }}
        CI_TARGET_BRANCH: ${{ fromJSON(inputs.request).request.target-branch }}
        MOUNT_GPG_HOME: ${{ inputs.import-gpg && 1 || '' }}
        ENVOY_DOCKER_OPTIONS: --network=host --security-opt seccomp=unconfined -v /dev/shm:/tmp/sandbox_base