envoy.yml

name: Envoy

permissions:
  contents: read

on:
  pull_request:
  push:
    branches:
    - main

concurrency:
  group: >-
    ${{ github.event.inputs.head_ref || github.run_id }}


jobs:
  envoy:
    runs-on: ubuntu-24.04
    if: github.repository_owner == 'envoyproxy'
    steps:
    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
    - id: versions
      run: |
        bazel build --config=ci //debs:minor_versions
        VERSION_HASH="$(cat bazel-bin/debs/minor_versions.txt | sha256sum | cut -f1)"
        echo "hash=${VERSION_HASH}" >> "$GITHUB_OUTPUT"
    - uses: actions/cache/restore@v4
      with:
        key: ${{ steps.versions.outputs.hash }}
        path: /tmp/repository
    - run: |
        mkdir -p /tmp/repository/v1.28.3
        ls /tmp/repository | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+' | sort -u > debs/custom-excludes.txt
        echo $GITHUB_TOKEN > debs/token.txt
        bazel run \
            --config=ci \
            --//debs:excludes=//debs:custom-excludes.txt \
            --//debs:token=//debs:token.txt \
            --//tools/tarball:target=//debs \
            //tools/tarball:unpack \
            /tmp/repository
        tar tf bazel-bin/debs/debs.tar.gz
        ls -alh bazel-bin/debs/debs.tar.gz
        ORIGINAL=$(cat debs/custom-excludes.txt | wc -l)
        UPDATED=$(ls /tmp/repository | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+' | wc -l)
        if [[ "$ORIGINAL" != "$UPDATED" ]]; then
           echo "changed=1" >> $GITHUB_OUTPUT
        fi
        rm -rf debs/token.txt
      id: update
    - uses: actions/cache/save@v4
      if: ${{ steps.update.outputs.changed }}
      with:
        key: ${{ steps.versions.outputs.hash }}
        path: /tmp/repository