envoy-prechecks.yml

name: Envoy/Prechecks

permissions:
  contents: read

on:
  workflow_run:
    workflows:
    - Request
    types:
    - completed

concurrency:
  group: ${{ github.head_ref || github.run_id }}-${{ github.workflow }}
  cancel-in-progress: true

env:
  CI_DEBUG: ${{ vars.CI_DEBUG }}


jobs:
  load:
    secrets:
      app-key: ${{ secrets.ENVOY_CI_APP_KEY }}
      app-id: ${{ secrets.ENVOY_CI_APP_ID }}
      lock-app-key: ${{ secrets.ENVOY_CI_MUTEX_APP_KEY }}
      lock-app-id: ${{ secrets.ENVOY_CI_MUTEX_APP_ID }}
    permissions:
      actions: read
      contents: read
      packages: read
      pull-requests: read
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    uses: ./.github/workflows/_load.yml
    with:
      check-name: prechecks

  format:
    permissions:
      actions: read
      contents: read
      packages: read
      pull-requests: read
    name: Precheck (${{ fromJSON(needs.load.outputs.request).summary.title }})
    uses: ./.github/workflows/_precheck_format.yml
    if: ${{ fromJSON(needs.load.outputs.request).run.precheck-format }}
    needs:
    - load
    with:
      request: ${{ needs.load.outputs.request }}
      trusted: ${{ fromJSON(needs.load.outputs.trusted) }}

  deps:
    permissions:
      actions: read
      contents: read
      packages: read
      pull-requests: read
    name: Precheck (${{ fromJSON(needs.load.outputs.request).summary.title }})
    uses: ./.github/workflows/_precheck_deps.yml
    if: ${{ fromJSON(needs.load.outputs.request).run.precheck-deps }}
    needs:
    - load
    with:
      dependency-review: ${{ github.event_name == 'pull_request_target' && github.repository == 'envoyproxy/envoy' }}
      request: ${{ needs.load.outputs.request }}
      trusted: ${{ fromJSON(needs.load.outputs.trusted) }}

  publish:
    secrets:
      gcp-key: ${{ fromJSON(needs.load.outputs.trusted) && secrets.GCP_SERVICE_ACCOUNT_KEY_TRUSTED || secrets.GCP_SERVICE_ACCOUNT_KEY }}
    permissions:
      actions: read
      contents: read
      packages: read
      pull-requests: read
    name: Precheck (${{ fromJSON(needs.load.outputs.request).summary.title }})
    uses: ./.github/workflows/_precheck_publish.yml
    if: ${{ fromJSON(needs.load.outputs.request).run.precheck-publish }}
    needs:
    - load
    with:
      request: ${{ needs.load.outputs.request }}
      trusted: ${{ fromJSON(needs.load.outputs.trusted) }}

  request:
    secrets:
      app-id: ${{ secrets.ENVOY_CI_APP_ID }}
      app-key: ${{ secrets.ENVOY_CI_APP_KEY }}
    permissions:
      actions: read
      contents: read
      pull-requests: read
    if: >-
      ${{ always()
          && github.event.workflow_run.conclusion == 'success'
          && (fromJSON(needs.load.outputs.request).run.precheck-format
              || fromJSON(needs.load.outputs.request).run.precheck-deps
              || fromJSON(needs.load.outputs.request).run.precheck-publish) }}
    needs:
    - load
    - format
    - deps
    - publish
    uses: ./.github/workflows/_finish.yml
    with:
      needs: ${{ toJSON(needs) }}