Merge branch 'main' into brian-spiffe

Signed-off-by: Brian Sonnenberg <[email protected]>

.bazelrc

@@ -10,6 +10,8 @@
 # Startup options cannot be selected via config.
 startup --host_jvm_args=-Xmx3g
 
+common --noenable_bzlmod
+
 fetch --color=yes
 run --color=yes
 
@@ -85,6 +87,7 @@ build:clang --action_env=BAZEL_COMPILER=clang
 build:clang --linkopt=-fuse-ld=lld
 build:clang --action_env=CC=clang --host_action_env=CC=clang
 build:clang --action_env=CXX=clang++ --host_action_env=CXX=clang++
+build:clang --incompatible_enable_cc_toolchain_resolution=false
 
 # Flags for Clang + PCH
 build:clang-pch --spawn_strategy=local
@@ -110,6 +113,7 @@ build:gcc --cxxopt=-Wno-missing-requires
 # not in GCC 11 and GCC 11 is what is used in docker-gcc
 # configuration currently
 build:gcc --cxxopt=-Wno-unknown-warning
+build:gcc --incompatible_enable_cc_toolchain_resolution=false
 
 # Clang-tidy
 # TODO(phlax): enable this, its throwing some errors as well as finding more issues
@@ -216,6 +220,7 @@ build:libc++ --action_env=BAZEL_LINKLIBS=-l%:libc++.a:-l%:libc++abi.a
 build:libc++ --action_env=BAZEL_LINKOPTS=-lm:-pthread
 build:libc++ --define force_libcpp=enabled
 build:clang-libc++ --config=libc++
+build:clang-libc++ --action_env=ARFLAGS=r
 
 build:libc++20 --config=libc++
 # gRPC has a lot of deprecated-enum-enum-conversion warning. Remove once it is addressed
@@ -267,6 +272,7 @@ build:cache-local --remote_cache=grpc://localhost:9092
 
 # Remote execution: https://docs.bazel.build/versions/master/remote-execution.html
 build:rbe-toolchain --action_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
+build:rbe-toolchain --incompatible_enable_cc_toolchain_resolution=false
 
 build:rbe-toolchain-clang --config=rbe-toolchain
 build:rbe-toolchain-clang --platforms=@envoy//bazel/rbe/toolchains:rbe_linux_clang_platform
@@ -374,7 +380,7 @@ build:compile-time-options --@envoy//source/extensions/filters/http/kill_request
 
 # Docker sandbox
 # NOTE: Update this from https://github.com/envoyproxy/envoy-build-tools/blob/main/toolchains/rbe_toolchains_config.bzl#L8
-build:docker-sandbox --experimental_docker_image=envoyproxy/envoy-build-ubuntu:f94a38f62220a2b017878b790b6ea98a0f6c5f9c@sha256:2dd96b6f43c08ccabd5f4747fce5854f5f96af509b32e5cf6493f136e9833649
+build:docker-sandbox --experimental_docker_image=envoyproxy/envoy-build-ubuntu:d2be0c198feda0c607fa33209da01bf737ef373f@sha256:026fb6710a3e55716cc1aba129f613f9834212d2deb4ea875ac9d2c37ca19aa3
 build:docker-sandbox --spawn_strategy=docker
 build:docker-sandbox --strategy=Javac=docker
 build:docker-sandbox --strategy=Closure=docker
@@ -543,7 +549,7 @@ common:bes-envoy-engflow --bes_timeout=3600s
 common:bes-envoy-engflow --bes_upload_mode=fully_async
 common:bes-envoy-engflow --nolegacy_important_outputs
 common:rbe-envoy-engflow --remote_executor=grpcs://mordenite.cluster.engflow.com
-common:rbe-envoy-engflow --remote_default_exec_properties=container-image=docker://gcr.io/envoy-ci/envoy-build@sha256:7adc40c09508f957624c4d2e0f5aeecb73a59207ee6ded53b107eac828c091b2
+common:rbe-envoy-engflow --remote_default_exec_properties=container-image=docker://gcr.io/envoy-ci/envoy-build@sha256:6e494ff9bcfa96868cb43f1200f2126cdab39d62db52a5dda80c8ec1694a93ee
 common:rbe-envoy-engflow --jobs=200
 common:rbe-envoy-engflow --define=engflow_rbe=true
 

.bazelversion

@@ -1 +1 @@
-6.5.0
+7.4.0

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM gcr.io/envoy-ci/envoy-build:f94a38f62220a2b017878b790b6ea98a0f6c5f9c@sha256:7adc40c09508f957624c4d2e0f5aeecb73a59207ee6ded53b107eac828c091b2
+FROM gcr.io/envoy-ci/envoy-build:d2be0c198feda0c607fa33209da01bf737ef373f@sha256:6e494ff9bcfa96868cb43f1200f2126cdab39d62db52a5dda80c8ec1694a93ee
 
 ARG USERNAME=vscode
 ARG USER_UID=501

.github/config.yml

@@ -1,12 +1,12 @@
-agent-ubuntu: ubuntu-22.04
+agent-ubuntu: ubuntu-24.04
 build-image:
   # Authoritative configuration for build image/s
   repo: envoyproxy/envoy-build-ubuntu
-  sha: 2dd96b6f43c08ccabd5f4747fce5854f5f96af509b32e5cf6493f136e9833649
-  mobile-sha: c9b6001d0c24170ae77b0ad39e1b0fcda49580c72a8578755dc65aec9be85be3
+  sha: 026fb6710a3e55716cc1aba129f613f9834212d2deb4ea875ac9d2c37ca19aa3
+  mobile-sha: d51387127bc3160b2c22b7b2d78f8182ad681a6d4feeeb5b55fda599dd7c4cbe
   # this is authoritative, but is not currently used in github ci
-  gcr-sha: 7adc40c09508f957624c4d2e0f5aeecb73a59207ee6ded53b107eac828c091b2
-  tag: f94a38f62220a2b017878b790b6ea98a0f6c5f9c
+  gcr-sha: 6e494ff9bcfa96868cb43f1200f2126cdab39d62db52a5dda80c8ec1694a93ee
+  tag: d2be0c198feda0c607fa33209da01bf737ef373f
 
 config:
   envoy:

.github/workflows/_check_coverage.yml

@@ -41,6 +41,8 @@ jobs:
       # bazel-extra: '--config=remote-envoy-engflow'
       cache-build-image: ${{ fromJSON(inputs.request).request.build-image.default }}
       concurrency-suffix: -${{ matrix.target }}
+      diskspace-hack: ${{ matrix.diskspace-hack && true || false }}
+      diskspace-hack-paths: ${{ matrix.diskspace-hack-paths }}
       error-match: |
         ERROR
         error:
@@ -50,7 +52,7 @@ jobs:
       rbe: true
       rbe-google: true
       request: ${{ inputs.request }}
-      runs-on: ubuntu-24.04
+      runs-on: ${{ fromJSON(inputs.request).config.ci.agent-ubuntu }}
       steps-post: |
         - uses: envoyproxy/toolshed/gh-actions/gcs/artefact/[email protected]
           with:
@@ -72,5 +74,8 @@ jobs:
         include:
         - target: coverage
           name: Coverage
+          diskspace-hack: true
+          diskspace-hack-paths: |
+            /opt/hostedtoolcache
         - target: fuzz_coverage
           name: Fuzz coverage

.github/workflows/_finish.yml

@@ -31,12 +31,12 @@ env:
 
 jobs:
   complete:
-    runs-on: ubuntu-22.04
+    runs-on: ${{ fromJSON(fromJSON(inputs.needs).load.outputs.request).config.ci.agent-ubuntu }}
     permissions:
       actions: read
       contents: read
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/[email protected].13
+    - uses: envoyproxy/toolshed/gh-actions/[email protected].14
       name: Incoming data
       id: needs
       with:
@@ -87,21 +87,21 @@ jobs:
                    summary: "Check has finished",
                    text: $text}}}}
 
-    - uses: envoyproxy/toolshed/gh-actions/[email protected].13
+    - uses: envoyproxy/toolshed/gh-actions/[email protected].14
       name: Print summary
       with:
         input: ${{ toJSON(steps.needs.outputs.value).summary-title }}
         filter: |
           "## \(.)"
         options: -Rr
         output-path: GITHUB_STEP_SUMMARY
-    - uses: envoyproxy/toolshed/gh-actions/[email protected].13
+    - uses: envoyproxy/toolshed/gh-actions/[email protected].14
       name: Appauth
       id: appauth
       with:
         app_id: ${{ secrets.app-id }}
         key: ${{ secrets.app-key }}
-    - uses: envoyproxy/toolshed/gh-actions/github/[email protected].13
+    - uses: envoyproxy/toolshed/gh-actions/github/[email protected].14
       name: Update check
       with:
         action: update

.github/workflows/_load.yml

@@ -14,7 +14,7 @@ on:
     inputs:
       agent-ubuntu:
         type: string
-        default: ubuntu-22.04
+        default: ubuntu-24.04
       check-name:
         type: string
         required: true
@@ -70,7 +70,7 @@ env:
 jobs:
   request:
     if: ${{ github.repository == 'envoyproxy/envoy' || vars.ENVOY_CI }}
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     permissions:
       actions: read
       contents: read
@@ -100,7 +100,7 @@ jobs:
     # Handle any failure in triggering job
     # Remove any `checks` we dont care about
     # Prepare a check request
-    - uses: envoyproxy/toolshed/gh-actions/github/env/[email protected].13
+    - uses: envoyproxy/toolshed/gh-actions/github/env/[email protected].14
       name: Load env
       id: data
       with:
@@ -111,21 +111,21 @@ jobs:
         GH_TOKEN: ${{ github.token }}
 
     #  Update the check
-    - uses: envoyproxy/toolshed/gh-actions/[email protected].13
+    - uses: envoyproxy/toolshed/gh-actions/[email protected].14
       name: Appauth
       id: appauth
       with:
         app_id: ${{ secrets.app-id }}
         key: ${{ secrets.app-key }}
-    - uses: envoyproxy/toolshed/gh-actions/github/[email protected].13
+    - uses: envoyproxy/toolshed/gh-actions/github/[email protected].14
       name: Update check
       if: ${{ fromJSON(steps.data.outputs.data).data.check.action == 'RUN' }}
       with:
         action: update
         checks: ${{ toJSON(fromJSON(steps.data.outputs.data).checks) }}
         token: ${{ steps.appauth.outputs.token }}
 
-    - uses: envoyproxy/toolshed/gh-actions/[email protected].13
+    - uses: envoyproxy/toolshed/gh-actions/[email protected].14
       name: Print request summary
       with:
         input: |
@@ -145,7 +145,7 @@ jobs:
           | $summary.summary as $summary
           | "${{ inputs.template-request-summary }}"
 
-    - uses: envoyproxy/toolshed/gh-actions/[email protected].13
+    - uses: envoyproxy/toolshed/gh-actions/[email protected].14
       id: request-output
       name: Load request
       with:

.github/workflows/_load_env.yml

@@ -56,25 +56,25 @@ env:
 jobs:
   request:
     if: ${{ github.repository == 'envoyproxy/envoy' || vars.ENVOY_CI }}
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     outputs:
       build-image: ${{ toJSON(fromJSON(steps.env.outputs.data).request.build-image) }}
       build-image-mobile: ${{ fromJSON(steps.env.outputs.data).request.build-image-mobile }}
       request: ${{ steps.env.outputs.data }}
       trusted: true
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/[email protected].13
+    - uses: envoyproxy/toolshed/gh-actions/[email protected].14
       id: started
       name: Create timestamp
       with:
         options: -r
         filter: |
           now
-    - uses: envoyproxy/toolshed/gh-actions/github/[email protected].13
+    - uses: envoyproxy/toolshed/gh-actions/github/[email protected].14
       id: checkout
       name: Checkout Envoy repository
     - name: Generate environment variables
-      uses: envoyproxy/toolshed/gh-actions/envoy/ci/[email protected].13
+      uses: envoyproxy/toolshed/gh-actions/envoy/ci/[email protected].14
       id: env
       with:
         branch-name: ${{ inputs.branch-name }}
@@ -86,7 +86,7 @@ jobs:
 
     - name: Request summary
       id: summary
-      uses: envoyproxy/toolshed/gh-actions/github/env/[email protected].13
+      uses: envoyproxy/toolshed/gh-actions/github/env/[email protected].14
       with:
         actor: ${{ toJSON(fromJSON(steps.env.outputs.data).request.actor) }}
         base-sha: ${{ fromJSON(steps.env.outputs.data).request.base-sha }}

.github/workflows/_precheck_deps.yml

@@ -56,7 +56,7 @@ jobs:
           rbe: false
 
   dependency-review:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     if: ${{ inputs.dependency-review }}
     steps:
     - name: Checkout Repository

.github/workflows/_precheck_publish.yml

@@ -45,7 +45,7 @@ jobs:
       gcs-cache-bucket: ${{ inputs.gcs-cache-bucket }}
       rbe: ${{ matrix.rbe }}
       request: ${{ inputs.request }}
-      runs-on: ${{ matrix.runs-on || 'ubuntu-24.04' }}
+      runs-on: ${{ matrix.runs-on || fromJSON(inputs.request).config.ci.agent-ubuntu  }}
       timeout-minutes: ${{ matrix.timeout-minutes || 120 }}
       error-match: |
         ERROR

.github/workflows/_publish_build.yml

@@ -71,7 +71,6 @@ jobs:
           bazel-extra: >-
             --config=remote-envoy-engflow
           rbe: true
-          runs-on: ubuntu-24.04
         - target: release.server_only
           name: Release (arm64)
           arch: arm64
@@ -118,7 +117,6 @@ jobs:
         - target: distribution
           name: Package debs (x64)
           arch: x64
-          runs-on: ubuntu-24.04
         - target: distribution
           name: Package debs (arm64)
           arch: arm64
@@ -143,7 +141,6 @@ jobs:
         release.arm64: envoy/arm64/bin/
         release.x64: envoy/x64/bin/
       request: ${{ inputs.request }}
-      runs-on: ${{ matrix.runs-on }}
       source: |
         export NO_BUILD_SETUP=1
         export ENVOY_DOCKER_IN_DOCKER=1
@@ -156,7 +153,6 @@ jobs:
         include:
         - target: docker
           name: Docker (Linux multiarch)
-          runs-on: ubuntu-24.04
 
   sign:
     permissions:
@@ -186,7 +182,6 @@ jobs:
       gcs-cache-bucket: ${{ inputs.gcs-cache-bucket }}
       import-gpg: true
       request: ${{ inputs.request }}
-      runs-on: ubuntu-24.04
       source: |
         export NO_BUILD_SETUP=1
       trusted: ${{ inputs.trusted }}

.github/workflows/_publish_publish.yml

@@ -74,16 +74,16 @@ jobs:
     # In turn the archive repo triggers an update in the website so the new release docs are
     # included in the published site
     if: ${{ inputs.trusted && github.repository == 'envoyproxy/envoy' }}
-    runs-on: ubuntu-22.04
+    runs-on: ${{ fromJSON(inputs.request).config.ci.agent-ubuntu }}
     needs:
     - publish
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/[email protected].13
+    - uses: envoyproxy/toolshed/gh-actions/[email protected].14
       id: appauth
       with:
         app_id: ${{ secrets.ENVOY_CI_SYNC_APP_ID }}
         key: ${{ secrets.ENVOY_CI_SYNC_APP_KEY }}
-    - uses: envoyproxy/toolshed/gh-actions/[email protected].13
+    - uses: envoyproxy/toolshed/gh-actions/[email protected].14
       with:
         ref: main
         repository: ${{ fromJSON(inputs.request).request.version.dev && 'envoyproxy/envoy-website' || 'envoyproxy/archive' }}

.github/workflows/_publish_verify.yml

@@ -44,7 +44,6 @@ jobs:
       downloads: ${{ matrix.downloads }}
       rbe: ${{ matrix.rbe }}
       request: ${{ inputs.request }}
-      runs-on: ubuntu-24.04
       steps-pre: ${{ matrix.steps-pre }}
       source: ${{ matrix.source }}
       target: ${{ matrix.target }}
@@ -104,7 +103,7 @@ jobs:
       gcs-cache-bucket: ${{ inputs.gcs-cache-bucket }}
       rbe: ${{ matrix.rbe && matrix.rbe || false }}
       request: ${{ inputs.request }}
-      runs-on: ${{ matrix.runs-on || 'ubuntu-24.04' }}
+      runs-on: ${{ matrix.runs-on }}
       source: |
         export NO_BUILD_SETUP=1
         export ENVOY_DOCKER_IN_DOCKER=1