diff --git a/.github/workflows/_run.yml b/.github/workflows/_run.yml index 993114d2a11b3..1e2287324ede4 100644 --- a/.github/workflows/_run.yml +++ b/.github/workflows/_run.yml @@ -218,7 +218,6 @@ jobs: ssh-key: ${{ inputs.trusted && inputs.ssh-key || '' }} token: ${{ inputs.trusted && steps.appauth.outputs.token || github.token }} - # This is currently only use by mobile-docs and can be removed once they are updated to the newer website - uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.31 id: checkout-extra name: Checkout extra repository (for publishing) diff --git a/.github/workflows/_stage_verify.yml b/.github/workflows/_stage_verify.yml index c6de8a7c1bf6f..5e9314acfb485 100644 --- a/.github/workflows/_stage_verify.yml +++ b/.github/workflows/_stage_verify.yml @@ -4,6 +4,7 @@ permissions: contents: read on: + pull_request: workflow_call: inputs: request: diff --git a/.github/workflows/_test_verify.yml b/.github/workflows/_test_verify.yml new file mode 100644 index 0000000000000..dce07c8bd33ca --- /dev/null +++ b/.github/workflows/_test_verify.yml @@ -0,0 +1,111 @@ +name: Verify (testing) + +permissions: + contents: read + +on: + pull_request: + workflow_call: + inputs: + request: + type: string + required: true + trusted: + type: boolean + required: true + +concurrency: + group: >- + ${{ github.actor != 'trigger-release-envoy[bot]' + && github.event.inputs.head_ref + || github.run_id + }}-${{ github.event.workflow.id }}-verify + cancel-in-progress: true + + +jobs: + verify: + permissions: + contents: read + packages: read + name: ${{ matrix.name || matrix.target }} + uses: ./.github/workflows/_run.yml + with: + cache-build-image: + checkout-extra: | + repository: envoyproxy/examples + path: examples + container-command: + rbe: ${{ matrix.rbe }} + request: ${{ inputs.request }} + runs-on: envoy-x64-small + steps-pre: ${{ matrix.steps-pre }} + source: ${{ matrix.source }} + target: ${{ matrix.target }} + trusted: ${{ inputs.trusted }} + strategy: + fail-fast: false + matrix: + include: + - name: examples + target: verify_examples + source: | + export NO_BUILD_SETUP=1 + rbe: false + steps-pre: | + - run: | + # TODO(phlax): Remove this once resolved properly + # Downgrade Docker to workaround https://github.com/containers/skopeo/issues/2365 + sudo install -m 0755 -d /etc/apt/keyrings + sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc + sudo chmod a+r /etc/apt/keyrings/docker.asc + echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] \ + https://download.docker.com/linux/ubuntu \ + $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \ + | sudo tee /etc/apt/sources.list.d/docker.list \ + > /dev/null + sudo apt-get update + sudo apt-get install -y -qq --allow-downgrades \ + docker-ce=5:24.0.9-1~ubuntu.22.04~jammy \ + docker-ce-cli=5:24.0.9-1~ubuntu.22.04~jammy + sudo systemctl restart docker + sudo docker --version + shell: bash + - id: url + uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.30 + with: + options: -Rr + input: >- + ${{ inputs.trusted + && fromJSON(inputs.request).request.sha + || fromJSON(inputs.request).request.ref }} + filter: | + .[:7] as $sha + | if ${{ inputs.trusted }} then + "envoy-postsubmit" + else + "envoy-pr" + end + | . as $bucket + | "https://storage.googleapis.com/\($bucket)/\($sha)" + - uses: envoyproxy/toolshed/gh-actions/docker/fetch@actions-v0.2.30 + with: + url: %{{ steps.url.outputs.value }}/docker/envoy.tar + variant: dev + - uses: envoyproxy/toolshed/gh-actions/docker/fetch@actions-v0.2.30 + with: + url: %{{ steps.url.outputs.value }}/docker/envoy-contrib.tar + variant: contrib-dev + - uses: envoyproxy/toolshed/gh-actions/docker/fetch@actions-v0.2.30 + with: + url: %{{ steps.url.outputs.value }}/docker/envoy-google-vrp.tar + variant: google-vrp-dev + - run: docker images | grep envoy + shell: bash + - run: | + # Install expected host packages + export DEBIAN_FRONTEND=noninteractive + sudo apt-get -qq update -y + sudo apt-get -qq install -y --no-install-recommends expect gettext whois + pip install -r ./.github/workflows/verify-requirements.txt + shell: bash