ci: Improve/make extensible (#727)

phlax · web-flow · commit c057d7a3166f · 2025-07-08T01:34:37.000+01:00
Signed-off-by: Ryan Northey &lt;ryan@synca.io&gt;
diff --git a/.bazelrc b/.bazelrc
@@ -6,6 +6,15 @@ common:ci --test_output=errors
 
 common:examples --action_env=DEV_CONTAINER_ID
 common:examples --host_action_env=DEV_CONTAINER_ID
+common:examples --action_env=DEV_CONTAINER_ID
+common:examples --host_action_env=DEV_CONTAINER_ID
+common:examples --action_env=DOCKER_BUILDKIT
+common:examples --host_action_env=DOCKER_BUILDKIT
+common:examples --action_env=COMPOSE_BAKE
+common:examples --host_action_env=COMPOSE_BAKE
+common:examples --action_env=BUILDKIT_PROGRESS
+common:examples --host_action_env=BUILDKIT_PROGRESS
+common:examples --sandbox_writable_path=/var/run/docker.sock
 
 try-import %workspace%/user.bazelrc
 try-import %workspace%/repo.bazelrc
diff --git a/.github/workflows/_verify_examples.yml b/.github/workflows/_verify_examples.yml
@@ -1,21 +1,14 @@
-name: Verify
+name: Verify/Examples
 
 permissions:
   contents: read
 
 on:
-  pull_request:
-  push:
-    branches:
-    - main
-
-concurrency:
-  group: >-
-    ${{ github.event.inputs.head_ref || github.run_id }}
+  workflow_call:
 
 
 jobs:
-  verify:
+  examples:
     runs-on: ubuntu-24.04
     steps:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
@@ -30,18 +23,10 @@ jobs:
         path: /cache/docker
         key: ${{ runner.os }}-docker-${{ hashFiles('**/Dockerfile*') }}
     - run: |
-        sudo systemctl stop docker docker.socket
-        sudo rm -rf /var/lib/docker/{*,.*}
         TEMPDIR=/cache/docker
-        zstd --stdout -d "${TEMPDIR}/docker.tar.zst" | sudo tar --warning=no-timestamp -xf - -C /var/lib/docker
+        zstd --stdout -d "${TEMPDIR}/docker.tar.zst" | sudo tar --warning=no-timestamp -xf - -C /var/lib/docker-examples
         sudo umount "$TEMPDIR"
-        sudo systemctl start docker
       if: steps.cache.outputs.cache-hit == 'true'
-    - run: |
-        sudo systemctl stop docker docker.socket
-        sudo rm -rf /var/lib/docker/{*,.*}
-        sudo systemctl start docker
-      if: steps.cache.outputs.cache-hit != 'true' && github.event_name != 'pull_request'
 
     - run: |
         TEMPDIR=/cache/docker
@@ -53,24 +38,22 @@ jobs:
         path: /home/runner/.cache
         key: ${{ runner.os }}-bazel-${{ hashFiles('**/BUILD', '**/*bzl', 'WORKSPACE') }}
 
-    - run: |
-        sudo apt-get update
-        sudo apt-get -qq install -y --no-install-recommends expect gettext yq whois
     - run: |
         docker pull envoyproxy/envoy:dev
         DEV_CONTAINER_ID=$(docker inspect --format='{{.Id}}' envoyproxy/envoy:dev)
         echo "DEV_CONTAINER_ID=${DEV_CONTAINER_ID}" >> $GITHUB_ENV
     - run: |
-        echo "common:examples --sandbox_writable_path=$HOME/.docker/" > repo.bazelrc
-        echo "common:examples --sandbox_writable_path=$HOME" >> repo.bazelrc
-        bazel run --config=ci \
-                  --config=examples \
-                  //:verify_examples
+        export UID
+        echo "common --config=ci" >> repo.bazelrc
+        docker compose run --quiet --quiet-pull --quiet-build examples
+      env:
+        DOCKER_BUILDKIT: 1
+        COMPOSE_BAKE: true
+        BUILDKIT_PROGRESS: quiet
 
     - run: |
-        sudo systemctl stop docker docker.socket
         TEMPDIR=/cache/docker
-        sudo tar cf - -C /var/lib/docker . | zstd - -q -T0 -o "${TEMPDIR}/docker.tar.zst"
+        sudo tar cf - -C /var/lib/docker-examples . | zstd - -q -T0 -o "${TEMPDIR}/docker.tar.zst"
         ls -alh "${TEMPDIR}/docker.tar.zst"
       if: steps.cache.outputs.cache-hit != 'true' && github.event_name != 'pull_request'
     - uses: actions/cache/save@v4
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
@@ -16,7 +16,7 @@ concurrency:
 
 jobs:
   docs:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
       with:
@@ -26,5 +26,14 @@ jobs:
       with:
         path: examples
     - run: |
-        bazel build --override_repository=envoy_examples=../examples --config=ci //docs
-      working-directory: envoy
+        export UID
+        docker compose run --quiet --quiet-pull --quiet-build docs
+      working-directory: examples
+      env:
+        BAZEL_BUILD_EXTRA_OPTIONS: >-
+          --override_repository=envoy_examples=../examples
+          --config=ci
+          --@rules_python//python/config_settings:bootstrap_impl=script
+        DOCKER_BUILDKIT: 1
+        COMPOSE_BAKE: true
+        BUILDKIT_PROGRESS: quiet
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
@@ -0,0 +1,19 @@
+name: Verify
+
+permissions:
+  contents: read
+
+on:
+  pull_request:
+  push:
+    branches:
+    - main
+
+concurrency:
+  group: >-
+    ${{ github.event.inputs.head_ref || github.run_id }}
+
+
+jobs:
+  examples:
+    uses: ./.github/workflows/_verify_examples.yml
diff --git a/.yamllint b/.yamllint
@@ -29,3 +29,4 @@ ignore:
 - "**/*template.yaml"
 - examples/single-page-app/_github-clusters.yml
 - test/config/integration/server_xds.cds.with_unknown_field.yaml
+- "**/node_modules/**"
diff --git a/_docker/Dockerfile-docs b/_docker/Dockerfile-docs
@@ -0,0 +1 @@
+FROM envoyproxy/envoy-build:llvm-a3be5281b88359ab536d052218a30a951c97d751@sha256:5e29f02effdc49483d1e8bc3093c54ed54fa8821bb4aa228d7b2f9769647d18e
diff --git a/_docker/Dockerfile-examples b/_docker/Dockerfile-examples
@@ -0,0 +1 @@
+FROM envoyproxy/envoy-build:docker-a3be5281b88359ab536d052218a30a951c97d751@sha256:ca020f5e40f928fc2ad1c03be1888b314a3b085d60bea59ef2941219c4669c5a
diff --git a/_docker/docs-entrypoint-extra.sh b/_docker/docs-entrypoint-extra.sh
@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+
+set -e -o pipefail
+
+su - envoybuild -c "git config --global --add safe.directory /workspace/envoy"
+mkdir -p /workspace/envoy/generated/docs
+chown envoybuild:envoybuild /workspace/envoy/generated/docs
diff --git a/_docker/examples-cleanup.sh b/_docker/examples-cleanup.sh
@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+
+set -e -o pipefail
+
+rm -f repo.bazelrc
diff --git a/_docker/examples-entrypoint-extra.sh b/_docker/examples-entrypoint-extra.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+set -e -o pipefail
+
+echo "common:examples --sandbox_writable_path=/home/envoybuild" >> repo.bazelrc
+echo "common:examples --sandbox_writable_path=/home/envoybuild/.docker" >> repo.bazelrc
diff --git a/cache/docker-compose.yaml b/cache/docker-compose.yaml
@@ -17,8 +17,8 @@ services:
       context: ../shared/python
       target: aiohttp-service
     volumes:
-    - "${CACHE_RESPONSES_YAML:-./responses.yaml}:/etc/responses.yaml"
-    - ./service.py:/code/service.py
+    - "${CACHE_RESPONSES_YAML:-${PWD}/responses.yaml}:/etc/responses.yaml"
+    - "${PWD}/service.py:/code/service.py"
     environment:
     - SERVICE_NAME=1
 
@@ -27,7 +27,7 @@ services:
       context: ../shared/python
       target: aiohttp-service
     volumes:
-    - "${CACHE_RESPONSES_YAML:-./responses.yaml}:/etc/responses.yaml"
-    - ./service.py:/code/service.py
+    - "${CACHE_RESPONSES_YAML:-${PWD}/responses.yaml}:/etc/responses.yaml"
+    - "${PWD}/service.py:/code/service.py"
     environment:
     - SERVICE_NAME=2
diff --git a/cache/verify.sh b/cache/verify.sh
@@ -3,7 +3,7 @@
 export NAME=cache
 
 export PORT_PROXY="${CACHE_PORT_PROXY:-10300}"
-export CACHE_RESPONSES_YAML=./ci-responses.yaml
+export CACHE_RESPONSES_YAML="${PWD}/ci-responses.yaml"
 
 
 # shellcheck source=verify-common.sh
diff --git a/docker-compose.yml b/docker-compose.yml
@@ -0,0 +1,62 @@
+services:
+  # assumes you have envoy checked out - docs are built in envoy workspace
+  docs:
+    build:
+      context: .
+      dockerfile: _docker/Dockerfile-docs
+    depends_on:
+    - html
+    volumes:
+    - "${PWD}/../envoy:/workspace/envoy"
+    - "${PWD}:/workspace/examples"
+    - "${PWD}/_docker/docs-entrypoint-extra.sh:/entrypoint-extra.sh"
+    - "${HOME}/.cache/envoy/examples:/home/envoybuild/.cache"
+    working_dir: /workspace/envoy
+    command:
+    - bash
+    - -c
+    - |
+      ./ci/do_ci.sh docs
+    environment:
+      BAZEL_BUILD_EXTRA_OPTIONS: >-
+        ${BAZEL_BUILD_EXTRA_OPTIONS:-
+        --override_repository=envoy_examples=../examples
+        --@rules_python//python/config_settings:bootstrap_impl=script}
+      BUILD_UID: "${UID:-1000}"
+      GITHUB_TOKEN: "${GITHUB_TOKEN:-}"
+
+  examples:
+    build:
+      context: .
+      dockerfile: _docker/Dockerfile-examples
+    privileged: true
+    cgroup: host
+    volumes:
+    - "${PWD}/../envoy:/workspace/envoy"
+    - "${PWD}:/workspace/examples"
+    - "${PWD}/_docker/examples-entrypoint-extra.sh:/entrypoint-extra.sh"
+    - "${PWD}/_docker/examples-cleanup.sh:/cleanup.sh"
+    - "${HOME}/.cache/envoy/examples:/home/envoybuild/.cache"
+    - "${DOCKER_EXAMPLES_LIB:-/var/lib/docker-examples}:/var/lib/docker"
+    - "${DOCKER_EXAMPLES_LOG:-/var/log/docker-examples}:/var/log/docker"
+    working_dir: /workspace/examples
+    environment:
+      BAZEL_BUILD_EXTRA_OPTIONS: "${BAZEL_BUILD_EXTRA_OPTIONS:-}"
+      BUILD_UID: "${UID:-1000}"
+      GITHUB_TOKEN: "${GITHUB_TOKEN:-}"
+      DEV_CONTAINER_ID: "${DEV_CONTAINER_ID:-}"
+      DOCKER_BUILDKIT: "${DOCKER_BUILDKIT:-1}"
+      COMPOSE_BAKE: "${COMPOSE_BAKE:-true}"
+      BUILDKIT_PROGRESS: "${BUILDKIT_PROGRESS:-quiet}"
+    command:
+    - bash
+    - -c
+    - |
+      bazel run ${BAZEL_BUILD_EXTRA_OPTIONS} --config=examples //:verify_examples
+
+  html:
+    image: nginx
+    volumes:
+    - "${PWD}/../envoy/generated/docs:/usr/share/nginx/html"
+    ports:
+    - "9090:80"
diff --git a/single-page-app/docker-compose.yml b/single-page-app/docker-compose.yml
@@ -40,6 +40,7 @@ services:
       touch /var/lib/envoy/lds.yml
       chmod +w /var/lib/envoy/lds.yml
       exec envoy "$${@}"
+      rm /var/lib/envoy/lds.yml
     volumes:
     - ${SECRETS_PATH:-./secrets}:/etc/envoy/secrets
     - ${XDS_PATH:-./xds}:/var/lib/envoy
diff --git a/single-page-app/verify.sh b/single-page-app/verify.sh
@@ -17,6 +17,9 @@ BACKUP_FILES=(
 
 
 finally () {
+    if [[ -n "$DEBUG_EXIT" ]]; then
+        return
+    fi
     rm -rf .local.ci
     for file in "${BACKUP_FILES[@]}"; do
         move_if_exists "${file}.bak" "${file}"
@@ -133,7 +136,7 @@ test_auth () {
         "${proxy_scheme}://localhost:${proxy_port}/login" \
         "${curl_args[@]}"
 
-    random=$(head /dev/urandom | xxd -p | head -c 16)
+    random=$(openssl rand -hex 8 | head -c -1)
     hmac=$(echo -n "${random}" | openssl dgst -sha256 -hmac "${HMAC_SECRET}" -binary|base64)
     csrf_token=${random}.${hmac}
     encoded_state=$(echo -n "{\"url\":\"${proxy_scheme}://localhost:${proxy_port}/login\",\"csrf_token\":\"${csrf_token}\"}" | basenc --base64url --wrap=0 | sed 's/=//g')
@@ -287,11 +290,13 @@ echo "VITE_APP_AUTH_PROVIDER=github" > .local.ci/ui/.env.local
 
 run_log "Rebuild the app and restart Envoy (Github)"
 export ENVOY_CONFIG=.local.ci/envoy.yml
+# without this the image does not get rebuilt with the new config
+export COMPOSE_BAKE=false
 docker compose run --rm ui build.sh
 docker compose up --build -d envoy
 
 run_log "Test dev app (Github)"
-wait_for 5 \
+wait_for 10 \
     bash -c "\
         responds_with \
             \"Envoy single page app example\" \
@@ -300,6 +305,7 @@ run_log "Inititiate dev login (Github)"
 responds_with_header \
     "HTTP/1.1 302 Found" \
     "http://localhost:${PORT_DEV_PROXY}/login"
+
 responds_with_header \
     "location: https://github.com/login/oauth/authorize?client_id=XXX&code_challenge=[A-Za-z0-9_-]\{1,\}&code_challenge_method=S256&redirect_uri=http%3A%2F%2Flocalhost%3A${PORT_DEV_PROXY}%2Fauthorize&response_type=code&scope=user%3Aemail&state=[A-Za-z0-9_-]\{1,\}" \
     "http://localhost:${PORT_DEV_PROXY}/login"
diff --git a/verify-common.sh b/verify-common.sh
@@ -71,6 +71,9 @@ bring_up_example () {
 }
 
 bring_down_example () {
+    if [[ -n "$DEBUG_EXIT" ]]; then
+        return
+    fi
     local path paths
     read -ra paths <<< "$(echo "$PATHS" | tr ',' ' ')"
     for path in "${paths[@]}"; do
@@ -235,6 +238,11 @@ wait_for () {
     return "$returns"
 }
 
+debug_exit () {
+    DEBUG_EXIT=1
+    exit 0
+}
+
 trap 'cleanup' EXIT
 
 if [[ -z "$NAME" ]]; then

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+FROM envoyproxy/envoy-build:llvm-a3be5281b88359ab536d052218a30a951c97d751@sha256:5e29f02effdc49483d1e8bc3093c54ed54fa8821bb4aa228d7b2f9769647d18e`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+FROM envoyproxy/envoy-build:docker-a3be5281b88359ab536d052218a30a951c97d751@sha256:ca020f5e40f928fc2ad1c03be1888b314a3b085d60bea59ef2941219c4669c5a`