From 7d1e65e2049ff4f048daae53ec2c446d55a28dd9 Mon Sep 17 00:00:00 2001
From: Ryan Northey <ryan@synca.io>
Date: Tue, 9 May 2023 20:57:15 +0100
Subject: [PATCH] ci: Shift downstream sync azp -> gh

Signed-off-by: Ryan Northey <ryan@synca.io>
---
 .azure-pipelines/stage/sync.yml  | 95 --------------------------------
 .azure-pipelines/stages.yml      | 15 -----
 .github/workflows/envoy-sync.yml | 29 ++++++++++
 ci/api_mirror.sh                 | 44 ---------------
 ci/filter_example_mirror.sh      | 37 -------------
 ci/go_mirror.sh                  | 12 ----
 6 files changed, 29 insertions(+), 203 deletions(-)
 delete mode 100644 .azure-pipelines/stage/sync.yml
 create mode 100644 .github/workflows/envoy-sync.yml
 delete mode 100755 ci/api_mirror.sh
 delete mode 100755 ci/filter_example_mirror.sh
 delete mode 100755 ci/go_mirror.sh

diff --git a/.azure-pipelines/stage/sync.yml b/.azure-pipelines/stage/sync.yml
deleted file mode 100644
index 39eb91180336..000000000000
--- a/.azure-pipelines/stage/sync.yml
+++ /dev/null
@@ -1,95 +0,0 @@
-
-parameters:
-- name: authGCP
-  type: string
-  default: ""
-- name: authSSHKeyPassphrase
-  type: string
-  default: ""
-- name: authSSHDataPlaneApiKey
-  type: string
-  default: ""
-- name: authSSHDataPlaneApiKeyPublic
-  type: string
-  default: ""
-- name: authSSHGoControlPlaneKey
-  type: string
-  default: ""
-- name: authSSHGoControlPlaneKeyPublic
-  type: string
-  default: ""
-- name: authSSHFilterExampleKey
-  type: string
-  default: ""
-- name: authSSHFilterExampleKeyPublic
-  type: string
-  default: ""
-
-
-jobs:
-- job: filter_example
-  dependsOn: []
-  pool:
-    vmImage: "ubuntu-20.04"
-  steps:
-  - checkout: self
-    fetchDepth: 0
-    fetchTags: true
-  - task: InstallSSHKey@0
-    inputs:
-      hostName: $(authGithubSSHKeyPublic)
-      sshPublicKey: "${{ parameters.authSSHFilterExampleKeyPublic }}"
-      sshPassphrase: "${{ parameters.authSSHKeyPassphrase }}"
-      sshKeySecureFile: "${{ parameters.authSSHFilterExampleKey }}"
-  - bash: ci/filter_example_mirror.sh
-    displayName: "Sync envoy-filter-example"
-    workingDirectory: $(Build.SourcesDirectory)
-    env:
-      AZP_BRANCH: $(Build.SourceBranch)
-
-- job: data_plane_api
-  dependsOn: []
-  pool:
-    vmImage: "ubuntu-20.04"
-  steps:
-  - checkout: self
-    fetchDepth: 0
-    fetchTags: true
-  - task: InstallSSHKey@0
-    inputs:
-      hostName: $(authGithubSSHKeyPublic)
-      sshPublicKey: "${{ parameters.authSSHDataPlaneApiKeyPublic }}"
-      sshPassphrase: "${{ parameters.authSSHKeyPassphrase }}"
-      sshKeySecureFile: "${{ parameters.authSSHDataPlaneApiKey }}"
-  - bash: ci/api_mirror.sh
-    displayName: "Sync data-plane-api"
-    workingDirectory: $(Build.SourcesDirectory)
-    env:
-      AZP_BRANCH: $(Build.SourceBranch)
-
-- job: go_control_plane
-  dependsOn: []
-  pool:
-    vmImage: "ubuntu-20.04"
-  steps:
-  - checkout: self
-    fetchDepth: 0
-    fetchTags: true
-  - task: InstallSSHKey@0
-    inputs:
-      hostName: $(authGithubSSHKeyPublic)
-      sshPublicKey: "${{ parameters.authSSHGoControlPlaneKeyPublic }}"
-      sshPassphrase: "${{ parameters.authSSHKeyPassphrase }}"
-      sshKeySecureFile: "${{ parameters.authSSHGoControlPlaneKey }}"
-  - bash: |
-      cp -a ~/.ssh $(Build.StagingDirectory)/
-      ci/run_envoy_docker.sh 'ci/go_mirror.sh'
-    displayName: "Sync go-control-plane"
-    workingDirectory: $(Build.SourcesDirectory)
-    env:
-      ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
-      # TODO: make into parameters
-      BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
-      BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
-      GCP_SERVICE_ACCOUNT_KEY: ${{ parameters.authGCP }}
-      AZP_BRANCH: $(Build.SourceBranch)
diff --git a/.azure-pipelines/stages.yml b/.azure-pipelines/stages.yml
index caab5bae0fad..de69153bfbf7 100644
--- a/.azure-pipelines/stages.yml
+++ b/.azure-pipelines/stages.yml
@@ -75,21 +75,6 @@ stages:
       bucketGCP: $(GcsArtifactBucket)
       checkDeps: variables['CHECK_DEPS']
 
-- stage: sync
-  condition: and(succeeded(), eq(variables['PostSubmit'], true), ne(variables['NoSync'], true))
-  dependsOn: []
-  jobs:
-  - template: stage/sync.yml
-    parameters:
-      authGCP: $(GcpServiceAccountKey)
-      authSSHDataPlaneApiKeyPublic: $(DataPlaneApiPublicKey)
-      authSSHDataPlaneApiKey: $(DataPlaneApiPrivateKey)
-      authSSHGoControlPlaneKeyPublic: $(GoControlPlanePublicKey)
-      authSSHGoControlPlaneKey: $(GoControlPlanePrivateKey)
-      authSSHFilterExampleKeyPublic: $(FilterExamplePublicKey)
-      authSSHFilterExampleKey: $(FilterExamplePrivateKey)
-      authSSHKeyPassphrase: $(SshDeployKeyPassphrase)
-
 - stage: linux_x64
   displayName: Linux x64
   dependsOn: ${{ parameters.buildStageDeps }}
diff --git a/.github/workflows/envoy-sync.yml b/.github/workflows/envoy-sync.yml
new file mode 100644
index 000000000000..da65ccc55984
--- /dev/null
+++ b/.github/workflows/envoy-sync.yml
@@ -0,0 +1,29 @@
+name: 'Sync downstream'
+
+on:
+  push:
+    branches:
+    - main
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
+jobs:
+  sync:
+    runs-on: ubuntu-20.04
+    strategy:
+      fail-fast: false
+      matrix:
+        downstream:
+        - go-control-plane
+        - envoy-filter-example
+        - data-plane-api
+    steps:
+    - uses: envoyproxy/toolshed/gh-actions/dispatch@1f1feae1e372dde41ecc6830028989bb6037c480
+      with:
+        repository: "envoyproxy/${{ matrix.downstream }}"
+        ref: main
+        key: "${{ secrets.ENVOY_CI_SYNC_APP_KEY }}"
+        workflow: envoy-sync.yaml
+        app_id: ${{ secrets.ENVOY_CI_SYNC_APP_ID }}
diff --git a/ci/api_mirror.sh b/ci/api_mirror.sh
deleted file mode 100755
index 8a3022b72431..000000000000
--- a/ci/api_mirror.sh
+++ /dev/null
@@ -1,44 +0,0 @@
-#!/bin/bash
-
-set -e
-
-CHECKOUT_DIR=../data-plane-api
-MAIN_BRANCH="refs/heads/main"
-API_MAIN_BRANCH="main"
-
-if [[ "${AZP_BRANCH}" == "${MAIN_BRANCH}" ]]; then
-  echo "Cloning..."
-  git clone git@github.com:envoyproxy/data-plane-api "$CHECKOUT_DIR" -b "${API_MAIN_BRANCH}"
-
-  git -C "$CHECKOUT_DIR" config user.name "data-plane-api(Azure Pipelines)"
-  git -C "$CHECKOUT_DIR" config user.email data-plane-api@users.noreply.github.com
-
-  # Determine last envoyproxy/envoy SHA in envoyproxy/data-plane-api
-  MIRROR_MSG="Mirrored from https://github.com/envoyproxy/envoy"
-  LAST_ENVOY_SHA=$(git -C "$CHECKOUT_DIR" log --grep="$MIRROR_MSG" -n 1 | grep "$MIRROR_MSG" | \
-    tail -n 1 | sed -e "s#.*$MIRROR_MSG @ ##")
-
-  echo "Last mirrored envoyproxy/envoy SHA is $LAST_ENVOY_SHA"
-
-  # Compute SHA sequence to replay in envoyproxy/data-plane-api
-  SHAS=$(git rev-list --reverse "$LAST_ENVOY_SHA"..HEAD api/)
-
-  # For each SHA, hard reset, rsync api/ and generate commit in
-  # envoyproxy/data-plane-api
-  API_WORKING_DIR="../envoy-api-mirror"
-  git worktree add "$API_WORKING_DIR"
-  for sha in $SHAS
-  do
-    git -C "$API_WORKING_DIR" reset --hard "$sha"
-    COMMIT_MSG=$(git -C "$API_WORKING_DIR" log --format=%B -n 1)
-    QUALIFIED_COMMIT_MSG=$(echo -e "$COMMIT_MSG\n\n$MIRROR_MSG @ $sha")
-    rsync -acv --delete --exclude "ci/" --exclude ".*" --exclude LICENSE \
-      "$API_WORKING_DIR"/api/ "$CHECKOUT_DIR"/
-    git -C "$CHECKOUT_DIR" add .
-    git -C "$CHECKOUT_DIR" commit -m "$QUALIFIED_COMMIT_MSG"
-  done
-
-  echo "Pushing..."
-  git -C "$CHECKOUT_DIR" push origin "${API_MAIN_BRANCH}"
-  echo "Done"
-fi
diff --git a/ci/filter_example_mirror.sh b/ci/filter_example_mirror.sh
deleted file mode 100755
index ed26317c49a2..000000000000
--- a/ci/filter_example_mirror.sh
+++ /dev/null
@@ -1,37 +0,0 @@
-#!/bin/bash
-
-set -e
-
-ENVOY_SRCDIR=$(cd "$(dirname "${BASH_SOURCE[0]}")/../" && pwd)
-CHECKOUT_DIR=../envoy-filter-example
-MAIN_BRANCH="refs/heads/main"
-FILTER_EXAMPLE_MAIN_BRANCH="main"
-
-if [[ "${AZP_BRANCH}" == "${MAIN_BRANCH}" ]]; then
-  echo "Cloning..."
-  git clone git@github.com:envoyproxy/envoy-filter-example "$CHECKOUT_DIR" -b "${FILTER_EXAMPLE_MAIN_BRANCH}"
-
-  git -C "$CHECKOUT_DIR" config user.name "envoy-filter-example(Azure Pipelines)"
-  git -C "$CHECKOUT_DIR" config user.email envoy-filter-example@users.noreply.github.com
-
-  echo "Updating Submodule..."
-  # Update submodule to latest Envoy SHA
-  ENVOY_SHA=$(git rev-parse HEAD)
-  CURRENT_SHA="$(git -C "$CHECKOUT_DIR" ls-files -s envoy | cut -d' ' -f2)"
-
-  if [[ "$CURRENT_SHA" == "$ENVOY_SHA" ]]; then
-      echo "Submodule already up to date (${ENVOY_SHA})"
-      exit 0
-  fi
-
-  git -C "$CHECKOUT_DIR" submodule update --init
-  git -C "$CHECKOUT_DIR/envoy" checkout "$ENVOY_SHA"
-
-  echo "Updating Workspace file."
-  sed -e "s|{ENVOY_SRCDIR}|envoy|" "${ENVOY_SRCDIR}"/ci/WORKSPACE.filter.example > "${CHECKOUT_DIR}"/WORKSPACE
-
-  echo "Committing, and Pushing..."
-  git -C "$CHECKOUT_DIR" commit -a -m "Update Envoy submodule to $ENVOY_SHA"
-  git -C "$CHECKOUT_DIR" push origin "${FILTER_EXAMPLE_MAIN_BRANCH}"
-  echo "Done"
-fi
diff --git a/ci/go_mirror.sh b/ci/go_mirror.sh
deleted file mode 100755
index 6e69c68a0a93..000000000000
--- a/ci/go_mirror.sh
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/bin/bash
-
-set -e
-
-MAIN_BRANCH="refs/heads/main"
-
-# shellcheck source=ci/setup_cache.sh
-. "$(dirname "$0")"/setup_cache.sh
-
-if [[ "${AZP_BRANCH}" == "${MAIN_BRANCH}" ]]; then
-  BAZEL_BUILD_OPTION_LIST="${BAZEL_BUILD_EXTRA_OPTIONS}" tools/api/generate_go_protobuf.py --sync
-fi