stages.yml

parameters:
## Build stages
# NB: all stages _must_ depend on `env`
- name: buildStageDeps
  displayName: "Build stage dependencies"
  type: object
  default:
  - env
  - prechecks
- name: checkStageDeps
  displayName: "Check stage dependencies"
  type: object
  default:
  - env
  - linux_x64
- name: concurrencyChecks
  displayName: "Check concurrency"
  type: number
  default: 10
- name: concurrencyPrechecks
  displayName: "Prechecks concurrency"
  type: number
  default: 10

## Timeouts
- name: timeoutDockerPublish
  displayName: "Timout Docker publish"
  type: number
  default: 10
- name: timeoutDockerBuild
  displayName: "Timout Docker build"
  type: number
  default: 400

## Build settings
- name: cacheTestResults
  displayName: "Cache test results"
  type: boolean
  default: true

stages:
- stage: env
  displayName: Environment
  jobs:
  - template: env.yml

- stage: prechecks
  displayName: Prechecks
  dependsOn: ["env"]
  jobs:
  - template: stage/prechecks.yml
    parameters:
      concurrencyPrechecks: ${{ parameters.concurrencyPrechecks }}
      cacheTestResults: ${{ parameters.cacheTestResults }}
      authGCP: $(GcpServiceAccountKey)
      authGPGPassphrase: $(MaintainerGPGKeyPassphrase)
      authGPGKey: $(MaintainerGPGKeySecureFileDownloadPath)
      authGPGPath: $(MaintainerGPGKey.secureFilePath)
      bucketGCP: $(GcsArtifactBucket)
      runPrechecks: stageDependencies.env.repo.outputs['run.releaseTests']

- stage: linux_x64
  displayName: Linux x64
  dependsOn: ${{ parameters.buildStageDeps }}
  variables:
    RUN_BUILD: $[stageDependencies.env.repo.outputs['run.build']]
    RUN_TESTS: $[stageDependencies.env.repo.outputs['run.releaseTests']]
  jobs:
  - template: stage/linux.yml
    parameters:
      cacheTestResults: ${{ parameters.cacheTestResults }}
      bazelConfigRBE: --config=remote-ci --config=rbe-google --jobs=200
      pool: envoy-x64-large
      # these are parsed differently and _must_ be expressed in this way
      runBuild: variables['RUN_BUILD']
      runTests: $(RUN_TESTS)

- stage: linux_arm64
  displayName: Linux arm64
  dependsOn: ${{ parameters.buildStageDeps }}
  variables:
    RUN_BUILD: $[stageDependencies.env.repo.outputs['run.build']]
    RUN_TESTS: $[stageDependencies.env.repo.outputs['run.releaseTests']]
  jobs:
  - template: stage/linux.yml
    parameters:
      cacheTestResults: ${{ parameters.cacheTestResults }}
      rbe: false
      artifactSuffix: .arm64
      timeoutBuild: 180
      pool: envoy-arm-large
      runBuild: variables['RUN_BUILD']
      runTests: $(RUN_TESTS)
      bazelBuildExtraOptions: "--sandbox_base=/tmp/sandbox_base"

- stage: check
  displayName: Checks (Linux x64)
  dependsOn: ${{ parameters.checkStageDeps }}
  variables:
    # Skip checks if only mobile/ or docs/ have changed.
    RUN_CHECKS: $[stageDependencies.env.repo.outputs['run.checks']]
  jobs:
  - template: stage/checks.yml
    parameters:
      cacheTestResults: ${{ parameters.cacheTestResults }}
      concurrencyChecks: ${{ parameters.concurrencyChecks }}
      authGCP: $(GcpServiceAccountKey)
      bucketGCP: $(GcsArtifactBucket)
      runChecks: variables['RUN_CHECKS']

- stage: publish
  displayName: Publish
  dependsOn: ["env", "linux_x64", "linux_arm64"]
  variables:
    RUN_DOCKER: $[stageDependencies.env.repo.outputs['run.docker']]
    RUN_PACKAGING: $[stageDependencies.env.repo.outputs['run.packaging']]
    PUBLISH_GITHUB_RELEASE: $[stageDependencies.env.repo.outputs['publish.githubRelease']]
    PUBLISH_DOCKERHUB: $[stageDependencies.env.repo.outputs['publish.dockerhub']]
  jobs:
  - template: stage/publish.yml
    parameters:
      authDockerUser: $(DockerUsername)
      authDockerPassword: $(DockerPassword)
      authGCP: $(GcpServiceAccountKey)
      authGithubWorkflow: $(GitHubPublicRepoWorkflowKey)
      authGithubWorkflowAppId: $(GitHubPublicRepoWorkflowAppId)
      authGithubWorkflowInstallId: $(GitHubPublicRepoWorkflowInstallId)
      authGPGPassphrase: $(MaintainerGPGKeyPassphrase)
      authGPGKey: $(MaintainerGPGKeySecureFileDownloadPath)
      authGPGPath: $(MaintainerGPGKey.secureFilePath)
      bucketGCP: $(GcsArtifactBucket)
      timeoutDockerBuild: ${{ parameters.timeoutDockerBuild }}
      timeoutDockerPublish: ${{ parameters.timeoutDockerPublish }}
      runDocker: variables['RUN_DOCKER']
      runPackaging: variables['RUN_PACKAGING']
      publishDockerhub: variables['PUBLISH_DOCKERHUB']
      publishGithubRelease: variables['PUBLISH_GITHUB_RELEASE']

- stage: verify
  displayName: Verify
  dependsOn: ["env", "publish"]
  variables:
    RUN_DOCKER: $[stageDependencies.env.repo.outputs['run.docker']]
  jobs:
  - template: stage/verify.yml
    parameters:
      authGCP: $(GcpServiceAccountKey)