echo.yaml

name: echo
# Builds ghcr.io/yolean/envoy:echo-vX.Y.Z. Spins up the result in docker,
# verifies /q/envoy/echo over HTTP, then pushes the multi-arch
# (amd64+arm64/v8) manifest. On schedule the job auto-discovers every
# upstream envoy release >= MIN_VERSION that doesn't yet have an
# :echo-* tag at ghcr — no human merge needed for new envoy releases.

on:
  schedule:
  - cron: "11 3 * * *"  # 03:11 UTC, after mirror
  push:
    branches: [main]
    paths:
    - echo/**
    - echo-build.sh
    - .github/workflows/echo.yaml
  pull_request:
    paths:
    - echo/**
    - echo-build.sh
    - .github/workflows/echo.yaml
  workflow_dispatch:
    inputs:
      envoy_version:
        description: 'Specific envoy version (e.g. v1.38.0); leave blank to auto-discover'
        required: false
        default: ''

env:
  MIN_VERSION: '1.38.0'
  # Reproducible builds: zero timestamps in image+layers; buildx flags
  # in echo-build.sh further drop provenance/sbom (which embed build
  # time and machine info). Same source + same ENVOY_VERSION should
  # always resolve to the same image digest.
  SOURCE_DATE_EPOCH: '0'

jobs:
  plan:
    name: Plan versions
    runs-on: ubuntu-latest
    outputs:
      versions: ${{ steps.plan.outputs.versions }}
      do_push: ${{ steps.plan.outputs.do_push }}
    steps:
    - uses: actions/checkout@v4
    - uses: imjasonh/setup-crane@v0.4
    - id: plan
      env:
        EVENT: ${{ github.event_name }}
        FORCE_VERSION: ${{ github.event.inputs.envoy_version }}
      run: |
        set -euo pipefail
        ver_ge() { [ "$1" = "$2" ] && return 0; printf '%s\n%s\n' "$2" "$1" | sort -V -C; }
        default_version=$(grep -E '^ARG ENVOY_VERSION=' echo/Dockerfile | head -1 | cut -d= -f2)

        case "$EVENT" in
          schedule)
            upstream=$(crane ls docker.io/envoyproxy/envoy)
            existing=$(crane ls ghcr.io/yolean/envoy 2>/dev/null || true)
            missing=()
            while IFS= read -r tag; do
              [[ "$tag" =~ ^v([0-9]+\.[0-9]+\.[0-9]+)$ ]] || continue
              ver="${BASH_REMATCH[1]}"
              ver_ge "$ver" "$MIN_VERSION" || continue
              if ! grep -Fxq "echo-$tag" <<<"$existing"; then
                missing+=("$tag")
              fi
            done <<<"$upstream"
            json=$(printf '%s\n' "${missing[@]:-}" | python3 -c 'import sys,json; print(json.dumps([l for l in sys.stdin.read().split() if l]))')
            echo "versions=$json" >> "$GITHUB_OUTPUT"
            echo "do_push=true" >> "$GITHUB_OUTPUT"
            echo "schedule discovered missing: ${missing[*]:-<none>}"
            ;;
          workflow_dispatch)
            v="${FORCE_VERSION:-$default_version}"
            echo "versions=[\"$v\"]" >> "$GITHUB_OUTPUT"
            echo "do_push=true" >> "$GITHUB_OUTPUT"
            ;;
          push)
            echo "versions=[\"$default_version\"]" >> "$GITHUB_OUTPUT"
            echo "do_push=true" >> "$GITHUB_OUTPUT"
            ;;
          pull_request)
            echo "versions=[\"$default_version\"]" >> "$GITHUB_OUTPUT"
            echo "do_push=false" >> "$GITHUB_OUTPUT"
            ;;
        esac

  build:
    name: Build ${{ matrix.version }}
    needs: plan
    if: ${{ needs.plan.outputs.versions != '[]' }}
    runs-on: ubuntu-latest
    permissions:
      packages: write
      contents: read
    strategy:
      fail-fast: false
      matrix:
        version: ${{ fromJSON(needs.plan.outputs.versions) }}
    env:
      ENVOY_VERSION: ${{ matrix.version }}
    steps:
    - uses: actions/checkout@v4
    - uses: docker/setup-qemu-action@v3
    - uses: docker/setup-buildx-action@v3
    - uses: docker/login-action@v3
      with:
        registry: ghcr.io
        username: ${{ github.repository_owner }}
        password: ${{ secrets.GITHUB_TOKEN }}
    - name: Build, verify, push (PUSH=${{ needs.plan.outputs.do_push }})
      env:
        PUSH: ${{ needs.plan.outputs.do_push }}
      run: ./echo-build.sh