request.yml

# This file must live on every branch and pass necessary secrets and permissions
#   to initiate the request
name: Request

permissions:
  contents: read

on:
  pull_request_target:
  push:
    branches:
    - main
    - release/v*
  schedule:
  - cron: '30 6 * * *'

concurrency:
  group: |
    ${{ github.head_ref
        || github.run_id
    }}-${{ github.workflow }}-request
  cancel-in-progress: true


jobs:
  request:
    permissions:
      actions: read
      contents: read
      packages: read
      # required to fetch merge commit
      pull-requests: read
    secrets:
      # these are required to start checks
      app-key: ${{ secrets.ENVOY_CI_APP_KEY }}
      app-id: ${{ secrets.ENVOY_CI_APP_ID }}
      lock-app-key: ${{ secrets.ENVOY_CI_MUTEX_APP_KEY }}
      lock-app-id: ${{ secrets.ENVOY_CI_MUTEX_APP_ID }}
    # For branches this can be pinned to a specific version if required
    # NB: `uses` cannot be dynamic so it _must_ be hardcoded anywhere it is read
    uses: envoyproxy/envoy/.github/workflows/_request.yml@main
    if: >-
      ${{ github.repository == 'envoyproxy/envoy'
          || (vars.ENVOY_CI && github.event_name != 'schedule')
          || (vars.ENVOY_SCHEDULED_CI && github.event_name == 'schedule') }}