Merge remote-tracking branch 'upstream/release/v1.26' into maistra-2.5

* upstream/release/v1.26: (45 commits)
  repo: Dev 1.26.8 (#32331)
  repo: Release v1.26.7
  Proxy protocol: sanitise non utf8 chars in TLVs
  Fix crashes when proxyproto receives address type not supported by the OS
  Cache RE object in uri template matcher.
  Fix crash when idle and per try timeouts occurs within backoff interval
  Fix crash from AWS NLB healthchecks when proxy protocol is enabled
  ci/release: Ensure windows is built on release
  release/ci: Fix artefact publishing (#31837)
  coverage: lower coverage for source/common/io/ (#32150)
  deps: bump Boost to 1.84.0 (#31566)
  deps/tooling: Bump python (~vulnerable) dependencies
  deps/build: Bump Ubuntu base image -> bb1c41
  build(deps): bump distroless/base-nossl-debian12 from `8c957f0` to `51ab103` in /ci (#32159)
  build(deps): bump distroless/base-nossl-debian12 from `8a0cabc` to `8c957f0` in /ci (#31389)
  deps: Bump `com_github_grpc_grpc` -> 1.49.4
  debs/build: Bump Ubuntu base image -> f2034e7
  docs/examples: Assorted cleanups (#31588)
  deps/go: Bump to resolve CVEs
  golang: fix replace path in go.mod (#31297)
  ...

.azure-pipelines/ci.yml

@@ -3,6 +3,10 @@ parameters:
   displayName: "CI target"
   type: string
   default: release
+- name: artifactName
+  displayName: "Artifact name"
+  type: string
+  default: ""
 - name: artifactSuffix
   displayName: "Suffix of artifact"
   type: string
@@ -186,7 +190,7 @@ steps:
         bash -c 'echo "$(GcpServiceAccountKey)"' | base64 --decode > "${GCP_SERVICE_ACCOUNT_KEY_PATH}"
         BAZEL_BUILD_EXTRA_OPTIONS+=" ${{ parameters.bazelConfigRBE }} --google_credentials=${GCP_SERVICE_ACCOUNT_KEY_PATH}"
         ENVOY_RBE=1
-        if [[ "${{ parameters.bazelUseBES }}" == "True" ]]; then
+        if [[ "${{ parameters.bazelUseBES }}" == "True" && -n "${GOOGLE_BES_PROJECT_ID}" ]]; then
             BAZEL_BUILD_EXTRA_OPTIONS+=" --config=rbe-google-bes --bes_instance_name=${GOOGLE_BES_PROJECT_ID}"
         fi
     else
@@ -338,6 +342,9 @@ steps:
 - task: PublishBuildArtifacts@1
   inputs:
     pathtoPublish: "$(Build.StagingDirectory)/envoy"
-    artifactName: ${{ parameters.ciTarget }}
+    ${{ if eq(parameters.artifactName, '') }}:
+      artifactName: ${{ parameters.ciTarget }}
+    ${{ if ne(parameters.artifactName, '') }}:
+      artifactName: ${{ parameters.artifactName }}
   timeoutInMinutes: 10
   condition: eq(${{ parameters.publishEnvoy }}, 'true')

.azure-pipelines/env.yml

@@ -161,6 +161,7 @@ jobs:
       if [[ "$ISSTABLEBRANCH" == True && -n "$POSTSUBMIT" && "$(state.isDev)" == false ]]; then
           RUN_RELEASE_TESTS=false
       fi
+
       echo "##vso[task.setvariable variable=build;isoutput=true]${RUN_BUILD}"
       echo "##vso[task.setvariable variable=checks;isoutput=true]${RUN_CHECKS}"
       echo "##vso[task.setvariable variable=docker;isoutput=true]${RUN_DOCKER}"
@@ -217,7 +218,7 @@ jobs:
       echo "env.outputs['run.build']: $(run.build)"
       echo "env.outputs['run.checks']: $(run.checks)"
       echo "env.outputs['run.packaging']: $(run.packaging)"
-      echo "env.outputs['run.releaseTests]: $(run.releaseTests)"
+      echo "env.outputs['run.releaseTests']: $(run.releaseTests)"
       echo
       echo "env.outputs['publish.githubRelease']: $(publish.githubRelease)"
       echo "env.outputs['publish.dockerhub]: $(publish.dockerhub)"

.azure-pipelines/pipelines.yml

@@ -68,10 +68,6 @@ stages:
     parameters:
       buildStageDeps:
       - env
-      macBuildStageDeps:
-      - env
-      windowsBuildStageDeps:
-      - env
 
 # Scheduled run anywhere
 - ${{ if eq(variables.pipelineScheduled, true) }}:
@@ -87,10 +83,6 @@ stages:
       - env
       checkStageDeps:
       - env
-      macBuildStageDeps:
-      - env
-      windowsBuildStageDeps:
-      - env
 
 # Postsubmit main/release branches
 - ${{ if eq(variables.pipelinePostsubmit, true) }}:
@@ -103,7 +95,3 @@ stages:
       - env
       checkStageDeps:
       - env
-      macBuildStageDeps:
-      - env
-      windowsBuildStageDeps:
-      - env

.azure-pipelines/stage/linux.yml

@@ -48,17 +48,21 @@ jobs:
         eq(${{ parameters.runBuild }}, 'true'))
   timeoutInMinutes: ${{ parameters.timeoutBuild }}
   pool: ${{ parameters.pool }}
-  variables:
-  - name: ciTarget
-    ${{ if eq(parameters.runTests, false) }}:
-      value: release.server_only
-    ${{ if ne(parameters.runTests, false) }}:
-      value: release
   steps:
+  - bash: |
+      if [[ "${{ parameters.runTests }}" == "false" ]]; then
+          CI_TARGET="release.server_only"
+      else
+          CI_TARGET="release"
+      fi
+      echo "${CI_TARGET}"
+      echo "##vso[task.setvariable variable=value;isoutput=true]${CI_TARGET}"
+    name: target
   - template: ../ci.yml
     parameters:
+      artifactName: release
       managedAgent: ${{ parameters.managedAgent }}
-      ciTarget: $(ciTarget)
+      ciTarget: $(target.value)
       cacheName: "release"
       bazelBuildExtraOptions: ${{ parameters.bazelBuildExtraOptions }}
       cacheTestResults: ${{ parameters.cacheTestResults }}

.azure-pipelines/stage/publish.yml

@@ -292,6 +292,7 @@ jobs:
       publishEnvoy: false
       publishTestResults: false
       env:
+        ENVOY_REPO: $(Build.Repository.Name)
         ${{ if eq(variables['Build.Reason'], 'PullRequest') }}:
           ENVOY_HEAD_REF: "$(Build.SourceBranch)"
           ENVOY_BRANCH: "$(System.PullRequest.TargetBranch)"

.azure-pipelines/stages.yml

@@ -8,18 +8,6 @@ parameters:
   default:
   - env
   - prechecks
-- name: macBuildStageDeps
-  displayName: "macOS stage dependencies"
-  type: object
-  default:
-  - env
-  - prechecks
-- name: windowsBuildStageDeps
-  displayName: "Windows stage dependencies"
-  type: object
-  default:
-  - env
-  - prechecks
 - name: checkStageDeps
   displayName: "Check stage dependencies"
   type: object
@@ -84,15 +72,17 @@ stages:
   - template: stage/linux.yml
     parameters:
       cacheTestResults: ${{ parameters.cacheTestResults }}
+      # these are parsed differently and _must_ be expressed in this way
       runBuild: variables['RUN_BUILD']
-      runTests: variables['RUN_TESTS']
+      runTests: $(RUN_TESTS)
       tmpfsDockerDisabled: true
 
 - stage: linux_arm64
   displayName: Linux arm64
   dependsOn: ${{ parameters.buildStageDeps }}
   variables:
     RUN_BUILD: $[stageDependencies.env.repo.outputs['run.build']]
+    RUN_TESTS: $[stageDependencies.env.repo.outputs['run.releaseTests']]
   jobs:
   - template: stage/linux.yml
     parameters:
@@ -102,6 +92,7 @@ stages:
       timeoutBuild: 180
       pool: envoy-arm-large
       runBuild: variables['RUN_BUILD']
+      runTests: $(RUN_TESTS)
       bazelBuildExtraOptions: "--sandbox_base=/tmp/sandbox_base"
 
 - stage: check
@@ -155,25 +146,3 @@ stages:
   - template: stage/verify.yml
     parameters:
       authGCP: $(GcpServiceAccountKey)
-
-- stage: macos
-  displayName: macOS
-  dependsOn: ${{ parameters.macBuildStageDeps }}
-  variables:
-    RUN_BUILD: $[stageDependencies.env.repo.outputs['run.build']]
-  jobs:
-  - template: stage/macos.yml
-    parameters:
-      authGCP: $(GcpServiceAccountKey)
-      runBuild: variables['RUN_BUILD']
-
-- stage: windows
-  displayName: Windows
-  dependsOn: ${{ parameters.windowsBuildStageDeps }}
-  variables:
-    RUN_BUILD: $[stageDependencies.env.repo.outputs['run.build']]
-  jobs:
-  - template: stage/windows.yml
-    parameters:
-      authGCP: $(GcpServiceAccountKey)
-      runBuild: variables['RUN_BUILD']

.devcontainer/setup.sh

@@ -1,10 +1,8 @@
 #!/usr/bin/env bash
 
-. ci/setup_cache.sh
-trap - EXIT # Don't remove the key file written into a temporary file
-
 BAZELRC_FILE=~/.bazelrc bazel/setup_clang.sh /opt/llvm
 
+# TODO(phlax): use user.bazelrc
 # Use generated toolchain config because we know the base container is the one we're using in RBE.
 # Not using libc++ here because clangd will raise some tidy issue in libc++ header as of version 9.
 echo "build --config=rbe-toolchain-clang" >> ~/.bazelrc