Merge branch 'istio-commit-1.26.3' into release/v1.34

Author: zmiklank

.bazelrc

@@ -246,7 +246,6 @@ build:coverage --action_env=GCOV=llvm-profdata
 build:coverage --copt=-DNDEBUG
 # 1.5x original timeout + 300s for trace merger in all categories
 build:coverage --test_timeout=390,750,1500,5700
-build:coverage --define=dynamic_link_tests=true
 build:coverage --define=ENVOY_CONFIG_COVERAGE=1
 build:coverage --cxxopt="-DENVOY_CONFIG_COVERAGE=1"
 build:coverage --test_env=HEAPCHECK=
@@ -265,13 +264,18 @@ build:coverage --define=no_debug_info=1
 # `--no-relax` is required for coverage to not err with `relocation R_X86_64_REX_GOTPCRELX`
 build:coverage --linkopt=-Wl,-s,--no-relax
 build:coverage --test_env=ENVOY_IP_TEST_VERSIONS=v4only
+build:coverage --define=dynamic_link_tests=false
 
 build:test-coverage --test_arg="-l trace"
 build:test-coverage --test_arg="--log-path /dev/null"
 build:test-coverage --test_tag_filters=-nocoverage,-fuzz_target
 build:fuzz-coverage --config=plain-fuzzer
 build:fuzz-coverage --run_under=@envoy//bazel/coverage:fuzz_coverage_wrapper.sh
 build:fuzz-coverage --test_tag_filters=-nocoverage
+# Existing fuzz tests don't need a full WASM runtime and in generally we don't really want to
+# fuzz dependencies anyways. On the other hand, disabling WASM reduces the build time and
+# resources required to build and run the tests.
+build:fuzz-coverage --define=wasm=disabled
 
 build:cache-local --remote_cache=grpc://localhost:9092
 

.github/config.yml

@@ -35,66 +35,6 @@ checks:
     required: true
     on-run:
     - build-macos
-  mobile-android:
-    name: Mobile/Android
-    required: true
-    on-run:
-    - mobile-android
-  mobile-android-tests:
-    name: Mobile/Android tests
-    required: true
-    on-run:
-    - mobile-android-tests
-  mobile-asan:
-    name: Mobile/ASAN
-    required: true
-    on-run:
-    - mobile-asan
-  mobile-cc:
-    name: Mobile/CC
-    required: true
-    on-run:
-    - mobile-cc
-  mobile-coverage:
-    name: Mobile/Coverage
-    required: true
-    on-run:
-    - mobile-coverage
-  mobile-docs:
-    name: Mobile/Docs
-    on-run:
-    - mobile-docs
-  mobile-format:
-    name: Mobile/Format
-    required: true
-    on-run:
-    - mobile-format
-  mobile-ios:
-    name: Mobile/iOS
-    required: true
-    cache:
-    on-run:
-    - mobile-ios
-  mobile-ios-tests:
-    name: Mobile/iOS tests
-    required: true
-    on-run:
-    - mobile-ios-tests
-  mobile-perf:
-    name: Mobile/Perf
-    required: true
-    on-run:
-    - mobile-perf
-  mobile-release-validation:
-    name: Mobile/Release validation
-    required: true
-    on-run:
-    - mobile-release-validation
-  mobile-tsan:
-    name: Mobile/TSAN
-    required: true
-    on-run:
-    - mobile-tsan
   prechecks:
     name: Envoy/Prechecks
     on-run:
@@ -173,148 +113,6 @@ run:
   check-san:
     paths:
     - "**/*"
-  mobile-android:
-    paths:
-    - .bazelrc
-    - .bazelversion
-    - .github/config.yml
-    - bazel/external/quiche.BUILD
-    - bazel/repository_locations.bzl
-    - mobile/.bazelrc
-    - mobile/**/*
-    - source/common/**/*
-    - tools/code_format/check_format.py
-  mobile-android-all:
-    paths:
-    - .bazelrc
-    - .bazelversion
-    - .github/config.yml
-    - bazel/external/quiche.BUILD
-    - bazel/repository_locations.bzl
-    - mobile/.bazelrc
-    - mobile/**/*
-    - source/common/**/*
-    - tools/code_format/check_format.py
-    push: never
-  mobile-android-tests:
-    paths:
-    - .bazelrc
-    - .bazelversion
-    - .github/config.yml
-    - bazel/external/quiche.BUILD
-    - bazel/repository_locations.bzl
-    - mobile/.bazelrc
-    - mobile/**/*
-    - tools/code_format/check_format.py
-  mobile-asan:
-    paths:
-    - .bazelrc
-    - .bazelversion
-    - .github/config.yml
-    - bazel/external/quiche.BUILD
-    - bazel/repository_locations.bzl
-    - mobile/.bazelrc
-    - mobile/**/*
-    - tools/code_format/check_format.py
-  mobile-cc:
-    paths:
-    - .bazelrc
-    - .bazelversion
-    - .github/config.yml
-    - api/**/*
-    - bazel/external/quiche.BUILD
-    - bazel/repository_locations.bzl
-    - envoy/**/*
-    - mobile/.bazelrc
-    - mobile/**/*
-    - source/**/*
-    - test/config/**/*
-    - test/integration/*
-    - test/mocks/**/*
-    - test/test_common/**/*
-  mobile-coverage:
-    paths:
-    - .bazelrc
-    - .bazelversion
-    - .github/config.yml
-    - bazel/external/quiche.BUILD
-    - bazel/repository_locations.bzl
-    - mobile/.bazelrc
-    - mobile/**/*
-    - tools/code_format/check_format.py
-  mobile-format:
-    paths:
-    - .bazelrc
-    - .bazelversion
-    - .github/config.yml
-    - bazel/external/quiche.BUILD
-    - bazel/repository_locations.bzl
-    - mobile/.bazelrc
-    - mobile/**/*
-    - tools/code_format/check_format.py
-  mobile-ios:
-    paths:
-    - .bazelrc
-    - .bazelversion
-    - .github/config.yml
-    - bazel/external/quiche.BUILD
-    - bazel/repository_locations.bzl
-    - mobile/.bazelrc
-    - mobile/**/*
-    - source/common/**/*
-    - tools/code_format/check_format.py
-  mobile-ios-all:
-    paths:
-    - .bazelrc
-    - .bazelversion
-    - .github/config.yml
-    - bazel/external/quiche.BUILD
-    - bazel/repository_locations.bzl
-    - mobile/.bazelrc
-    - mobile/**/*
-    - source/common/**/*
-    - tools/code_format/check_format.py
-    push: never
-  mobile-ios-tests:
-    paths:
-    - .bazelrc
-    - .bazelversion
-    - .github/config.yml
-    - bazel/external/quiche.BUILD
-    - bazel/repository_locations.bzl
-    - mobile/.bazelrc
-    - mobile/**/*
-    - tools/code_format/check_format.py
-  mobile-perf:
-    paths:
-    - .bazelrc
-    - .bazelversion
-    - .github/config.yml
-    - bazel/external/quiche.BUILD
-    - bazel/repository_locations.bzl
-    - mobile/.bazelrc
-    - mobile/**/*
-    - tools/code_format/check_format.py
-  mobile-release-validation:
-    paths:
-    - .bazelrc
-    - .bazelversion
-    - .github/config.yml
-    - bazel/external/quiche.BUILD
-    - bazel/repository_locations.bzl
-    - mobile/.bazelrc
-    - mobile/**/*
-    - tools/code_format/check_format.py
-  mobile-tsan:
-    paths:
-    - .bazelrc
-    - .bazelversion
-    - .github/config.yml
-    - bazel/external/quiche.BUILD
-    - bazel/repository_locations.bzl
-    - mobile/.bazelrc
-    - mobile/**/*
-    - tools/code_format/check_format.py
   precheck-deps:
     paths:
     - .bazelrc

.github/workflows/_publish_verify.yml

@@ -83,6 +83,52 @@ jobs:
             - run: docker images | grep envoy
               shell: bash
 
+  distroless:
+    permissions:
+      contents: read
+      packages: read
+    name: ${{ matrix.name || matrix.target }}
+    uses: ./.github/workflows/_run.yml
+    with:
+      bazel-extra: ${{ matrix.bazel-extra || '--config=remote-envoy-engflow' }}
+      cache-build-image: ${{ matrix.cache-build-image }}
+      cache-build-image-key-suffix: ${{ matrix.arch == 'arm64' && format('-{0}', matrix.arch) || '' }}
+      container-command: ${{ matrix.container-command }}
+      concurrency-suffix: -${{ matrix.arch || 'x64' }}
+      downloads: ${{ matrix.downloads }}
+      rbe: ${{ matrix.rbe }}
+      request: ${{ inputs.request }}
+      steps-pre: ${{ matrix.steps-pre }}
+      source: ${{ matrix.source }}
+      target: ${{ matrix.target }}
+      trusted: ${{ inputs.trusted }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - name: distroless
+          target: verify-distroless
+          downloads: |
+            docker: build_images
+          rbe: false
+          source: |
+            export NO_BUILD_SETUP=1
+          steps-pre: |
+            - run: |
+                IMAGES=(
+                    envoy-distroless:distroless-dev)
+                for image in "${IMAGES[@]}"; do
+                    src_name="$(echo ${image} | cut -d: -f1)"
+                    dest_name="$(echo ${image} | cut -d: -f2)"
+                    src="oci-archive:%{{ runner.temp }}/build_images/${src_name}.tar"
+                    dest="docker-daemon:envoyproxy/envoy:${dest_name}"
+                    echo "Copy image: ${src} ${dest}"
+                    skopeo copy -q "${src}" "${dest}"
+                done
+              shell: bash
+            - run: docker images | grep envoy
+              shell: bash
+
   distro:
     secrets:
       gcs-cache-key: ${{ secrets.gcs-cache-key }}