From 2feda4ae4754ae8020d7a8b60d0314979dec13cd Mon Sep 17 00:00:00 2001
From: Lizan Zhou <lizan@tetrate.io>
Date: Sat, 10 Oct 2020 09:31:55 -0700
Subject: [PATCH 1/8] ci: use same flaky test process script on macOS (#13485)

Signed-off-by: Lizan Zhou <lizan@tetrate.io>
---
 .azure-pipelines/pipelines.yml       | 2 +-
 ci/flaky_test/run_process_xml.sh     | 2 ++
 ci/flaky_test/run_process_xml_mac.sh | 4 ----
 ci/mac_ci_setup.sh                   | 2 +-
 4 files changed, 4 insertions(+), 6 deletions(-)
 delete mode 100755 ci/flaky_test/run_process_xml_mac.sh

diff --git a/.azure-pipelines/pipelines.yml b/.azure-pipelines/pipelines.yml
index 06d77ecce551..9769450e98f2 100644
--- a/.azure-pipelines/pipelines.yml
+++ b/.azure-pipelines/pipelines.yml
@@ -201,7 +201,7 @@ jobs:
           testRunTitle: "macOS"
         condition: always()
 
-      - script: ./ci/flaky_test/run_process_xml_mac.sh
+      - script: ./ci/flaky_test/run_process_xml.sh
         displayName: "Process Test Results"
         env:
           TEST_TMPDIR: $(Build.SourcesDirectory)
diff --git a/ci/flaky_test/run_process_xml.sh b/ci/flaky_test/run_process_xml.sh
index 85cab7c4711d..38496128bb91 100755
--- a/ci/flaky_test/run_process_xml.sh
+++ b/ci/flaky_test/run_process_xml.sh
@@ -1,5 +1,7 @@
 #!/bin/bash
 
+export ENVOY_SRCDIR=${ENVOY_SRCDIR:-.}
+
 # shellcheck source=tools/shell_utils.sh
 . "${ENVOY_SRCDIR}"/tools/shell_utils.sh
 
diff --git a/ci/flaky_test/run_process_xml_mac.sh b/ci/flaky_test/run_process_xml_mac.sh
deleted file mode 100755
index 9dad6b7ea7fd..000000000000
--- a/ci/flaky_test/run_process_xml_mac.sh
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/bash
-
-pip3 install slackclient
-./ci/flaky_test/process_xml.py
diff --git a/ci/mac_ci_setup.sh b/ci/mac_ci_setup.sh
index 9ac12acf5e80..395c3297fe62 100755
--- a/ci/mac_ci_setup.sh
+++ b/ci/mac_ci_setup.sh
@@ -65,4 +65,4 @@ fi
 
 bazel version
 
-pip3 install slackclient
+pip3 install virtualenv

From f2916c43a4a4e34c84499d0e67b24310cbf949b3 Mon Sep 17 00:00:00 2001
From: Lizan Zhou <lizan@tetrate.io>
Date: Sun, 11 Oct 2020 10:03:55 -0700
Subject: [PATCH 2/8] ci: bring BAZEL_BUILD_OPTIONS back for format and docs
 (#13480)

Signed-off-by: Lizan Zhou <lizan@tetrate.io>
---
 ci/do_ci.sh | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/ci/do_ci.sh b/ci/do_ci.sh
index f470f60c19e9..a421f5ff67b9 100755
--- a/ci/do_ci.sh
+++ b/ci/do_ci.sh
@@ -368,21 +368,23 @@ elif [[ "$CI_TARGET" == "bazel.fuzz" ]]; then
 elif [[ "$CI_TARGET" == "fix_format" ]]; then
   # proto_format.sh needs to build protobuf.
   setup_clang_toolchain
+
   echo "fix_format..."
   ./tools/code_format/check_format.py fix
   ./tools/code_format/format_python_tools.sh fix
-  ./tools/proto_format/proto_format.sh fix --test
+  BAZEL_BUILD_OPTIONS="${BAZEL_BUILD_OPTIONS[*]}" ./tools/proto_format/proto_format.sh fix --test
   exit 0
 elif [[ "$CI_TARGET" == "check_format" ]]; then
   # proto_format.sh needs to build protobuf.
   setup_clang_toolchain
+
   echo "check_format_test..."
   ./tools/code_format/check_format_test_helper.sh --log=WARN
   echo "check_format..."
   ./tools/code_format/check_shellcheck_format.sh
   ./tools/code_format/check_format.py check
   ./tools/code_format/format_python_tools.sh check
-  ./tools/proto_format/proto_format.sh check --test
+  BAZEL_BUILD_OPTIONS="${BAZEL_BUILD_OPTIONS[*]}" ./tools/proto_format/proto_format.sh check --test
   exit 0
 elif [[ "$CI_TARGET" == "check_repositories" ]]; then
   echo "check_repositories..."
@@ -410,7 +412,7 @@ elif [[ "$CI_TARGET" == "docs" ]]; then
   tools/dependency/validate_test.py
   tools/dependency/validate.py
   # Build docs.
-  docs/build.sh
+  BAZEL_BUILD_OPTIONS="${BAZEL_BUILD_OPTIONS[*]}" docs/build.sh
   exit 0
 elif [[ "$CI_TARGET" == "verify_examples" ]]; then
   echo "verify examples..."

From c1072d2bb4029f006c549ebd5290d0f696430f13 Mon Sep 17 00:00:00 2001
From: Lizan Zhou <lizan@tetrate.io>
Date: Mon, 12 Oct 2020 07:42:40 -0700
Subject: [PATCH 3/8] ci: use azp to generate docs (#13481)

Signed-off-by: Lizan Zhou <lizan@tetrate.io>
---
 .azure-pipelines/pipelines.yml | 43 ++++++++++++++++++++++++++++++++++
 .circleci/config.yml           | 17 --------------
 ci/run_envoy_docker.sh         |  1 +
 docs/build.sh                  | 17 +++++++++-----
 docs/publish.sh                | 33 +++++++++++++-------------
 5 files changed, 72 insertions(+), 39 deletions(-)

diff --git a/.azure-pipelines/pipelines.yml b/.azure-pipelines/pipelines.yml
index 9769450e98f2..0f28ad9ea779 100644
--- a/.azure-pipelines/pipelines.yml
+++ b/.azure-pipelines/pipelines.yml
@@ -37,6 +37,49 @@ jobs:
           artifactName: format
         condition: failed()
 
+  - job: docs
+    dependsOn: [] # this removes the implicit dependency on previous stage and causes this to run in parallel.
+    pool:
+      vmImage: "ubuntu-18.04"
+    steps:
+      - task: Cache@2
+        inputs:
+          key: "docs | ./WORKSPACE | **/*.bzl"
+          path: $(Build.StagingDirectory)/repository_cache
+        continueOnError: true
+
+      - script: ci/run_envoy_docker.sh 'ci/do_ci.sh docs'
+        workingDirectory: $(Build.SourcesDirectory)
+        env:
+          ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
+          BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
+          BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
+          GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
+        displayName: "Generate docs"
+
+      - script: ci/run_envoy_docker.sh 'ci/upload_gcs_artifact.sh /source/generated/docs docs'
+        displayName: "Upload Docs to GCS"
+        env:
+          ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
+          GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
+          GCS_ARTIFACT_BUCKET: $(GcsArtifactBucket)
+
+      - task: InstallSSHKey@0
+        inputs:
+          hostName: "github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
+          sshPublicKey: "$(DocsPublicKey)"
+          sshPassphrase: "$(SshDeployKeyPassphrase)"
+          sshKeySecureFile: "$(DocsPrivateKey)"
+        condition: and(succeeded(), ne(variables['Build.Reason'], 'PullRequest'), eq(variables['PostSubmit'], true))
+
+      - script: docs/publish.sh
+        displayName: "Publish to GitHub"
+        workingDirectory: $(Build.SourcesDirectory)
+        env:
+          AZP_BRANCH: $(Build.SourceBranch)
+          AZP_SHA1: $(Build.SourceVersion)
+        condition: and(succeeded(), ne(variables['Build.Reason'], 'PullRequest'), eq(variables['PostSubmit'], true))
+
   - job: release
     displayName: "Linux-x64 release"
     dependsOn: ["format"]
diff --git a/.circleci/config.yml b/.circleci/config.yml
index 467b3e872acc..105c71dba328 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -45,19 +45,6 @@ jobs:
              - "f6:f9:df:90:9c:4b:5f:9c:f4:69:fd:42:94:ff:88:24"
        - run: ci/filter_example_mirror.sh
 
-   docs:
-     executor: ubuntu-build
-     steps:
-       - run: rm -rf /home/circleci/project/.git # CircleCI git caching is likely broken
-       - checkout
-       - run: ci/do_circle_ci.sh docs
-       - add_ssh_keys:
-           fingerprints:
-             - "44:c7:a1:9e:f4:9e:a5:33:11:f1:0e:79:e1:55:c9:04"
-       - run: docs/publish.sh
-       - store_artifacts:
-           path: generated/docs
-
 workflows:
   version: 2
   all:
@@ -65,7 +52,3 @@ workflows:
       - api
       - go_control_plane_mirror
       - filter_example_mirror
-      - docs:
-          filters:
-            tags:
-              only: /^v.*/
diff --git a/ci/run_envoy_docker.sh b/ci/run_envoy_docker.sh
index 2faf10591c82..003a5ab28b76 100755
--- a/ci/run_envoy_docker.sh
+++ b/ci/run_envoy_docker.sh
@@ -64,6 +64,7 @@ docker run --rm \
        "${ENVOY_DOCKER_OPTIONS[@]}" \
        -v "${ENVOY_DOCKER_BUILD_DIR}":"${BUILD_DIR_MOUNT_DEST}" \
        -v "${SOURCE_DIR}":"${SOURCE_DIR_MOUNT_DEST}" \
+       -e AZP_BRANCH \
        -e HTTP_PROXY \
        -e HTTPS_PROXY \
        -e NO_PROXY \
diff --git a/docs/build.sh b/docs/build.sh
index 0a8cbc900ebd..87ec3a0e4022 100755
--- a/docs/build.sh
+++ b/docs/build.sh
@@ -7,15 +7,20 @@
 
 set -e
 
+RELEASE_TAG_REGEX="^refs/tags/v.*"
+
+if [[ "${AZP_BRANCH}" =~ ${RELEASE_TAG_REGEX} ]]; then
+  DOCS_TAG="${AZP_BRANCH/refs\/tags\//}"
+fi
+
 # We need to set ENVOY_DOCS_VERSION_STRING and ENVOY_DOCS_RELEASE_LEVEL for Sphinx.
 # We also validate that the tag and version match at this point if needed.
-if [ -n "$CIRCLE_TAG" ]
-then
+if [[ -n "${DOCS_TAG}" ]]; then
   # Check the git tag matches the version number in the VERSION file.
   VERSION_NUMBER=$(cat VERSION)
-  if [ "v${VERSION_NUMBER}" != "${CIRCLE_TAG}" ]; then
+  if [[ "v${VERSION_NUMBER}" != "${DOCS_TAG}" ]]; then
     echo "Given git tag does not match the VERSION file content:"
-    echo "${CIRCLE_TAG} vs $(cat VERSION)"
+    echo "${DOCS_TAG} vs $(cat VERSION)"
     exit 1
   fi
   # Check the version_history.rst contains current release version.
@@ -23,9 +28,9 @@ then
     || (echo "Git tag not found in version_history/current.rst" && exit 1)
 
   # Now that we know there is a match, we can use the tag.
-  export ENVOY_DOCS_VERSION_STRING="tag-$CIRCLE_TAG"
+  export ENVOY_DOCS_VERSION_STRING="tag-${DOCS_TAG}"
   export ENVOY_DOCS_RELEASE_LEVEL=tagged
-  export ENVOY_BLOB_SHA="$CIRCLE_TAG"
+  export ENVOY_BLOB_SHA="${DOCS_TAG}"
 else
   BUILD_SHA=$(git rev-parse HEAD)
   VERSION_NUM=$(cat VERSION)
diff --git a/docs/publish.sh b/docs/publish.sh
index 498a68d0f45e..c56e9bb31066 100755
--- a/docs/publish.sh
+++ b/docs/publish.sh
@@ -10,35 +10,36 @@
 set -e
 
 DOCS_DIR=generated/docs
-CHECKOUT_DIR=../envoy-docs
+CHECKOUT_DIR=envoy-docs
 BUILD_SHA=$(git rev-parse HEAD)
 
-if [ -n "$CIRCLE_TAG" ]
-then
-  PUBLISH_DIR="$CHECKOUT_DIR"/docs/envoy/"$CIRCLE_TAG"
-elif [ -z "$CIRCLE_PULL_REQUEST" ] && [ "$CIRCLE_BRANCH" == "master" ]
-then
-  PUBLISH_DIR="$CHECKOUT_DIR"/docs/envoy/latest
+MAIN_BRANCH="refs/heads/master"
+RELEASE_TAG_REGEX="^refs/tags/v.*"
+
+if [[ "${AZP_BRANCH}" =~ ${RELEASE_TAG_REGEX} ]]; then
+  PUBLISH_DIR="${CHECKOUT_DIR}"/docs/envoy/"${AZP_BRANCH/refs\/tags\//}"
+elif [[ "$AZP_BRANCH" == "${MAIN_BRANCH}" ]]; then
+  PUBLISH_DIR="${CHECKOUT_DIR}"/docs/envoy/latest
 else
   echo "Ignoring docs push"
   exit 0
 fi
 
+DOCS_MAIN_BRANCH="master"
+
 echo 'cloning'
-git clone git@github.com:envoyproxy/envoyproxy.github.io "$CHECKOUT_DIR"
+git clone git@github.com:envoyproxy/envoyproxy.github.io "${CHECKOUT_DIR}" -b "${DOCS_MAIN_BRANCH}" --depth 1
 
-git -C "$CHECKOUT_DIR" fetch
-git -C "$CHECKOUT_DIR" checkout -B master origin/master
 rm -fr "$PUBLISH_DIR"
 mkdir -p "$PUBLISH_DIR"
 cp -r "$DOCS_DIR"/* "$PUBLISH_DIR"
-cd "$CHECKOUT_DIR"
+cd "${CHECKOUT_DIR}"
 
-git config user.name "envoy-docs(travis)"
+git config user.name "envoy-docs(Azure Pipelines)"
 git config user.email envoy-docs@users.noreply.github.com
-echo 'add'
+
+set -x
+
 git add .
-echo 'commit'
 git commit -m "docs envoy@$BUILD_SHA"
-echo 'push'
-git push origin master
+git push origin "${DOCS_MAIN_BRANCH}"

From 0fcfa3e6bcb7cc95297ea31277f7a0acbeb157c2 Mon Sep 17 00:00:00 2001
From: Lizan Zhou <lizan@tetrate.io>
Date: Mon, 12 Oct 2020 18:24:20 -0700
Subject: [PATCH 4/8] ci use azp to sync filter example (#13501)

Signed-off-by: Lizan Zhou <lizan@tetrate.io>
---
 .azure-pipelines/pipelines.yml | 18 ++++++++++++++++++
 .circleci/config.yml           | 11 -----------
 ci/filter_example_mirror.sh    | 13 ++++++-------
 3 files changed, 24 insertions(+), 18 deletions(-)

diff --git a/.azure-pipelines/pipelines.yml b/.azure-pipelines/pipelines.yml
index 0f28ad9ea779..7858c98f1a27 100644
--- a/.azure-pipelines/pipelines.yml
+++ b/.azure-pipelines/pipelines.yml
@@ -109,6 +109,24 @@ jobs:
           artifactSuffix: ".arm64"
           bazelBuildExtraOptions: "--sandbox_base=/tmp/sandbox_base"
 
+  - job: filter_example
+    displayName: "filter-example sync"
+    dependsOn: []
+    condition: and(succeeded(), eq(variables['PostSubmit'], true))
+    steps:
+      - task: InstallSSHKey@0
+        inputs:
+          hostName: "github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
+          sshPublicKey: "$(FilterExamplePublicKey)"
+          sshPassphrase: "$(SshDeployKeyPassphrase)"
+          sshKeySecureFile: "$(FilterExamplePrivateKey)"
+
+      - bash: ci/filter_example_mirror.sh
+        displayName: "Sync envoy-filter-example"
+        workingDirectory: $(Build.SourcesDirectory)
+        env:
+          AZP_BRANCH: $(Build.SourceBranch)
+
   - job: bazel
     displayName: "Linux-x64"
     dependsOn: ["release"]
diff --git a/.circleci/config.yml b/.circleci/config.yml
index 105c71dba328..e04a9737d8f9 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -35,20 +35,9 @@ jobs:
              - "9d:3b:fe:7c:09:3b:ce:a9:6a:de:de:41:fb:6b:52:62"
        - run: ci/go_mirror.sh
 
-   filter_example_mirror:
-     executor: ubuntu-build
-     steps:
-       - run: rm -rf /home/circleci/project/.git # CircleCI git caching is likely broken
-       - checkout
-       - add_ssh_keys:
-           fingerprints:
-             - "f6:f9:df:90:9c:4b:5f:9c:f4:69:fd:42:94:ff:88:24"
-       - run: ci/filter_example_mirror.sh
-
 workflows:
   version: 2
   all:
     jobs:
       - api
       - go_control_plane_mirror
-      - filter_example_mirror
diff --git a/ci/filter_example_mirror.sh b/ci/filter_example_mirror.sh
index 1d6d5ae05b23..8602b1677e4b 100755
--- a/ci/filter_example_mirror.sh
+++ b/ci/filter_example_mirror.sh
@@ -4,16 +4,15 @@ set -e
 
 ENVOY_SRCDIR=$(cd "$(dirname "${BASH_SOURCE[0]}")/../" && pwd)
 CHECKOUT_DIR=../envoy-filter-example
+MAIN_BRANCH="refs/heads/master"
+FILTER_EXAMPLE_MAIN_BRANCH="master"
 
-if [ -z "$CIRCLE_PULL_REQUEST" ] && [ "$CIRCLE_BRANCH" == "master" ]
-then
+if [[ "${AZP_BRANCH}" == "${MAIN_BRANCH}" ]]; then
   echo "Cloning..."
-  git clone git@github.com:envoyproxy/envoy-filter-example "$CHECKOUT_DIR"
+  git clone git@github.com:envoyproxy/envoy-filter-example "$CHECKOUT_DIR" -b "${FILTER_EXAMPLE_MAIN_BRANCH}"
 
-  git -C "$CHECKOUT_DIR" config user.name "envoy-filter-example(CircleCI)"
+  git -C "$CHECKOUT_DIR" config user.name "envoy-filter-example(Azure Pipelines)"
   git -C "$CHECKOUT_DIR" config user.email envoy-filter-example@users.noreply.github.com
-  git -C "$CHECKOUT_DIR" fetch
-  git -C "$CHECKOUT_DIR" checkout -B master origin/master
 
   echo "Updating Submodule..."
   # Update submodule to latest Envoy SHA
@@ -26,6 +25,6 @@ then
 
   echo "Committing, and Pushing..."
   git -C "$CHECKOUT_DIR" commit -a -m "Update Envoy submodule to $ENVOY_SHA"
-  git -C "$CHECKOUT_DIR" push origin master
+  git -C "$CHECKOUT_DIR" push origin "${FILTER_EXAMPLE_MAIN_BRANCH}"
   echo "Done"
 fi

From 4f9134914118a4d881252ed9344007c3a0aabce1 Mon Sep 17 00:00:00 2001
From: Lizan Zhou <lizan@tetrate.io>
Date: Wed, 14 Oct 2020 08:16:42 -0700
Subject: [PATCH 5/8] ci: use azp for api and go-control-plane sync (#13550)

Signed-off-by: Lizan Zhou <lizan@tetrate.io>
---
 .azure-pipelines/pipelines.yml    | 48 +++++++++++++++++++++++++++++++
 .circleci/config.yml              | 43 ---------------------------
 ci/api_mirror.sh                  | 13 ++++-----
 ci/do_ci.sh                       | 14 +++++----
 ci/go_mirror.sh                   | 10 +++++--
 ci/run_envoy_docker.sh            |  1 +
 tools/api/generate_go_protobuf.py | 12 ++++----
 tools/api_boost/api_boost.py      |  1 -
 8 files changed, 77 insertions(+), 65 deletions(-)
 delete mode 100644 .circleci/config.yml

diff --git a/.azure-pipelines/pipelines.yml b/.azure-pipelines/pipelines.yml
index 7858c98f1a27..8cedff62133a 100644
--- a/.azure-pipelines/pipelines.yml
+++ b/.azure-pipelines/pipelines.yml
@@ -112,6 +112,8 @@ jobs:
   - job: filter_example
     displayName: "filter-example sync"
     dependsOn: []
+    pool:
+      vmImage: "ubuntu-18.04"
     condition: and(succeeded(), eq(variables['PostSubmit'], true))
     steps:
       - task: InstallSSHKey@0
@@ -127,6 +129,50 @@ jobs:
         env:
           AZP_BRANCH: $(Build.SourceBranch)
 
+  - job: api
+    displayName: "data-plane-api sync"
+    dependsOn: []
+    condition: and(succeeded(), eq(variables['PostSubmit'], true))
+    pool:
+      vmImage: "ubuntu-18.04"
+    steps:
+      - task: InstallSSHKey@0
+        inputs:
+          hostName: "github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
+          sshPublicKey: "$(DataPlaneApiPublicKey)"
+          sshPassphrase: "$(SshDeployKeyPassphrase)"
+          sshKeySecureFile: "$(DataPlaneApiPrivateKey)"
+
+      - bash: ci/api_mirror.sh
+        displayName: "Sync data-plane-api"
+        workingDirectory: $(Build.SourcesDirectory)
+        env:
+          AZP_BRANCH: $(Build.SourceBranch)
+
+  - job: go_control_plane
+    displayName: "go-control-plane sync"
+    dependsOn: []
+    condition: and(succeeded(), eq(variables['PostSubmit'], true))
+    steps:
+      - task: InstallSSHKey@0
+        inputs:
+          hostName: "github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
+          sshPublicKey: "$(GoControlPlanePublicKey)"
+          sshPassphrase: "$(SshDeployKeyPassphrase)"
+          sshKeySecureFile: "$(GoControlPlanePrivateKey)"
+
+      - bash: |
+          cp -a ~/.ssh $(Build.StagingDirectory)/
+          ci/run_envoy_docker.sh 'ci/go_mirror.sh'
+        displayName: "Sync go-control-plane"
+        workingDirectory: $(Build.SourcesDirectory)
+        env:
+          ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
+          BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
+          BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
+          GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
+          AZP_BRANCH: $(Build.SourceBranch)
+
   - job: bazel
     displayName: "Linux-x64"
     dependsOn: ["release"]
@@ -135,6 +181,8 @@ jobs:
     strategy:
       maxParallel: 3
       matrix:
+        api:
+          CI_TARGET: "bazel.api"
         gcc:
           CI_TARGET: "bazel.gcc"
         clang_tidy:
diff --git a/.circleci/config.yml b/.circleci/config.yml
deleted file mode 100644
index e04a9737d8f9..000000000000
--- a/.circleci/config.yml
+++ /dev/null
@@ -1,43 +0,0 @@
-version: 2.1
-
-executors:
-  ubuntu-build:
-    description: "A regular build executor based on ubuntu image"
-    docker:
-      # NOTE: Update this from https://github.com/envoyproxy/envoy-build-tools/blob/master/toolchains/rbe_toolchains_config.bzl#L8
-      - image: envoyproxy/envoy-build-ubuntu:b480535e8423b5fd7c102fd30c92f4785519e33a
-    resource_class: xlarge
-    working_directory: /source
-
-jobs:
-   api:
-     executor: ubuntu-build
-     steps:
-       - run: rm -rf /home/circleci/project/.git # CircleCI git caching is likely broken
-       - checkout
-       - run: ci/do_circle_ci.sh bazel.api
-       - add_ssh_keys:
-           fingerprints:
-             - "fb:f3:fe:be:1c:b2:ec:b6:25:f9:7b:a6:87:54:02:8c"
-       - run: ci/api_mirror.sh
-       - store_artifacts:
-           path: /build/envoy/generated
-           destination: /
-
-   go_control_plane_mirror:
-     executor: ubuntu-build
-     steps:
-       - run: rm -rf /home/circleci/project/.git # CircleCI git caching is likely broken
-       - checkout
-       - run: ci/do_circle_ci.sh bazel.api
-       - add_ssh_keys:
-           fingerprints:
-             - "9d:3b:fe:7c:09:3b:ce:a9:6a:de:de:41:fb:6b:52:62"
-       - run: ci/go_mirror.sh
-
-workflows:
-  version: 2
-  all:
-    jobs:
-      - api
-      - go_control_plane_mirror
diff --git a/ci/api_mirror.sh b/ci/api_mirror.sh
index 077cdd1d3cfe..03e8ab85d80c 100755
--- a/ci/api_mirror.sh
+++ b/ci/api_mirror.sh
@@ -3,16 +3,15 @@
 set -e
 
 CHECKOUT_DIR=../data-plane-api
+MAIN_BRANCH="refs/heads/master"
+API_MAIN_BRANCH="master"
 
-if [ -z "$CIRCLE_PULL_REQUEST" ] && [ "$CIRCLE_BRANCH" == "master" ]
-then
+if [[ "${AZP_BRANCH}" == "${MAIN_BRANCH}" ]]; then
   echo "Cloning..."
-  git clone git@github.com:envoyproxy/data-plane-api "$CHECKOUT_DIR"
+  git clone git@github.com:envoyproxy/data-plane-api "$CHECKOUT_DIR" -b "${API_MAIN_BRANCH}"
 
-  git -C "$CHECKOUT_DIR" config user.name "data-plane-api(CircleCI)"
+  git -C "$CHECKOUT_DIR" config user.name "data-plane-api(Azure Pipelines)"
   git -C "$CHECKOUT_DIR" config user.email data-plane-api@users.noreply.github.com
-  git -C "$CHECKOUT_DIR" fetch
-  git -C "$CHECKOUT_DIR" checkout -B master origin/master
 
   # Determine last envoyproxy/envoy SHA in envoyproxy/data-plane-api
   MIRROR_MSG="Mirrored from https://github.com/envoyproxy/envoy"
@@ -40,6 +39,6 @@ then
   done
 
   echo "Pushing..."
-  git -C "$CHECKOUT_DIR" push origin master
+  git -C "$CHECKOUT_DIR" push origin "${API_MAIN_BRANCH}"
   echo "Done"
 fi
diff --git a/ci/do_ci.sh b/ci/do_ci.sh
index a421f5ff67b9..bda21807218c 100755
--- a/ci/do_ci.sh
+++ b/ci/do_ci.sh
@@ -311,19 +311,21 @@ elif [[ "$CI_TARGET" == "bazel.compile_time_options" ]]; then
   collect_build_profile build
   exit 0
 elif [[ "$CI_TARGET" == "bazel.api" ]]; then
+  # Use libstdc++ because the API booster links to prebuilt libclang*/libLLVM* installed in /opt/llvm/lib,
+  # which is built with libstdc++. Using libstdc++ for whole of the API CI job to avoid unnecessary rebuild.
+  ENVOY_STDLIB="libstdc++"
   setup_clang_toolchain
+  export LLVM_CONFIG="${LLVM_ROOT}"/bin/llvm-config
   echo "Validating API structure..."
   ./tools/api/validate_structure.py
+  echo "Testing API and API Boosting..."
+  bazel_with_collection test "${BAZEL_BUILD_OPTIONS[@]}" -c fastbuild @envoy_api_canonical//test/... @envoy_api_canonical//tools/... \
+    @envoy_api_canonical//tools:tap2pcap_test @envoy_dev//clang_tools/api_booster/...
   echo "Building API..."
   bazel build "${BAZEL_BUILD_OPTIONS[@]}" -c fastbuild @envoy_api_canonical//envoy/...
-  echo "Testing API..."
-  bazel_with_collection test "${BAZEL_BUILD_OPTIONS[@]}" -c fastbuild @envoy_api_canonical//test/... @envoy_api_canonical//tools/... \
-    @envoy_api_canonical//tools:tap2pcap_test
-  echo "Testing API boosting (unit tests)..."
-  bazel_with_collection test "${BAZEL_BUILD_OPTIONS[@]}" -c fastbuild @envoy_dev//clang_tools/api_booster/...
   echo "Testing API boosting (golden C++ tests)..."
   # We use custom BAZEL_BUILD_OPTIONS here; the API booster isn't capable of working with libc++ yet.
-  LLVM_CONFIG="${LLVM_ROOT}"/bin/llvm-config BAZEL_BUILD_OPTIONS="--config=clang" python3.8 ./tools/api_boost/api_boost_test.py
+  BAZEL_BUILD_OPTIONS="${BAZEL_BUILD_OPTIONS[*]}" python3.8 ./tools/api_boost/api_boost_test.py
   exit 0
 elif [[ "$CI_TARGET" == "bazel.coverage" || "$CI_TARGET" == "bazel.fuzz_coverage" ]]; then
   setup_clang_toolchain
diff --git a/ci/go_mirror.sh b/ci/go_mirror.sh
index 80be4cc0b532..63f96d0d7969 100755
--- a/ci/go_mirror.sh
+++ b/ci/go_mirror.sh
@@ -2,7 +2,11 @@
 
 set -e
 
-if [ -z "$CIRCLE_PULL_REQUEST" ] && [ "$CIRCLE_BRANCH" == "master" ]
-then
-  tools/api/generate_go_protobuf.py
+MAIN_BRANCH="refs/heads/master"
+
+# shellcheck source=ci/setup_cache.sh
+. "$(dirname "$0")"/setup_cache.sh
+
+if [[ "${AZP_BRANCH}" == "${MAIN_BRANCH}" ]]; then
+  BAZEL_BUILD_OPTIONS="${BAZEL_BUILD_EXTRA_OPTIONS}" tools/api/generate_go_protobuf.py
 fi
diff --git a/ci/run_envoy_docker.sh b/ci/run_envoy_docker.sh
index 003a5ab28b76..842b51b6ce89 100755
--- a/ci/run_envoy_docker.sh
+++ b/ci/run_envoy_docker.sh
@@ -56,6 +56,7 @@ mkdir -p "${ENVOY_DOCKER_BUILD_DIR}"
 
 [[ -t 1 ]] && ENVOY_DOCKER_OPTIONS+=("-it")
 [[ -f .git ]] && [[ ! -d .git ]] && ENVOY_DOCKER_OPTIONS+=(-v "$(git rev-parse --git-common-dir):$(git rev-parse --git-common-dir)")
+[[ -n "${SSH_AUTH_SOCK}" ]] && ENVOY_DOCKER_OPTIONS+=(-v "${SSH_AUTH_SOCK}:${SSH_AUTH_SOCK}" -e SSH_AUTH_SOCK)
 
 export ENVOY_BUILD_IMAGE="${IMAGE_NAME}:${IMAGE_ID}"
 
diff --git a/tools/api/generate_go_protobuf.py b/tools/api/generate_go_protobuf.py
index 0cd15b637449..5b25de2dbb0a 100755
--- a/tools/api/generate_go_protobuf.py
+++ b/tools/api/generate_go_protobuf.py
@@ -4,17 +4,21 @@
 from subprocess import check_call
 import glob
 import os
+import shlex
 import shutil
 import sys
 import re
 
+# Needed for CI to pass down bazel options.
+BAZEL_BUILD_OPTIONS = shlex.split(os.environ.get('BAZEL_BUILD_OPTIONS', ''))
+
 TARGETS = '@envoy_api//...'
 IMPORT_BASE = 'github.com/envoyproxy/go-control-plane'
 OUTPUT_BASE = 'build_go'
 REPO_BASE = 'go-control-plane'
 BRANCH = 'master'
 MIRROR_MSG = 'Mirrored from envoyproxy/envoy @ '
-USER_NAME = 'go-control-plane(CircleCI)'
+USER_NAME = 'go-control-plane(Azure Pipelines)'
 USER_EMAIL = 'go-control-plane@users.noreply.github.com'
 
 
@@ -32,7 +36,7 @@ def generateProtobufs(output):
   check_call([
       'bazel', 'build', '-c', 'fastbuild',
       '--experimental_proto_descriptor_sets_include_source_info'
-  ] + go_protos)
+  ] + BAZEL_BUILD_OPTIONS + go_protos)
 
   for rule in go_protos:
     # Example rule:
@@ -67,9 +71,7 @@ def git(repo, *args):
 
 def cloneGoProtobufs(repo):
   # Create a local clone of go-control-plane
-  git(None, 'clone', 'git@github.com:envoyproxy/go-control-plane', repo)
-  git(repo, 'fetch')
-  git(repo, 'checkout', '-B', BRANCH, 'origin/master')
+  git(None, 'clone', 'git@github.com:envoyproxy/go-control-plane', repo, '-b', BRANCH)
 
 
 def findLastSyncSHA(repo):
diff --git a/tools/api_boost/api_boost.py b/tools/api_boost/api_boost.py
index eda6eaf94088..5cd9846bcf21 100755
--- a/tools/api_boost/api_boost.py
+++ b/tools/api_boost/api_boost.py
@@ -132,7 +132,6 @@ def ApiBoostTree(target_paths,
     sp.run([
         'bazel',
         'build',
-        '--config=libc++',
         '--strip=always',
     ] + BAZEL_BUILD_OPTIONS + dep_lib_build_targets,
            check=True)

From b25abcbe159d55797d3067d0c3b0ba3a7643ca71 Mon Sep 17 00:00:00 2001
From: Lizan Zhou <lizan@tetrate.io>
Date: Thu, 15 Oct 2020 08:15:53 -0700
Subject: [PATCH 6/8] ci: use multiple stage (#13557)

Signed-off-by: Lizan Zhou <lizan@tetrate.io>
---
 .azure-pipelines/pipelines.yml | 621 +++++++++++++++++----------------
 1 file changed, 319 insertions(+), 302 deletions(-)

diff --git a/.azure-pipelines/pipelines.yml b/.azure-pipelines/pipelines.yml
index 8cedff62133a..4a128c44e224 100644
--- a/.azure-pipelines/pipelines.yml
+++ b/.azure-pipelines/pipelines.yml
@@ -10,332 +10,349 @@ trigger:
 # PR build config is manually overridden in Azure pipelines UI with different secrets
 pr: none
 
-jobs:
-  - job: format
-    dependsOn: [] # this removes the implicit dependency on previous stage and causes this to run in parallel.
-    pool:
-      vmImage: "ubuntu-18.04"
-    steps:
-      - task: Cache@2
-        inputs:
-          key: "format | ./WORKSPACE | **/*.bzl"
-          path: $(Build.StagingDirectory)/repository_cache
-        continueOnError: true
+stages:
+  - stage: precheck
+    jobs:
+      - job: format
+        dependsOn: [] # this removes the implicit dependency on previous stage and causes this to run in parallel.
+        pool:
+          vmImage: "ubuntu-18.04"
+        steps:
+          - task: Cache@2
+            inputs:
+              key: "format | ./WORKSPACE | **/*.bzl"
+              path: $(Build.StagingDirectory)/repository_cache
+            continueOnError: true
 
-      - script: ci/run_envoy_docker.sh 'ci/check_and_fix_format.sh'
-        workingDirectory: $(Build.SourcesDirectory)
-        env:
-          ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
-          BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
-          BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
-          GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
-        displayName: "Run check format scripts"
+          - script: ci/run_envoy_docker.sh 'ci/check_and_fix_format.sh'
+            workingDirectory: $(Build.SourcesDirectory)
+            env:
+              ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
+              BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
+              BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
+              GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
+            displayName: "Run check format scripts"
 
-      - task: PublishBuildArtifacts@1
-        inputs:
-          pathtoPublish: "$(Build.StagingDirectory)/fix_format.diff"
-          artifactName: format
-        condition: failed()
+          - task: PublishBuildArtifacts@1
+            inputs:
+              pathtoPublish: "$(Build.StagingDirectory)/fix_format.diff"
+              artifactName: format
+            condition: failed()
 
-  - job: docs
-    dependsOn: [] # this removes the implicit dependency on previous stage and causes this to run in parallel.
-    pool:
-      vmImage: "ubuntu-18.04"
-    steps:
-      - task: Cache@2
-        inputs:
-          key: "docs | ./WORKSPACE | **/*.bzl"
-          path: $(Build.StagingDirectory)/repository_cache
-        continueOnError: true
+      - job: docs
+        dependsOn: [] # this removes the implicit dependency on previous stage and causes this to run in parallel.
+        pool:
+          vmImage: "ubuntu-18.04"
+        steps:
+          - task: Cache@2
+            inputs:
+              key: "docs | ./WORKSPACE | **/*.bzl"
+              path: $(Build.StagingDirectory)/repository_cache
+            continueOnError: true
 
-      - script: ci/run_envoy_docker.sh 'ci/do_ci.sh docs'
-        workingDirectory: $(Build.SourcesDirectory)
-        env:
-          ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
-          BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
-          BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
-          GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
-        displayName: "Generate docs"
+          - script: ci/run_envoy_docker.sh 'ci/do_ci.sh docs'
+            workingDirectory: $(Build.SourcesDirectory)
+            env:
+              ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
+              BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
+              BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
+              GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
+            displayName: "Generate docs"
 
-      - script: ci/run_envoy_docker.sh 'ci/upload_gcs_artifact.sh /source/generated/docs docs'
-        displayName: "Upload Docs to GCS"
-        env:
-          ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
-          GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
-          GCS_ARTIFACT_BUCKET: $(GcsArtifactBucket)
+          - script: ci/run_envoy_docker.sh 'ci/upload_gcs_artifact.sh /source/generated/docs docs'
+            displayName: "Upload Docs to GCS"
+            env:
+              ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
+              GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
+              GCS_ARTIFACT_BUCKET: $(GcsArtifactBucket)
 
-      - task: InstallSSHKey@0
-        inputs:
-          hostName: "github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
-          sshPublicKey: "$(DocsPublicKey)"
-          sshPassphrase: "$(SshDeployKeyPassphrase)"
-          sshKeySecureFile: "$(DocsPrivateKey)"
-        condition: and(succeeded(), ne(variables['Build.Reason'], 'PullRequest'), eq(variables['PostSubmit'], true))
+          - task: PublishBuildArtifacts@1
+            inputs:
+              pathtoPublish: "$(Build.SourcesDirectory)/generated/docs"
+              artifactName: docs
+            condition: and(succeeded(), eq(variables['Build.Reason'], 'PullRequest'))
 
-      - script: docs/publish.sh
-        displayName: "Publish to GitHub"
-        workingDirectory: $(Build.SourcesDirectory)
-        env:
-          AZP_BRANCH: $(Build.SourceBranch)
-          AZP_SHA1: $(Build.SourceVersion)
-        condition: and(succeeded(), ne(variables['Build.Reason'], 'PullRequest'), eq(variables['PostSubmit'], true))
+          - task: InstallSSHKey@0
+            inputs:
+              hostName: "github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
+              sshPublicKey: "$(DocsPublicKey)"
+              sshPassphrase: "$(SshDeployKeyPassphrase)"
+              sshKeySecureFile: "$(DocsPrivateKey)"
+            condition: and(succeeded(), ne(variables['Build.Reason'], 'PullRequest'), eq(variables['PostSubmit'], true))
 
-  - job: release
-    displayName: "Linux-x64 release"
-    dependsOn: ["format"]
-    # For master builds, continue even if format fails
-    condition: and(not(canceled()), or(succeeded(), ne(variables['Build.Reason'], 'PullRequest')))
-    timeoutInMinutes: 360
-    pool:
-      vmImage: "ubuntu-18.04"
-    steps:
-      - template: bazel.yml
-        parameters:
-          ciTarget: bazel.release
-
-  - job: release_arm64
-    displayName: "Linux-arm64 release"
-    dependsOn: ["format"]
-    # For master builds, continue even if format fails
-    condition: and(not(canceled()), or(succeeded(), ne(variables['Build.Reason'], 'PullRequest')))
-    timeoutInMinutes: 360
-    pool: "arm-large"
-    steps:
-      - template: bazel.yml
-        parameters:
-          managedAgent: false
-          ciTarget: bazel.release
-          rbe: false
-          artifactSuffix: ".arm64"
-          bazelBuildExtraOptions: "--sandbox_base=/tmp/sandbox_base"
+          - script: docs/publish.sh
+            displayName: "Publish to GitHub"
+            workingDirectory: $(Build.SourcesDirectory)
+            env:
+              AZP_BRANCH: $(Build.SourceBranch)
+              AZP_SHA1: $(Build.SourceVersion)
+            condition: and(succeeded(), ne(variables['Build.Reason'], 'PullRequest'), eq(variables['PostSubmit'], true))
 
-  - job: filter_example
-    displayName: "filter-example sync"
-    dependsOn: []
-    pool:
-      vmImage: "ubuntu-18.04"
+  - stage: sync
     condition: and(succeeded(), eq(variables['PostSubmit'], true))
-    steps:
-      - task: InstallSSHKey@0
-        inputs:
-          hostName: "github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
-          sshPublicKey: "$(FilterExamplePublicKey)"
-          sshPassphrase: "$(SshDeployKeyPassphrase)"
-          sshKeySecureFile: "$(FilterExamplePrivateKey)"
+    dependsOn: []
+    jobs:
+      - job: filter_example
+        dependsOn: []
+        pool:
+          vmImage: "ubuntu-18.04"
+        steps:
+          - task: InstallSSHKey@0
+            inputs:
+              hostName: "github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
+              sshPublicKey: "$(FilterExamplePublicKey)"
+              sshPassphrase: "$(SshDeployKeyPassphrase)"
+              sshKeySecureFile: "$(FilterExamplePrivateKey)"
 
-      - bash: ci/filter_example_mirror.sh
-        displayName: "Sync envoy-filter-example"
-        workingDirectory: $(Build.SourcesDirectory)
-        env:
-          AZP_BRANCH: $(Build.SourceBranch)
+          - bash: ci/filter_example_mirror.sh
+            displayName: "Sync envoy-filter-example"
+            workingDirectory: $(Build.SourcesDirectory)
+            env:
+              AZP_BRANCH: $(Build.SourceBranch)
 
-  - job: api
-    displayName: "data-plane-api sync"
-    dependsOn: []
-    condition: and(succeeded(), eq(variables['PostSubmit'], true))
-    pool:
-      vmImage: "ubuntu-18.04"
-    steps:
-      - task: InstallSSHKey@0
-        inputs:
-          hostName: "github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
-          sshPublicKey: "$(DataPlaneApiPublicKey)"
-          sshPassphrase: "$(SshDeployKeyPassphrase)"
-          sshKeySecureFile: "$(DataPlaneApiPrivateKey)"
+      - job: data_plane_api
+        dependsOn: []
+        pool:
+          vmImage: "ubuntu-18.04"
+        steps:
+          - task: InstallSSHKey@0
+            inputs:
+              hostName: "github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
+              sshPublicKey: "$(DataPlaneApiPublicKey)"
+              sshPassphrase: "$(SshDeployKeyPassphrase)"
+              sshKeySecureFile: "$(DataPlaneApiPrivateKey)"
 
-      - bash: ci/api_mirror.sh
-        displayName: "Sync data-plane-api"
-        workingDirectory: $(Build.SourcesDirectory)
-        env:
-          AZP_BRANCH: $(Build.SourceBranch)
+          - bash: ci/api_mirror.sh
+            displayName: "Sync data-plane-api"
+            workingDirectory: $(Build.SourcesDirectory)
+            env:
+              AZP_BRANCH: $(Build.SourceBranch)
 
-  - job: go_control_plane
-    displayName: "go-control-plane sync"
-    dependsOn: []
-    condition: and(succeeded(), eq(variables['PostSubmit'], true))
-    steps:
-      - task: InstallSSHKey@0
-        inputs:
-          hostName: "github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
-          sshPublicKey: "$(GoControlPlanePublicKey)"
-          sshPassphrase: "$(SshDeployKeyPassphrase)"
-          sshKeySecureFile: "$(GoControlPlanePrivateKey)"
+      - job: go_control_plane
+        dependsOn: []
+        steps:
+          - task: InstallSSHKey@0
+            inputs:
+              hostName: "github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
+              sshPublicKey: "$(GoControlPlanePublicKey)"
+              sshPassphrase: "$(SshDeployKeyPassphrase)"
+              sshKeySecureFile: "$(GoControlPlanePrivateKey)"
 
-      - bash: |
-          cp -a ~/.ssh $(Build.StagingDirectory)/
-          ci/run_envoy_docker.sh 'ci/go_mirror.sh'
-        displayName: "Sync go-control-plane"
-        workingDirectory: $(Build.SourcesDirectory)
-        env:
-          ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
-          BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
-          BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
-          GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
-          AZP_BRANCH: $(Build.SourceBranch)
+          - bash: |
+              cp -a ~/.ssh $(Build.StagingDirectory)/
+              ci/run_envoy_docker.sh 'ci/go_mirror.sh'
+            displayName: "Sync go-control-plane"
+            workingDirectory: $(Build.SourcesDirectory)
+            env:
+              ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
+              BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
+              BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
+              GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
+              AZP_BRANCH: $(Build.SourceBranch)
 
-  - job: bazel
-    displayName: "Linux-x64"
-    dependsOn: ["release"]
-    # For master builds, continue even if format fails
+  - stage: linux_x64
+    dependsOn: ["precheck"]
+    # For master builds, continue even if precheck fails
     condition: and(not(canceled()), or(succeeded(), ne(variables['Build.Reason'], 'PullRequest')))
-    strategy:
-      maxParallel: 3
-      matrix:
-        api:
-          CI_TARGET: "bazel.api"
-        gcc:
-          CI_TARGET: "bazel.gcc"
-        clang_tidy:
-          CI_TARGET: "bazel.clang_tidy"
-        asan:
-          CI_TARGET: "bazel.asan"
-        tsan:
-          CI_TARGET: "bazel.tsan"
-        compile_time_options:
-          CI_TARGET: "bazel.compile_time_options"
-    timeoutInMinutes: 360
-    pool:
-      vmImage: "ubuntu-18.04"
-    steps:
-      - template: bazel.yml
-        parameters:
-          ciTarget: $(CI_TARGET)
+    jobs:
+      - job: release
+        # For master builds, continue even if format fails
+        timeoutInMinutes: 360
+        pool:
+          vmImage: "ubuntu-18.04"
+        steps:
+          - template: bazel.yml
+            parameters:
+              ciTarget: bazel.release
+
+  - stage: linux_arm64
+    dependsOn: ["precheck"]
+    # For master builds, continue even if precheck fails
+    condition: and(not(canceled()), or(succeeded(), ne(variables['Build.Reason'], 'PullRequest')))
+    jobs:
+      - job: release
+        timeoutInMinutes: 360
+        pool: "arm-large"
+        steps:
+          - template: bazel.yml
+            parameters:
+              managedAgent: false
+              ciTarget: bazel.release
+              rbe: false
+              artifactSuffix: ".arm64"
+              bazelBuildExtraOptions: "--sandbox_base=/tmp/sandbox_base"
+
+  - stage: check
+    dependsOn: ["linux_x64"]
+    jobs:
+      - job: bazel
+        displayName: "linux_x64"
+        dependsOn: []
+        strategy:
+          maxParallel: 3
+          matrix:
+            api:
+              CI_TARGET: "bazel.api"
+            gcc:
+              CI_TARGET: "bazel.gcc"
+            clang_tidy:
+              CI_TARGET: "bazel.clang_tidy"
+            asan:
+              CI_TARGET: "bazel.asan"
+            tsan:
+              CI_TARGET: "bazel.tsan"
+            compile_time_options:
+              CI_TARGET: "bazel.compile_time_options"
+        timeoutInMinutes: 360
+        pool:
+          vmImage: "ubuntu-18.04"
+        steps:
+          - template: bazel.yml
+            parameters:
+              ciTarget: $(CI_TARGET)
 
-  - job: coverage
-    displayName: "Linux-x64"
-    dependsOn: ["release"]
-    timeoutInMinutes: 360
-    pool: "x64-large"
-    strategy:
-      maxParallel: 2
-      matrix:
-        coverage:
-          CI_TARGET: "coverage"
-        fuzz_coverage:
-          CI_TARGET: "fuzz_coverage"
-    steps:
-      - template: bazel.yml
-        parameters:
-          managedAgent: false
-          ciTarget: bazel.$(CI_TARGET)
-          rbe: false
-          # /tmp/sandbox_base is a tmpfs in CI environment to optimize large I/O for coverage traces
-          bazelBuildExtraOptions: "--define=no_debug_info=1 --linkopt=-Wl,-s --test_env=ENVOY_IP_TEST_VERSIONS=v4only --sandbox_base=/tmp/sandbox_base"
+      - job: coverage
+        displayName: "linux_x64"
+        dependsOn: []
+        timeoutInMinutes: 360
+        pool: "x64-large"
+        strategy:
+          maxParallel: 2
+          matrix:
+            coverage:
+              CI_TARGET: "coverage"
+            fuzz_coverage:
+              CI_TARGET: "fuzz_coverage"
+        steps:
+          - template: bazel.yml
+            parameters:
+              managedAgent: false
+              ciTarget: bazel.$(CI_TARGET)
+              rbe: false
+              # /tmp/sandbox_base is a tmpfs in CI environment to optimize large I/O for coverage traces
+              bazelBuildExtraOptions: "--define=no_debug_info=1 --linkopt=-Wl,-s --test_env=ENVOY_IP_TEST_VERSIONS=v4only --sandbox_base=/tmp/sandbox_base"
 
-      - script: ci/run_envoy_docker.sh 'ci/upload_gcs_artifact.sh /source/generated/$(CI_TARGET) $(CI_TARGET)'
-        displayName: "Upload $(CI_TARGET) Report to GCS"
-        env:
-          ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
-          GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
-          GCS_ARTIFACT_BUCKET: $(GcsArtifactBucket)
-        condition: always()
+          - script: ci/run_envoy_docker.sh 'ci/upload_gcs_artifact.sh /source/generated/$(CI_TARGET) $(CI_TARGET)'
+            displayName: "Upload $(CI_TARGET) Report to GCS"
+            env:
+              ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
+              GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
+              GCS_ARTIFACT_BUCKET: $(GcsArtifactBucket)
+            condition: always()
 
-  - job: docker
-    displayName: "Linux multi-arch docker"
-    dependsOn: ["release", "release_arm64"]
-    pool:
-      vmImage: "ubuntu-18.04"
-    steps:
-      - bash: .azure-pipelines/cleanup.sh
-        displayName: "Removing tools from agent"
-      - task: DownloadBuildArtifacts@0
-        inputs:
-          buildType: current
-          artifactName: "bazel.release"
-          itemPattern: "bazel.release/envoy_binary.tar.gz"
-          downloadType: single
-          targetPath: $(Build.StagingDirectory)
-      - task: DownloadBuildArtifacts@0
-        inputs:
-          buildType: current
-          artifactName: "bazel.release.arm64"
-          itemPattern: "bazel.release.arm64/envoy_binary.tar.gz"
-          downloadType: single
-          targetPath: $(Build.StagingDirectory)
-      - bash: |
-          set -e
-          mkdir -p linux/amd64 && tar zxf $(Build.StagingDirectory)/bazel.release/envoy_binary.tar.gz -C ./linux/amd64
-          mkdir -p linux/arm64 && tar zxf $(Build.StagingDirectory)/bazel.release.arm64/envoy_binary.tar.gz -C ./linux/arm64
-          ci/docker_ci.sh
-        workingDirectory: $(Build.SourcesDirectory)
-        env:
-          AZP_BRANCH: $(Build.SourceBranch)
-          AZP_SHA1: $(Build.SourceVersion)
-          DOCKERHUB_USERNAME: $(DockerUsername)
-          DOCKERHUB_PASSWORD: $(DockerPassword)
-      - task: PublishBuildArtifacts@1
-        inputs:
-          pathtoPublish: "$(Build.StagingDirectory)/build_images"
-          artifactName: docker
-        condition: always()
+  - stage: docker
+    dependsOn: ["linux_x64", "linux_arm64"]
+    jobs:
+      - job: docker
+        displayName: "linux multiarch"
+        pool:
+          vmImage: "ubuntu-18.04"
+        steps:
+          - bash: .azure-pipelines/cleanup.sh
+            displayName: "Removing tools from agent"
+          - task: DownloadBuildArtifacts@0
+            inputs:
+              buildType: current
+              artifactName: "bazel.release"
+              itemPattern: "bazel.release/envoy_binary.tar.gz"
+              downloadType: single
+              targetPath: $(Build.StagingDirectory)
+          - task: DownloadBuildArtifacts@0
+            inputs:
+              buildType: current
+              artifactName: "bazel.release.arm64"
+              itemPattern: "bazel.release.arm64/envoy_binary.tar.gz"
+              downloadType: single
+              targetPath: $(Build.StagingDirectory)
+          - bash: |
+              set -e
+              mkdir -p linux/amd64 && tar zxf $(Build.StagingDirectory)/bazel.release/envoy_binary.tar.gz -C ./linux/amd64
+              mkdir -p linux/arm64 && tar zxf $(Build.StagingDirectory)/bazel.release.arm64/envoy_binary.tar.gz -C ./linux/arm64
+              ci/docker_ci.sh
+            workingDirectory: $(Build.SourcesDirectory)
+            env:
+              AZP_BRANCH: $(Build.SourceBranch)
+              AZP_SHA1: $(Build.SourceVersion)
+              DOCKERHUB_USERNAME: $(DockerUsername)
+              DOCKERHUB_PASSWORD: $(DockerPassword)
+          - task: PublishBuildArtifacts@1
+            inputs:
+              pathtoPublish: "$(Build.StagingDirectory)/build_images"
+              artifactName: docker
+            condition: always()
 
-  - job: examples
+  - stage: verify
     dependsOn: ["docker"]
-    displayName: "Verify examples run as documented"
-    pool:
-      vmImage: "ubuntu-18.04"
-    steps:
-      - task: DownloadBuildArtifacts@0
-        inputs:
-          buildType: current
-          artifactName: "docker"
-          itemPattern: "docker/envoy-docker-images.tar.xz"
-          downloadType: single
-          targetPath: $(Build.StagingDirectory)
-      - bash: ./ci/do_ci.sh verify_examples
-        env:
-          ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
-          NO_BUILD_SETUP: 1
+    jobs:
+      - job: examples
+        pool:
+          vmImage: "ubuntu-18.04"
+        steps:
+          - task: DownloadBuildArtifacts@0
+            inputs:
+              buildType: current
+              artifactName: "docker"
+              itemPattern: "docker/envoy-docker-images.tar.xz"
+              downloadType: single
+              targetPath: $(Build.StagingDirectory)
+          - bash: ./ci/do_ci.sh verify_examples
+            env:
+              ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
+              NO_BUILD_SETUP: 1
 
-  - job: macOS
-    dependsOn: ["format"]
-    timeoutInMinutes: 360
-    pool:
-      vmImage: "macos-latest"
-    steps:
-      - script: ./ci/mac_ci_setup.sh
-        displayName: "Install dependencies"
+  - stage: macos
+    dependsOn: ["precheck"]
+    jobs:
+      - job: test
+        timeoutInMinutes: 360
+        pool:
+          vmImage: "macos-latest"
+        steps:
+          - script: ./ci/mac_ci_setup.sh
+            displayName: "Install dependencies"
 
-      - script: ./ci/mac_ci_steps.sh
-        displayName: "Run Mac CI"
-        env:
-          BAZEL_BUILD_EXTRA_OPTIONS: "--remote_download_toplevel --flaky_test_attempts=2"
-          BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
-          BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
-          GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
+          - script: ./ci/mac_ci_steps.sh
+            displayName: "Run Mac CI"
+            env:
+              BAZEL_BUILD_EXTRA_OPTIONS: "--remote_download_toplevel --flaky_test_attempts=2"
+              BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
+              BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
+              GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
 
-      - task: PublishTestResults@2
-        inputs:
-          testResultsFiles: "**/bazel-testlogs/**/test.xml"
-          testRunTitle: "macOS"
-        condition: always()
+          - task: PublishTestResults@2
+            inputs:
+              testResultsFiles: "**/bazel-testlogs/**/test.xml"
+              testRunTitle: "macOS"
+            condition: always()
 
-      - script: ./ci/flaky_test/run_process_xml.sh
-        displayName: "Process Test Results"
-        env:
-          TEST_TMPDIR: $(Build.SourcesDirectory)
-          SLACK_TOKEN: $(SLACK_TOKEN)
-          CI_TARGET: "MacOS"
-          REPO_URI: $(Build.Repository.Uri)
-          BUILD_URI: $(Build.BuildUri)
+          - script: ./ci/flaky_test/run_process_xml.sh
+            displayName: "Process Test Results"
+            env:
+              TEST_TMPDIR: $(Build.SourcesDirectory)
+              SLACK_TOKEN: $(SLACK_TOKEN)
+              CI_TARGET: "MacOS"
+              REPO_URI: $(Build.Repository.Uri)
+              BUILD_URI: $(Build.BuildUri)
 
-  - job: Windows
-    dependsOn: ["format"]
-    timeoutInMinutes: 360
-    pool:
-      vmImage: "windows-latest"
-    steps:
-      - bash: ci/run_envoy_docker.sh ci/windows_ci_steps.sh
-        displayName: "Run Windows CI"
-        env:
-          ENVOY_DOCKER_BUILD_DIR: "$(Build.StagingDirectory)"
-          ENVOY_RBE: "true"
-          BAZEL_BUILD_EXTRA_OPTIONS: "--config=remote-ci --config=remote-msvc-cl --jobs=$(RbeJobs)"
-          BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
-          BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
-          GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
-      - task: PublishBuildArtifacts@1
-        inputs:
-          pathtoPublish: "$(Build.StagingDirectory)/envoy"
-          artifactName: windows.release
-        condition: always()
+  - stage: windows
+    dependsOn: ["precheck"]
+    jobs:
+      - job: release
+        timeoutInMinutes: 360
+        pool:
+          vmImage: "windows-latest"
+        steps:
+          - bash: ci/run_envoy_docker.sh ci/windows_ci_steps.sh
+            displayName: "Run Windows CI"
+            env:
+              ENVOY_DOCKER_BUILD_DIR: "$(Build.StagingDirectory)"
+              ENVOY_RBE: "true"
+              BAZEL_BUILD_EXTRA_OPTIONS: "--config=remote-ci --config=remote-msvc-cl --jobs=$(RbeJobs)"
+              BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
+              BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
+              GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
+          - task: PublishBuildArtifacts@1
+            inputs:
+              pathtoPublish: "$(Build.StagingDirectory)/envoy"
+              artifactName: windows.release
+            condition: always()

From 863c49790160f14164d46175d4efaf9412ab1fe4 Mon Sep 17 00:00:00 2001
From: Lizan Zhou <lizan@tetrate.io>
Date: Tue, 20 Oct 2020 16:12:33 -0700
Subject: [PATCH 7/8] ci: various improvements (#13660)

Signed-off-by: Lizan Zhou <lizan@tetrate.io>
---
 .azure-pipelines/pipelines.yml | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/.azure-pipelines/pipelines.yml b/.azure-pipelines/pipelines.yml
index 4a128c44e224..e60c04242b8d 100644
--- a/.azure-pipelines/pipelines.yml
+++ b/.azure-pipelines/pipelines.yml
@@ -70,7 +70,6 @@ stages:
             inputs:
               pathtoPublish: "$(Build.SourcesDirectory)/generated/docs"
               artifactName: docs
-            condition: and(succeeded(), eq(variables['Build.Reason'], 'PullRequest'))
 
           - task: InstallSSHKey@0
             inputs:
@@ -78,7 +77,7 @@ stages:
               sshPublicKey: "$(DocsPublicKey)"
               sshPassphrase: "$(SshDeployKeyPassphrase)"
               sshKeySecureFile: "$(DocsPrivateKey)"
-            condition: and(succeeded(), ne(variables['Build.Reason'], 'PullRequest'), eq(variables['PostSubmit'], true))
+            condition: and(succeeded(), eq(variables['PostSubmit'], true), ne(variables['NoSync'], true))
 
           - script: docs/publish.sh
             displayName: "Publish to GitHub"
@@ -86,10 +85,10 @@ stages:
             env:
               AZP_BRANCH: $(Build.SourceBranch)
               AZP_SHA1: $(Build.SourceVersion)
-            condition: and(succeeded(), ne(variables['Build.Reason'], 'PullRequest'), eq(variables['PostSubmit'], true))
+            condition: and(succeeded(), eq(variables['PostSubmit'], true), ne(variables['NoSync'], true))
 
   - stage: sync
-    condition: and(succeeded(), eq(variables['PostSubmit'], true))
+    condition: and(succeeded(), eq(variables['PostSubmit'], true), ne(variables['NoSync'], true))
     dependsOn: []
     jobs:
       - job: filter_example
@@ -130,6 +129,8 @@ stages:
 
       - job: go_control_plane
         dependsOn: []
+        pool:
+          vmImage: "ubuntu-18.04"
         steps:
           - task: InstallSSHKey@0
             inputs:
@@ -152,12 +153,11 @@ stages:
 
   - stage: linux_x64
     dependsOn: ["precheck"]
-    # For master builds, continue even if precheck fails
-    condition: and(not(canceled()), or(succeeded(), ne(variables['Build.Reason'], 'PullRequest')))
+    # For post-submit builds, continue even if precheck fails
+    condition: and(not(canceled()), or(succeeded(), eq(variables['PostSubmit'], true)))
     jobs:
       - job: release
-        # For master builds, continue even if format fails
-        timeoutInMinutes: 360
+        timeoutInMinutes: 120
         pool:
           vmImage: "ubuntu-18.04"
         steps:
@@ -167,11 +167,11 @@ stages:
 
   - stage: linux_arm64
     dependsOn: ["precheck"]
-    # For master builds, continue even if precheck fails
-    condition: and(not(canceled()), or(succeeded(), ne(variables['Build.Reason'], 'PullRequest')))
+    # For post-submit builds, continue even if precheck fails
+    condition: and(not(canceled()), or(succeeded(), eq(variables['PostSubmit'], true)))
     jobs:
       - job: release
-        timeoutInMinutes: 360
+        timeoutInMinutes: 120
         pool: "arm-large"
         steps:
           - template: bazel.yml
@@ -203,7 +203,7 @@ stages:
               CI_TARGET: "bazel.tsan"
             compile_time_options:
               CI_TARGET: "bazel.compile_time_options"
-        timeoutInMinutes: 360
+        timeoutInMinutes: 120
         pool:
           vmImage: "ubuntu-18.04"
         steps:
@@ -214,7 +214,7 @@ stages:
       - job: coverage
         displayName: "linux_x64"
         dependsOn: []
-        timeoutInMinutes: 360
+        timeoutInMinutes: 120
         pool: "x64-large"
         strategy:
           maxParallel: 2
@@ -304,7 +304,7 @@ stages:
     dependsOn: ["precheck"]
     jobs:
       - job: test
-        timeoutInMinutes: 360
+        timeoutInMinutes: 180
         pool:
           vmImage: "macos-latest"
         steps:
@@ -338,7 +338,7 @@ stages:
     dependsOn: ["precheck"]
     jobs:
       - job: release
-        timeoutInMinutes: 360
+        timeoutInMinutes: 120
         pool:
           vmImage: "windows-latest"
         steps:

From 5da02bacf14ec4582a4e87eeb96244fa2bfdad40 Mon Sep 17 00:00:00 2001
From: asraa <asraa@google.com>
Date: Tue, 20 Oct 2020 14:02:21 -0400
Subject: [PATCH 8/8] mac ci: try ignoring update failure (#13658)

Signed-off-by: Asra Ali <asraa@google.com>
---
 ci/mac_ci_setup.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/ci/mac_ci_setup.sh b/ci/mac_ci_setup.sh
index 395c3297fe62..8eec2a712e33 100755
--- a/ci/mac_ci_setup.sh
+++ b/ci/mac_ci_setup.sh
@@ -38,8 +38,8 @@ function retry () {
 }
 
 if ! retry brew update; then
-    echo "Failed to update homebrew"
-    exit 1
+  # Do not exit early if update fails.
+  echo "Failed to update homebrew"
 fi
 
 DEPS="automake cmake coreutils go libtool wget ninja"