Try without old rt profile

Signed-off-by: Kateryna Nezdolii <kateryna.nezdolii@gmail.com>

Author: nezdolik

.github/workflows/ci-check-coverage.yaml

@@ -33,6 +33,10 @@ jobs:
         uses: google-github-actions/auth@v2
         with:
           credentials_json: ${{ secrets.CI_CILIUM_PROXY_SA_KEY }}
+      - name: set up google cloud sdk
+        uses: 'google-github-actions/setup-gcloud@v2'
+        with:
+          version: '>= 507.0.0'
       - name: Install deps (for C++)
         shell: bash
         run: |
@@ -45,46 +49,56 @@ jobs:
           sudo apt-add-repository -y "deb http://apt.llvm.org/jammy/ llvm-toolchain-jammy-18 main" && \
           sudo apt-get update && \
           sudo apt-get install -y --no-install-recommends \
-            clang-18 clangd-18 clang-tidy-18 clang-tools-18 llvm-18-dev lldb-18 lld-18 clang-format-18 libc++-18-dev libc++abi-18-dev && \
+            clang-18 clangd-18 clang-tidy-18 clang-tools-18 llvm-18-dev lldb-18 lld-18 clang-format-18 libc++-18-dev libc++abi-18-dev libclang-rt-18-dev lcov && \
           sudo apt-get purge --auto-remove && \
           sudo apt-get clean && \
           sudo rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
           cp /usr/lib/llvm-18/bin/llvm-cov /usr/local/bin
           cp /usr/lib/llvm-18/bin/llvm-profdata /usr/local/bin
-          #libclang_rt.profile is not installed from deb repo, doing this hack for now...
-          sudo mkdir -p /usr/lib/llvm-18/lib/clang/18/lib/linux/
-          sudo cp /usr/lib/llvm-15/lib/clang/15.0.7/lib/linux/libclang_rt.profile-x86_64.a /usr/lib/llvm-18/lib/clang/18/lib/linux/
-          clang --version
-          llvm-config --version
-      # - name: Install Go
-      #   uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
-      #   with:
-      #     # renovate: datasource=golang-version depName=go
-      #     go-version: 1.24.6
-      # - name: Sync crate lockfile with bazel
-      #   shell: bash
-      #   run: |
-      #     CARGO_BAZEL_ISOLATED=0 CARGO_BAZEL_REPIN=1 bazel sync --only=crate_index
-      # - name: Build proxylib
-      #   shell: bash
-      #   run: |
-      #     go version
-      #     # go mod tidy
-      #     # go mod vendor
-      #     # test -z "$(git status --porcelain)" || (echo "please run 'go mod tidy && go mod vendor', and submit your changes"; exit 1)
-      #     make -C proxylib
-      # - name: Build test deps
-      #   shell: bash
-      #   run: |
-      #     BAZEL_BUILD_OPTS="${BAZEL_BUILD_OPTS} --remote_cache=https://storage.googleapis.com/cilium-proxy-bazel-remote-cache --google_default_credentials" BAZEL_TEST_OPTS="--test_timeout=300 --local_test_jobs=1 --flaky_test_attempts=3" make envoy-test-deps
-      # - name: Generate coverage data
-      #   shell: bash
-      #   run: |
-      #     echo "Generating bazel coverage: "
-      #     ./tests/run_bazel_coverage.sh
-
-     #TODO(nezdolik)
-      # - name: Display coverage data
-
-
-
+      - name: Install Go
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        with:
+          # renovate: datasource=golang-version depName=go
+          go-version: 1.24.6
+      - name: Sync crate lockfile with bazel
+        shell: bash
+        run: |
+          CARGO_BAZEL_ISOLATED=0 CARGO_BAZEL_REPIN=1 bazel sync --only=crate_index
+      - name: Build proxylib
+        shell: bash
+        run: |
+          go version
+          make -C proxylib
+      - name: Build test deps
+        shell: bash
+        run: |
+          BAZEL_BUILD_OPTS="${BAZEL_BUILD_OPTS} --remote_cache=${{ vars.GCS_ARTIFACT_BUCKET_REMOTE_CACHE }} --google_default_credentials" BAZEL_TEST_OPTS="--test_timeout=300 --local_test_jobs=1 --flaky_test_attempts=3" make envoy-test-deps
+      - name: Generate coverage data
+        shell: bash
+        run: |
+          echo "Generating bazel coverage: "
+          ./tests/run_bazel_coverage.sh
+          ls -la /home/runner/work/cilium-proxy/cilium-proxy/generated/coverage/
+      - name: Upload (sync) to GCS bucket
+        if: '!cancelled()'
+        shell: bash
+        run: |
+          UPLOAD_DIR="/home/runner/work/cilium-proxy/cilium-proxy/generated/coverage/"
+          SHA=${{ github.sha }}
+          BUCKET_PATH="${{ vars.GCS_ARTIFACT_BUCKET_COVERAGE }}/${SHA:0:7}/coverage"
+          echo "Uploading to gs://$BUCKET_PATH ..."
+          gsutil \
+              -mq rsync \
+              -dr "$UPLOAD_DIR" \
+              "gs://$BUCKET_PATH"
+          echo "Artifacts uploaded to: https://storage.googleapis.com/$BUCKET_PATH/html/index.html" >&2
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - target: coverage
+          name: Coverage
+          diskspace-hack: true
+          diskspace-hack-paths: |
+            /opt/hostedtoolcache
+            /usr/local/lib/android

WORKSPACE

@@ -49,6 +49,10 @@ git_repository(
     # // clang-format on
 )
 
+load("//bazel:repo.bzl", "cilium_proxy_repo")
+
+cilium_proxy_repo()
+
 #
 # Bazel does not do transitive dependencies, so we must basically
 # include all of Envoy's WORKSPACE file below, with the following

bazel/repo.bzl

@@ -0,0 +1,75 @@
+# `@cilium_proxy_repo` repository rule for managing the repo and querying its metadata.
+
+def _cilium_proxy_repo_impl(repository_ctx):
+    """This provides information about the Envoy repository
+
+    You can access the current project and api versions and the path to the repository in
+    .bzl/BUILD files as follows:
+
+    ```starlark
+    load("@cilium_proxy_repo//:version.bzl", "VERSION", "API_VERSION")
+    ```
+
+    `*VERSION` can be used to derive version-specific rules and can be passed
+    to the rules.
+
+    The `VERSION`s and also the local `PATH` to the repo can be accessed in
+    python libraries/binaries. By adding `@cilium_proxy_repo` to `deps` they become
+    importable through the `cilium_proxy_repo` namespace.
+
+    As the `PATH` is local to the machine, it is generally only useful for
+    jobs that will run locally.
+
+    This can be useful, for example, for bazel run jobs to run bazel queries that cannot be run
+    within the constraints of a `genquery`, or that otherwise need access to the repository
+    files.
+
+    Project and repo data can be accessed in JSON format using `@cilium_proxy_repo//:project`, eg:
+
+    ```starlark
+    load("@aspect_bazel_lib//lib:jq.bzl", "jq")
+
+    jq(
+        name = "project_version",
+        srcs = ["@cilium_proxy_repo//:data"],
+        out = "version.txt",
+        args = ["-r"],
+        filter = ".version",
+    )
+
+    ```
+
+    """
+    repo_version_path = repository_ctx.path(repository_ctx.attr.envoy_version)
+    api_version_path = repository_ctx.path(repository_ctx.attr.envoy_api_version)
+    version = repository_ctx.read(repo_version_path).strip()
+    api_version = repository_ctx.read(api_version_path).strip()
+    repository_ctx.file("version.bzl", "VERSION = '%s'\nAPI_VERSION = '%s'" % (version, api_version))
+    repository_ctx.file("path.bzl", "PATH = '%s'" % repo_version_path.dirname)
+    repository_ctx.file("__init__.py", "PATH = '%s'\nVERSION = '%s'\nAPI_VERSION = '%s'" % (repo_version_path.dirname, version, api_version))
+    repository_ctx.file("WORKSPACE", "")
+    repository_ctx.file("BUILD", '''
+load("@rules_python//python:defs.bzl", "py_library")
+load("@rules_python//python/entry_points:py_console_script_binary.bzl", "py_console_script_binary")
+load("//:path.bzl", "PATH")
+
+py_library(
+    name = "cilium_proxy_repo",
+    srcs = ["__init__.py"],
+    visibility = ["//visibility:public"],
+)
+
+''')
+
+_cilium_proxy_repo = repository_rule(
+    implementation = _cilium_proxy_repo_impl,
+    attrs = {
+        #todo(nezdolik) add cilium version
+        "envoy_version": attr.label(default = "@envoy//:VERSION.txt"),
+        "envoy_api_version": attr.label(default = "@envoy//:API_VERSION.txt"),
+    },
+)
+
+def cilium_proxy_repo():
+    if "cilium_proxy_repo" not in native.existing_rules().keys():
+        _cilium_proxy_repo(name = "cilium_proxy_repo")

envoy.bazelrc

@@ -262,7 +262,7 @@ build:coverage --linkopt=-Wl,-s,--no-relax
 build:coverage --test_env=ENVOY_IP_TEST_VERSIONS=v4only
 build:coverage --define=dynamic_link_tests=false
 # Use custom report generator that also generates HTML
-build:coverage --coverage_report_generator=@envoy//tools/coverage:report_generator
+build:coverage --coverage_report_generator=//tools/coverage:cilium_report_generator
 
 build:test-coverage --test_arg="-l trace"
 build:test-coverage --test_arg="--log-path /dev/null"

tests/BUILD

@@ -1,3 +1,4 @@
+load("@aspect_bazel_lib//lib:yq.bzl", "yq")
 load(
     "@envoy//bazel:envoy_build_system.bzl",
     "envoy_cc_test",
@@ -18,6 +19,14 @@ api_cc_py_proto_library(
     srcs = ["bpf_metadata.proto"],
 )
 
+yq(
+    name = "coverage_config",
+    srcs = [":coverage.yaml"],
+    outs = ["cilium_coverage_config.json"],
+    args = ["-o=json"],
+    visibility = ["//visibility:public"],
+)
+
 envoy_cc_test_library(
     name = "accesslog_server_lib",
     srcs = ["accesslog_server.cc"],

tests/coverage.yaml

@@ -0,0 +1,7 @@
+thresholds:
+  total: 95.0
+  per_directory: 95.0
+
+directories:
+  cilium: 95.0
+  linux: 95.0

tests/run_bazel_coverage.sh

@@ -42,7 +42,24 @@ else
   COVERAGE_TARGETS=(//tests/...)
 fi
 
-BAZEL_COVERAGE_OPTIONS=(--heap_dump_on_oom)
+BAZEL_COVERAGE_OPTIONS=()
+BAZEL_COVERAGE_OPTIONS+=(--heap_dump_on_oom)
+BAZEL_COVERAGE_OPTIONS+=(--action_env=BAZEL_USE_LLVM_NATIVE_COVERAGE=1)
+BAZEL_COVERAGE_OPTIONS+=(--combined_report=lcov)
+BAZEL_COVERAGE_OPTIONS+=(--coverage_report_generator=//tools/coverage:cilium_report_generator)
+BAZEL_COVERAGE_OPTIONS+=(--experimental_use_llvm_covmap)
+BAZEL_COVERAGE_OPTIONS+=(--experimental_generate_llvm_lcov)
+BAZEL_COVERAGE_OPTIONS+=(--experimental_split_coverage_postprocessing)
+BAZEL_COVERAGE_OPTIONS+=(--experimental_fetch_all_coverage_outputs)
+BAZEL_COVERAGE_OPTIONS+=(--collect_code_coverage)
+BAZEL_COVERAGE_OPTIONS+=(--remote_download_minimal)
+BAZEL_COVERAGE_OPTIONS+=(--copt=-DNDEBUG)
+BAZEL_COVERAGE_OPTIONS+=(--build_tests_only)
+#from envoy
+BAZEL_COVERAGE_OPTIONS+=(--experimental_repository_cache_hardlinks)
+BAZEL_COVERAGE_OPTIONS+=(--verbose_failures)
+BAZEL_COVERAGE_OPTIONS+=(--experimental_generate_json_trace_profile)
+BAZEL_COVERAGE_OPTIONS+=(--action_env=GCOV=llvm-profdata)
 BAZEL_VALIDATE_OPTIONS=()
 
 
@@ -53,6 +70,9 @@ BAZEL_BUILD_OPTIONS+=("--google_default_credentials")
 
 COVERAGE_DIR="${SRCDIR}/generated/coverage"
 
+COVERAGE_DATA="${COVERAGE_DIR}/coverage.dat"
+
+
 run_coverage() {
     echo "Running bazel coverage with:"
     echo "  Options: ${BAZEL_BUILD_OPTIONS[*]} ${BAZEL_COVERAGE_OPTIONS[*]}"
@@ -68,15 +88,25 @@ run_coverage() {
     fi
 }
 
-render_coverage_results() {
-  declare -r COVERAGE_DIR="${SRCDIR}"/generated/coverage
-  declare -r COVERAGE_SUMMARY="${COVERAGE_DIR}/coverage_summary.txt"
-  mkdir -p "${COVERAGE_DIR}"
-  genhtml bazel-out/_coverage/_coverage_report.dat --output-directory="${COVERAGE_DIR}" | tee "${COVERAGE_SUMMARY}"
+unpack_coverage_results() {
+    rm -rf "${COVERAGE_DIR}"
+    mkdir -p "${COVERAGE_DIR}"
+    rm -f bazel-out/_coverage/_coverage_report.tar.zst
+    mv bazel-out/_coverage/_coverage_report.dat bazel-out/_coverage/_coverage_report.tar.zst
+    bazel run "${BAZEL_BUILD_OPTIONS[@]}" --nobuild_tests_only @envoy//tools/zstd -- -d -c "${PWD}/bazel-out/_coverage/_coverage_report.tar.zst" \
+        | tar -xf - -C "${COVERAGE_DIR}"
+    COVERAGE_JSON="${COVERAGE_DIR}/coverage.json"
 }
 
-
+validate_coverage() {
+    bazel run \
+          "${BAZEL_BUILD_OPTIONS[@]}" \
+          "${BAZEL_VALIDATE_OPTIONS[@]}" \
+          --nobuild_tests_only \
+          //tools/coverage:validate \
+          "$COVERAGE_JSON"
+}
 
 run_coverage
-render_coverage_results
-
+unpack_coverage_results
+validate_coverage

tools/coverage/BUILD

@@ -0,0 +1,99 @@
+load("@aspect_bazel_lib//lib:jq.bzl", "jq")
+load("@cilium_proxy_repo//:path.bzl", "PATH")
+load("@rules_shell//shell:sh_binary.bzl", "sh_binary")
+load("@envoy//bazel:envoy_build_system.bzl", "envoy_package")
+
+licenses(["notice"])  # Apache 2
+
+envoy_package()
+
+exports_files(glob(["templates/*.html"]))
+
+genrule(
+    name = "grcov",
+    srcs = ["@grcov"],
+    outs = ["grcov_bin"],
+    cmd = "cp $< $@ && chmod +x $@",
+    executable = True,
+    visibility = ["//visibility:public"],
+)
+
+jq(
+    name = "grcov_config",
+    srcs = [],
+    out = "grcov_config.json",
+    args = [
+        "-sR",
+        "--arg",
+        "macros",
+        "$(location :templates/macros.html)",
+        "--arg",
+        "base",
+        "$(location :templates/base.html)",
+        "--arg",
+        "index",
+        "$(location :templates/index.html)",
+    ],
+    data = [
+        ":templates/base.html",
+        ":templates/index.html",
+        ":templates/macros.html",
+    ],
+    expand_args = True,
+    filter = """
+    {templates: {
+       "base.html": $base,
+       "index.html": $index,
+       "macros.html": $macros}}
+    """,
+)
+
+# This is a bit of a hack, and totally non-hermetic
+# grcov needs access to the source files, so the path
+# is injected here. This means CoverageReportGenerator cannot
+# run remote.
+genrule(
+    name = "cilium_report_generator_script",
+    srcs = ["report_generator.sh.template"],
+    outs = ["report_generator.sh"],
+    cmd = "sed 's|@@WORKSPACE_PATH@@|$$(realpath %s)|g' $< > $@" % PATH,
+)
+
+label_flag(
+    name = "config",
+    build_setting_default = "//tests:coverage_config",
+    visibility = ["//visibility:public"],
+)
+
+sh_binary(
+    name = "cilium_report_generator",
+    srcs = [":cilium_report_generator_script"],
+    data = [
+        ":config",
+        ":filter.jq",
+        ":grcov_bin",
+        ":grcov_config",
+        ":templates/base.html",
+        ":templates/index.html",
+        ":templates/macros.html",
+        "@envoy//tools/zstd",
+        "@jq_toolchains//:resolved_toolchain",
+    ],
+    toolchains = ["@jq_toolchains//:resolved_toolchain"],
+    visibility = ["//visibility:public"],
+)
+
+sh_binary(
+    name = "validate",
+    srcs = [":validate.sh"],
+    data = [
+        ":config",
+        "@jq_toolchains//:resolved_toolchain",
+    ],
+    env = {
+        "JQ_BIN": "$(JQ_BIN)",
+        "COVERAGE_CONFIG": "$(location :config)",
+    },
+    toolchains = ["@jq_toolchains//:resolved_toolchain"],
+    visibility = ["//visibility:public"],
+)