Skip to content

Commit 81f1a59

Browse files
quinna-hquinna-h
authored
Merge branch 'master' into quinna.halim/update-supported-versions-script
2 parents 17db220 + 04efab7 commit 81f1a59

File tree

55 files changed

+2004
-367
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

55 files changed

+2004
-367
lines changed

‎.github/workflows/cache-cleanup.yml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# Reference:
2+
# https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/caching-dependencies-to-speed-up-workflows#force-deleting-cache-entries
3+
4+
name: Cleanup caches by a branch
5+
on:
6+
pull_request:
7+
types:
8+
- closed
9+
10+
jobs:
11+
cleanup:
12+
runs-on: ubuntu-latest
13+
steps:
14+
- name: Cleanup
15+
run: |
16+
echo "Fetching list of cache key"
17+
cacheKeysForPR=$(gh cache list --ref $BRANCH --limit 100 --json id --jq '.[].id')
18+
19+
## Setting this to not fail the workflow while deleting cache keys.
20+
set +e
21+
echo "Deleting caches..."
22+
for cacheKey in $cacheKeysForPR
23+
do
24+
gh cache delete $cacheKey
25+
done
26+
echo "Done"
27+
env:
28+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
29+
GH_REPO: ${{ github.repository }}
30+
BRANCH: refs/pull/${{ github.event.pull_request.number }}/merge

‎.github/workflows/check.yml

Lines changed: 99 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,57 @@
1-
name: Check
1+
name: Static Analysis
22
on:
33
push:
44

5+
concurrency:
6+
group: ${{ github.workflow }}-${{ github.ref }}
7+
cancel-in-progress: true
8+
59
jobs:
6-
lint:
7-
runs-on: ubuntu-22.04
8-
container:
9-
image: ghcr.io/datadog/images-rb/engines/ruby:3.2
10+
build:
11+
name: build
12+
runs-on: ubuntu-24.04
13+
container: ghcr.io/datadog/images-rb/engines/ruby:3.3
1014
steps:
1115
- uses: actions/checkout@v4
16+
- run: bundle lock
17+
- uses: actions/upload-artifact@v4
18+
id: lockfile
19+
with:
20+
name: 'check-lockfile-${{ github.sha }}-${{ github.run_id }}'
21+
path: '*.lock'
22+
if-no-files-found: error
23+
24+
rubocop:
25+
name: rubocop/lint
26+
runs-on: ubuntu-24.04
27+
needs: ['build']
28+
container: ghcr.io/datadog/images-rb/engines/ruby:3.3
29+
steps:
30+
- uses: actions/checkout@v4
31+
- uses: actions/download-artifact@v4
32+
- run: bundle install
33+
- run: bundle exec rake rubocop
34+
35+
standard:
36+
name: standard/lint
37+
runs-on: ubuntu-24.04
38+
needs: ['build']
39+
container: ghcr.io/datadog/images-rb/engines/ruby:3.3
40+
steps:
41+
- uses: actions/checkout@v4
42+
- uses: actions/download-artifact@v4
1243
- name: Install dependencies
1344
run: bundle install
14-
- run: bundle exec rake rubocop standard
45+
- run: bundle exec rake standard
1546

16-
check:
17-
name: Check types
18-
runs-on: ubuntu-22.04
19-
container:
20-
image: ghcr.io/datadog/images-rb/engines/ruby:3.2
47+
steep:
48+
name: steep/typecheck
49+
runs-on: ubuntu-24.04
50+
needs: ['build']
51+
container: ghcr.io/datadog/images-rb/engines/ruby:3.3
2152
steps:
2253
- uses: actions/checkout@v4
54+
- uses: actions/download-artifact@v4
2355
- name: Install dependencies
2456
run: bundle install
2557
- name: Check for stale signature files
@@ -30,3 +62,59 @@ jobs:
3062
run: bundle exec rake steep:check
3163
- name: Record stats
3264
run: bundle exec rake steep:stats[md] >> $GITHUB_STEP_SUMMARY
65+
66+
# Dogfooding Datadog SBOM Analysis
67+
dd-software-composition-analysis:
68+
name: dd/sca
69+
runs-on: ubuntu-24.04
70+
needs: ['build']
71+
container: ghcr.io/datadog/images-rb/engines/ruby:3.3
72+
steps:
73+
- name: Checkout
74+
uses: actions/checkout@v4
75+
- uses: actions/download-artifact@v4 # requires the lockfile
76+
- uses: DataDog/datadog-sca-github-action@main
77+
with:
78+
dd_api_key: ${{ secrets.DD_API_KEY }}
79+
dd_app_key: ${{ secrets.DD_APP_KEY }}
80+
dd_site: datadoghq.com
81+
82+
# Dogfooding Datadog Static Analysis
83+
dd-static-analysis:
84+
name: dd/static-analysis
85+
runs-on: ubuntu-24.04
86+
steps:
87+
- uses: actions/checkout@v4
88+
- uses: DataDog/datadog-static-analyzer-github-action@v1
89+
with:
90+
dd_api_key: ${{ secrets.DD_API_KEY }}
91+
dd_app_key: ${{ secrets.DD_APP_KEY }}
92+
dd_site: datadoghq.com
93+
cpu_count: 2
94+
95+
semgrep:
96+
name: semgrep/ci
97+
runs-on: ubuntu-24.04
98+
container: semgrep/semgrep # PENDING: Possible to be rate limited.
99+
steps:
100+
- uses: actions/checkout@v4
101+
- run: |
102+
semgrep ci \
103+
--include=bin/* \
104+
--include=ext/* \
105+
--include=lib/* \
106+
--exclude-rule=ruby.lang.security.model-attributes-attr-accessible.model-attributes-attr-accessible
107+
env:
108+
SEMGREP_RULES: p/default
109+
110+
static-analysis:
111+
needs:
112+
- 'steep'
113+
- 'rubocop'
114+
- 'standard'
115+
- 'semgrep'
116+
- 'dd-software-composition-analysis'
117+
- 'dd-static-analysis'
118+
runs-on: ubuntu-24.04
119+
steps:
120+
- run: echo "Done"

‎.github/workflows/datadog-sca.yml

Lines changed: 0 additions & 25 deletions
This file was deleted.

‎.github/workflows/datadog-static-analysis.yml

Lines changed: 0 additions & 21 deletions
This file was deleted.

‎.github/workflows/publish.yml

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
name: Publish gem
2+
3+
# TODO: Implement a dry-run mode to verify the checks without publishing
4+
on: workflow_dispatch
5+
6+
concurrency: "rubygems" # Only one publish job at a time
7+
8+
jobs:
9+
verify-checks:
10+
name: Verify commit status checks
11+
runs-on: ubuntu-24.04
12+
permissions:
13+
checks: read
14+
outputs:
15+
version: ${{ steps.version.outputs.version }}
16+
steps:
17+
- uses: actions/checkout@v4
18+
- uses: ruby/setup-ruby@v1
19+
with:
20+
ruby-version: '3.3.7'
21+
22+
- id: version
23+
run: echo "version=$(ruby -e 'puts Gem::Specification::load(Dir.glob("*.gemspec").first).version')" >> $GITHUB_OUTPUT
24+
25+
# Check if the gem version is already published
26+
- name: Verify gem version
27+
env:
28+
GEM_VERSION: ${{ steps.version.outputs.version }}
29+
run: |
30+
if gem search datadog --exact --remote --version "$GEM_VERSION" | grep -q "($GEM_VERSION)"; then
31+
echo "::error::Version $GEM_VERSION is already published"
32+
exit 1
33+
else
34+
echo "Version $GEM_VERSION is not published yet"
35+
fi
36+
37+
# TODO: Verify draft release
38+
# TODO: Verify milestone
39+
40+
# Check if the commit has passed all Github checks
41+
# API: https://docs.github.com/en/rest/checks/runs?apiVersion=2022-11-28#list-check-runs-for-a-git-reference
42+
- name: Verify check runs
43+
uses: actions/github-script@v7
44+
with:
45+
script: |
46+
const checkRuns = await github.paginate(github.rest.checks.listForRef, {
47+
owner: context.repo.owner,
48+
repo: context.repo.repo,
49+
ref: context.sha,
50+
per_page: 100
51+
});
52+
53+
const failedChecks = checkRuns.filter(check =>
54+
check.status === 'completed' &&
55+
check.conclusion !== 'success' &&
56+
check.conclusion !== 'skipped'
57+
);
58+
59+
if (failedChecks.length > 0) {
60+
const failedNames = failedChecks.map(c => c.name).join(', ');
61+
core.setFailed(`Check runs failed: ${failedNames}`);
62+
}
63+
64+
# Check if the commit has passed external CI checks
65+
# API: https://docs.github.com/en/rest/commits/statuses?apiVersion=2022-11-28#get-the-combined-status-for-a-specific-reference
66+
- name: Verify commit status
67+
uses: actions/github-script@v7
68+
with:
69+
script: |
70+
const { data: status } = await github.rest.repos.getCombinedStatusForRef({
71+
owner: context.repo.owner,
72+
repo: context.repo.repo,
73+
ref: context.sha
74+
});
75+
76+
if (status.state !== 'success') {
77+
core.setFailed(`Commit status is ${status.state}`);
78+
}
79+
80+
# Check if the commit has all the checks passed
81+
- name: Verify deferred commit data
82+
# NOTE:
83+
#
84+
# This step uses Github's internal API (for rendering the status of the checks in UI),
85+
# which includes Github check runs and external CI statuses and possibly more.
86+
#
87+
# Although Github check runs and external CI statuses are already covered by the previous steps,
88+
# it is still useful to have a double-check and also possibly unearth missing validations.
89+
#
90+
# However, not depending on Github's public API (REST/GraphQL) suggested that this might change in the future.
91+
run: |
92+
COMMIT_URL="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/commit/$GITHUB_SHA"
93+
STATUS=$(curl -sS --fail --retry 3 --retry-delay 5 "$COMMIT_URL/deferred_commit_data" | jq -r ".data.statusCheckStatus.state")
94+
if [ "$STATUS" != "success" ]; then
95+
echo "::error::Status check state is '$STATUS'. See: $COMMIT_URL"
96+
exit 1
97+
fi
98+
99+
100+
rubygems-release:
101+
name: Build and push gem to RubyGems.org
102+
runs-on: ubuntu-24.04
103+
environment: "rubygems.org" # see: https://github.com/DataDog/dd-trace-rb/settings/environments
104+
needs: verify-checks # Make sure to release from a healthy commit
105+
permissions:
106+
id-token: write
107+
contents: write
108+
env:
109+
SKIP_SIMPLECOV: 1
110+
steps:
111+
- uses: actions/checkout@v4
112+
- name: Set up Ruby
113+
uses: ruby/setup-ruby@v1
114+
with:
115+
ruby-version: '3.3.7'
116+
- uses: rubygems/release-gem@v1
117+
with:
118+
attestations: false # PENDING decision for attestations
119+
120+
github-release:
121+
name: Attach gem to GitHub release and publish
122+
runs-on: ubuntu-24.04
123+
needs:
124+
- verify-checks
125+
- rubygems-release
126+
env:
127+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
128+
GH_REPO: ${{ github.repository }}
129+
GEM_VERSION: ${{ needs.verify-checks.outputs.version }}
130+
permissions:
131+
contents: write
132+
steps:
133+
- name: Download from RubyGems
134+
run: |
135+
gem fetch datadog --version ${GEM_VERSION} --verbose
136+
- name: Attach to existing release draft
137+
run: |
138+
gh release upload "v${GEM_VERSION}" *.gem --clobber
139+
gh release edit "v${GEM_VERSION}" --draft=false
140+
141+
# TODO: Close existing milestone and create next milestone

‎.github/workflows/semgrep.yml

Lines changed: 0 additions & 27 deletions
This file was deleted.

‎.github/workflows/system-tests.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -481,5 +481,5 @@ jobs:
481481
with:
482482
library: ruby
483483
binaries_artifact: system_tests_binaries
484-
_experimental_job_count: 8
485-
_experimental_job_matrix: "[1,2,3,4,5,6,7,8]"
484+
job_count: 8
485+
job_matrix: "[1,2,3,4,5,6,7,8]"

0 commit comments

Comments
 (0)