deps(actions): bump github/codeql-action from 4.35.5 to 4.36.2 #707
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Unless explicitly stated otherwise all files in this repository are licensed under | |
| # the Apache 2.0 License. | |
| # | |
| # This product includes software developed at Datadog | |
| # (https://www.datadoghq.com/) Copyright 2025-Present Datadog, Inc. | |
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| - "feature/**" | |
| permissions: | |
| contents: read | |
| env: | |
| # Keep the host Go toolchain aligned with the public WORKSPACE Go fixture and | |
| # the current default tracer pin exercised by that fixture. | |
| GO_VERSION: "1.25.0" | |
| PYTHON_VERSION: "3.11" | |
| BUILDIFIER_VERSION: "8.2.1" | |
| BUILDIFIER_SHA256_LINUX_AMD64: "6ceb7b0ab7cf66fceccc56a027d21d9cc557a7f34af37d2101edb56b92fcfa1a" | |
| concurrency: | |
| # Keep one active run per workflow/ref to avoid wasting CI minutes when | |
| # multiple commits are pushed quickly to the same branch. | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # Keep the workflow itself running on every PR update so required checks still | |
| # report a concrete result. Heavy jobs can then opt out cleanly on docs-only | |
| # changes instead of leaving branch protection checks stuck in a pending state. | |
| changes: | |
| timeout-minutes: 5 | |
| runs-on: ubuntu-latest | |
| outputs: | |
| docs_only: ${{ steps.classify.outputs.docs_only }} | |
| run_full_ci: ${{ steps.classify.outputs.run_full_ci }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| fetch-depth: 0 | |
| - name: Classify changed files | |
| id: classify | |
| shell: bash | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| PR_BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| PUSH_BEFORE_SHA: ${{ github.event.before }} | |
| PUSH_AFTER_SHA: ${{ github.sha }} | |
| run: | | |
| set -euo pipefail | |
| case "${EVENT_NAME}" in | |
| pull_request) | |
| base_sha="${PR_BASE_SHA}" | |
| head_sha="${PR_HEAD_SHA}" | |
| ;; | |
| push) | |
| base_sha="${PUSH_BEFORE_SHA}" | |
| head_sha="${PUSH_AFTER_SHA}" | |
| ;; | |
| *) | |
| base_sha="" | |
| head_sha="" | |
| ;; | |
| esac | |
| while IFS= read -r line; do | |
| echo "${line}" >> "${GITHUB_OUTPUT}" | |
| done < <(./tools/dev/classify_ci_changes.sh "${base_sha}" "${head_sha}") | |
| bazel-tests: | |
| needs: changes | |
| if: ${{ needs.changes.outputs.run_full_ci == 'true' }} | |
| timeout-minutes: 45 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Set up Go | |
| uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| - name: Set up Python | |
| uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| # Fresh-run policy: keep this lane intentionally cacheless so every CI run | |
| # re-evaluates repository rules from scratch. | |
| # Guardrail: do not add Bazel cache steps (actions/cache, disk cache, | |
| # remote cache) here without explicit maintainer approval. | |
| - name: Run Bazel tests | |
| timeout-minutes: 25 | |
| shell: bash | |
| run: ./bazelw test //tools/... | |
| - name: Run Bazel tests (go companion module) | |
| if: matrix.os == 'ubuntu-latest' | |
| timeout-minutes: 10 | |
| shell: bash | |
| run: | | |
| ( | |
| cd modules/go && | |
| ../../bazelw test //... \ | |
| --override_module=datadog-rules-test-optimization=../.. | |
| ) | |
| - name: Run Bazel tests (python companion module) | |
| if: matrix.os == 'ubuntu-latest' | |
| timeout-minutes: 10 | |
| shell: bash | |
| run: | | |
| ( | |
| cd modules/python && | |
| ../../bazelw test //... \ | |
| --override_module=datadog-rules-test-optimization=../.. | |
| ) | |
| - name: Run Bazel tests (java companion module) | |
| if: matrix.os == 'ubuntu-latest' | |
| timeout-minutes: 10 | |
| shell: bash | |
| run: | | |
| ( | |
| cd modules/java && | |
| ../../bazelw test //... \ | |
| --override_module=datadog-rules-test-optimization=../.. | |
| ) | |
| - name: Run Bazel tests (nodejs companion module) | |
| if: matrix.os == 'ubuntu-latest' | |
| timeout-minutes: 10 | |
| shell: bash | |
| run: | | |
| ( | |
| cd modules/nodejs && | |
| ../../bazelw test //... \ | |
| --override_module=datadog-rules-test-optimization=../.. | |
| ) | |
| - name: Run Bazel tests (dotnet companion module) | |
| if: matrix.os == 'ubuntu-latest' | |
| timeout-minutes: 10 | |
| shell: bash | |
| run: | | |
| ( | |
| cd modules/dotnet && | |
| ../../bazelw test //... \ | |
| --override_module=datadog-rules-test-optimization=../.. | |
| ) | |
| - name: Run Bazel tests (ruby companion module) | |
| if: matrix.os == 'ubuntu-latest' | |
| timeout-minutes: 10 | |
| shell: bash | |
| run: | | |
| ( | |
| cd modules/ruby && | |
| ../../bazelw test //... \ | |
| --override_module=datadog-rules-test-optimization=../.. | |
| ) | |
| - name: Build examples | |
| timeout-minutes: 20 | |
| shell: bash | |
| run: | | |
| if [[ "${{ runner.os }}" == "Windows" ]]; then | |
| # Linux/macOS already build the full example matrix, including Go. | |
| # Keep Windows coverage on the non-Go examples until the vendored | |
| # rules_go Orchestrion stdlib action is stable there. | |
| ./bazelw --output_user_root=C:/b build \ | |
| -- \ | |
| //examples/... \ | |
| -//examples/single_service/src/go-project/... \ | |
| -//examples/multi_service/src/go-project/... | |
| else | |
| ./bazelw build //examples/... | |
| fi | |
| - name: Test examples | |
| timeout-minutes: 20 | |
| shell: bash | |
| # --enable_runfiles is required on Windows so the dd_topt_java_test | |
| # example can resolve -javaagent via $(rootpath); no-op on Linux/macOS. | |
| run: | | |
| if [[ "${{ runner.os }}" == "Windows" ]]; then | |
| ./bazelw --output_user_root=C:/b test \ | |
| --enable_runfiles \ | |
| --test_output=errors \ | |
| -- \ | |
| //examples/... \ | |
| -//examples/single_service/src/go-project/... \ | |
| -//examples/multi_service/src/go-project/... | |
| else | |
| ./bazelw test //examples/... --test_output=errors | |
| fi | |
| - name: Exercise single-service runtests script (dry-run) | |
| shell: bash | |
| # Keep CI deterministic and secret-free: this validates script wiring | |
| # and command construction without requiring live Datadog credentials. | |
| run: RUNTESTS_DRY_RUN=1 bash ./examples/single_service/runtests.sh | |
| - name: Exercise multi-service runtests script (dry-run) | |
| shell: bash | |
| # Keep CI deterministic and secret-free: this validates script wiring | |
| # and command construction without requiring live Datadog credentials. | |
| run: RUNTESTS_DRY_RUN=1 bash ./examples/multi_service/runtests.sh | |
| # Exercises the uploader end-to-end against a local mock server. | |
| - name: Run mock server integration tests (Linux) | |
| if: runner.os == 'Linux' | |
| # The guided Orchestrion bootstrap coverage in this harness now performs | |
| # a full cold-start bootstrap before the mocked runtime assertions. Keep | |
| # this lane bounded, but give it enough headroom to finish on slower | |
| # GitHub-hosted Linux runners. | |
| timeout-minutes: 30 | |
| shell: bash | |
| run: ./tools/tests/integration/run_mock_server_tests.sh | |
| - name: Ensure jq is available (Windows) | |
| if: runner.os == 'Windows' | |
| shell: pwsh | |
| run: | | |
| if (Get-Command jq -ErrorAction SilentlyContinue) { | |
| jq --version | |
| exit 0 | |
| } | |
| choco install jq --no-progress -y | |
| jq --version | |
| # Runs the same integration harness on Windows. | |
| - name: Run mock server integration tests (Windows) | |
| if: runner.os == 'Windows' | |
| timeout-minutes: 15 | |
| shell: pwsh | |
| run: ./tools/tests/integration/run_mock_server_tests.ps1 | |
| rules-go-variant-smoke: | |
| needs: changes | |
| if: ${{ needs.changes.outputs.run_full_ci == 'true' }} | |
| timeout-minutes: 45 | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| # The variant verifier and smoke harness inspect the vendored fork | |
| # contract directly, so keep the checkout complete for maintainer | |
| # diagnostics instead of relying on a shallow history. | |
| fetch-depth: 0 | |
| - name: Set up Python | |
| uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| - name: Set up Go | |
| uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| - name: Install Bazelisk | |
| shell: bash | |
| run: | | |
| GO111MODULE=on go install github.com/bazelbuild/bazelisk@v1.28.1 | |
| echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH" | |
| - name: Run vendored rules_go base smoke coverage | |
| shell: bash | |
| run: RULES_GO_VARIANT=base ./tools/dev/run_rules_go_variant_smoke.sh | |
| - name: Run vendored rules_go complete smoke coverage | |
| shell: bash | |
| run: RULES_GO_VARIANT=complete ./tools/dev/run_rules_go_variant_smoke.sh | |
| workspace-compat: | |
| needs: changes | |
| if: ${{ needs.changes.outputs.run_full_ci == 'true' }} | |
| timeout-minutes: 45 | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Set up Python | |
| uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| - name: Set up Go | |
| uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| - name: Install Bazelisk | |
| shell: bash | |
| run: | | |
| GO111MODULE=on go install github.com/bazelbuild/bazelisk@v1.28.1 | |
| echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH" | |
| - name: Validate WORKSPACE Go companion path (base, general) | |
| shell: bash | |
| run: | | |
| USE_BAZEL_VERSION=8.4.1 RULES_GO_VARIANT=base \ | |
| ./tools/tests/integration/run_workspace_go_integration.sh | |
| - name: Validate WORKSPACE Go companion path (complete, general) | |
| shell: bash | |
| run: | | |
| USE_BAZEL_VERSION=8.4.1 RULES_GO_VARIANT=complete \ | |
| ./tools/tests/integration/run_workspace_go_integration.sh | |
| - name: Validate Bzlmod Go companion path (base, general) | |
| shell: bash | |
| run: | | |
| USE_BAZEL_VERSION=8.4.1 RULES_GO_VARIANT=base \ | |
| ./tools/tests/integration/run_bzlmod_go_integration.sh | |
| - name: Validate Bzlmod Go companion path (complete, general) | |
| shell: bash | |
| run: | | |
| USE_BAZEL_VERSION=8.4.1 RULES_GO_VARIANT=complete \ | |
| ./tools/tests/integration/run_bzlmod_go_integration.sh | |
| - name: Validate WORKSPACE Go companion path (base, test_optimization) | |
| shell: bash | |
| run: | | |
| USE_BAZEL_VERSION=8.4.1 RULES_GO_VARIANT=base ORCHESTRION_MODE=test_optimization \ | |
| ./tools/tests/integration/run_workspace_go_integration.sh | |
| - name: Validate WORKSPACE Go companion path (complete, test_optimization) | |
| shell: bash | |
| run: | | |
| USE_BAZEL_VERSION=8.4.1 RULES_GO_VARIANT=complete ORCHESTRION_MODE=test_optimization \ | |
| ./tools/tests/integration/run_workspace_go_integration.sh | |
| - name: Validate Bzlmod Go companion path (base, test_optimization) | |
| shell: bash | |
| run: | | |
| USE_BAZEL_VERSION=8.4.1 RULES_GO_VARIANT=base ORCHESTRION_MODE=test_optimization \ | |
| ./tools/tests/integration/run_bzlmod_go_integration.sh | |
| - name: Validate Bzlmod Go companion path (complete, test_optimization) | |
| shell: bash | |
| run: | | |
| USE_BAZEL_VERSION=8.4.1 RULES_GO_VARIANT=complete ORCHESTRION_MODE=test_optimization \ | |
| ./tools/tests/integration/run_bzlmod_go_integration.sh | |
| coverage-tools: | |
| needs: changes | |
| if: ${{ needs.changes.outputs.run_full_ci == 'true' }} | |
| timeout-minutes: 15 | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Set up Python | |
| uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| - name: Install Python tooling dependencies | |
| shell: bash | |
| run: python3 -m pip install --require-hashes -r tools/requirements.txt | |
| - name: Verify Python tooling tests through Bazel | |
| shell: bash | |
| run: ./bazelw test //tools/tests/python:python_tools_test | |
| - name: Enforce minimum tools coverage signal | |
| shell: bash | |
| env: | |
| TOOLS_COVERAGE_MIN: "40.0" | |
| run: | | |
| # Coverage is collected via Python's trace module for file-level signal, | |
| # while the Bazel step above keeps runtime wiring parity verified. | |
| TOOLS_COVERAGE_MIN="$TOOLS_COVERAGE_MIN" python3 - <<'PY' | |
| import os | |
| import pathlib | |
| import runpy | |
| import sys | |
| import trace | |
| repo_root = pathlib.Path.cwd() | |
| min_raw = os.environ.get("TOOLS_COVERAGE_MIN") | |
| if min_raw is None or min_raw.strip() == "": | |
| print("error: TOOLS_COVERAGE_MIN must be provided") | |
| sys.exit(2) | |
| min_pct = float(min_raw) | |
| targets = [ | |
| repo_root / "tools/core/validate_payload_schema.py", | |
| repo_root / "tools/core/schemas/sync_agentless_schema.py", | |
| repo_root / "tools/dev/check_module_versions.py", | |
| repo_root / "tools/dev/lint_uploader_templates.py", | |
| ] | |
| tracer = trace.Trace(count=True, trace=False) | |
| exit_code = 0 | |
| try: | |
| tracer.runctx( | |
| 'runpy.run_path("tools/tests/python/test_python_tools.py", run_name="__main__")', | |
| {"runpy": runpy}, | |
| {}, | |
| ) | |
| except SystemExit as exc: | |
| code = exc.code | |
| if code is None: | |
| exit_code = 0 | |
| elif isinstance(code, int): | |
| exit_code = code | |
| else: | |
| print(code) | |
| exit_code = 1 | |
| if exit_code != 0: | |
| sys.exit(exit_code) | |
| counts = tracer.results().counts | |
| lines_found = 0 | |
| lines_hit = 0 | |
| for target in targets: | |
| target_path = target.resolve() | |
| source_lines = target_path.read_text(encoding="utf-8").splitlines() | |
| executable_lines = [ | |
| idx | |
| for idx, line in enumerate(source_lines, start=1) | |
| if line.strip() and not line.lstrip().startswith("#") | |
| ] | |
| hit_lines = set() | |
| for (filename, lineno), count in counts.items(): | |
| if count <= 0: | |
| continue | |
| try: | |
| if pathlib.Path(filename).resolve() == target_path: | |
| hit_lines.add(lineno) | |
| except OSError: | |
| continue | |
| found = len(executable_lines) | |
| hit = len([ln for ln in executable_lines if ln in hit_lines]) | |
| lines_found += found | |
| lines_hit += hit | |
| print(f"tools coverage file: {target_path} -> {hit}/{found} lines hit") | |
| if lines_found <= 0: | |
| print("error: tools coverage probe found zero executable lines") | |
| sys.exit(1) | |
| pct = (lines_hit / lines_found) * 100.0 | |
| print(f"tools coverage total: {lines_hit}/{lines_found} lines hit ({pct:.2f}%)") | |
| if pct < min_pct: | |
| print( | |
| f"error: tools coverage {pct:.2f}% is below minimum {min_pct:.2f}%" | |
| ) | |
| sys.exit(1) | |
| PY | |
| shared-validation: | |
| needs: changes | |
| uses: ./.github/workflows/shared-validation.yml | |
| with: | |
| docs_only: ${{ needs.changes.outputs.docs_only == 'true' }} | |
| python_version: "3.11" | |
| run_buildifier: true | |
| verify_bazelrc_sync: true | |
| run_gofmt: true | |
| run_powershell_lint: true | |
| run_schema_validation: true | |
| run_fixture_json_validation: true | |
| run_schema_parser_parity: true | |
| # Policy: keep the hermetic lane Linux-only for now. | |
| # Rationale: sandbox/network-blocking semantics are most reliable on Linux; | |
| # macOS/Windows are still covered by the standard test+integration matrix. | |
| bazel-tests-hermetic: | |
| needs: changes | |
| if: ${{ needs.changes.outputs.run_full_ci == 'true' }} | |
| timeout-minutes: 45 | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Run Bazel tests (hermetic lane) | |
| timeout-minutes: 25 | |
| shell: bash | |
| run: | | |
| ./bazelw test //tools/... \ | |
| --spawn_strategy=sandboxed \ | |
| --strategy=TestRunner=sandboxed \ | |
| --incompatible_strict_action_env \ | |
| --sandbox_default_allow_network=false \ | |
| --modify_execution_info=TestRunner=+block-network \ | |
| --test_env=TZ=UTC \ | |
| --test_env=LANG=C \ | |
| --test_env=LC_ALL=C \ | |
| --enable_runfiles | |
| - name: Run Bazel tests (go companion hermetic lane) | |
| timeout-minutes: 10 | |
| shell: bash | |
| run: | | |
| ( | |
| cd modules/go && | |
| ../../bazelw test //... \ | |
| --override_module=datadog-rules-test-optimization=../.. \ | |
| --spawn_strategy=sandboxed \ | |
| --strategy=TestRunner=sandboxed \ | |
| --incompatible_strict_action_env \ | |
| --sandbox_default_allow_network=false \ | |
| --modify_execution_info=TestRunner=+block-network \ | |
| --test_env=TZ=UTC \ | |
| --test_env=LANG=C \ | |
| --test_env=LC_ALL=C \ | |
| --enable_runfiles | |
| ) | |
| - name: Run Bazel tests (python companion hermetic lane) | |
| timeout-minutes: 10 | |
| shell: bash | |
| run: | | |
| ( | |
| cd modules/python && | |
| ../../bazelw test //... \ | |
| --override_module=datadog-rules-test-optimization=../.. \ | |
| --spawn_strategy=sandboxed \ | |
| --strategy=TestRunner=sandboxed \ | |
| --incompatible_strict_action_env \ | |
| --sandbox_default_allow_network=false \ | |
| --modify_execution_info=TestRunner=+block-network \ | |
| --test_env=TZ=UTC \ | |
| --test_env=LANG=C \ | |
| --test_env=LC_ALL=C \ | |
| --enable_runfiles | |
| ) | |
| - name: Run Bazel tests (java companion hermetic lane) | |
| timeout-minutes: 10 | |
| shell: bash | |
| run: | | |
| ( | |
| cd modules/java && | |
| ../../bazelw test //... \ | |
| --override_module=datadog-rules-test-optimization=../.. \ | |
| --spawn_strategy=sandboxed \ | |
| --strategy=TestRunner=sandboxed \ | |
| --incompatible_strict_action_env \ | |
| --sandbox_default_allow_network=false \ | |
| --modify_execution_info=TestRunner=+block-network \ | |
| --test_env=TZ=UTC \ | |
| --test_env=LANG=C \ | |
| --test_env=LC_ALL=C \ | |
| --enable_runfiles | |
| ) | |
| - name: Run Bazel tests (nodejs companion hermetic lane) | |
| timeout-minutes: 10 | |
| shell: bash | |
| run: | | |
| ( | |
| cd modules/nodejs && | |
| ../../bazelw test //... \ | |
| --override_module=datadog-rules-test-optimization=../.. \ | |
| --spawn_strategy=sandboxed \ | |
| --strategy=TestRunner=sandboxed \ | |
| --incompatible_strict_action_env \ | |
| --sandbox_default_allow_network=false \ | |
| --modify_execution_info=TestRunner=+block-network \ | |
| --test_env=TZ=UTC \ | |
| --test_env=LANG=C \ | |
| --test_env=LC_ALL=C \ | |
| --enable_runfiles | |
| ) | |
| - name: Run Bazel tests (dotnet companion hermetic lane) | |
| timeout-minutes: 10 | |
| shell: bash | |
| run: | | |
| ( | |
| cd modules/dotnet && | |
| ../../bazelw test //... \ | |
| --override_module=datadog-rules-test-optimization=../.. \ | |
| --spawn_strategy=sandboxed \ | |
| --strategy=TestRunner=sandboxed \ | |
| --incompatible_strict_action_env \ | |
| --sandbox_default_allow_network=false \ | |
| --modify_execution_info=TestRunner=+block-network \ | |
| --test_env=TZ=UTC \ | |
| --test_env=LANG=C \ | |
| --test_env=LC_ALL=C \ | |
| --enable_runfiles | |
| ) | |
| - name: Run Bazel tests (ruby companion hermetic lane) | |
| timeout-minutes: 10 | |
| shell: bash | |
| run: | | |
| ( | |
| cd modules/ruby && | |
| ../../bazelw test //... \ | |
| --override_module=datadog-rules-test-optimization=../.. \ | |
| --spawn_strategy=sandboxed \ | |
| --strategy=TestRunner=sandboxed \ | |
| --incompatible_strict_action_env \ | |
| --sandbox_default_allow_network=false \ | |
| --modify_execution_info=TestRunner=+block-network \ | |
| --test_env=TZ=UTC \ | |
| --test_env=LANG=C \ | |
| --test_env=LC_ALL=C \ | |
| --enable_runfiles | |
| ) |