Skip to content

ci: resolve Envoy proto dependencies from API lockfile #526

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rulex123 wants to merge 5 commits into
base: main
Choose a base branch
from
+31 −34
Open

ci: resolve Envoy proto dependencies from API lockfile #526

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
ead49de
ci: resolve Envoy proto dependencies from Bazel lockfile
rulex123 Oct 30, 2026
388c04a
ci: simplify Envoy source revision lookup
rulex123 Nov 1, 2026
c7f9f8f
ci: remove unclear registry comment
rulex123 Nov 1, 2026
0324f6b
ci: use API lockfile while preserving CEL compatibility
rulex123 Nov 2, 2026
9ab29a6
ci: explain temporary CEL pin and upstream follow-up
rulex123 Nov 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
65 changes: 31 additions & 34 deletions tools/update-sha.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,15 +6,20 @@ set -o nounset
set -o xtrace

function find_sha() {
local CONTENT=$1
local DEPENDENCY=$2
echo "$CONTENT" | grep "$DEPENDENCY" -A 11 | grep -m 1 "version =" | awk '{ print $3 }' | tr -d '"' | tr -d ","
}

function find_date() {
local CONTENT=$1
local DEPENDENCY=$2
echo "$CONTENT" | grep "$DEPENDENCY" -A 11 | grep -m 1 "release_date =" | awk '{ print $3 }' | tr -d '"' | tr -d "," || true
local MODULE=$1
local SOURCE_JSON ARCHIVE_URL REVISION
SOURCE_JSON=$(
jq -r '.registryFileHashes | keys[]' <<< "$LOCKFILE" |
grep -F "/modules/$MODULE/" |
grep '/source.json$'
)

ARCHIVE_URL=$(curl -fsSL "$SOURCE_JSON" | jq -er '.url')

REVISION=${ARCHIVE_URL##*/} # Keep only the filename, e.g. v1.8.0.tar.gz.
REVISION=${REVISION%.tar.gz} # Remove .tar.gz if present.
REVISION=${REVISION%.zip} # Remove .zip if present.
echo "${REVISION#v}" # Remove a leading v and print the revision for the caller.
}

function find_envoy_sha_from_tag() {
Expand All @@ -25,38 +30,30 @@ function find_envoy_sha_from_tag() {
CURRENT_ENVOY_RELEASE=$(cat envoy_release)
ENVOY_VERSION=$(find_envoy_sha_from_tag "$1")

CURL_OUTPUT=$(curl -fsSL "https://raw.githubusercontent.com/envoyproxy/envoy/$ENVOY_VERSION/api/bazel/repository_locations.bzl")

GOOGLEAPIS_SHA=$(find_sha "$CURL_OUTPUT" com_google_googleapis)
GOOGLEAPIS_DATE=$(find_date "$CURL_OUTPUT" com_google_googleapis)

PGV_GIT_SHA=$(find_sha "$CURL_OUTPUT" com_envoyproxy_protoc_gen_validate)
PGV_GIT_DATE=$(find_date "$CURL_OUTPUT" com_envoyproxy_protoc_gen_validate)

PROMETHEUS_SHA=$(find_sha "$CURL_OUTPUT" prometheus_metrics_model)
PROMETHEUS_DATE=$(find_date "$CURL_OUTPUT" prometheus_metrics_model)

XDS_SHA=$(find_sha "$CURL_OUTPUT" "xds = dict")
XDS_DATE=$(find_date "$CURL_OUTPUT" "xds = dict")

OPENTELEMETRY_SHA=$(find_sha "$CURL_OUTPUT" opentelemetry_proto)
OPENTELEMETRY_DATE=$(find_date "$CURL_OUTPUT" opentelemetry_proto)
LOCKFILE=$(curl -fsSL "https://raw.githubusercontent.com/envoyproxy/envoy/$ENVOY_VERSION/api/MODULE.bazel.lock")

CEL_SHA=$(find_sha "$CURL_OUTPUT" dev_cel)
CEL_DATE=$(find_date "$CURL_OUTPUT" dev_cel)
GOOGLEAPIS_SHA=$(find_sha googleapis)
PGV_GIT_SHA=$(find_sha protoc-gen-validate)
PROMETHEUS_SHA=$(find_sha prometheus-metrics-model)
XDS_SHA=$(find_sha xds)
OPENTELEMETRY_SHA=$(find_sha opentelemetry-proto)
# Envoy removed its direct CEL pin in envoyproxy/envoy#43265, so the API
# lockfile now selects 0.24.0. Keep 0.25.1 to preserve our generated CEL API
# while we clarify upstream whether api/ should restore that version.
CEL_SHA="0.25.1"

echo -n "# Update the versions here and run update-api.sh

# envoy (source: SHA from https://github.com/envoyproxy/envoy)
ENVOY_SHA=\"$ENVOY_VERSION\"

# dependencies (source: https://github.com/envoyproxy/envoy/blob/$ENVOY_VERSION/api/bazel/repository_locations.bzl)
GOOGLEAPIS_SHA=\"$GOOGLEAPIS_SHA\" # $GOOGLEAPIS_DATE
PGV_VERSION=\"$PGV_GIT_SHA\" # $PGV_GIT_DATE
PROMETHEUS_SHA=\"$PROMETHEUS_SHA\" # $PROMETHEUS_DATE
OPENTELEMETRY_VERSION=\"$OPENTELEMETRY_SHA\" # $OPENTELEMETRY_DATE
CEL_VERSION=\"$CEL_SHA\" # $CEL_DATE
XDS_SHA=\"$XDS_SHA\" # $XDS_DATE
# dependencies (source: https://github.com/envoyproxy/envoy/blob/$ENVOY_VERSION/api/MODULE.bazel.lock)
GOOGLEAPIS_SHA=\"$GOOGLEAPIS_SHA\"
PGV_VERSION=\"$PGV_GIT_SHA\"
PROMETHEUS_SHA=\"$PROMETHEUS_SHA\"
OPENTELEMETRY_VERSION=\"$OPENTELEMETRY_SHA\"
CEL_VERSION=\"$CEL_SHA\" # Pinned for API compatibility.
XDS_SHA=\"$XDS_SHA\"
"

# replace version in EnvoyContainer.java
Expand Down
Loading