envoy.yml

name: Envoy

permissions:
  contents: read

on:
  pull_request:
  push:
    branches:
    - main

concurrency:
  group: >-
    ${{ github.event.inputs.head_ref || github.run_id }}


jobs:
  envoy:
    runs-on: ubuntu-24.04
    if: github.repository_owner == 'envoyproxy'
    steps:
    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
    - id: versions
      run: |
        bazel build --config=ci //debs:minor_versions
        VERSION_HASH="$(cat bazel-bin/debs/minor_versions.txt | sha256sum | cut -d' ' -f1)"
        echo "hash=${VERSION_HASH}" >> "$GITHUB_OUTPUT"
    - uses: actions/cache/restore@v4
      id: cache
      with:
        key: ${{ steps.versions.outputs.hash }}
        path: /tmp/repository
    - id: repository
      run: |
        mkdir -p /tmp/repository
        rm -rf /tmp/repository/v1.28.3
        ls /tmp/repository | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+' | sort -u > debs/custom-excludes.txt
        DIR_SHA=$(cat debs/custom-excludes.txt | sha256sum | cut -d' ' -f1)
        cat debs/custom-excludes.txt
        echo "cached=${DIR_SHA}" >> $GITHUB_OUTPUT
    - run: |
        bazel build \
            //debs:debs_downloads
        cat bazel-bin/debs/debs_downloads.json | jq '.'

    - run: |
        echo $GITHUB_TOKEN > debs/token.txt
        bazel run \
            --config=debs-ci \
            //tools/tarball:unpack \
            /tmp/repository

    - run: |
        UPDATED=$(ls /tmp/repository | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+' | sort -u | sha256sum | cut -d' ' -f1)
        if [[ "${{ steps.repository.outputs.cached }}" != "$UPDATED" ]]; then
           echo "changed=1" >> $GITHUB_OUTPUT
        fi
        rm -rf debs/token.txt
      id: update

    - if: ${{ steps.cache.outputs.cache-hit && steps.update.outputs.changed }}
      run: |
         gh extension install actions/gh-actions-cache
         gh actions-cache delete ${{ steps.versions.outputs.hash }}

    - uses: actions/cache/save@v4
      if: ${{ steps.update.outputs.changed }}
      with:
        key: ${{ steps.versions.outputs.hash }}
        path: /tmp/repository