[bp/1.30] CI migration stack

.bazelrc

@@ -42,10 +42,6 @@ build:windows --action_env=PATH --host_action_env=PATH
 # Requires setting `BAZEL_VOLATILE_DIRTY` in the env.
 build --action_env=BAZEL_VOLATILE_DIRTY --host_action_env=BAZEL_VOLATILE_DIRTY
 
-# Prevent stamped caches from busting (eg in PRs)
-# Requires setting `BAZEL_FAKE_SCM_REVISION` in the env.
-build --action_env=BAZEL_FAKE_SCM_REVISION --host_action_env=BAZEL_FAKE_SCM_REVISION
-
 build --test_summary=terse
 
 build:docs-ci --action_env=DOCS_RST_CHECK=1 --host_action_env=DOCS_RST_CHECK=1
@@ -523,19 +519,27 @@ build:rbe-engflow --bes_timeout=3600s
 build:rbe-engflow --bes_upload_mode=fully_async
 build:rbe-engflow --nolegacy_important_outputs
 
-build:cache-envoy-engflow --google_default_credentials=false
+# RBE (Engflow Envoy)
+build:common-envoy-engflow --google_default_credentials=false
+build:common-envoy-engflow --credential_helper=*.engflow.com=%workspace%/bazel/engflow-bazel-credential-helper.sh
+build:common-envoy-engflow --grpc_keepalive_time=30s
+
 build:cache-envoy-engflow --remote_cache=grpcs://morganite.cluster.engflow.com
 build:cache-envoy-engflow --remote_timeout=3600s
-build:cache-envoy-engflow --credential_helper=*.engflow.com=%workspace%/bazel/engflow-bazel-credential-helper.sh
-build:cache-envoy-engflow --grpc_keepalive_time=30s
 build:bes-envoy-engflow --bes_backend=grpcs://morganite.cluster.engflow.com/
 build:bes-envoy-engflow --bes_results_url=https://morganite.cluster.engflow.com/invocation/
 build:bes-envoy-engflow --bes_timeout=3600s
 build:bes-envoy-engflow --bes_upload_mode=fully_async
-build:rbe-envoy-engflow --config=cache-envoy-engflow
-build:rbe-envoy-engflow --config=bes-envoy-engflow
+build:bes-envoy-engflow --nolegacy_important_outputs
 build:rbe-envoy-engflow --remote_executor=grpcs://morganite.cluster.engflow.com
-build:rbe-envoy-engflow --remote_default_exec_properties=container-image=docker://docker.io/envoyproxy/envoy-build-ubuntu:f94a38f62220a2b017878b790b6ea98a0f6c5f9c@sha256:2dd96b6f43c08ccabd5f4747fce5854f5f96af509b32e5cf6493f136e9833649
+build:rbe-envoy-engflow --remote_default_exec_properties=container-image=docker://gcr.io/envoy-ci/envoy-build@sha256:7adc40c09508f957624c4d2e0f5aeecb73a59207ee6ded53b107eac828c091b2
+build:rbe-envoy-engflow --jobs=200
+build:rbe-envoy-engflow --define=engflow_rbe=true
+
+build:remote-envoy-engflow --config=common-envoy-engflow
+build:remote-envoy-engflow --config=cache-envoy-engflow
+build:remote-envoy-engflow --config=bes-envoy-engflow
+build:remote-envoy-engflow --config=rbe-envoy-engflow
 
 #############################################################################
 # debug: Various Bazel debugging flags

.github/config.yml

@@ -23,6 +23,13 @@ checks:
   #
   # For example if macos is marked as `required: true` but then has a path
   # selection that means its doesnt run the check will be `skipped` and pass
+  checks:
+    name: Envoy/Checks
+    on-run:
+    - check-build
+    - check-coverage
+    - check-san
+    required: true
   macos:
     name: Envoy/macOS
     required: true
@@ -32,6 +39,8 @@ checks:
     name: Envoy/Prechecks
     on-run:
     - precheck-deps
+    - precheck-format
+    - precheck-publish
     required: true
     # yamllint disable rule:line-length
     advice:
@@ -95,6 +104,15 @@ run:
     - envoy/**/*
     - source/**/*
     - test/**/*
+  check-build:
+    paths:
+    - "**/*"
+  check-coverage:
+    paths:
+    - "**/*"
+  check-san:
+    paths:
+    - "**/*"
   precheck-deps:
     paths:
     - .bazelrc
@@ -107,6 +125,13 @@ run:
     - "**/requirements.txt"
     - "**/go.mod"
     - "**/Dockerfile*"
+    push: paths
+  precheck-format:
+    paths:
+    - "**/*"
+  precheck-publish:
+    paths:
+    - "**/*"
   publish:
     paths:
     - .bazelrc

.github/workflows/_run.yml

@@ -250,6 +250,11 @@ jobs:
         passphrase-path: "${{ runner.temp }}/gpg-passphrase"
         configured-passphrase-path: /build/gpg-passphrase
 
+    - run: |
+        echo "e3b4a6e9570da15ac1caffdded17a8bebdc7dfc9" > .BAZEL_FAKE_SCM_REVISION
+      if: >-
+        ${{ fromJSON(inputs.request).request.pr == '' }}
+
     - uses: envoyproxy/toolshed/gh-actions/github/[email protected]
       name: Run CI ${{ inputs.command }} ${{ inputs.target }}
       with:
@@ -290,7 +295,6 @@ jobs:
           --config=remote-ci
           ${{ inputs.bazel-extra }}
           ${{ inputs.rbe == true && format('--jobs={0}', inputs.bazel-rbe-jobs) || '' }}
-        BAZEL_FAKE_SCM_REVISION: ${{ github.event_name == 'pull_request' && 'e3b4a6e9570da15ac1caffdded17a8bebdc7dfc9' || '' }}
         CI_BRANCH: >-
           ${{ inputs.trusted
               && format('refs/heads/{0}', fromJSON(inputs.request).request.target-branch)

bazel/BUILD

@@ -743,6 +743,11 @@ alias(
     }),
 )
 
+config_setting(
+    name = "engflow_rbe",
+    define_values = {"engflow_rbe": "true"},
+)
+
 selects.config_setting_group(
     name = "apple",
     match_any = [

bazel/envoy_binary.bzl

@@ -18,6 +18,8 @@ def envoy_cc_binary(
         data = [],
         testonly = 0,
         visibility = None,
+        rbe_pool = None,
+        exec_properties = {},
         external_deps = [],
         repository = "",
         stamp = 1,
@@ -27,6 +29,10 @@ def envoy_cc_binary(
         tags = [],
         features = [],
         linkstatic = True):
+    exec_properties = exec_properties | select({
+        repository + "//bazel:engflow_rbe": {"Pool": rbe_pool} if rbe_pool else {},
+        "//conditions:default": {},
+    })
     linker_inputs = envoy_exported_symbols_input()
 
     if not linkopts:
@@ -42,6 +48,7 @@ def envoy_cc_binary(
         data = data,
         additional_linker_inputs = linker_inputs,
         copts = envoy_copts(repository),
+        exec_properties = exec_properties,
         linkopts = linkopts,
         testonly = testonly,
         linkstatic = linkstatic,

bazel/envoy_library.bzl

@@ -98,6 +98,8 @@ def envoy_cc_library(
         hdrs = [],
         copts = [],
         visibility = None,
+        rbe_pool = None,
+        exec_properties = {},
         external_deps = [],
         tcmalloc_dep = None,
         repository = "",
@@ -112,6 +114,10 @@ def envoy_cc_library(
         linkopts = []):
     if tcmalloc_dep:
         deps += tcmalloc_external_deps(repository)
+    exec_properties = exec_properties | select({
+        repository + "//bazel:engflow_rbe": {"Pool": rbe_pool} if rbe_pool else {},
+        "//conditions:default": {},
+    })
 
     # If alwayslink is not specified, allow turning it off via --define=library_autolink=disabled
     # alwayslink is defaulted on for envoy_cc_extensions to ensure the REGISTRY macros work.
@@ -132,6 +138,7 @@ def envoy_cc_library(
         textual_hdrs = textual_hdrs,
         deps = deps + [envoy_external_dep_path(dep) for dep in external_deps] +
                envoy_pch_deps(repository, "//source/common/common:common_pch"),
+        exec_properties = exec_properties,
         alwayslink = alwayslink,
         linkstatic = envoy_linkstatic(),
         strip_include_prefix = strip_include_prefix,

bazel/envoy_test.bzl

@@ -80,11 +80,17 @@ def envoy_cc_fuzz_test(
         name,
         corpus,
         dictionaries = [],
+        rbe_pool = None,
+        exec_properties = {},
         repository = "",
         size = "medium",
         deps = [],
         tags = [],
         **kwargs):
+    exec_properties = exec_properties | select({
+        repository + "//bazel:engflow_rbe": {"Pool": rbe_pool} if rbe_pool else {},
+        "//conditions:default": {},
+    })
     if not (corpus.startswith("//") or corpus.startswith(":") or corpus.startswith("@")):
         corpus_name = name + "_corpus_files"
         native.filegroup(
@@ -97,6 +103,7 @@ def envoy_cc_fuzz_test(
     test_lib_name = name + "_lib"
     envoy_cc_test_library(
         name = test_lib_name,
+        exec_properties = exec_properties,
         deps = deps + envoy_stdlib_deps() + [
             repository + "//test/fuzz:fuzz_runner_lib",
             repository + "//test/test_common:test_version_linkstamp",
@@ -121,6 +128,7 @@ def envoy_cc_fuzz_test(
             "//conditions:default": ["$(locations %s)" % corpus_name],
         }),
         data = [corpus_name],
+        exec_properties = exec_properties,
         # No fuzzing on macOS or Windows
         deps = select({
             "@envoy//bazel:apple": [repository + "//test:dummy_main"],
@@ -163,9 +171,13 @@ def envoy_cc_test(
         size = "medium",
         flaky = False,
         env = {},
+        rbe_pool = None,
         exec_properties = {}):
     coverage_tags = tags + ([] if coverage else ["nocoverage"])
-
+    exec_properties = exec_properties | select({
+        repository + "//bazel:engflow_rbe": {"Pool": rbe_pool} if rbe_pool else {},
+        "//conditions:default": {},
+    })
     native.cc_test(
         name = name,
         srcs = srcs,
@@ -198,6 +210,8 @@ def envoy_cc_test_library(
         srcs = [],
         hdrs = [],
         data = [],
+        rbe_pool = None,
+        exec_properties = {},
         external_deps = [],
         deps = [],
         repository = "",
@@ -206,6 +220,10 @@ def envoy_cc_test_library(
         copts = [],
         alwayslink = 1,
         **kargs):
+    exec_properties = exec_properties | select({
+        repository + "//bazel:engflow_rbe": {"Pool": rbe_pool} if rbe_pool else {},
+        "//conditions:default": {},
+    })
     disable_pch = kargs.pop("disable_pch", True)
     _envoy_cc_test_infrastructure_library(
         name,
@@ -221,6 +239,7 @@ def envoy_cc_test_library(
         visibility = ["//visibility:public"],
         alwayslink = alwayslink,
         disable_pch = disable_pch,
+        exec_properties = exec_properties,
         **kargs
     )
 
@@ -266,13 +285,20 @@ def envoy_benchmark_test(
         name,
         benchmark_binary,
         data = [],
+        rbe_pool = None,
+        exec_properties = {},
         tags = [],
         repository = "",
         **kargs):
+    exec_properties = exec_properties | select({
+        repository + "//bazel:engflow_rbe": {"Pool": rbe_pool} if rbe_pool else {},
+        "//conditions:default": {},
+    })
     native.sh_test(
         name = name,
         srcs = [repository + "//bazel:test_for_benchmark_wrapper.sh"],
         data = [":" + benchmark_binary] + data,
+        exec_properties = exec_properties,
         args = ["%s/%s" % (native.package_name(), benchmark_binary)],
         tags = tags + ["nocoverage"],
         **kargs

bazel/get_workspace_status

@@ -29,7 +29,8 @@ then
     exit 0
 fi
 
-if [[ -n "$BAZEL_FAKE_SCM_REVISION" ]]; then
+if [[ -e ".BAZEL_FAKE_SCM_REVISION" ]]; then
+    BAZEL_FAKE_SCM_REVISION="$(cat .BAZEL_FAKE_SCM_REVISION)"
     echo "BUILD_SCM_REVISION $BAZEL_FAKE_SCM_REVISION"
     echo "ENVOY_BUILD_SCM_REVISION $BAZEL_FAKE_SCM_REVISION"
     echo "STABLE_BUILD_SCM_REVISION $BAZEL_FAKE_SCM_REVISION"

bazel/sh_test_wrapper.sh

@@ -4,7 +4,7 @@
 # TODO(lizan): remove when we have a solution for
 # https://github.com/bazelbuild/bazel/issues/3510
 
-cd "$(dirname "$0")" || exit 1
+cd "$(realpath "$(dirname "${BASH_SOURCE[0]}")")" || exit 1
 
 if [ $# -gt 0 ]; then
   "./${1}" "${@:2}"

ci/build_setup.sh

@@ -11,6 +11,8 @@ if [[ -n "$NO_BUILD_SETUP" ]]; then
     return
 fi
 
+CURRENT_SCRIPT_DIR="$(realpath "$(dirname "${BASH_SOURCE[0]}")")"
+
 export PPROF_PATH=/thirdparty_build/bin/pprof
 
 [ -z "${NUM_CPUS}" ] && NUM_CPUS=$(grep -c ^processor /proc/cpuinfo)
@@ -111,7 +113,7 @@ export BAZEL_BUILD_OPTION_LIST
 export BAZEL_GLOBAL_OPTION_LIST
 
 if [[ -e "${LLVM_ROOT}" ]]; then
-    "$(dirname "$0")/../bazel/setup_clang.sh" "${LLVM_ROOT}"
+    "${CURRENT_SCRIPT_DIR}/../bazel/setup_clang.sh" "${LLVM_ROOT}"
 else
     echo "LLVM_ROOT not found, not setting up llvm."
 fi
@@ -148,7 +150,7 @@ mkdir -p "${ENVOY_BUILD_PROFILE}"
 
 if [[ "${ENVOY_BUILD_FILTER_EXAMPLE}" == "true" ]]; then
   # shellcheck source=ci/filter_example_setup.sh
-  . "$(dirname "$0")"/filter_example_setup.sh
+  . "${CURRENT_SCRIPT_DIR}"/filter_example_setup.sh
 else
   echo "Skip setting up Envoy Filter Example."
 fi

ci/do_ci.sh

@@ -8,8 +8,10 @@ set -e
 export SRCDIR="${SRCDIR:-$PWD}"
 export ENVOY_SRCDIR="${ENVOY_SRCDIR:-$PWD}"
 
+CURRENT_SCRIPT_DIR="$(realpath "$(dirname "${BASH_SOURCE[0]}")")"
+
 # shellcheck source=ci/build_setup.sh
-. "$(dirname "$0")"/build_setup.sh
+. "${CURRENT_SCRIPT_DIR}"/build_setup.sh
 
 echo "building using ${NUM_CPUS} CPUs"
 echo "building for ${ENVOY_BUILD_ARCH}"
@@ -367,7 +369,7 @@ case $CI_TARGET in
         # fi
         ;;
 
-    check_and_fix_proto_format)
+    format-api|check_and_fix_proto_format)
         setup_clang_toolchain
         echo "Check and fix proto format ..."
         "${ENVOY_SRCDIR}/ci/check_and_fix_format.sh"

ci/envoy_build_sha.sh

@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 
+CURRENT_SCRIPT_DIR="$(realpath "$(dirname "${BASH_SOURCE[0]}")")"
 
-ENVOY_BUILD_CONTAINER="$(grep envoyproxy/envoy-build-ubuntu "$(dirname "$0")"/../.bazelrc | sed -e 's#.*envoyproxy/envoy-build-ubuntu:\(.*\)#\1#' | uniq)"
+ENVOY_BUILD_CONTAINER="$(grep envoyproxy/envoy-build-ubuntu "${CURRENT_SCRIPT_DIR}"/../.bazelrc | sed -e 's#.*envoyproxy/envoy-build-ubuntu:\(.*\)#\1#' | uniq)"
 ENVOY_BUILD_SHA="$(echo "${ENVOY_BUILD_CONTAINER}" | cut -d@ -f1)"
 ENVOY_BUILD_CONTAINER_SHA="$(echo "${ENVOY_BUILD_CONTAINER}" | cut -d@ -f2)"
 

ci/format_pre.sh

@@ -58,12 +58,6 @@ bazel "${BAZEL_STARTUP_OPTIONS[@]}" run "${BAZEL_BUILD_OPTIONS[@]}" //configs:ex
 CURRENT=spelling
 "${ENVOY_SRCDIR}/tools/spelling/check_spelling_pedantic.py" --mark check
 
-# TODO(phlax): move clang/buildifier checks to bazel rules (/aspects)
-if [[ -n "$CI_BRANCH" ]]; then
-    CURRENT=check_format_test
-    "${ENVOY_SRCDIR}/tools/code_format/check_format_test_helper.sh" --log=WARN
-fi
-
 CURRENT=check_format
 bazel "${BAZEL_STARTUP_OPTIONS[@]}" run "${BAZEL_BUILD_OPTIONS[@]}" //tools/code_format:check_format -- fix --fail_on_diff
 

ci/mac_ci_steps.sh

@@ -17,6 +17,8 @@ BAZEL_BUILD_OPTIONS=(
     "${BAZEL_BUILD_EXTRA_OPTIONS[@]}"
     "${BAZEL_EXTRA_TEST_OPTIONS[@]}")
 
+echo "RUN MAC: ${BAZEL_BUILD_OPTIONS[*]}"
+
 NCPU=$(sysctl -n hw.ncpu)
 if [[ $NCPU -gt 0 ]]; then
     echo "limiting build to $NCPU jobs, based on CPU count"