pipelines.yml

trigger:
  branches:
    include:
    - "main"
    - "release/v*"
  tags:
    include:
    - "v*"

# PR build config is manually overridden in Azure pipelines UI with different secrets
pr: none

stages:
- stage: precheck
  jobs:
  - job: format_pre
    dependsOn: []
    pool:
      vmImage: "ubuntu-18.04"
    steps:
    - task: Cache@2
      inputs:
        key: "format_pre | ./WORKSPACE | **/*.bzl"
        path: $(Build.StagingDirectory)/repository_cache
      continueOnError: true

    - script: ci/run_envoy_docker.sh 'ci/do_ci.sh format_pre'
      workingDirectory: $(Build.SourcesDirectory)
      env:
        ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
        BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
        BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
        GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
      displayName: "Run format pre-checks"
    - task: PublishBuildArtifacts@1
      inputs:
        pathtoPublish: "$(Build.StagingDirectory)/fix_format_pre.diff"
        artifactName: format
      # not all have fixes so improve condition/handling
      condition: failed()

  - job: tooling
    dependsOn: []
    pool:
      vmImage: "ubuntu-18.04"
    steps:
    - task: Cache@2
      inputs:
        key: "tooling | ./WORKSPACE | **/*.bzl"
        path: $(Build.StagingDirectory)/repository_cache
      continueOnError: true

    - script: ci/run_envoy_docker.sh 'ci/do_ci.sh tooling'
      workingDirectory: $(Build.SourcesDirectory)
      env:
        ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
        BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
        BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
        GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
      displayName: "Run tooling checks"

  - job: format
    dependsOn: ["format_pre"]
    pool:
      vmImage: "ubuntu-18.04"
    steps:
    - task: Cache@2
      inputs:
        key: "format | ./WORKSPACE | **/*.bzl"
        path: $(Build.StagingDirectory)/repository_cache
      continueOnError: true

    - script: ci/run_envoy_docker.sh 'ci/check_and_fix_format.sh'
      workingDirectory: $(Build.SourcesDirectory)
      env:
        ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
        BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
        BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
        GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
      displayName: "Run check format scripts"

    - task: PublishBuildArtifacts@1
      inputs:
        pathtoPublish: "$(Build.StagingDirectory)/fix_format.diff"
        artifactName: format
      condition: failed()

  - job: docs
    dependsOn: []  # this removes the implicit dependency on previous stage and causes this to run in parallel.
    condition: ne(variables['PostSubmit'], true)
    pool:
      vmImage: "ubuntu-18.04"
    steps:
    - task: Cache@2
      inputs:
        key: "docs | ./WORKSPACE | **/*.bzl"
        path: $(Build.StagingDirectory)/repository_cache
      continueOnError: true

    - script: ci/run_envoy_docker.sh 'ci/do_ci.sh docs'
      workingDirectory: $(Build.SourcesDirectory)
      env:
        AZP_BRANCH: $(Build.SourceBranch)
        ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
        BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
        BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
        GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
      displayName: "Generate docs"

    - script: |
        ci/run_envoy_docker.sh 'ci/upload_gcs_artifact.sh /source/generated/docs docs'
      displayName: "Upload Docs to GCS"
      env:
        ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
        GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
        GCS_ARTIFACT_BUCKET: $(GcsArtifactBucket)

  - job: dependencies
    dependsOn: []  # this removes the implicit dependency on previous stage and causes this to run in parallel.
    pool:
      vmImage: "ubuntu-18.04"
    steps:
    - script: ci/run_envoy_docker.sh 'ci/do_ci.sh deps'
      workingDirectory: $(Build.SourcesDirectory)
      env:
        ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
        BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
        BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
        GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
        GITHUB_TOKEN: $(GitHubPublicRepoOnlyAccessToken)
      displayName: "Verify dependency information"

- stage: sync
  condition: and(succeeded(), eq(variables['PostSubmit'], true), ne(variables['NoSync'], true))
  dependsOn: []
  jobs:
  - job: filter_example
    dependsOn: []
    pool:
      vmImage: "ubuntu-18.04"
    steps:
    - task: InstallSSHKey@0
      inputs:
        hostName: "github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
        sshPublicKey: "$(FilterExamplePublicKey)"
        sshPassphrase: "$(SshDeployKeyPassphrase)"
        sshKeySecureFile: "$(FilterExamplePrivateKey)"

    - bash: ci/filter_example_mirror.sh
      displayName: "Sync envoy-filter-example"
      workingDirectory: $(Build.SourcesDirectory)
      env:
        AZP_BRANCH: $(Build.SourceBranch)

  - job: data_plane_api
    dependsOn: []
    pool:
      vmImage: "ubuntu-18.04"
    steps:
    - task: InstallSSHKey@0
      inputs:
        hostName: "github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
        sshPublicKey: "$(DataPlaneApiPublicKey)"
        sshPassphrase: "$(SshDeployKeyPassphrase)"
        sshKeySecureFile: "$(DataPlaneApiPrivateKey)"

    - bash: ci/api_mirror.sh
      displayName: "Sync data-plane-api"
      workingDirectory: $(Build.SourcesDirectory)
      env:
        AZP_BRANCH: $(Build.SourceBranch)

  - job: go_control_plane
    dependsOn: []
    pool:
      vmImage: "ubuntu-18.04"
    steps:
    - task: InstallSSHKey@0
      inputs:
        hostName: "github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
        sshPublicKey: "$(GoControlPlanePublicKey)"
        sshPassphrase: "$(SshDeployKeyPassphrase)"
        sshKeySecureFile: "$(GoControlPlanePrivateKey)"

    - bash: |
        cp -a ~/.ssh $(Build.StagingDirectory)/
        ci/run_envoy_docker.sh 'ci/go_mirror.sh'
      displayName: "Sync go-control-plane"
      workingDirectory: $(Build.SourcesDirectory)
      env:
        ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
        BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
        BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
        GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
        AZP_BRANCH: $(Build.SourceBranch)

- stage: linux_x64
  dependsOn: ["precheck"]
  # For post-submit builds, continue even if precheck fails
  condition: and(not(canceled()), or(succeeded(), eq(variables['PostSubmit'], true)))
  jobs:
  - job: release
    timeoutInMinutes: 120
    pool:
      vmImage: "ubuntu-18.04"
    steps:
    - bash: .azure-pipelines/cleanup.sh
      displayName: "Removing tools from agent"
    - template: bazel.yml
      parameters:
        ciTarget: bazel.release

- stage: linux_arm64
  dependsOn: ["precheck"]
  # For post-submit builds, continue even if precheck fails
  condition: and(not(canceled()), or(succeeded(), eq(variables['PostSubmit'], true)))
  jobs:
  - job: release
    timeoutInMinutes: 120
    pool: "arm-large"
    steps:
    - template: bazel.yml
      parameters:
        managedAgent: false
        ciTarget: bazel.release
        rbe: false
        artifactSuffix: ".arm64"
        bazelBuildExtraOptions: "--sandbox_base=/tmp/sandbox_base"

- stage: distribution
  dependsOn: ["linux_arm64", "linux_x64"]
  jobs:
  - job: package_x64
    dependsOn: []
    timeoutInMinutes: 120
    pool:
      vmImage: "ubuntu-18.04"
    steps:
    - template: bazel.yml
      parameters:
        ciTarget: bazel.distribution
  - job: package_arm64
    dependsOn: []
    timeoutInMinutes: 120
    pool: "arm-large"
    steps:
    - template: bazel.yml
      parameters:
        managedAgent: false
        ciTarget: bazel.distribution
        rbe: false
        artifactSuffix: ".arm64"
        bazelBuildExtraOptions: "--sandbox_base=/tmp/sandbox_base"
  - job: verify_x64
    dependsOn: ["package_x64"]
    timeoutInMinutes: 120
    pool:
      vmImage: "ubuntu-18.04"
    steps:
    - task: DownloadBuildArtifacts@0
      inputs:
        buildType: current
        artifactName: "bazel.distribution"
        itemPattern: "bazel.distribution/packages.x64.tar.gz"
        downloadType: single
        targetPath: $(Build.StagingDirectory)
    - script: ci/run_envoy_docker.sh 'ci/do_ci.sh verify_distro'
      workingDirectory: $(Build.SourcesDirectory)
      env:
        AZP_BRANCH: $(Build.SourceBranch)
        ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
        BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
        BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
        GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
      displayName: "Verify packages"
  - job: verify_arm64
    dependsOn: ["package_arm64"]
    timeoutInMinutes: 120
    pool: "arm-large"
    steps:
    - task: DownloadBuildArtifacts@0
      inputs:
        buildType: current
        artifactName: "bazel.distribution.arm64"
        itemPattern: "bazel.distribution.arm64/packages.arm64.tar.gz"
        downloadType: single
        targetPath: $(Build.StagingDirectory)
    - script: ci/run_envoy_docker.sh 'ci/do_ci.sh verify_distro'
      workingDirectory: $(Build.SourcesDirectory)
      env:
        AZP_BRANCH: $(Build.SourceBranch)
        ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
        BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
        BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
        GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
      displayName: "Verify packages"

- stage: check
  dependsOn: ["linux_x64"]
  jobs:
  - job: bazel
    displayName: "linux_x64"
    dependsOn: []
    strategy:
      maxParallel: 3
      matrix:
        api:
          CI_TARGET: "bazel.api"
        # Disabled due to https://github.com/envoyproxy/envoy/pull/18218
        # api_compat:
        #  CI_TARGET: "bazel.api_compat"
        gcc:
          CI_TARGET: "bazel.gcc"
        clang_tidy:
          CI_TARGET: "bazel.clang_tidy"
        asan:
          CI_TARGET: "bazel.asan"
        msan:
          CI_TARGET: "bazel.msan"
        tsan:
          CI_TARGET: "bazel.tsan"
        compile_time_options:
          CI_TARGET: "bazel.compile_time_options"
    timeoutInMinutes: 120
    pool:
      vmImage: "ubuntu-18.04"
    steps:
    - template: bazel.yml
      parameters:
        ciTarget: $(CI_TARGET)

  - job: coverage
    displayName: "linux_x64"
    dependsOn: []
    timeoutInMinutes: 120
    pool: "x64-large"
    strategy:
      maxParallel: 2
      matrix:
        coverage:
          CI_TARGET: "coverage"
        fuzz_coverage:
          CI_TARGET: "fuzz_coverage"
    steps:
    - template: bazel.yml
      parameters:
        managedAgent: false
        ciTarget: bazel.$(CI_TARGET)
        rbe: false
        # /tmp/sandbox_base is a tmpfs in CI environment to optimize large I/O for coverage traces
        bazelBuildExtraOptions: "--define=no_debug_info=1 --linkopt=-Wl,-s --test_env=ENVOY_IP_TEST_VERSIONS=v4only --sandbox_base=/tmp/sandbox_base"

    - script: ci/run_envoy_docker.sh 'ci/upload_gcs_artifact.sh /source/generated/$(CI_TARGET) $(CI_TARGET)'
      displayName: "Upload $(CI_TARGET) Report to GCS"
      env:
        ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
        GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
        GCS_ARTIFACT_BUCKET: $(GcsArtifactBucket)
      condition: always()

- stage: docker
  dependsOn: ["linux_x64", "linux_arm64"]
  jobs:
  - job: docker
    displayName: "linux multiarch"
    timeoutInMinutes: 120
    pool:
      vmImage: "ubuntu-18.04"
    steps:
    - bash: .azure-pipelines/cleanup.sh
      displayName: "Removing tools from agent"
    - bash: |
        echo "disk space at beginning of build:"
        df -h
      displayName: "Check disk space at beginning"
    - task: DownloadBuildArtifacts@0
      inputs:
        buildType: current
        artifactName: "bazel.release"
        itemPattern: "bazel.release/envoy_binary.tar.gz"
        downloadType: single
        targetPath: $(Build.StagingDirectory)
    - task: DownloadBuildArtifacts@0
      inputs:
        buildType: current
        artifactName: "bazel.release"
        itemPattern: "bazel.release/envoy-contrib_binary.tar.gz"
        downloadType: single
        targetPath: $(Build.StagingDirectory)
    - task: DownloadBuildArtifacts@0
      inputs:
        buildType: current
        artifactName: "bazel.release.arm64"
        itemPattern: "bazel.release.arm64/envoy_binary.tar.gz"
        downloadType: single
        targetPath: $(Build.StagingDirectory)
    - task: DownloadBuildArtifacts@0
      inputs:
        buildType: current
        artifactName: "bazel.release.arm64"
        itemPattern: "bazel.release.arm64/envoy-contrib_binary.tar.gz"
        downloadType: single
        targetPath: $(Build.StagingDirectory)
    - bash: |
        set -e
        mkdir -p linux/amd64
        tar zxf $(Build.StagingDirectory)/bazel.release/envoy_binary.tar.gz -C ./linux/amd64
        tar zxf $(Build.StagingDirectory)/bazel.release/envoy-contrib_binary.tar.gz -C ./linux/amd64
        rm $(Build.StagingDirectory)/bazel.release/envoy_binary.tar.gz
        rm $(Build.StagingDirectory)/bazel.release/envoy-contrib_binary.tar.gz
        mkdir -p linux/arm64
        tar zxf $(Build.StagingDirectory)/bazel.release.arm64/envoy_binary.tar.gz -C ./linux/arm64
        tar zxf $(Build.StagingDirectory)/bazel.release.arm64/envoy-contrib_binary.tar.gz -C ./linux/arm64
        rm $(Build.StagingDirectory)/bazel.release.arm64/envoy_binary.tar.gz
        rm $(Build.StagingDirectory)/bazel.release.arm64/envoy-contrib_binary.tar.gz
        ci/docker_ci.sh
      workingDirectory: $(Build.SourcesDirectory)
      env:
        AZP_BRANCH: $(Build.SourceBranch)
        AZP_SHA1: $(Build.SourceVersion)
        DOCKERHUB_USERNAME: $(DockerUsername)
        DOCKERHUB_PASSWORD: $(DockerPassword)
    - bash: |
        echo "disk space at end of build:"
        df -h
      displayName: "Check disk space at end"
      condition: always()
    - task: PublishBuildArtifacts@1
      inputs:
        pathtoPublish: "$(Build.StagingDirectory)/build_images"
        artifactName: docker
      condition: always()

- stage: docs
  dependsOn: ["docker"]
  condition: and(succeeded(), eq(variables['PostSubmit'], true), ne(variables['NoSync'], true))
  jobs:
  - job: publish
    pool:
      vmImage: "ubuntu-18.04"
    steps:
    - task: Cache@2
      inputs:
        key: "docs | ./WORKSPACE | **/*.bzl"
        path: $(Build.StagingDirectory)/repository_cache
      continueOnError: true

    - script: ci/run_envoy_docker.sh 'ci/do_ci.sh docs'
      workingDirectory: $(Build.SourcesDirectory)
      env:
        AZP_BRANCH: $(Build.SourceBranch)
        ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
        BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
        BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
        GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
      displayName: "Generate docs"

    - script: |
        ci/run_envoy_docker.sh 'ci/upload_gcs_artifact.sh /source/generated/docs docs'
      displayName: "Upload Docs to GCS"
      env:
        ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
        GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
        GCS_ARTIFACT_BUCKET: $(GcsArtifactBucket)
      condition: eq(variables['Build.SourceBranch'], 'refs/heads/main')

    - task: InstallSSHKey@0
      inputs:
        hostName: "github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
        sshPublicKey: "$(DocsPublicKey)"
        sshPassphrase: "$(SshDeployKeyPassphrase)"
        sshKeySecureFile: "$(DocsPrivateKey)"

    - script: docs/publish.sh
      displayName: "Publish to GitHub"
      workingDirectory: $(Build.SourcesDirectory)
      env:
        AZP_BRANCH: $(Build.SourceBranch)
        NETLIFY_TRIGGER_URL: $(NetlifyTriggerURL)

- stage: verify
  dependsOn: ["docker"]
  jobs:
  - job: examples
    pool:
      vmImage: "ubuntu-18.04"
    steps:
    - task: DownloadBuildArtifacts@0
      inputs:
        buildType: current
        artifactName: "docker"
        itemPattern: "docker/envoy*.tar"
        targetPath: $(Build.StagingDirectory)
    - bash: ./ci/do_ci.sh verify_examples
      env:
        ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
        NO_BUILD_SETUP: 1
  - job: examples_build
    dependsOn: []
    pool:
      vmImage: "ubuntu-18.04"
    steps:
    - task: DownloadBuildArtifacts@0
      inputs:
        buildType: current
        artifactName: "docker"
        itemPattern: "docker/envoy*.tar"
        targetPath: $(Build.StagingDirectory)
    - bash: ./ci/do_ci.sh verify_build_examples
      env:
        ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
        NO_BUILD_SETUP: 1

- stage: macos
  dependsOn: ["precheck"]
  jobs:
  - job: test
    timeoutInMinutes: 180
    pool:
      vmImage: "macos-11"
    steps:
    - script: ./ci/mac_ci_setup.sh
      displayName: "Install dependencies"

    - script: ./ci/mac_ci_steps.sh
      displayName: "Run Mac CI"
      env:
        BAZEL_BUILD_EXTRA_OPTIONS: "--remote_download_toplevel --flaky_test_attempts=2"
        BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
        BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
        GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)

    - task: PublishTestResults@2
      inputs:
        testResultsFiles: "**/bazel-testlogs/**/test.xml"
        testRunTitle: "macOS"
      condition: always()

    - script: bazel run //ci/flaky_test:process_xml
      displayName: "Process Test Results"
      env:
        TEST_TMPDIR: $(Build.SourcesDirectory)
        SLACK_TOKEN: $(SLACK_TOKEN)
        CI_TARGET: "MacOS"
        REPO_URI: $(Build.Repository.Uri)
        BUILD_URI: $(Build.BuildUri)

- stage: windows
  dependsOn: ["precheck"]
  jobs:
  - job: release
    timeoutInMinutes: 180
    pool:
      vmImage: "windows-2019"
    steps:
    - task: Cache@2
      inputs:
        key: '"windows.release" | ./WORKSPACE | **/*.bzl'
        path: $(Build.StagingDirectory)/repository_cache
      continueOnError: true
    - bash: ci/run_envoy_docker.sh ci/windows_ci_steps.sh
      displayName: "Run Windows msvc-cl CI"
      env:
        CI_TARGET: "windows"
        ENVOY_DOCKER_BUILD_DIR: "$(Build.StagingDirectory)"
        SLACK_TOKEN: $(SLACK_TOKEN)
        REPO_URI: $(Build.Repository.Uri)
        BUILD_URI: $(Build.BuildUri)
        ENVOY_RBE: "true"
        BAZEL_BUILD_EXTRA_OPTIONS: "--config=remote-ci --config=remote-msvc-cl --jobs=$(RbeJobs) --flaky_test_attempts=2"
        BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
        BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
        GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
    - task: PublishTestResults@2
      inputs:
        testResultsFiles: "**/bazel-out/**/testlogs/**/test.xml"
        testRunTitle: "windows"
        searchFolder: $(Build.StagingDirectory)/tmp
      condition: always()
    - task: PublishBuildArtifacts@1
      inputs:
        pathtoPublish: "$(Build.StagingDirectory)/envoy"
        artifactName: windows.release
      condition: always()

  - job: docker
    strategy:
      matrix:
        windows2019:
          imageName: 'windows-2019'
          windowsBuildType: "windows"
          windowsImageBase: "mcr.microsoft.com/windows/servercore"
          windowsImageTag: "ltsc2019"
        windows2022:
          imageName: 'windows-2022'
          windowsBuildType: "windows-ltsc2022"
          windowsImageBase: "mcr.microsoft.com/windows/nanoserver"
          windowsImageTag: "ltsc2022"
    dependsOn: ["release"]
    timeoutInMinutes: 120
    pool:
      vmImage: $(imageName)
    steps:
    - task: DownloadBuildArtifacts@0
      inputs:
        buildType: current
        artifactName: "windows.release"
        itemPattern: "windows.release/envoy_binary.tar.gz"
        downloadType: single
        targetPath: $(Build.StagingDirectory)
    - bash: |
        set -e
        # Convert to Unix-style path so tar doesn't think drive letter is a hostname
        STAGING_DIR="/$(echo '$(Build.StagingDirectory)' | tr -d ':' | tr '\\' '/')"
        mkdir -p windows/amd64 && tar zxf "${STAGING_DIR}/windows.release/envoy_binary.tar.gz" -C ./windows/amd64
        ci/docker_ci.sh
      workingDirectory: $(Build.SourcesDirectory)
      env:
        AZP_BRANCH: $(Build.SourceBranch)
        AZP_SHA1: $(Build.SourceVersion)
        DOCKERHUB_USERNAME: $(DockerUsername)
        DOCKERHUB_PASSWORD: $(DockerPassword)
        WINDOWS_BUILD_TYPE: $(windowsBuildType)
        WINDOWS_IMAGE_BASE: $(windowsImageBase)
        WINDOWS_IMAGE_TAG: $(windowsImageTag)
    - task: PublishBuildArtifacts@1
      inputs:
        pathtoPublish: "$(Build.StagingDirectory)/build_images"
        artifactName: docker_windows
      condition: always()