Add filter-cc: a tested, docs-first native filter build example using bzlmod

.bcr/config.yml

@@ -1,3 +1,4 @@
 moduleRoots:
 - "."
+- filter-cc
 - wasm-cc

.bcr/filter-cc/metadata.template.json

@@ -0,0 +1,18 @@
+{
+    "homepage": "https://www.envoyproxy.io/",
+    "maintainers": [
+        {
+            "github": "mmorel-35",
+            "github_user_id": 6032561
+        },
+        {
+            "github": "phlax",
+            "github_user_id": 454682
+        }
+    ],
+    "repository": [
+        "github:envoyproxy/examples"
+    ],
+    "versions": [],
+    "yanked_versions": {}
+}

.bcr/filter-cc/presubmit.yml

@@ -0,0 +1,16 @@
+matrix:
+  unix_platform:
+  - debian11
+  - ubuntu2404
+  - macos_arm64
+  bazel:
+  - 7.x
+  - 8.x
+  - 9.*
+tasks:
+  verify_targets:
+    name: Verify build targets
+    platform: ${{ unix_platform }}
+    bazel: ${{ bazel }}
+    build_targets:
+    - "@envoy-example-filter-cc//..."

.bcr/filter-cc/source.template.json

@@ -0,0 +1,5 @@
+{
+    "integrity": "",
+    "strip_prefix": "{REPO}-{VERSION}/filter-cc",
+    "url": "https://github.com/{OWNER}/{REPO}/archive/refs/tags/v{TAG}.tar.gz"
+}

.github/workflows/_verify_filter.yml

@@ -0,0 +1,67 @@
+name: Verify/Filter
+
+permissions:
+  contents: read
+
+on:
+  workflow_call:
+
+
+jobs:
+  filter:
+    runs-on: ubuntu-24.04
+    steps:
+    - uses: envoyproxy/toolshed/actions/bind-mounts@598eacce15ab5f208102a2fd5669292868002701  # v0.4.0
+      with:
+        mounts: |
+          - src: /mnt/docker
+            target: /var/lib/docker
+            rm: true
+            command-pre: sudo systemctl stop docker
+            command-post: sudo systemctl start docker
+          - src: /mnt/runner-cache
+            target: /home/runner/.cache
+            chown: "runner:runner"
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      with:
+        path: examples
+    - run: |
+        printf '%s\n' 'common --config=ci' > repo.bazelrc
+      working-directory: examples/filter-cc
+    - name: Inject bzlmod envoy pin into MODULE.bazel
+      run: |
+        # The envoy module is not (yet) published to a registry, so resolve
+        # the current envoy main HEAD and override the module to use it.
+        ENVOY_SHA=$(git ls-remote https://github.com/envoyproxy/envoy refs/heads/main | head -n1 | awk '{print $1}')
+        echo "Resolved envoy main HEAD: ${ENVOY_SHA}"
+        cat >> MODULE.bazel <<EOF
+
+        git_override(
+            module_name = "envoy",
+            remote = "https://github.com/envoyproxy/envoy",
+            commit = "${ENVOY_SHA}",
+        )
+        git_override(
+            module_name = "envoy_api",
+            remote = "https://github.com/envoyproxy/envoy",
+            commit = "${ENVOY_SHA}",
+            strip_prefix = "api",
+        )
+        EOF
+      working-directory: examples/filter-cc
+    - name: Verify the filter builds against envoy head
+      run: |
+        # Building the fully statically linked binary (`//:envoy`), as
+        # `verify.sh` does, is too heavy for hosted runners - build the
+        # filter's extension wiring instead, which proves the example builds
+        # against envoy at a fraction of the cost.
+        export UID
+        docker compose -f docker-compose-build.yaml run --quiet-pull --remove-orphans filter_build \
+            bash -c "bazel build --experimental_repository_downloader_retries=2 --disk_cache=/tmp/disk_cache \
+                --repository_cache=/tmp/repository_cache --experimental_repository_cache_hardlinks \
+                //:http_filter_config"
+      working-directory: examples/filter-cc
+      env:
+        DOCKER_BUILDKIT: 1
+        COMPOSE_BAKE: true
+        BUILDKIT_PROGRESS: quiet

.github/workflows/verify.yml

@@ -17,5 +17,7 @@ concurrency:
 jobs:
   examples:
     uses: ./.github/workflows/_verify_examples.yml
+  filter:
+    uses: ./.github/workflows/_verify_filter.yml
   wasm:
     uses: ./.github/workflows/_verify_wasm.yml

BUILD

@@ -68,7 +68,10 @@ filegroup(
             "kafka/*.yaml",
             "kafka-mesh/*.yaml",
         ],
-    ) + ["@envoy-example-wasm-cc//:configs"],
+    ) + [
+        "@envoy-example-filter-cc//:configs",
+        "@envoy-example-wasm-cc//:configs",
+    ],
     visibility = ["//visibility:public"],
 )
 
@@ -98,7 +101,10 @@ filegroup(
 
 filegroup(
     name = "docs_rst",
-    srcs = glob(["**/example.rst"]) + ["@envoy-example-wasm-cc//:example.rst"],
+    srcs = glob(["**/example.rst"]) + [
+        "@envoy-example-filter-cc//:example.rst",
+        "@envoy-example-wasm-cc//:example.rst",
+    ],
 )
 
 pkg_files(
@@ -115,7 +121,9 @@ genrule(
     cmd = """
     TEMP=$$(mktemp -d)
     for location in $(locations :docs_rst); do
-        if [[ "$$location" == *wasm-cc* ]]; then
+        if [[ "$$location" == *filter-cc* ]]; then
+            example="filter-cc"
+        elif [[ "$$location" == *wasm-cc* ]]; then
             example="wasm-cc"
         else
             example="$$(basename "$$(dirname "$$location")")"
@@ -165,6 +173,7 @@ pkg_tar(
     package_dir = "start/sandboxes",
     deps = [
         ":examples_docs",
+        "@envoy-example-filter-cc//:includes",
         "@envoy-example-wasm-cc//:includes",
     ],
     visibility = ["//visibility:public"],

MODULE.bazel

@@ -6,6 +6,7 @@ module(
 bazel_dep(name = "bazel_skylib", version = "1.9.0")
 bazel_dep(name = "envoy", version = "1.40.0-dev")
 bazel_dep(name = "envoy_api", version = "1.40.0-dev")
+bazel_dep(name = "envoy-example-filter-cc", version = "0.1.6-dev")
 bazel_dep(name = "envoy-example-wasm-cc", version = "0.1.6-dev")
 bazel_dep(name = "rules_go", version = "0.59.0", repo_name = "io_bazel_rules_go")
 bazel_dep(name = "rules_pkg", version = "1.1.0")
@@ -22,6 +23,11 @@ local_path_override(
     path = "../envoy/api",
 )
 
+local_path_override(
+    module_name = "envoy-example-filter-cc",
+    path = "filter-cc",
+)
+
 local_path_override(
     module_name = "envoy-example-wasm-cc",
     path = "wasm-cc",

filter-cc/.bazelrc

@@ -0,0 +1,47 @@
+common --enable_bzlmod
+common --noenable_workspace
+common --color=yes
+common --noincompatible_disallow_empty_glob
+common --noincompatible_disallow_ctx_resolve_tools
+common --legacy_external_runfiles
+
+common --registry=https://bcr.bazel.build/
+common --registry=https://raw.githubusercontent.com/envoyproxy/bazel-registry/4520e1df0c26dbd5e441517d09dfb941064cf79a
+
+build --incompatible_strict_action_env
+build --java_runtime_version=remotejdk_11
+build --tool_java_runtime_version=remotejdk_11
+build --java_language_version=11
+build --tool_java_language_version=11
+build --extra_toolchains=@envoy//bazel:envoy_java_toolchain_definition
+# silence absl logspam.
+build --copt=-DABSL_MIN_LOG_LEVEL=4
+build --cxxopt=-std=c++20 --host_cxxopt=-std=c++20
+build --copt=-Wno-deprecated-declarations
+build --define envoy_mobile_listener=enabled
+build --experimental_repository_downloader_retries=2
+build --experimental_cc_static_library
+build --enable_platform_specific_config
+build --incompatible_merge_fixed_and_default_shell_env
+
+common --repo_env=ANDROID_HOME=
+
+build --incompatible_config_setting_private_default_visibility
+build --incompatible_enforce_config_setting_visibility
+
+common --incompatible_allow_tags_propagation
+
+# Protobuf
+common --@protobuf//bazel/flags:prefer_prebuilt_protoc=true
+common --incompatible_enable_proto_toolchain_resolution
+
+# We already have absl in the build, define absl=1 to tell googletest to use absl for backtrace.
+build --define absl=1
+
+common:ci --noshow_progress
+common:ci --noshow_loading_progress
+common:ci --test_output=errors
+
+
+try-import %workspace%/user.bazelrc
+try-import %workspace%/repo.bazelrc

filter-cc/.bazelversion

@@ -0,0 +1 @@
+8.7.0

filter-cc/BUILD

@@ -0,0 +1,87 @@
+load("@envoy//bazel:envoy_build_system.bzl", "envoy_cc_binary", "envoy_cc_library", "envoy_cc_test")
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+load("@rules_pkg//pkg:pkg.bzl", "pkg_tar")
+
+licenses(["notice"])  # Apache 2
+
+exports_files(["example.rst"])
+
+filegroup(
+    name = "configs",
+    srcs = glob(
+        [
+            "**/*.yaml",
+        ],
+        exclude = [
+            "**/*docker-compose*.yaml",
+        ],
+    ),
+    visibility = ["//visibility:public"],
+)
+
+api_proto_package()
+
+envoy_cc_library(
+    name = "http_filter_lib",
+    srcs = ["http_filter.cc"],
+    hdrs = ["http_filter.h"],
+    repository = "@envoy",
+    deps = [
+        ":pkg_cc_proto",
+        "@envoy//source/extensions/filters/http/common:pass_through_filter_lib",
+    ],
+)
+
+envoy_cc_library(
+    name = "http_filter_config",
+    srcs = ["http_filter_config.cc"],
+    repository = "@envoy",
+    deps = [
+        ":http_filter_lib",
+        "@envoy//envoy/registry",
+        "@envoy//envoy/server:filter_config_interface",
+        "@envoy//source/extensions/filters/http/common:factory_base_lib",
+    ],
+)
+
+envoy_cc_binary(
+    name = "envoy",
+    repository = "@envoy",
+    deps = [
+        ":http_filter_config",
+        "@envoy//source/exe:envoy_main_entry_lib",
+    ],
+)
+
+envoy_cc_test(
+    name = "http_filter_integration_test",
+    srcs = ["http_filter_integration_test.cc"],
+    repository = "@envoy",
+    deps = [
+        ":http_filter_config",
+        "@envoy//test/integration:http_integration_lib",
+    ],
+)
+
+filegroup(
+    name = "files",
+    srcs = glob(
+        ["**/*"],
+        exclude = [
+            "**/*~",
+            "**/.*",
+            ".*/**/*",
+            "bin/**/*",
+            "example.rst",
+            "BUILD",
+            "README.md",
+        ],
+    ),
+)
+
+pkg_tar(
+    name = "includes",
+    srcs = [":files"],
+    package_dir = "_include/filter-cc",
+    visibility = ["//visibility:public"],
+)

filter-cc/Dockerfile-echo

@@ -0,0 +1 @@
+FROM jmalloc/echo-server@sha256:86f2c45aa7e7ebe1be30b21f8cfff25a7ed6e3b059751822d4b35bf244a688d5

filter-cc/Dockerfile-proxy

@@ -0,0 +1,5 @@
+FROM envoyproxy/envoy:dev
+COPY ./envoy.yaml /etc/envoy.yaml
+COPY ./bin/envoy /usr/local/bin/envoy
+RUN chmod go+r /etc/envoy.yaml && chmod go+rx /usr/local/bin/envoy
+CMD ["/usr/local/bin/envoy", "-c", "/etc/envoy.yaml", "--service-cluster", "proxy"]