Fix websocket test flakes and complete TCP half-closed support #4052
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI Build & Push | |
| on: | |
| pull_request_target: | |
| types: [opened, synchronize, reopened] | |
| permissions: | |
| # To be able to access the repository with `actions/checkout` | |
| contents: read | |
| # Required to generate OIDC tokens for `sigstore/cosign-installer` authentication | |
| id-token: write | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.after }} | |
| cancel-in-progress: true | |
| jobs: | |
| build-and-push-prs: | |
| name: Build and push multi-arch images | |
| environment: | |
| name: ci-build | |
| deployment: false | |
| timeout-minutes: 360 | |
| runs-on: ${{ vars.PROXY_BUILD_GITHUB_RUNNER }} | |
| outputs: | |
| sha: ${{ steps.tag.outputs.sha }} | |
| steps: | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 | |
| with: | |
| image: tonistiigi/binfmt:qemu-v7.0.0-28 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 | |
| - name: Cache Docker layers | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: /tmp/buildx-cache | |
| key: docker-cache-${{ github.head_ref }} | |
| restore-keys: docker-cache-main | |
| - name: Login to quay.io | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 | |
| with: | |
| registry: quay.io | |
| username: ${{ secrets.QUAY_ENVOY_USERNAME_DEV }} | |
| password: ${{ secrets.QUAY_ENVOY_PASSWORD_DEV }} | |
| - name: Checkout PR | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| persist-credentials: false | |
| allow-unsafe-pr-checkout: true | |
| - name: Prep for build | |
| run: | | |
| echo "${{ github.event.pull_request.head.sha }}" >SOURCE_VERSION | |
| VERSION=$(cat ENVOY_VERSION) | |
| if [[ "$VERSION" =~ ^envoy-[0-9]+\.[0-9]+\.[0-9]+$ ]]; then | |
| PATCH="${VERSION#envoy-}" | |
| MINOR="${PATCH%.*}" | |
| echo "ENVOY_MINOR_RELEASE=v${MINOR}" >> $GITHUB_ENV | |
| echo "ENVOY_PATCH_RELEASE=v${PATCH}" >> $GITHUB_ENV | |
| else | |
| echo "Invalid ENVOY_VERSION format: '$VERSION'" && exit 1 | |
| fi | |
| echo "BUILDER_DOCKER_HASH=$(git ls-tree --full-tree HEAD -- ./Dockerfile.builder | awk '{ print $3 }')" >> $GITHUB_ENV | |
| - name: Checking if cilium-envoy-builder image exists | |
| id: cilium-builder-tag-in-repositories | |
| shell: bash | |
| run: | | |
| if docker buildx imagetools inspect quay.io/${{ github.repository_owner }}/cilium-envoy-builder-dev:${{ env.BUILDER_DOCKER_HASH }} &>/dev/null; then | |
| echo exists="true" >> $GITHUB_OUTPUT | |
| else | |
| echo exists="false" >> $GITHUB_OUTPUT | |
| fi | |
| - name: PR Multi-arch build & push of Builder image (dev) | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| if: steps.cilium-builder-tag-in-repositories.outputs.exists == 'false' | |
| id: docker_build_builder_ci | |
| with: | |
| provenance: false | |
| context: . | |
| file: ./Dockerfile.builder | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| tags: quay.io/${{ github.repository_owner }}/cilium-envoy-builder-dev:${{ env.BUILDER_DOCKER_HASH }} | |
| - name: CI Builder Image Digest | |
| if: steps.cilium-builder-tag-in-repositories.outputs.exists == 'false' | |
| shell: bash | |
| run: | | |
| echo "Digests:" | |
| echo "quay.io/${{ github.repository_owner }}/cilium-envoy-builder-dev:${{ env.BUILDER_DOCKER_HASH }}@${{ steps.docker_build_builder_ci.outputs.digest }}" | |
| - name: PR Multi-arch build & push of cilium-envoy | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| id: docker_build_ci | |
| with: | |
| provenance: false | |
| context: . | |
| file: ./Dockerfile | |
| platforms: linux/amd64,linux/arm64 | |
| build-args: | | |
| BUILDER_BASE=quay.io/cilium/cilium-envoy-builder-dev:${{ env.BUILDER_DOCKER_HASH }} | |
| ARCHIVE_IMAGE=quay.io/${{ github.repository_owner }}/cilium-envoy-builder:main-archive-latest | |
| BAZEL_BUILD_OPTS=--remote_upload_local_results=false | |
| cache-from: type=local,src=/tmp/buildx-cache | |
| cache-to: type=local,dest=/tmp/buildx-cache,mode=max | |
| push: true | |
| tags: quay.io/${{ github.repository_owner }}/cilium-envoy-dev:${{ github.event.pull_request.head.sha }} | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 | |
| - name: Sign Container Image | |
| run: | | |
| cosign sign -y quay.io/${{ github.repository_owner }}/cilium-envoy-dev@${{ steps.docker_build_ci.outputs.digest }} | |
| - name: Install Bom | |
| shell: bash | |
| env: | |
| # renovate: datasource=github-releases depName=kubernetes-sigs/bom | |
| BOM_VERSION: v0.7.1 | |
| run: | | |
| curl -L https://github.com/kubernetes-sigs/bom/releases/download/${{ env.BOM_VERSION }}/bom-amd64-linux -o bom | |
| sudo mv ./bom /usr/local/bin/bom | |
| sudo chmod +x /usr/local/bin/bom | |
| - name: Generate SBOM | |
| shell: bash | |
| # To-Do: generate SBOM from source after https://github.com/kubernetes-sigs/bom/issues/202 is fixed | |
| run: | | |
| bom generate -o sbom_cilium-envoy_${{ github.event.pull_request.head.sha }}.spdx --format=json --image=quay.io/${{ github.repository_owner }}/cilium-envoy-dev:${{ github.event.pull_request.head.sha }} | |
| - name: Attach SBOM to container images | |
| run: | | |
| cosign attach sbom --sbom sbom_cilium-envoy_${{ github.event.pull_request.head.sha }}.spdx quay.io/${{ github.repository_owner }}/cilium-envoy-dev@${{ steps.docker_build_ci.outputs.digest }} | |
| - name: Sign SBOM Image | |
| run: | | |
| docker_build_ci_digest="${{ steps.docker_build_ci.outputs.digest }}" | |
| image_name="quay.io/${{ github.repository_owner }}/cilium-envoy-dev:${docker_build_ci_digest/:/-}.sbom" | |
| docker_build_ci_sbom_digest="sha256:$(docker buildx imagetools inspect --raw ${image_name} | sha256sum | head -c 64)" | |
| cosign sign -y "quay.io/${{ github.repository_owner }}/cilium-envoy-dev@${docker_build_ci_sbom_digest}" | |
| - name: Envoy binary version check | |
| shell: bash | |
| run: | | |
| envoy_version=$(docker run --rm quay.io/${{ github.repository_owner }}/cilium-envoy-dev:${{ github.event.pull_request.head.sha }} cilium-envoy --version) | |
| expected_version=$(echo ${{ env.ENVOY_PATCH_RELEASE }} | sed 's/^v//') | |
| echo ${envoy_version} | |
| [[ "${envoy_version}" == *"${{ github.event.pull_request.head.sha }}/$expected_version"* ]] | |
| - name: CI Image Digest | |
| shell: bash | |
| run: | | |
| echo "Digests:" | |
| echo "quay.io/${{ github.repository_owner }}/cilium-envoy-dev:${{ github.event.pull_request.head.sha }}@${{ steps.docker_build_ci.outputs.digest }}" | |
| cilium-intergration-tests: | |
| name: Cilium Integration Tests | |
| needs: build-and-push-prs | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| statuses: write | |
| uses: ./.github/workflows/cilium-integration-tests.yaml | |
| with: | |
| repository: ${{ github.event.pull_request.head.repo.full_name }} | |
| commit_ref: ${{ github.event.pull_request.head.sha }} | |
| # pull_request_target runs the default-branch workflow files, so the Cilium | |
| # branch is derived from the PR base branch here instead of per-branch overrides. | |
| cilium_ref: ${{ github.base_ref == 'v1.37' && 'v1.20' || github.base_ref == 'v1.36' && 'v1.19' || 'main' }} | |
| secrets: inherit | |
| cilium-gateway-api-tests: | |
| name: Cilium Gateway API Tests | |
| needs: build-and-push-prs | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| statuses: write | |
| uses: ./.github/workflows/cilium-gateway-api.yaml | |
| with: | |
| repository: ${{ github.event.pull_request.head.repo.full_name }} | |
| commit_ref: ${{ github.event.pull_request.head.sha }} | |
| cilium_ref: ${{ github.base_ref == 'v1.37' && 'v1.20' || github.base_ref == 'v1.36' && 'v1.19' || 'main' }} | |
| secrets: inherit |