From ead49dee45573e7d90e014ce0d84f5480f0f6176 Mon Sep 17 00:00:00 2001 From: rulex123 Date: Fri, 30 Oct 2026 10:58:49 +0100 Subject: [PATCH 1/5] ci: resolve Envoy proto dependencies from Bazel lockfile Signed-off-by: rulex123 --- tools/update-sha.sh | 58 +++++++++++++++++++-------------------------- 1 file changed, 24 insertions(+), 34 deletions(-) diff --git a/tools/update-sha.sh b/tools/update-sha.sh index 7641ee64..ea338e13 100755 --- a/tools/update-sha.sh +++ b/tools/update-sha.sh @@ -6,15 +6,16 @@ set -o nounset set -o xtrace function find_sha() { - local CONTENT=$1 - local DEPENDENCY=$2 - echo "$CONTENT" | grep "$DEPENDENCY" -A 11 | grep -m 1 "version =" | awk '{ print $3 }' | tr -d '"' | tr -d "," -} - -function find_date() { - local CONTENT=$1 - local DEPENDENCY=$2 - echo "$CONTENT" | grep "$DEPENDENCY" -A 11 | grep -m 1 "release_date =" | awk '{ print $3 }' | tr -d '"' | tr -d "," || true + local MODULE=$1 + local SOURCE_JSON + # The lockfile includes both the public and Envoy-specific registry URLs. + SOURCE_JSON=$(jq -er --arg module "$MODULE" ' + .registryFileHashes | to_entries[] | + select(.value != "not found") | + .key | select(contains("/modules/" + $module + "/") and endswith("/source.json")) + ' <<< "$LOCKFILE") + curl -fsSL "$SOURCE_JSON" | jq -er '.url' | + sed -E 's@.*/archive/(refs/tags/)?@@; s@\.(tar\.gz|zip)$@@; s@^v@@' } function find_envoy_sha_from_tag() { @@ -25,38 +26,27 @@ function find_envoy_sha_from_tag() { CURRENT_ENVOY_RELEASE=$(cat envoy_release) ENVOY_VERSION=$(find_envoy_sha_from_tag "$1") -CURL_OUTPUT=$(curl -fsSL "https://raw.githubusercontent.com/envoyproxy/envoy/$ENVOY_VERSION/api/bazel/repository_locations.bzl") - -GOOGLEAPIS_SHA=$(find_sha "$CURL_OUTPUT" com_google_googleapis) -GOOGLEAPIS_DATE=$(find_date "$CURL_OUTPUT" com_google_googleapis) - -PGV_GIT_SHA=$(find_sha "$CURL_OUTPUT" com_envoyproxy_protoc_gen_validate) -PGV_GIT_DATE=$(find_date "$CURL_OUTPUT" com_envoyproxy_protoc_gen_validate) - -PROMETHEUS_SHA=$(find_sha "$CURL_OUTPUT" prometheus_metrics_model) -PROMETHEUS_DATE=$(find_date "$CURL_OUTPUT" prometheus_metrics_model) - -XDS_SHA=$(find_sha "$CURL_OUTPUT" "xds = dict") -XDS_DATE=$(find_date "$CURL_OUTPUT" "xds = dict") - -OPENTELEMETRY_SHA=$(find_sha "$CURL_OUTPUT" opentelemetry_proto) -OPENTELEMETRY_DATE=$(find_date "$CURL_OUTPUT" opentelemetry_proto) +LOCKFILE=$(curl -fsSL "https://raw.githubusercontent.com/envoyproxy/envoy/$ENVOY_VERSION/MODULE.bazel.lock") -CEL_SHA=$(find_sha "$CURL_OUTPUT" dev_cel) -CEL_DATE=$(find_date "$CURL_OUTPUT" dev_cel) +GOOGLEAPIS_SHA=$(find_sha googleapis) +PGV_GIT_SHA=$(find_sha protoc-gen-validate) +PROMETHEUS_SHA=$(find_sha prometheus-metrics-model) +XDS_SHA=$(find_sha xds) +OPENTELEMETRY_SHA=$(find_sha opentelemetry-proto) +CEL_SHA=$(find_sha cel-spec) echo -n "# Update the versions here and run update-api.sh # envoy (source: SHA from https://github.com/envoyproxy/envoy) ENVOY_SHA=\"$ENVOY_VERSION\" -# dependencies (source: https://github.com/envoyproxy/envoy/blob/$ENVOY_VERSION/api/bazel/repository_locations.bzl) -GOOGLEAPIS_SHA=\"$GOOGLEAPIS_SHA\" # $GOOGLEAPIS_DATE -PGV_VERSION=\"$PGV_GIT_SHA\" # $PGV_GIT_DATE -PROMETHEUS_SHA=\"$PROMETHEUS_SHA\" # $PROMETHEUS_DATE -OPENTELEMETRY_VERSION=\"$OPENTELEMETRY_SHA\" # $OPENTELEMETRY_DATE -CEL_VERSION=\"$CEL_SHA\" # $CEL_DATE -XDS_SHA=\"$XDS_SHA\" # $XDS_DATE +# dependencies (source: https://github.com/envoyproxy/envoy/blob/$ENVOY_VERSION/MODULE.bazel.lock) +GOOGLEAPIS_SHA=\"$GOOGLEAPIS_SHA\" +PGV_VERSION=\"$PGV_GIT_SHA\" +PROMETHEUS_SHA=\"$PROMETHEUS_SHA\" +OPENTELEMETRY_VERSION=\"$OPENTELEMETRY_SHA\" +CEL_VERSION=\"$CEL_SHA\" +XDS_SHA=\"$XDS_SHA\" " # replace version in EnvoyContainer.java From 388c04a2f39928e754e6d1d57c907a42ed9be75b Mon Sep 17 00:00:00 2001 From: rulex123 Date: Sun, 1 Nov 2026 17:56:41 +0100 Subject: [PATCH 2/5] ci: simplify Envoy source revision lookup Signed-off-by: rulex123 --- tools/update-sha.sh | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/tools/update-sha.sh b/tools/update-sha.sh index ea338e13..ea093a96 100755 --- a/tools/update-sha.sh +++ b/tools/update-sha.sh @@ -7,15 +7,20 @@ set -o xtrace function find_sha() { local MODULE=$1 - local SOURCE_JSON + local SOURCE_JSON ARCHIVE_URL REVISION # The lockfile includes both the public and Envoy-specific registry URLs. - SOURCE_JSON=$(jq -er --arg module "$MODULE" ' - .registryFileHashes | to_entries[] | - select(.value != "not found") | - .key | select(contains("/modules/" + $module + "/") and endswith("/source.json")) - ' <<< "$LOCKFILE") - curl -fsSL "$SOURCE_JSON" | jq -er '.url' | - sed -E 's@.*/archive/(refs/tags/)?@@; s@\.(tar\.gz|zip)$@@; s@^v@@' + SOURCE_JSON=$( + jq -r '.registryFileHashes | keys[]' <<< "$LOCKFILE" | + grep -F "/modules/$MODULE/" | + grep '/source.json$' + ) + + ARCHIVE_URL=$(curl -fsSL "$SOURCE_JSON" | jq -er '.url') + + REVISION=${ARCHIVE_URL##*/} # Keep only the filename, e.g. v1.8.0.tar.gz. + REVISION=${REVISION%.tar.gz} # Remove .tar.gz if present. + REVISION=${REVISION%.zip} # Remove .zip if present. + echo "${REVISION#v}" # Remove a leading v and print the revision for the caller. } function find_envoy_sha_from_tag() { From c7f9f8fb3f0fcf7cf1774e8c2ab5e244d4e0d977 Mon Sep 17 00:00:00 2001 From: rulex123 Date: Sun, 1 Nov 2026 18:00:34 +0100 Subject: [PATCH 3/5] ci: remove unclear registry comment Signed-off-by: rulex123 --- tools/update-sha.sh | 1 - 1 file changed, 1 deletion(-) diff --git a/tools/update-sha.sh b/tools/update-sha.sh index ea093a96..f362acca 100755 --- a/tools/update-sha.sh +++ b/tools/update-sha.sh @@ -8,7 +8,6 @@ set -o xtrace function find_sha() { local MODULE=$1 local SOURCE_JSON ARCHIVE_URL REVISION - # The lockfile includes both the public and Envoy-specific registry URLs. SOURCE_JSON=$( jq -r '.registryFileHashes | keys[]' <<< "$LOCKFILE" | grep -F "/modules/$MODULE/" | From 0324f6ba907beec0ab6ca282cfca4e9e79dc71c6 Mon Sep 17 00:00:00 2001 From: rulex123 Date: Mon, 2 Nov 2026 08:50:42 +0100 Subject: [PATCH 4/5] ci: use API lockfile while preserving CEL compatibility Signed-off-by: rulex123 --- tools/update-sha.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tools/update-sha.sh b/tools/update-sha.sh index f362acca..4cc216a8 100755 --- a/tools/update-sha.sh +++ b/tools/update-sha.sh @@ -30,26 +30,26 @@ function find_envoy_sha_from_tag() { CURRENT_ENVOY_RELEASE=$(cat envoy_release) ENVOY_VERSION=$(find_envoy_sha_from_tag "$1") -LOCKFILE=$(curl -fsSL "https://raw.githubusercontent.com/envoyproxy/envoy/$ENVOY_VERSION/MODULE.bazel.lock") +LOCKFILE=$(curl -fsSL "https://raw.githubusercontent.com/envoyproxy/envoy/$ENVOY_VERSION/api/MODULE.bazel.lock") GOOGLEAPIS_SHA=$(find_sha googleapis) PGV_GIT_SHA=$(find_sha protoc-gen-validate) PROMETHEUS_SHA=$(find_sha prometheus-metrics-model) XDS_SHA=$(find_sha xds) OPENTELEMETRY_SHA=$(find_sha opentelemetry-proto) -CEL_SHA=$(find_sha cel-spec) +CEL_SHA="0.25.1" # Preserve our generated CEL API; Envoy's API lockfile selects 0.24.0. echo -n "# Update the versions here and run update-api.sh # envoy (source: SHA from https://github.com/envoyproxy/envoy) ENVOY_SHA=\"$ENVOY_VERSION\" -# dependencies (source: https://github.com/envoyproxy/envoy/blob/$ENVOY_VERSION/MODULE.bazel.lock) +# dependencies (source: https://github.com/envoyproxy/envoy/blob/$ENVOY_VERSION/api/MODULE.bazel.lock) GOOGLEAPIS_SHA=\"$GOOGLEAPIS_SHA\" PGV_VERSION=\"$PGV_GIT_SHA\" PROMETHEUS_SHA=\"$PROMETHEUS_SHA\" OPENTELEMETRY_VERSION=\"$OPENTELEMETRY_SHA\" -CEL_VERSION=\"$CEL_SHA\" +CEL_VERSION=\"$CEL_SHA\" # Pinned for API compatibility. XDS_SHA=\"$XDS_SHA\" " From 9ab29a6cc7dacd94531f34664780ef5ebf4add3a Mon Sep 17 00:00:00 2001 From: rulex123 Date: Mon, 2 Nov 2026 08:58:11 +0100 Subject: [PATCH 5/5] ci: explain temporary CEL pin and upstream follow-up Signed-off-by: rulex123 --- tools/update-sha.sh | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tools/update-sha.sh b/tools/update-sha.sh index 4cc216a8..91958d54 100755 --- a/tools/update-sha.sh +++ b/tools/update-sha.sh @@ -37,7 +37,10 @@ PGV_GIT_SHA=$(find_sha protoc-gen-validate) PROMETHEUS_SHA=$(find_sha prometheus-metrics-model) XDS_SHA=$(find_sha xds) OPENTELEMETRY_SHA=$(find_sha opentelemetry-proto) -CEL_SHA="0.25.1" # Preserve our generated CEL API; Envoy's API lockfile selects 0.24.0. +# Envoy removed its direct CEL pin in envoyproxy/envoy#43265, so the API +# lockfile now selects 0.24.0. Keep 0.25.1 to preserve our generated CEL API +# while we clarify upstream whether api/ should restore that version. +CEL_SHA="0.25.1" echo -n "# Update the versions here and run update-api.sh