ci: Add sync workflow #701
Conversation
|
@phlax let me know when this gets out of wip, thanks for this change this is great |
will do, shouldnt take much, mostly i want to test it, but i think its also not quite right yet |
When this is ready, could you please also add an explanation (to the README maybe?) of where all the moving parts are, and how someone could update them? If the app has any source code, then it might be good for it to also live in the |
phlax
force-pushed
the
ci-sync
branch
5 times, most recently
from
78c40aa
to
185efe4
Compare
|
@alecholmez i have shifted the algo from the python script to here, i will update to use the envoy ive tested this pretty well now, so reasonably confident this should hit the ground working, but will follow up if there any issues currently it takes ~3 mins, at the cost of some complexity it could be a lot faster with caching
note about sync added
they are here, pr to this repo
it doesnt
it does |
Signed-off-by: Ryan Northey <[email protected]>
|
for ref, you can see a triggered wf run here https://github.com/phlax/go-control-plane/actions/runs/5111042721/jobs/9187570100 and a commit here phlax@ed38670 i have fixed the commit message |
|
can we land? i have the other repos that envoy syncs to updated, so we should be good to update envoy |
ci/sync_envoy.sh
Outdated
| # shellcheck disable=SC1091 | ||
| . ci/setup_cache.sh | ||
|
|
||
| read -a go_protos <<< "$(bazel query "kind('go_proto_library', ${GO_TARGETS[*]})" | tr '\n' ' ')" |
There was a problem hiding this comment.
nit:
$ shellcheck ci/sync_envoy.sh
In ci/sync_envoy.sh line 31:
read -a go_protos <<< "$(bazel query "kind('go_proto_library', ${GO_TARGETS[*]})" | tr '\n' ' ')"
^--^ SC2162 (info): read without -r will mangle backslashes.
For more information:
https://www.shellcheck.net/wiki/SC2162 -- read without -r will mangle backs...
There was a problem hiding this comment.
would be good to add shellcheck to the ci here - i was running it locally before submitting but i think this slipped through
also, would be good to clear up the whitespace issues
$ pip install envoy.code.check
$ envoy.code.check . -c glintwill show you issues
| @@ -0,0 +1,95 @@ | |||
| #!/bin/bash -e | |||
|
|
|||
| set -o pipefail | |||
There was a problem hiding this comment.
nit: if you add set -o errexit here, it's the same as bash -e, except (IMHO) a bit clearer to the reader.
There was a problem hiding this comment.
Also consider set -o nounset, which is also a useful check, though not always what you want.
There was a problem hiding this comment.
nouunset would not work here if it is checking for an unset var
There was a problem hiding this comment.
nit: if you add set -o errexit here, it's the same as bash -e, except (IMHO) a bit clearer to the reader.
thinking on this im not sure - my guess is that you if you surveyed devs more would recognize -e as its just far more common
re nounset - i guess it can probably work if i re/set it from the env
|
@phlax do you have merge permissions? If not I can roll it in |
Signed-off-by: Ryan Northey <[email protected]>
i do, but would rather let you guys do it ive updated the pr with feedback we can test it manually straight away when it lands, but i will also move to get the envoy side set up asap so we can test it properly - im happy to follow up if necessary |
|
I'm good to merge this... @jpeach I'll defer to you clicking the green button since you had some comments |
Yeh, I just had a few nitpicks. This looks good overall 👍 |
|
after removing Syncing go protos ...
Copying ../envoy/build_go/envoy -> envoy
Copying ../envoy/build_go/contrib -> contrib
Committing changes ...
Nothing changed, not committingi will land the update in Envoy shortly envoyproxy/envoy#27294 and check from there the real test will be when there is some change to commit, so will keep watching |
|
looking good
|
Currently Envoy CI uses an SSH key with all powers to sync this repo by pushing to it
This is not optimally secure, and furthermore this pattern regularly causes Envoy CI to flake racing to checkout/push downstream repos.
I have created an app with just wf trigger permissions and added it to this repo
This PR adds a workflow that can be triggered by the app to sync Envoy by pulling from it