From b1740ab1256cf90231601c9ccfc7e2388e0bd72a Mon Sep 17 00:00:00 2001
From: Ryan Northey <ryan@synca.io>
Date: Thu, 3 Aug 2023 20:56:01 +0100
Subject: [PATCH] ci/rbe: Enable Engflow RBE for prechecks

Signed-off-by: Ryan Northey <ryan@synca.io>
---
 .bazelrc                                 | 12 ++++++++++++
 .github/workflows/envoy-prechecks.yml    |  4 ++++
 bazel/engflow-bazel-credential-helper.sh |  8 ++++++++
 3 files changed, 24 insertions(+)
 create mode 100755 bazel/engflow-bazel-credential-helper.sh

diff --git a/.bazelrc b/.bazelrc
index 4cbb370a591c5..ff555052883e7 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -503,6 +503,18 @@ build:rbe-engflow --remote_timeout=3600s
 build:rbe-engflow --bes_timeout=3600s
 build:rbe-engflow --bes_upload_mode=fully_async
 
+build:rbe-envoy-engflow --google_default_credentials=false
+build:rbe-envoy-engflow --remote_cache=grpcs://morganite.cluster.engflow.com
+build:rbe-envoy-engflow --remote_executor=grpcs://morganite.cluster.engflow.com
+build:rbe-envoy-engflow --bes_backend=grpcs://morganite.cluster.engflow.com/
+build:rbe-envoy-engflow --bes_results_url=https://morganite.cluster.engflow.com/invocation/
+build:rbe-envoy-engflow --credential_helper=%workspace%/bazel/engflow-bazel-credential-helper.sh
+build:rbe-envoy-engflow --grpc_keepalive_time=30s
+build:rbe-envoy-engflow --remote_timeout=3600s
+build:rbe-envoy-engflow --bes_timeout=3600s
+build:rbe-envoy-engflow --bes_upload_mode=fully_async
+build:rbe-envoy-engflow --remote_default_exec_properties=container-image=docker://docker.io/envoyproxy/envoy-build-ubuntu:94e5d873c145ae86f205117e76276161c9af4806@sha256:8d3763e19d5b71fdc95666d75073ce4581e566ce28ca09106607b6a3ef7ba902
+
 #############################################################################
 # debug: Various Bazel debugging flags
 #############################################################################
diff --git a/.github/workflows/envoy-prechecks.yml b/.github/workflows/envoy-prechecks.yml
index 5e5c8d0555532..d12715c918cbe 100644
--- a/.github/workflows/envoy-prechecks.yml
+++ b/.github/workflows/envoy-prechecks.yml
@@ -43,8 +43,12 @@ jobs:
           managed: true
     uses: ./.github/workflows/_ci.yml
     name: CI ${{ matrix.target }}
+    permissions:
+      contents: read
+      packages: read
     with:
       target: ${{ matrix.target }}
       rbe: ${{ matrix.rbe }}
+      bazel_extra: '--config=rbe-envoy-engflow'
       managed: ${{ matrix.managed }}
       cache_build_image: ${{ needs.env.outputs.build_image_ubuntu }}
diff --git a/bazel/engflow-bazel-credential-helper.sh b/bazel/engflow-bazel-credential-helper.sh
new file mode 100755
index 0000000000000..c6c1bd339b624
--- /dev/null
+++ b/bazel/engflow-bazel-credential-helper.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+
+# Bazel expects the helper to read stdin.
+# See https://github.com/bazelbuild/bazel/pull/17666
+cat /dev/stdin > /dev/null
+
+# `GITHUB_TOKEN` is provided as a secret.
+echo "{\"headers\":{\"Authorization\":[\"Bearer ${GITHUB_TOKEN}\"]}}"