ci/examples: Improve CI config (#28445)

Signed-off-by: Ryan Northey <ryan@synca.io>

.github/actions/verify/examples/setup/action.yml

@@ -0,0 +1,35 @@
+inputs:
+  ref:
+    type: string
+    required: true
+
+runs:
+  using: composite
+  steps:
+  - id: url
+    run: |
+        echo "base=https://storage.googleapis.com/${BUCKET}/${REF:0:7}/docker" \
+            >> "$GITHUB_OUTPUT"
+    env:
+      BUCKET: envoy-${{ github.event_name == 'pull_request' && 'pr' || 'postsubmit' }}
+      REF: ${{ inputs.ref }}
+    shell: bash
+  - uses: envoyproxy/toolshed/gh-actions/docker/fetch@actions-v0.0.8
+    with:
+      url: "${{ steps.url.outputs.base }}/envoy.tar"
+      variant: dev
+  - uses: envoyproxy/toolshed/gh-actions/docker/fetch@actions-v0.0.8
+    with:
+      url: "${{ steps.url.outputs.base }}/envoy-contrib.tar"
+      variant: contrib-dev
+  - uses: envoyproxy/toolshed/gh-actions/docker/fetch@actions-v0.0.8
+    with:
+      url: "${{ steps.url.outputs.base }}/envoy-google-vrp.tar"
+      variant: google-vrp-dev
+  - run: docker images | grep envoy
+    shell: bash
+  - run: |
+      export DEBIAN_FRONTEND=noninteractive
+      sudo apt-get -qq update -y
+      sudo apt-get -qq install -y --no-install-recommends expect
+    shell: bash

.github/workflows/_ci.yml

@@ -73,7 +73,8 @@ jobs:
     runs-on: ubuntu-22.04
     name: do_ci.sh ${{ inputs.target }}
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/docker/cache/restore@actions-v0.0.7
+    - if: ${{ inputs.cache_build_image }}
+      uses: envoyproxy/toolshed/gh-actions/docker/cache/restore@actions-v0.0.8
       with:
         image_tag: ${{ inputs.cache_build_image }}
     - uses: actions/checkout@v3
@@ -101,7 +102,7 @@ jobs:
       name: "Check disk space at beginning"
 
     - if: ${{ inputs.run_pre }}
-      uses: envoyproxy/toolshed/gh-actions/using/recurse@actions-v0.0.7
+      uses: envoyproxy/toolshed/gh-actions/using/recurse@actions-v0.0.8
       with:
         uses: ${{ inputs.run_pre }}
         with: ${{ inputs.run_pre_with }}
@@ -123,7 +124,7 @@ jobs:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
     - if: ${{ inputs.run_post }}
-      uses: envoyproxy/toolshed/gh-actions/using/recurse@actions-v0.0.7
+      uses: envoyproxy/toolshed/gh-actions/using/recurse@actions-v0.0.8
       with:
         uses: ${{ inputs.run_post }}
         with: ${{ inputs.run_post_with }}

.github/workflows/envoy-publish.yml

@@ -0,0 +1,77 @@
+name: Publish & verify
+
+on:
+  # This runs untrusted code, do not expose secrets in the verify job
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: "Git SHA ref to checkout"
+      sha:
+        description: "Git SHA of commit HEAD (ie last commit of PR)"
+      head_ref:
+        description: "Ref for grouping PRs"
+
+concurrency:
+  group: ${{ github.event.inputs.head_ref || github.run_id }}-${{ github.workflow }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    if: |
+      ${{
+          github.repository == 'envoyproxy/envoy'
+          && (!contains(github.actor, '[bot]')
+              || github.actor == 'trigger-workflow-envoy[bot]')
+      }}
+    uses: ./.github/workflows/_workflow-start.yml
+    permissions:
+      contents: read
+      statuses: write
+    with:
+      workflowName: Verify/examples
+
+  env:
+    uses: ./.github/workflows/_env.yml
+  cache:
+    needs:
+    - env
+    uses: ./.github/workflows/_cache_docker.yml
+    with:
+      image_tag: "${{ needs.env.outputs.build_image_ubuntu }}"
+
+  ci:
+    needs:
+    - check
+    - env
+    - cache
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - target: verify_examples
+          rbe: false
+          managed: true
+          cache_build_image: ""
+          command_prefix: ""
+          diskspace_hack: true
+          run_pre: ./.github/actions/verify/examples/setup
+          run_pre_with: |
+            ref: ${{ inputs.ref }}
+          env: |
+            export NO_BUILD_SETUP=1
+    uses: ./.github/workflows/_ci.yml
+    name: CI ${{ matrix.target }}
+    with:
+      target: ${{ matrix.target }}
+      rbe: ${{ matrix.rbe }}
+      managed: ${{ matrix.managed }}
+      cache_build_image: ${{ matrix.cache_build_image }}
+      diskspace_hack: ${{ matrix.diskspace_hack }}
+      command_prefix: ${{ matrix.command_prefix }}
+      run_pre: ${{ matrix.run_pre }}
+      run_pre_with: ${{ matrix.run_pre_with }}
+      env: ${{ matrix.env }}
+    secrets: inherit

.github/workflows/workflow-complete.yml

@@ -6,7 +6,7 @@ on:
   # Do not run untrusted code here
   workflow_run:
     workflows:
-    - Verify/examples
+    - Publish & verify
     types:
     - completed