envoy/.github/workflows/_publish_build.yml at main · wbpcode/envoy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
name: Build

permissions:
  contents: read

on:
  workflow_call:
    secrets:
      dockerhub-token:
      gpg-key:
        required: true
      gpg-key-password:
        required: true
    inputs:
      arch:
        type: string
        required: true
      request:
        type: string
        required: true
      trusted:
        type: boolean
        required: true


concurrency:
  group: >-
    ${{ github.actor != 'trigger-release-envoy[bot]'
        && github.event.inputs.head_ref
        || github.run_id
    }}-${{ inputs.arch }}-${{ github.event.workflow.id }}-publish
  cancel-in-progress: true


jobs:
  binary:
    secrets:
      dockerhub-token: ${{ secrets.dockerhub-token }}
    permissions:
      actions: read
      contents: read
      packages: read
    name: Binary
    uses: ./.github/workflows/_run.yml
    with:
      arch: ${{ inputs.arch }}
      bazel-cache: true
      bazel-extra: >-
        --config=rbe
      target: release.server_only
      target-suffix: ${{ inputs.arch }}
      cache-build-image: ${{ fromJSON(inputs.request).request.build-image.default }}
      cache-build-image-key-suffix: ${{ inputs.arch == 'arm64' && '-arm64' || '' }}
      concurrency-suffix: -${{ inputs.arch }}
      rbe: true
      request: ${{ inputs.request }}
      runs-on: ${{ inputs.arch == 'arm64' && (vars.ENVOY_ARM_VM || 'ubuntu-24.04-arm') || null }}
      timeout-minutes: 120
      trusted: ${{ inputs.trusted }}
      upload-name: release.${{ inputs.arch }}
      upload-path: container/envoy/${{ inputs.arch }}/bin/

  docker:
    secrets:
      dockerhub-token: ${{ secrets.dockerhub-token }}
    permissions:
      actions: read
      contents: read
      packages: read
    name: Docker OCI
    needs:
    - binary
    uses: ./.github/workflows/_run.yml
    with:
      arch: ${{ inputs.arch }}
      target: docker
      target-suffix: ${{ inputs.arch }}
      cache-build-image: ${{ fromJSON(inputs.request).request.build-image.default }}
      cache-build-image-key-suffix: ${{ inputs.arch == 'arm64' && '-arm64' || '' }}
      concurrency-suffix: -${{ inputs.arch }}
      downloads: |
        release.${{ inputs.arch }}: container/envoy/${{ inputs.arch }}/bin/
      request: ${{ inputs.request }}
      source: |
        export NO_BUILD_SETUP=1
        export ENVOY_DOCKER_IN_DOCKER=1
        export ENVOY_DOCKER_SAVE_IMAGE=true
        export ENVOY_OCI_DIR=build_images
      trusted: ${{ inputs.trusted }}
      upload-name: oci.${{ inputs.arch }}
      upload-path: container/envoy/${{ inputs.arch }}/build_images
      runs-on: ${{ inputs.arch == 'arm64' && (vars.ENVOY_ARM_VM || 'ubuntu-24.04-arm') || null }}

  distribution:
    secrets:
      dockerhub-token: ${{ secrets.dockerhub-token }}
      gpg-key: ${{ secrets.gpg-key }}
      gpg-key-password: ${{ secrets.gpg-key-password }}
    permissions:
      actions: read
      contents: read
      packages: read
    name: Packages
    needs:
    - binary
    uses: ./.github/workflows/_run.yml
    with:
      arch: ${{ inputs.arch }}
      bazel-cache: true
      bazel-extra: >-
        --config=remote-cache
      downloads: |
        release.${{ inputs.arch }}: container/release/${{ inputs.arch }}/bin/
      target: distribution
      target-suffix: ${{ inputs.arch }}
      cache-build-image: ${{ fromJSON(inputs.request).request.build-image.default }}
      cache-build-image-key-suffix: ${{ inputs.arch == 'arm64' && '-arm64' || '' }}
      concurrency-suffix: -${{ inputs.arch }}
      docker-ci: false
      import-gpg: true
      rbe: false
      request: ${{ inputs.request }}
      runs-on: ${{ inputs.arch == 'arm64' && (vars.ENVOY_ARM_VM || 'ubuntu-24.04-arm') || null }}
      trusted: ${{ inputs.trusted }}
      upload-name: packages.${{ inputs.arch }}
      upload-path: container/envoy/${{ inputs.arch }}