Merge remote-tracking branch 'upstream/main'

Author: nshipilov

.bazelci/presubmit.yml

@@ -17,10 +17,6 @@ tasks:
     platform: ubuntu2004
     shell_commands:
     - "sudo apt -y update && sudo apt -y install automake autotools-dev cmake libtool m4 ninja-build"
-    - "wget https://apt.llvm.org/llvm.sh && sudo bash llvm.sh 14"
-    - "bazel/setup_clang.sh /usr/lib/llvm-14"
-    # TODO(keith): Remove once we use clang 15+ on CI
-    - "sudo apt-get install -y libclang-rt-14-dev"
     test_targets:
     - "//test/common/common/..."
     - "//test/integration/..."

.bazelrc

@@ -209,7 +209,6 @@ build:compile-time-options --config=boringssl-fips
 build:compile-time-options --define=log_debug_assert_in_release=enabled
 build:compile-time-options --define=path_normalization_by_default=true
 build:compile-time-options --define=deprecated_features=disabled
-build:compile-time-options --define=tcmalloc=gperftools
 build:compile-time-options --define=uhv=enabled
 # gRPC has a lot of deprecated-enum-enum-conversion warnings with C++20
 build:compile-time-options --copt=-Wno-error=deprecated-enum-enum-conversion
@@ -237,6 +236,15 @@ common:aws-lc-fips --@envoy//bazel:ssl=@aws_lc//:ssl
 common:aws-lc-fips --@envoy//bazel:crypto=@aws_lc//:crypto
 common:aws-lc-fips --@envoy//bazel:http3=False
 
+# OpenSSL
+common:openssl --//bazel:ssl=//compat/openssl:ssl
+common:openssl --//bazel:crypto=//compat/openssl:crypto
+common:openssl --copt=-DENVOY_SSL_OPENSSL
+common:openssl --host_copt=-DENVOY_SSL_OPENSSL
+common:openssl --@envoy//bazel:http3=False
+common:openssl --test_tag_filters=-nofips
+common:openssl --build_tag_filters=-nofips
+
 
 #############################################################################
 # sanitizers
@@ -267,7 +275,7 @@ build:asan-common --build_tag_filters=-no_san
 build:asan-common --test_tag_filters=-no_san
 build:asan-common --copt -fsanitize=address,undefined
 build:asan-common --linkopt -fsanitize=address,undefined
-# vptr and function sanitizer are enabled in asan if it is set up via bazel/setup_clang.sh.
+# vptr and function sanitizer are enabled in asan when using --config=clang.
 build:asan-common --copt -fno-sanitize=vptr,function
 build:asan-common --linkopt -fno-sanitize=vptr,function
 build:asan-common --copt -DADDRESS_SANITIZER=1
@@ -387,7 +395,7 @@ build:clang-pch --define=ENVOY_CLANG_PCH=1
 
 # Clang-tidy
 build:clang-tidy --@envoy_toolshed//format/clang_tidy:executable=@envoy//tools/clang-tidy
-build:clang-tidy --@envoy_toolshed//format/clang_tidy:config=//:clang_tidy_config
+build:clang-tidy --@envoy_toolshed//format/clang_tidy:config=@envoy//:clang_tidy_config
 build:clang-tidy --aspects @envoy_toolshed//format/clang_tidy:clang_tidy.bzl%clang_tidy_aspect
 build:clang-tidy --output_groups=report
 build:clang-tidy --build_tag_filters=-notidy

.github/dependabot.yml

@@ -24,7 +24,7 @@ updates:
     time: "06:00"
 
 - package-ecosystem: "pip"
-  directory: "/mobile/third_party/python"
+  directory: "/mobile/tools/python"
   open-pull-requests-limit: 20
   schedule:
     interval: "daily"

.github/workflows/_precheck_deps.yml

@@ -57,4 +57,4 @@ jobs:
         ref: ${{ fromJSON(inputs.request).request.sha }}
         persist-credentials: false
     - name: Dependency Review
-      uses: actions/dependency-review-action@05fe4576374b728f0c523d6a13d64c25081e0803  # v4.8.3
+      uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48  # v4.9.0

.github/workflows/_request.yml

@@ -176,14 +176,14 @@ jobs:
     # TODO(phlax): shift this to ci/request action above
     - name: Check Docker cache (x64)
       id: cache-exists-docker-x64
-      uses: actions/cache/restore@8b402f58fbc84540c8b491a91e594a4576fec3d7  # v5.0.2
+      uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7  # v5.0.4
       with:
         lookup-only: true
         path: /tmp/cache
         key: ${{ fromJSON(steps.data.outputs.value).request.build-image.default }}
     - name: Check Docker cache (arm64)
       id: cache-exists-docker-arm64
-      uses: actions/cache/restore@8b402f58fbc84540c8b491a91e594a4576fec3d7  # v5.0.2
+      uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7  # v5.0.4
       with:
         lookup-only: true
         path: /tmp/cache

.github/workflows/_run.yml

@@ -318,7 +318,7 @@ jobs:
     # HACK/WORKAROUND for cache scope issue (https://github.com/envoyproxy/envoy/issues/37603)
     - if: ${{ inputs.cache-build-image }}
       id: cache-lookup
-      uses: actions/cache/restore@8b402f58fbc84540c8b491a91e594a4576fec3d7  # v5.0.2
+      uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7  # v5.0.4
       with:
         lookup-only: true
         path: /tmp/cache

.github/workflows/_upload_gcs.yml

@@ -25,7 +25,7 @@ jobs:
       matrix:
         artifact: ${{ fromJSON(inputs.artifacts) }}
     steps:
-    - uses: actions/download-artifact@v8.0.0
+    - uses: actions/download-artifact@v8.0.1
       with:
         name: ${{ matrix.artifact }}
         path: ${{ matrix.artifact }}

.github/workflows/codeql-daily.yml

@@ -52,7 +52,7 @@ jobs:
       uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e  # codeql-bundle-v4.32.4
+      uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13  # codeql-bundle-v4.35.1
       with:
         languages: cpp
         trap-caching: false
@@ -91,4 +91,4 @@ jobs:
         git clean -xdf
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e  # codeql-bundle-v4.32.4
+      uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13  # codeql-bundle-v4.35.1

.github/workflows/codeql-push.yml

@@ -88,7 +88,7 @@ jobs:
         echo "MINIMAL_BUILD_TARGET=//source/common/common:assert_lib" > $GITHUB_ENV
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e  # codeql-bundle-v4.32.4
+      uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13  # codeql-bundle-v4.35.1
       with:
         languages: cpp
         trap-caching: false
@@ -129,4 +129,4 @@ jobs:
 
     - name: Perform CodeQL Analysis
       # if: ${{ env.BUILD_TARGETS != '' }}
-      uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e  # codeql-bundle-v4.32.4
+      uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13  # codeql-bundle-v4.35.1

.github/workflows/command.yml

@@ -71,7 +71,7 @@ jobs:
       pull-requests: write
     steps:
     - name: React with rocket emoji
-      uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043  # v4.0.0
+      uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9  # v5.0.0
       with:
         comment-id: ${{ github.event.comment.id }}
         reactions: rocket