envoy-macos.yml

name: Envoy/macOS

permissions:
  contents: read

on:
  workflow_run:
    workflows:
    - Request
    types:
    - completed

concurrency:
  group: ${{ github.head_ref || github.run_id }}-${{ github.workflow }}
  cancel-in-progress: true


jobs:
  load:
    secrets:
      app-key: ${{ secrets.ENVOY_CI_APP_KEY }}
      app-id: ${{ secrets.ENVOY_CI_APP_ID }}
      lock-app-key: ${{ secrets.ENVOY_CI_MUTEX_APP_KEY }}
      lock-app-id: ${{ secrets.ENVOY_CI_MUTEX_APP_ID }}
    permissions:
      actions: read
      contents: read
      packages: read
      pull-requests: read
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    uses: ./.github/workflows/_load.yml
    with:
      cache-docker: false
      check-name: macos

  macos:
    permissions:
      contents: read
      packages: read
    secrets:
      rbe-key: ${{ secrets.GCP_SERVICE_ACCOUNT_KEY }}
    if: ${{ fromJSON(needs.load.outputs.request).run.build-macos }}
    needs:
    - load
    uses: ./.github/workflows/_run.yml
    name: CI ${{ matrix.name || matrix.target }}
    with:
      command:
      container-command:
      request: ${{ needs.load.outputs.request }}
      runs-on: macos-14-xlarge
      steps-post:
      steps-pre: ${{ matrix.steps-pre }}
      target: ${{ matrix.target }}
      trusted: ${{ fromJSON(needs.load.outputs.trusted) }}
    strategy:
      fail-fast: false
      matrix:
        include:
        - target: ci/mac_ci_steps.sh
          name: macOS
          steps-pre: |
            - run: ./ci/mac_ci_setup.sh
              shell: bash
              name: Setup macos
          source: |
            GCP_SERVICE_ACCOUNT_KEY_PATH=$(mktemp -t gcp_service_account.XXXXXX.json)
            bash -c "echo \"${RBE_KEY}\" | base64 --decode > \"${GCP_SERVICE_ACCOUNT_KEY_PATH}\""
            _BAZEL_BUILD_EXTRA_OPTIONS=(
              --remote_download_toplevel
              --flaky_test_attempts=2
              --config=cache-google
              --config=ci
              --google_credentials=${GCP_SERVICE_ACCOUNT_KEY_PATH})
            export BAZEL_BUILD_EXTRA_OPTIONS=${_BAZEL_BUILD_EXTRA_OPTIONS[*]}

  request:
    permissions:
      actions: read
      contents: read
      pull-requests: read
    secrets:
      app-id: ${{ secrets.ENVOY_CI_APP_ID }}
      app-key: ${{ secrets.ENVOY_CI_APP_KEY }}
    if: >-
      ${{ always()
          && github.event.workflow_run.conclusion == 'success'
          && fromJSON(needs.load.outputs.request).run.build-macos }}
    needs:
    - load
    - macos
    uses: ./.github/workflows/_finish.yml
    with:
      needs: ${{ toJSON(needs) }}