build/ci: Improve build examples and CI

.bazelrc

@@ -1,9 +1,9 @@
-common --enable_bzlmod=0
-common --enable_workspace
 common --color=yes
 
 common --registry=https://bcr.bazel.build
-common --registry=https://raw.githubusercontent.com/envoyproxy/toolshed/ed25d5ad5460714de8dc27d73a4730e7331e4f9b/bazel-registry
+common --registry=https://raw.githubusercontent.com/envoyproxy/bazel-registry/246fd7c83fed24ff3115e691e0c6ff59248b551c
+
+common --config=clang
 
 common:ci --noshow_progress
 common:ci --noshow_loading_progress
@@ -19,9 +19,66 @@ common:examples --action_env=COMPOSE_BAKE
 common:examples --host_action_env=COMPOSE_BAKE
 common:examples --action_env=BUILDKIT_PROGRESS
 common:examples --host_action_env=BUILDKIT_PROGRESS
+common:examples --action_env=USER_UID
+common:examples --host_action_env=USER_UID
 common:examples --sandbox_writable_path=/var/run/docker.sock
 
 common --@rules_python//python/config_settings:bootstrap_impl=script
 
+## RBE (Engflow Envoy)
+
+# this is not included in the `--config=rbe` target - set it to publish to engflow ui
+common:bes --bes_backend=grpcs://mordenite.cluster.engflow.com/
+common:bes --bes_results_url=https://mordenite.cluster.engflow.com/invocation/
+common:bes --bes_timeout=3600s
+common:bes --bes_upload_mode=fully_async
+common:bes --nolegacy_important_outputs
+
+common:engflow-common --google_default_credentials=false
+common:engflow-common --credential_helper=*.engflow.com=%workspace%/bazel/engflow-bazel-credential-helper.sh
+common:engflow-common --grpc_keepalive_time=60s
+common:engflow-common --grpc_keepalive_timeout=30s
+common:engflow-common --remote_cache_compression
+# Recover from transient gRPC failures (e.g. UNAVAILABLE: io exception) talking to engflow.
+common:engflow-common --remote_retries=10
+common:engflow-common --remote_retry_max_delay=60s
+# Recover when blobs are evicted from the CAS mid-build (common during patch releases).
+common:engflow-common --experimental_remote_cache_eviction_retries=5
+
+# this provides access to RBE+cache
+common:rbe --config=remote-cache
+common:rbe --config=remote-exec
+
+# this provides access to just cache
+common:remote-cache --config=engflow-common
+common:remote-cache --remote_cache=grpcs://mordenite.cluster.engflow.com
+common:remote-cache --experimental_remote_downloader=grpcs://mordenite.cluster.engflow.com
+common:remote-cache --remote_timeout=3600s
+
+common:remote-exec --remote_executor=grpcs://mordenite.cluster.engflow.com
+common:remote-exec --jobs=200
+common:remote-exec --define=engflow_rbe=true
+
+# libc++ - default for clang
+common:libc++ --action_env=CXXFLAGS=-stdlib=libc++
+common:libc++ --action_env=LDFLAGS="-stdlib=libc++ -fuse-ld=lld"
+common:libc++ --action_env=BAZEL_CXXOPTS=-stdlib=libc++
+common:libc++ --action_env=BAZEL_LINKLIBS=-l%:libc++.a:-l%:libc++abi.a
+common:libc++ --action_env=BAZEL_LINKOPTS=-lm:-pthread
+common:libc++ --define force_libcpp=enabled
+common:libc++ --@envoy//bazel:libc++=true
+
+# Common flags for Clang (shared between all clang variants)
+common:clang-common --linkopt=-fuse-ld=lld
+common:clang-common --cxxopt=-Wno-nullability-completeness
+common:clang-common --@toolchains_llvm//toolchain/config:compiler-rt=false
+common:clang-common --@toolchains_llvm//toolchain/config:libunwind=false
+
+# Clang with libc++ (default)
+common:clang --config=clang-common
+common:clang --config=libc++
+common:clang --host_platform=@clang_platform
+common:clang --repo_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
+
 try-import %workspace%/user.bazelrc
 try-import %workspace%/repo.bazelrc

.github/workflows/_verify_build.yml

@@ -0,0 +1,67 @@
+name: Verify/Wasm
+
+permissions:
+  contents: read
+
+on:
+  workflow_call:
+
+
+jobs:
+  build:
+    permissions:
+      contents: read
+      packages: read
+    runs-on: ubuntu-24.04
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      with:
+        path: examples
+    - run: |
+        docker pull envoyproxy/envoy:dev
+        DEV_CONTAINER_ID=$(docker inspect --format='{{.Id}}' envoyproxy/envoy:dev)
+        echo "DEV_CONTAINER_ID=${DEV_CONTAINER_ID}" >> $GITHUB_ENV
+        printf '%s\n' 'common --config=ci' > repo.bazelrc
+      working-directory: examples/wasm-cc
+    - name: Inject bzlmod envoy pin into MODULE.bazel
+      run: |
+        cat >> MODULE.bazel <<'EOF'
+
+        git_override(
+            module_name = "envoy",
+            remote = "https://github.com/envoyproxy/envoy",
+            commit = "6609c01e330fb84049d54a9dbffae8609b1ec9f7",
+        )
+        git_override(
+            module_name = "envoy_api",
+            remote = "https://github.com/envoyproxy/envoy",
+            commit = "6609c01e330fb84049d54a9dbffae8609b1ec9f7",
+            strip_prefix = "api",
+        )
+        EOF
+      working-directory: examples/wasm-cc
+    - name: RBE auth check
+      id: rbe
+      if: github.event_name == 'pull_request'
+      uses: envoyproxy/toolshed/actions/github/container/auth@00661cc7647f9d375041292d0218c75633f0bb03
+      with:
+        container: hello-world
+    - name: Configure repo Bazel settings (RBE/BES)
+      if: >-
+        github.event_name != 'pull_request'
+        || steps.rbe.outputs.authorized == 'true'
+      working-directory: examples/wasm-cc
+      run: |
+        cat >> repo.bazelrc <<'EOF'
+        common --config=rbe
+        common --config=bes
+        EOF
+        cat repo.bazelrc
+    - run: |
+        ./verify.sh
+      working-directory: examples/wasm-cc
+      env:
+        DOCKER_BUILDKIT: 1
+        COMPOSE_BAKE: true
+        BUILDKIT_PROGRESS: quiet
+        GITHUB_TOKEN: ${{ github.token }}

.github/workflows/_verify_examples.yml

@@ -9,11 +9,10 @@ on:
 
 jobs:
   examples:
+    permissions:
+      contents: read
+      packages: read
     runs-on: ubuntu-24.04
-    strategy:
-      fail-fast: false
-      matrix:
-        bazel-mode: [workspace, bzlmod]
     steps:
     - uses: envoyproxy/toolshed/actions/bind-mounts@598eacce15ab5f208102a2fd5669292868002701  # v0.4.0
       with:
@@ -30,10 +29,8 @@ jobs:
       with:
         path: examples
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      if: matrix.bazel-mode == 'bzlmod'
       with:
         repository: envoyproxy/envoy
-        ref: bzlmod-envoy-head
         path: envoy
     - run: |
         TEMPDIR=/cache/docker
@@ -44,7 +41,7 @@ jobs:
       id: cache
       with:
         path: /cache/docker
-        key: ${{ runner.os }}-docker-${{ matrix.bazel-mode }}-${{ hashFiles('examples/**/Dockerfile*') }}
+        key: ${{ runner.os }}-docker-${{ hashFiles('examples/**/Dockerfile*') }}
     - run: |
         TEMPDIR=/cache/docker
         sudo mkdir -p /var/lib/docker-examples
@@ -62,26 +59,39 @@ jobs:
     - uses: actions/cache@v6
       with:
         path: /home/runner/.cache
-        key: ${{ runner.os }}-bazel-${{ matrix.bazel-mode }}-${{ hashFiles('examples/**/BUILD', 'examples/**/*bzl', 'examples/WORKSPACE') }}
+        key: ${{ runner.os }}-bazel-${{ hashFiles('examples/**/BUILD', 'examples/**/*bzl', 'examples/WORKSPACE') }}
 
+    - name: RBE auth check
+      id: rbe
+      if: github.event_name == 'pull_request'
+      uses: envoyproxy/toolshed/actions/github/container/auth@00661cc7647f9d375041292d0218c75633f0bb03
+      with:
+        container: hello-world
+    - name: Configure repo Bazel settings (RBE/BES)
+      if: >-
+        github.event_name != 'pull_request'
+        || steps.rbe.outputs.authorized == 'true'
+      working-directory: examples
+      run: |
+        cat >> repo.bazelrc <<'EOF'
+        common --config=rbe
+        common --config=bes
+        EOF
+        cat repo.bazelrc
     - run: |
         docker pull envoyproxy/envoy:dev
         DEV_CONTAINER_ID=$(docker inspect --format='{{.Id}}' envoyproxy/envoy:dev)
         echo "DEV_CONTAINER_ID=${DEV_CONTAINER_ID}" >> $GITHUB_ENV
     - run: |
         export UID
-        printf '%s\n' 'common --config=ci' > repo.bazelrc
-        if [ "${BAZEL_MODE}" = "bzlmod" ]; then
-          echo "common --enable_bzlmod" >> repo.bazelrc
-          echo "common --noenable_workspace" >> repo.bazelrc
-        fi
+        printf '%s\n' 'common --config=ci' >> repo.bazelrc
         docker compose run --quiet --quiet-pull --quiet-build examples
       working-directory: examples
       env:
-        BAZEL_MODE: ${{ matrix.bazel-mode }}
         DOCKER_BUILDKIT: 1
         COMPOSE_BAKE: true
         BUILDKIT_PROGRESS: quiet
+        GITHUB_TOKEN: ${{ github.token }}
 
     - run: |
         TEMPDIR=/cache/docker
@@ -92,4 +102,4 @@ jobs:
       if: steps.cache.outputs.cache-hit != 'true' && github.event_name != 'pull_request'
       with:
         path: /cache/docker
-        key: ${{ runner.os }}-docker-${{ matrix.bazel-mode }}-${{ hashFiles('examples/**/Dockerfile*') }}
+        key: ${{ runner.os }}-docker-${{ hashFiles('examples/**/Dockerfile*') }}