envoy-sync.yaml

name: Sync Envoy

on:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  sync:
    runs-on: ubuntu-22.04
    permissions:
      contents: write
    if: |
      ${{
          !contains(github.actor, '[bot]')
          || github.actor == 'sync-envoy[bot]'
      }}
    steps:
    - id: appauth
      uses: envoyproxy/toolshed/gh-actions/appauth@5ef04d5f8144dc3a1a8c05bd81b0ef267c0849f5  # actions-v0.1.83
      with:
        key: ${{ secrets.ENVOY_CI_UPDATE_BOT_KEY }}
        app_id: ${{ secrets.ENVOY_CI_UPDATE_APP_ID }}

    # Checkout the repo
    - name: 'Checkout Repository'
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
      with:
        ref: main
        fetch-depth: 0
        token: ${{ steps.appauth.outputs.token }}

    # Checkout the Envoy repo
    - name: 'Checkout Repository'
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
      with:
        repository: envoyproxy/envoy
        ref: main
        fetch-depth: 0
        path: upstream

    - run: mv upstream ../envoy
    - run: ci/sync_envoy.sh
      env:
        ENVOY_SRC_DIR: ../envoy