-
Notifications
You must be signed in to change notification settings - Fork 10
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
APMSP-1542 feat: setup dotnet CI and add support for win-x64, win-x86, linux-x64, linux-arm64 & osx-arm64 #771
base: main
Are you sure you want to change the base?
Changes from 23 commits
4dc22ed
3cea755
875a031
8abe17c
cf16b4b
468235c
7c8ecdf
58a5f7c
6c2fd51
5bf2f91
0c05e06
fa33233
6d264f5
989ee38
efa4f94
e5c5584
134f684
71fe5dc
ec662ad
77e593e
2f03203
c779ba7
217b2b4
05d5450
faa037c
c4019bb
51522cc
0fdcbb9
8707d97
691d93f
4cdce24
2fcee63
07adb6b
b144f44
bd1d936
81c29b4
1e22aaf
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,5 @@ | ||
[target.aarch64-unknown-linux-gnu] | ||
linker = "aarch64-linux-gnu-gcc" | ||
|
||
[target.aarch64-unknown-linux-musl] | ||
linker = "aarch64-linux-musl-gcc" |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,315 @@ | ||
name: .NET | ||
on: | ||
push: | ||
branches: | ||
- main | ||
pull_request: | ||
branches: | ||
- main | ||
|
||
permissions: | ||
contents: read | ||
|
||
env: | ||
OUTPUT_DIR: bin | ||
PACKAGES_DIR: packages | ||
NUGET_NAME: ganeshnj.libdatadog | ||
|
||
jobs: | ||
build: | ||
runs-on: ${{ matrix.os }} | ||
|
||
# container: ${{ matrix.container }} | ||
|
||
env: | ||
ACTIONS_RUNNER_FORCE_ACTIONS_NODE_VERSION: node16 | ||
ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true | ||
|
||
strategy: | ||
matrix: | ||
include: | ||
- os: windows-latest | ||
target: x86_64-pc-windows-msvc | ||
- os: windows-latest | ||
target: i686-pc-windows-msvc | ||
- os: ubuntu-latest | ||
target: x86_64-unknown-linux-gnu | ||
container: centos:7 | ||
- os: arm-4core-linux-ubuntu24.04 | ||
Check failure on line 38 in .github/workflows/dotnet.yml
|
||
target: aarch64-unknown-linux-gnu | ||
container: centos:7 | ||
# - os: ubuntu-latest | ||
# target: x86_64-unknown-linux-musl | ||
# container: alpine:3.19 | ||
# - os: arm-4core-linux-ubuntu24.04 | ||
# target: aarch64-unknown-linux-musl | ||
# container: alpine:3.19 | ||
- os: macos-latest | ||
target: aarch64-apple-darwin | ||
- os: macos-latest | ||
target: x86_64-apple-darwin | ||
steps: | ||
- name: Checkout | ||
uses: actions/checkout@v4 | ||
ganeshnj marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
||
- name: centos:7 | ||
uses: addnab/docker-run-action@v3 | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag (...read more)When using a third party action, one needs to provide its GitHub path ( No pinned Git ref means the action uses the latest commit of the default branch each time it runs, eventually running newer versions of the code that were not audited by Datadog. Specifying a Git tag is better, but since they are not immutable, using a full length hash is recommended to make sure the action content is actually frozen to some reviewed state. Be careful however, as even pinning an action by hash can be circumvented by attackers still. For instance, if an action relies on a Docker image which is itself not pinned to a digest, it becomes possible to alter its behaviour through the Docker image without actually changing its hash. You can learn more about this kind of attacks in Unpinnable Actions: How Malicious Code Can Sneak into Your GitHub Actions Workflows. Pinning actions by hash is still a good first line of defense against supply chain attacks. Additionally, pinning by hash or tag means the action won’t benefit from newer version updates if any, including eventual security patches. Make sure to regularly check if newer versions for an action you use are available. For actions coming from a very trustworthy source, it can make sense to use a laxer pinning policy to benefit from updates as soon as possible. |
||
if: matrix.container == 'centos:7' | ||
with: | ||
image: ${{ matrix.container }} | ||
options: -v ${{ github.workspace }}:/workspace | ||
run: | | ||
sed -i 's/mirrorlist/#mirrorlist/g' /etc/yum.repos.d/CentOS-* | ||
sed -i 's|#baseurl=http://mirror.centos.org|baseurl=http://vault.centos.org|g' /etc/yum.repos.d/CentOS-* | ||
|
||
yum install epel-release -y | ||
|
||
yum clean all -y && yum makecache -y && yum update -y | ||
|
||
yum install -y centos-release-scl \ | ||
&& sed -i s/mirror.centos.org/buildlogs.centos.org/g /etc/yum.repos.d/CentOS-SCLo-*.repo \ | ||
&& sed -i s/^#.*baseurl=http/baseurl=http/g /etc/yum.repos.d/CentOS-SCLo-*.repo \ | ||
&& sed -i s/^mirrorlist=http/#mirrorlist=http/g /etc/yum.repos.d/CentOS-SCLo-*.repo \ | ||
&& yum install -y --setopt=tsflags=nodocs --nogpgcheck \ | ||
curl \ | ||
devtoolset-9 \ | ||
git \ | ||
make \ | ||
pkg-config \ | ||
unzip \ | ||
strace \ | ||
zlib-devel \ | ||
jq \ | ||
&& yum clean all --enablerepo='*' \ | ||
|
||
# switch to GCC9 environment for the duration of the script | ||
source scl_source enable devtoolset-9 | ||
|
||
gcc --version | ||
ldd --version | ||
|
||
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y | ||
source $HOME/.cargo/env | ||
rustup target add ${{ matrix.target }} | ||
cargo install --force cbindgen | ||
|
||
cd /workspace | ||
./windows/build-artifacts.sh ${{ env.OUTPUT_DIR }} ${{ matrix.target }} | ||
|
||
- name: alpine:3.19 | ||
uses: addnab/docker-run-action@v3 | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag (...read more)When using a third party action, one needs to provide its GitHub path ( No pinned Git ref means the action uses the latest commit of the default branch each time it runs, eventually running newer versions of the code that were not audited by Datadog. Specifying a Git tag is better, but since they are not immutable, using a full length hash is recommended to make sure the action content is actually frozen to some reviewed state. Be careful however, as even pinning an action by hash can be circumvented by attackers still. For instance, if an action relies on a Docker image which is itself not pinned to a digest, it becomes possible to alter its behaviour through the Docker image without actually changing its hash. You can learn more about this kind of attacks in Unpinnable Actions: How Malicious Code Can Sneak into Your GitHub Actions Workflows. Pinning actions by hash is still a good first line of defense against supply chain attacks. Additionally, pinning by hash or tag means the action won’t benefit from newer version updates if any, including eventual security patches. Make sure to regularly check if newer versions for an action you use are available. For actions coming from a very trustworthy source, it can make sense to use a laxer pinning policy to benefit from updates as soon as possible. |
||
if: matrix.container == 'alpine:3.19' | ||
with: | ||
image: ${{ matrix.container }} | ||
options: -v ${{ github.workspace }}:/workspace | ||
run: | | ||
apk update \ | ||
&& apk add --no-cache \ | ||
build-base \ | ||
cargo \ | ||
cmake \ | ||
curl \ | ||
git \ | ||
make \ | ||
patchelf \ | ||
protoc \ | ||
pkgconf \ | ||
unzip \ | ||
bash \ | ||
jq \ | ||
clang16-libclang \ | ||
&& mkdir /usr/local/src \ | ||
|
||
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y | ||
source $HOME/.cargo/env | ||
rustup target add ${{ matrix.target }} | ||
cargo install --force cbindgen | ||
|
||
gcc --version | ||
ldd --version | ||
|
||
cd /workspace | ||
./windows/build-artifacts.sh ${{ env.OUTPUT_DIR }} ${{ matrix.target }} | ||
|
||
- name: Windows | ||
if: matrix.os == 'windows-latest' | ||
run: | | ||
$ProgressPreference = "SilentlyContinue" | ||
Invoke-WebRequest https://win.rustup.rs/ -OutFile rustup-init.exe | ||
.\rustup-init.exe -y --default-host=${{ matrix.target }} --default-toolchain stable --profile minimal | ||
del rustup-init.exe | ||
rustup target add ${{ matrix.target }} | ||
./windows/build-artifacts.ps1 ${{ env.OUTPUT_DIR }} ${{ matrix.target }} | ||
shell: powershell | ||
|
||
- name: macOS | ||
if: matrix.os == 'macos-latest' | ||
run: | | ||
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y | ||
source $HOME/.cargo/env | ||
rustup target add ${{ matrix.target }} | ||
cargo install --force cbindgen | ||
./windows/build-artifacts.sh ${{ env.OUTPUT_DIR }} ${{ matrix.target }} | ||
shell: bash | ||
|
||
- name: Upload artifacts | ||
uses: actions/upload-artifact@v4 | ||
ganeshnj marked this conversation as resolved.
Show resolved
Hide resolved
|
||
with: | ||
name: ${{ env.OUTPUT_DIR }}-${{ matrix.target }} | ||
path: | | ||
bin/* | ||
!bin/*/*/build | ||
!bin/*/*/deps | ||
!bin/*/*/examples | ||
!bin/*/*/incremental | ||
!bin/*/*/.fingerprint | ||
!bin/debug | ||
!bin/release | ||
|
||
pack: | ||
runs-on: windows-latest | ||
needs: build | ||
outputs: | ||
NUGET_VERSION: ${{ steps.dotnet-pack.outputs.NUGET_VERSION }} | ||
steps: | ||
- name: Checkout code | ||
uses: actions/checkout@v4 | ||
ganeshnj marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
||
- name: Download x86_64-pc-windows-msvc | ||
uses: actions/download-artifact@v4 | ||
ganeshnj marked this conversation as resolved.
Show resolved
Hide resolved
|
||
with: | ||
name: ${{ env.OUTPUT_DIR }}-x86_64-pc-windows-msvc | ||
path: bin | ||
|
||
- name: Download i686-pc-windows-msvc | ||
uses: actions/download-artifact@v4 | ||
ganeshnj marked this conversation as resolved.
Show resolved
Hide resolved
|
||
with: | ||
name: ${{ env.OUTPUT_DIR }}-i686-pc-windows-msvc | ||
path: bin | ||
|
||
- name: Download x86_64-unknown-linux-gnu | ||
uses: actions/download-artifact@v4 | ||
ganeshnj marked this conversation as resolved.
Show resolved
Hide resolved
|
||
with: | ||
name: ${{ env.OUTPUT_DIR }}-x86_64-unknown-linux-gnu | ||
path: bin | ||
|
||
- name: Download aarch64-unknown-linux-gnu | ||
uses: actions/download-artifact@v4 | ||
with: | ||
name: ${{ env.OUTPUT_DIR }}-aarch64-unknown-linux-gnu | ||
path: bin | ||
|
||
# - name: Download x86_64-unknown-linux-musl | ||
# uses: actions/download-artifact@v4 | ||
# with: | ||
# name: ${{ env.OUTPUT_DIR }}-x86_64-unknown-linux-musl | ||
# path: bin | ||
|
||
# - name: Download aarch64-unknown-linux-musl | ||
# uses: actions/download-artifact@v4 | ||
# with: | ||
# name: ${{ env.OUTPUT_DIR }}-aarch64-unknown-linux-musl | ||
# path: bin | ||
|
||
- name: Download aarch64-apple-darwin | ||
uses: actions/download-artifact@v4 | ||
ganeshnj marked this conversation as resolved.
Show resolved
Hide resolved
|
||
with: | ||
name: ${{ env.OUTPUT_DIR }}-aarch64-apple-darwin | ||
path: bin | ||
|
||
- name: Download x86_64-apple-darwin | ||
uses: actions/download-artifact@v4 | ||
ganeshnj marked this conversation as resolved.
Show resolved
Hide resolved
|
||
with: | ||
name: ${{ env.OUTPUT_DIR }}-x86_64-apple-darwin | ||
path: bin | ||
|
||
- name: dotnet pack | ||
id: dotnet-pack | ||
run: | | ||
$cargo_content=Get-Content Cargo.toml -Raw | ||
$cargo_content -match '(?m)^version += +"([^"]+)"' | ||
$current_version=$Matches[1] | ||
$version_suffix="ci.${{ github.event.number }}.${{ github.run_number }}" | ||
$version="$current_version-$version_suffix" | ||
echo "NUGET_VERSION=$version" >> $env:GITHUB_OUTPUT | ||
dotnet pack windows/libdatadog.csproj -p:LibDatadogBinariesOutputDir=../${{ env.OUTPUT_DIR }} -p:LibDatadogVersion=$version -p:PackageID=${{ env.NUGET_NAME }} -o ${{ env.PACKAGES_DIR }} | ||
|
||
- name: Upload package | ||
uses: actions/upload-artifact@v4 # v4 | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag (...read more)When using a third party action, one needs to provide its GitHub path ( No pinned Git ref means the action uses the latest commit of the default branch each time it runs, eventually running newer versions of the code that were not audited by Datadog. Specifying a Git tag is better, but since they are not immutable, using a full length hash is recommended to make sure the action content is actually frozen to some reviewed state. Be careful however, as even pinning an action by hash can be circumvented by attackers still. For instance, if an action relies on a Docker image which is itself not pinned to a digest, it becomes possible to alter its behaviour through the Docker image without actually changing its hash. You can learn more about this kind of attacks in Unpinnable Actions: How Malicious Code Can Sneak into Your GitHub Actions Workflows. Pinning actions by hash is still a good first line of defense against supply chain attacks. Additionally, pinning by hash or tag means the action won’t benefit from newer version updates if any, including eventual security patches. Make sure to regularly check if newer versions for an action you use are available. For actions coming from a very trustworthy source, it can make sense to use a laxer pinning policy to benefit from updates as soon as possible. |
||
with: | ||
name: ${{ env.PACKAGES_DIR }} | ||
path: ${{ env.PACKAGES_DIR }} | ||
|
||
test: | ||
runs-on: ${{ matrix.os }} | ||
needs: pack | ||
|
||
strategy: | ||
matrix: | ||
include: | ||
- os: windows-latest | ||
- os: ubuntu-latest | ||
container: centos:7 | ||
- os: arm-4core-linux-ubuntu24.04 | ||
Check failure on line 253 in .github/workflows/dotnet.yml
|
||
container: centos:7 | ||
- os: macos-latest | ||
|
||
steps: | ||
- name: Checkout code | ||
uses: actions/checkout@v4 | ||
ganeshnj marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
||
- name: Download package | ||
uses: actions/download-artifact@v4 | ||
ganeshnj marked this conversation as resolved.
Show resolved
Hide resolved
|
||
with: | ||
name: ${{ env.PACKAGES_DIR }} | ||
path: ${{ env.PACKAGES_DIR }} | ||
|
||
- name: ${{ matrix.container }} Test | ||
uses: addnab/docker-run-action@v3 | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag (...read more)When using a third party action, one needs to provide its GitHub path ( No pinned Git ref means the action uses the latest commit of the default branch each time it runs, eventually running newer versions of the code that were not audited by Datadog. Specifying a Git tag is better, but since they are not immutable, using a full length hash is recommended to make sure the action content is actually frozen to some reviewed state. Be careful however, as even pinning an action by hash can be circumvented by attackers still. For instance, if an action relies on a Docker image which is itself not pinned to a digest, it becomes possible to alter its behaviour through the Docker image without actually changing its hash. You can learn more about this kind of attacks in Unpinnable Actions: How Malicious Code Can Sneak into Your GitHub Actions Workflows. Pinning actions by hash is still a good first line of defense against supply chain attacks. Additionally, pinning by hash or tag means the action won’t benefit from newer version updates if any, including eventual security patches. Make sure to regularly check if newer versions for an action you use are available. For actions coming from a very trustworthy source, it can make sense to use a laxer pinning policy to benefit from updates as soon as possible. |
||
if: matrix.container == 'centos:7' || matrix.container == 'alpine:3.19' | ||
with: | ||
image: ${{ matrix.container }} | ||
options: -v ${{ github.workspace }}:/workspace | ||
run: | | ||
curl -sSL https://dot.net/v1/dotnet-install.sh | bash /dev/stdin --channel 3.1 --install-dir /usr/share/dotnet | ||
source /usr/share/dotnet/dotnet.complete.sh | ||
cd /workspace/tests/nuget_package | ||
/usr/share/dotnet/dotnet add nuget_package.csproj package ${{ env.NUGET_NAME }} --version ${{ needs.pack.outputs.NUGET_VERSION }} | ||
/usr/share/dotnet/dotnet run | ||
|
||
- name: Install .NET SDK | ||
if: matrix.os == 'windows-latest' || matrix.os == 'macos-latest' | ||
uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25 #v4 | ||
with: | ||
dotnet-version: 3.1.X | ||
|
||
- name: Test | ||
if: matrix.os == 'windows-latest' || matrix.os == 'macos-latest' | ||
run: | | ||
cd tests/nuget_package | ||
dotnet add nuget_package.csproj package ${{ env.NUGET_NAME }} --version ${{ needs.pack.outputs.NUGET_VERSION }} | ||
|
||
dotnet run | ||
|
||
nuget-push: | ||
runs-on: windows-latest | ||
needs: test | ||
steps: | ||
- name: Checkout code | ||
uses: actions/checkout@v4 | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag (...read more)When using a third party action, one needs to provide its GitHub path ( No pinned Git ref means the action uses the latest commit of the default branch each time it runs, eventually running newer versions of the code that were not audited by Datadog. Specifying a Git tag is better, but since they are not immutable, using a full length hash is recommended to make sure the action content is actually frozen to some reviewed state. Be careful however, as even pinning an action by hash can be circumvented by attackers still. For instance, if an action relies on a Docker image which is itself not pinned to a digest, it becomes possible to alter its behaviour through the Docker image without actually changing its hash. You can learn more about this kind of attacks in Unpinnable Actions: How Malicious Code Can Sneak into Your GitHub Actions Workflows. Pinning actions by hash is still a good first line of defense against supply chain attacks. Additionally, pinning by hash or tag means the action won’t benefit from newer version updates if any, including eventual security patches. Make sure to regularly check if newer versions for an action you use are available. For actions coming from a very trustworthy source, it can make sense to use a laxer pinning policy to benefit from updates as soon as possible. |
||
|
||
- name: Download package | ||
uses: actions/download-artifact@v4 | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag (...read more)When using a third party action, one needs to provide its GitHub path ( No pinned Git ref means the action uses the latest commit of the default branch each time it runs, eventually running newer versions of the code that were not audited by Datadog. Specifying a Git tag is better, but since they are not immutable, using a full length hash is recommended to make sure the action content is actually frozen to some reviewed state. Be careful however, as even pinning an action by hash can be circumvented by attackers still. For instance, if an action relies on a Docker image which is itself not pinned to a digest, it becomes possible to alter its behaviour through the Docker image without actually changing its hash. You can learn more about this kind of attacks in Unpinnable Actions: How Malicious Code Can Sneak into Your GitHub Actions Workflows. Pinning actions by hash is still a good first line of defense against supply chain attacks. Additionally, pinning by hash or tag means the action won’t benefit from newer version updates if any, including eventual security patches. Make sure to regularly check if newer versions for an action you use are available. For actions coming from a very trustworthy source, it can make sense to use a laxer pinning policy to benefit from updates as soon as possible. |
||
with: | ||
name: ${{ env.PACKAGES_DIR }} | ||
path: ${{ env.PACKAGES_DIR }} | ||
|
||
- name: Install .NET SDK | ||
uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25 #v4 | ||
with: | ||
dotnet-version: 6.0.X | ||
|
||
- name: NuGet push | ||
run: | | ||
cd ${{ env.PACKAGES_DIR }} | ||
dotnet nuget push *.nupkg --api-key ${{ secrets.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json --skip-duplicate |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,9 @@ | ||
<?xml version="1.0" encoding="utf-8"?> | ||
<configuration> | ||
<packageSources> | ||
<!--To inherit the global NuGet package sources remove the <clear/> line below --> | ||
<clear /> | ||
<add key="local" value="packages" /> | ||
<add key="nuget" value="https://api.nuget.org/v3/index.json" /> | ||
</packageSources> | ||
</configuration> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🟠 Code Vulnerability
No explicit permissions set for at the workflow level (...read more)
Datadog’s GitHub organization defines default permissions for the
GITHUB_TOKEN
to be restricted (contents:read
,metadata:read
, andpackages:read
).Your repository may require a different setup, so consider defining permissions for each job following the least privilege principle to restrict the impact of a possible compromise.
You can find the list of all possible permissions in Workflow syntax for GitHub Actions - GitHub Docs. They can be defined at the job or the workflow level.