Merge branch 'main' into local_cert_provider

Signed-off-by: lei zhang <[email protected]>

.azure-pipelines/bazel.yml

@@ -72,10 +72,12 @@ steps:
     testResultsFiles: "**/bazel-out/**/testlogs/**/test.xml"
     testRunTitle: "${{ parameters.ciTarget }}"
     searchFolder: $(Build.StagingDirectory)/tmp
+  timeoutInMinutes: 10
   condition: always()
 
 - task: PublishBuildArtifacts@1
   inputs:
     pathtoPublish: "$(Build.StagingDirectory)/envoy"
     artifactName: ${{ parameters.ciTarget }}${{ parameters.artifactSuffix }}
+  timeoutInMinutes: 10
   condition: always()

.azure-pipelines/pipelines.yml

@@ -10,13 +10,25 @@ trigger:
 # PR build config is manually overridden in Azure pipelines UI with different secrets
 pr: none
 
+variables:
+- name: isDev
+  # This must be checked/set in a `step` from the VERSION.txt file, in order to be useful
+  value: true
+- name: isMain
+  value: $[eq(variables['Build.SourceBranch'], 'refs/heads/main')]
+- name: isRelease
+  value: $[startsWith(variables['Build.SourceBranch'], 'refs/heads/release/v')]
+- name: isStableBranch
+  # A release branch can be either `main` or a `release/v1.x` stable branch
+  value: $[or(eq(variables['isMain'], 'true'), eq(variables['isRelease'], 'true'))]
+
 stages:
 - stage: precheck
   jobs:
   - job: format
     dependsOn: []
     pool:
-      vmImage: "ubuntu-18.04"
+      vmImage: "ubuntu-20.04"
     steps:
     - task: Cache@2
       inputs:
@@ -33,18 +45,20 @@ stages:
         BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
         BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
         GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
+        AZP_BRANCH: $(Build.SourceBranch)
       displayName: "Run format checks"
     - task: PublishBuildArtifacts@1
       inputs:
         pathtoPublish: "$(Build.StagingDirectory)/fix_format.diff"
         artifactName: format
+      timeoutInMinutes: 10
       # not all have fixes so improve condition/handling
       condition: failed()
 
   - job: proto_format
     dependsOn: []
     pool:
-      vmImage: "ubuntu-18.04"
+      vmImage: "ubuntu-20.04"
     steps:
     - task: Cache@2
       inputs:
@@ -67,13 +81,14 @@ stages:
       inputs:
         pathtoPublish: "$(Build.StagingDirectory)/fix_proto_format.diff"
         artifactName: format
+      timeoutInMinutes: 10
       condition: failed()
 
   - job: docs
     dependsOn: []  # this removes the implicit dependency on previous stage and causes this to run in parallel.
     condition: ne(variables['PostSubmit'], true)
     pool:
-      vmImage: "ubuntu-18.04"
+      vmImage: "ubuntu-20.04"
     steps:
     - task: Cache@2
       inputs:
@@ -104,7 +119,7 @@ stages:
   - job: dependencies
     dependsOn: []  # this removes the implicit dependency on previous stage and causes this to run in parallel.
     pool:
-      vmImage: "ubuntu-18.04"
+      vmImage: "ubuntu-20.04"
     steps:
     - task: Cache@2
       inputs:
@@ -131,7 +146,7 @@ stages:
   - job: filter_example
     dependsOn: []
     pool:
-      vmImage: "ubuntu-18.04"
+      vmImage: "ubuntu-20.04"
     steps:
     - task: InstallSSHKey@0
       inputs:
@@ -149,7 +164,7 @@ stages:
   - job: data_plane_api
     dependsOn: []
     pool:
-      vmImage: "ubuntu-18.04"
+      vmImage: "ubuntu-20.04"
     steps:
     - task: InstallSSHKey@0
       inputs:
@@ -167,7 +182,7 @@ stages:
   - job: go_control_plane
     dependsOn: []
     pool:
-      vmImage: "ubuntu-18.04"
+      vmImage: "ubuntu-20.04"
     steps:
     - task: InstallSSHKey@0
       inputs:
@@ -196,7 +211,7 @@ stages:
   - job: release
     timeoutInMinutes: 120
     pool:
-      vmImage: "ubuntu-18.04"
+      vmImage: "ubuntu-20.04"
     steps:
     - template: bazel.yml
       parameters:
@@ -226,7 +241,7 @@ stages:
     dependsOn: []
     timeoutInMinutes: 120
     pool:
-      vmImage: "ubuntu-18.04"
+      vmImage: "ubuntu-20.04"
     steps:
     - template: bazel.yml
       parameters:
@@ -247,7 +262,7 @@ stages:
     dependsOn: ["package_x64"]
     timeoutInMinutes: 120
     pool:
-      vmImage: "ubuntu-18.04"
+      vmImage: "ubuntu-20.04"
     steps:
     - task: DownloadBuildArtifacts@0
       inputs:
@@ -315,7 +330,7 @@ stages:
           CI_TARGET: "bazel.compile_time_options"
     timeoutInMinutes: 120
     pool:
-      vmImage: "ubuntu-18.04"
+      vmImage: "ubuntu-20.04"
     steps:
     - template: bazel.yml
       parameters:
@@ -357,7 +372,7 @@ stages:
     displayName: "linux multiarch"
     timeoutInMinutes: 120
     pool:
-      vmImage: "ubuntu-18.04"
+      vmImage: "ubuntu-20.04"
     steps:
     - bash: |
         echo "disk space at beginning of build:"
@@ -419,15 +434,16 @@ stages:
       inputs:
         pathtoPublish: "$(Build.StagingDirectory)/build_images"
         artifactName: docker
+      timeoutInMinutes: 10
       condition: always()
 
-- stage: docs
+- stage: publish
   dependsOn: ["docker"]
   condition: and(succeeded(), eq(variables['PostSubmit'], true), ne(variables['NoSync'], true))
   jobs:
-  - job: publish
+  - job: docs
     pool:
-      vmImage: "ubuntu-18.04"
+      vmImage: "ubuntu-20.04"
     steps:
     - task: Cache@2
       inputs:
@@ -454,7 +470,7 @@ stages:
         ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
         GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
         GCS_ARTIFACT_BUCKET: $(GcsArtifactBucket)
-      condition: eq(variables['Build.SourceBranch'], 'refs/heads/main')
+      condition: eq(variables['isMain'], 'true')
 
     - task: InstallSSHKey@0
       inputs:
@@ -470,12 +486,32 @@ stages:
         AZP_BRANCH: $(Build.SourceBranch)
         NETLIFY_TRIGGER_URL: $(NetlifyTriggerURL)
 
+  - job: github
+    dependsOn: ["docs"]
+    condition: eq(variables['isStableBranch'], 'true')
+    pool:
+      vmImage: "ubuntu-20.04"
+    steps:
+    - bash: |
+        VERSION_DEV="$(cat VERSION.txt | cut -d- -f2)"
+        if [[ $VERSION_DEV != "dev" ]]; then
+            echo "##vso[task.setvariable variable=isDev]false"
+        fi
+      displayName: Set development/release env
+
+    - script: ./ci/run_envoy_docker.sh './ci/do_ci.sh publish'
+      displayName: "Publish release to Github"
+      workingDirectory: $(Build.SourcesDirectory)
+      condition: eq(variables['isDev'], 'false')
+      env:
+        GITHUB_TOKEN: $(GitHubPublicRepoOnlyAccessToken)
+
 - stage: verify
   dependsOn: ["docker"]
   jobs:
   - job: examples
     pool:
-      vmImage: "ubuntu-18.04"
+      vmImage: "ubuntu-20.04"
     steps:
     - task: DownloadBuildArtifacts@0
       inputs:
@@ -511,6 +547,7 @@ stages:
       inputs:
         testResultsFiles: "**/bazel-testlogs/**/test.xml"
         testRunTitle: "macOS"
+      timeoutInMinutes: 10
       condition: always()
 
     - script: bazel run //ci/flaky_test:process_xml
@@ -548,16 +585,19 @@ stages:
         BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
         BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
         GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
+
     - task: PublishTestResults@2
       inputs:
         testResultsFiles: "**/bazel-out/**/testlogs/**/test.xml"
         testRunTitle: "windows"
         searchFolder: $(Build.StagingDirectory)/tmp
+      timeoutInMinutes: 10
       condition: always()
     - task: PublishBuildArtifacts@1
       inputs:
         pathtoPublish: "$(Build.StagingDirectory)/envoy"
         artifactName: windows.release
+      timeoutInMinutes: 10
       condition: always()
 
   - job: docker
@@ -604,4 +644,5 @@ stages:
       inputs:
         pathtoPublish: "$(Build.StagingDirectory)/build_images"
         artifactName: docker_windows
+      timeoutInMinutes: 10
       condition: always()

.bazelignore

@@ -1,6 +1,6 @@
+# only directories can be ignored, and no globbing
 api
 examples/grpc-bridge/script
 tools/clang_tools
 tools/dev/src
-*~
-\#*
+.project

.bazelrc

@@ -14,6 +14,8 @@ run --color=yes
 
 build --color=yes
 build --workspace_status_command="bash bazel/get_workspace_status"
+# TODO: https://github.com/envoyproxy/envoy/issues/22758
+build --incompatible_use_platforms_repo_for_constraints=false
 build --incompatible_strict_action_env
 build --host_force_python=PY3
 build --java_runtime_version=remotejdk_11
@@ -66,6 +68,9 @@ build:clang --linkopt=-fuse-ld=lld
 build:clang-pch --spawn_strategy=local
 build:clang-pch --define=ENVOY_CLANG_PCH=1
 
+# Use gold linker for gcc compiler.
+build:gcc --linkopt=-fuse-ld=gold
+
 # Basic ASAN/UBSAN that works for gcc
 build:asan --action_env=ENVOY_ASAN=1
 build:asan --config=sanitizer
@@ -178,7 +183,7 @@ build:coverage --strategy=CoverageReport=sandboxed,local
 build:coverage --experimental_use_llvm_covmap
 build:coverage --collect_code_coverage
 build:coverage --test_tag_filters=-nocoverage
-build:coverage --instrumentation_filter="//source(?!/common/quic/platform)[/:],//include[/:],//contrib(?!/.*/test)[/:]"
+build:coverage --instrumentation_filter="//source(?!/common/quic/platform)[/:],//envoy[/:],//contrib(?!/.*/test)[/:]"
 build:test-coverage --test_arg="-l trace"
 build:fuzz-coverage --config=plain-fuzzer
 build:fuzz-coverage --run_under=@envoy//bazel/coverage:fuzz_coverage_wrapper.sh
@@ -285,7 +290,7 @@ build:remote-clang-cl --config=rbe-toolchain-clang-cl
 
 # Docker sandbox
 # NOTE: Update this from https://github.com/envoyproxy/envoy-build-tools/blob/main/toolchains/rbe_toolchains_config.bzl#L8
-build:docker-sandbox --experimental_docker_image=envoyproxy/envoy-build-ubuntu:0a02a76af5951bf7f4c7029c0ea6d29d96c0f682
+build:docker-sandbox --experimental_docker_image=envoyproxy/envoy-build-ubuntu:b0ff77ae3f25b0bf595f9b8bba46b489723ab446
 build:docker-sandbox --spawn_strategy=docker
 build:docker-sandbox --strategy=Javac=docker
 build:docker-sandbox --strategy=Closure=docker

.bazelversion

@@ -1 +1 @@
-6.0.0-pre.20220421.3
+6.0.0-pre.20220706.4

.clang-format

@@ -5,6 +5,7 @@ ColumnLimit: 100
 DerivePointerAlignment: false
 PointerAlignment: Left
 SortIncludes: false
+TypenameMacros: ['STACK_OF']
 ...
 
 ---

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM gcr.io/envoy-ci/envoy-build:0a02a76af5951bf7f4c7029c0ea6d29d96c0f682
+FROM gcr.io/envoy-ci/envoy-build:b0ff77ae3f25b0bf595f9b8bba46b489723ab446
 
 ARG USERNAME=vscode
 ARG USER_UID=501

.github/actions/pr_notifier/requirements.txt

@@ -111,9 +111,9 @@ six==1.16.0 \
     --hash=sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926 \
     --hash=sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254
     # via pynacl
-slack-sdk==3.17.2 \
-    --hash=sha256:60302e32d48db6b4ea5453d92f23ecf3f7b843f799f61eaf271315264d7cb281 \
-    --hash=sha256:70d5a55a5d52ba7128d5347ed995425e1f83e729667ab296035bcf6c1b13a049
+slack-sdk==3.18.2 \
+    --hash=sha256:69befeadfbfc9238e85d0641c864cd12bfb162fbdf3e8f9eef30180f171ea675 \
+    --hash=sha256:d895fa191f2288d74cbbf20055be2f39c54397b3288c766fcd31e3f5828ef937
     # via -r requirements.in
 urllib3==1.26.6 \
     --hash=sha256:39fb8672126159acb139a7718dd10806104dec1e2f0f6c88aab05d17df10c8d4 \

.github/workflows/check-deps.yml

@@ -15,10 +15,10 @@ jobs:
         uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
         with:
           ref: ${{ github.head_ref }}
-      - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@c4e89fac7e8767b327bbad6cb4d859eda999cf08
+      - name: Set up Python (3.10)
+        uses: actions/setup-python@b55428b1882923874294fa556849718a1d7f2ca5
         with:
-          python-version: ${{ matrix.python-version }}
+          python-version: "3.10"
 
       - name: Run dependency checker
         run: |

.github/workflows/codeql-daily.yml

@@ -28,7 +28,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@3e7e3b32d0fb8283594bb0a76cc60a00918b0969
+      uses: github/codeql-action/init@b398f525a5587552e573b247ac661067fafa920b
       # Override language selection by uncommenting this and choosing your languages
       with:
         languages: cpp
@@ -55,4 +55,4 @@ jobs:
         git clean -xdf
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@3e7e3b32d0fb8283594bb0a76cc60a00918b0969
+      uses: github/codeql-action/analyze@b398f525a5587552e573b247ac661067fafa920b

.github/workflows/codeql-push.yml

@@ -41,7 +41,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@3e7e3b32d0fb8283594bb0a76cc60a00918b0969
+      uses: github/codeql-action/init@b398f525a5587552e573b247ac661067fafa920b
       # Override language selection by uncommenting this and choosing your languages
       with:
         languages: cpp
@@ -71,4 +71,4 @@ jobs:
 
     - name: Perform CodeQL Analysis
       if: env.BUILD_TARGETS != ''
-      uses: github/codeql-action/analyze@3e7e3b32d0fb8283594bb0a76cc60a00918b0969
+      uses: github/codeql-action/analyze@b398f525a5587552e573b247ac661067fafa920b

.github/workflows/depsreview.yml

@@ -9,4 +9,4 @@ jobs:
       - name: 'Checkout Repository'
         uses: actions/checkout@dcd71f646680f2efd8db4afa5ad64fdcba30e748
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@94145f3150bfabdc97540cbd5f7e926306ea7744
+        uses: actions/dependency-review-action@23d1ffffb6fa5401173051ec21eba8c35242733f

.github/workflows/pr_notifier.yml

@@ -11,7 +11,7 @@ jobs:
     steps:
     - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
     - name: Set up Python 3.8
-      uses: actions/setup-python@c4e89fac7e8767b327bbad6cb4d859eda999cf08
+      uses: actions/setup-python@b55428b1882923874294fa556849718a1d7f2ca5
       with:
         python-version: '3.8'
         architecture: 'x64'

.github/workflows/stale.yml

@@ -14,7 +14,7 @@ jobs:
 
     steps:
     - name: Prune Stale
-      uses: actions/stale@428b0ed64d74596742200dc98805bb90f39ef9f0
+      uses: actions/stale@9c1b1c6e115ca2af09755448e0dbba24e5061cc8
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         # Different amounts of days for issues/PRs are not currently supported but there is a PR