Skip to content

deps(actions): bump github/codeql-action from 4.35.5 to 4.36.2 #707

deps(actions): bump github/codeql-action from 4.35.5 to 4.36.2

deps(actions): bump github/codeql-action from 4.35.5 to 4.36.2 #707

Workflow file for this run

# Unless explicitly stated otherwise all files in this repository are licensed under
# the Apache 2.0 License.
#
# This product includes software developed at Datadog
# (https://www.datadoghq.com/) Copyright 2025-Present Datadog, Inc.
name: CI
on:
pull_request:
push:
branches:
- main
- "feature/**"
permissions:
contents: read
env:
# Keep the host Go toolchain aligned with the public WORKSPACE Go fixture and
# the current default tracer pin exercised by that fixture.
GO_VERSION: "1.25.0"
PYTHON_VERSION: "3.11"
BUILDIFIER_VERSION: "8.2.1"
BUILDIFIER_SHA256_LINUX_AMD64: "6ceb7b0ab7cf66fceccc56a027d21d9cc557a7f34af37d2101edb56b92fcfa1a"
concurrency:
# Keep one active run per workflow/ref to avoid wasting CI minutes when
# multiple commits are pushed quickly to the same branch.
group: ci-${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
# Keep the workflow itself running on every PR update so required checks still
# report a concrete result. Heavy jobs can then opt out cleanly on docs-only
# changes instead of leaving branch protection checks stuck in a pending state.
changes:
timeout-minutes: 5
runs-on: ubuntu-latest
outputs:
docs_only: ${{ steps.classify.outputs.docs_only }}
run_full_ci: ${{ steps.classify.outputs.run_full_ci }}
steps:
- name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
fetch-depth: 0
- name: Classify changed files
id: classify
shell: bash
env:
EVENT_NAME: ${{ github.event_name }}
PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
PUSH_BEFORE_SHA: ${{ github.event.before }}
PUSH_AFTER_SHA: ${{ github.sha }}
run: |
set -euo pipefail
case "${EVENT_NAME}" in
pull_request)
base_sha="${PR_BASE_SHA}"
head_sha="${PR_HEAD_SHA}"
;;
push)
base_sha="${PUSH_BEFORE_SHA}"
head_sha="${PUSH_AFTER_SHA}"
;;
*)
base_sha=""
head_sha=""
;;
esac
while IFS= read -r line; do
echo "${line}" >> "${GITHUB_OUTPUT}"
done < <(./tools/dev/classify_ci_changes.sh "${base_sha}" "${head_sha}")
bazel-tests:
needs: changes
if: ${{ needs.changes.outputs.run_full_ci == 'true' }}
timeout-minutes: 45
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, macos-latest, windows-latest]
runs-on: ${{ matrix.os }}
steps:
- name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: ${{ env.GO_VERSION }}
- name: Set up Python
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
with:
python-version: ${{ env.PYTHON_VERSION }}
# Fresh-run policy: keep this lane intentionally cacheless so every CI run
# re-evaluates repository rules from scratch.
# Guardrail: do not add Bazel cache steps (actions/cache, disk cache,
# remote cache) here without explicit maintainer approval.
- name: Run Bazel tests
timeout-minutes: 25
shell: bash
run: ./bazelw test //tools/...
- name: Run Bazel tests (go companion module)
if: matrix.os == 'ubuntu-latest'
timeout-minutes: 10
shell: bash
run: |
(
cd modules/go &&
../../bazelw test //... \
--override_module=datadog-rules-test-optimization=../..
)
- name: Run Bazel tests (python companion module)
if: matrix.os == 'ubuntu-latest'
timeout-minutes: 10
shell: bash
run: |
(
cd modules/python &&
../../bazelw test //... \
--override_module=datadog-rules-test-optimization=../..
)
- name: Run Bazel tests (java companion module)
if: matrix.os == 'ubuntu-latest'
timeout-minutes: 10
shell: bash
run: |
(
cd modules/java &&
../../bazelw test //... \
--override_module=datadog-rules-test-optimization=../..
)
- name: Run Bazel tests (nodejs companion module)
if: matrix.os == 'ubuntu-latest'
timeout-minutes: 10
shell: bash
run: |
(
cd modules/nodejs &&
../../bazelw test //... \
--override_module=datadog-rules-test-optimization=../..
)
- name: Run Bazel tests (dotnet companion module)
if: matrix.os == 'ubuntu-latest'
timeout-minutes: 10
shell: bash
run: |
(
cd modules/dotnet &&
../../bazelw test //... \
--override_module=datadog-rules-test-optimization=../..
)
- name: Run Bazel tests (ruby companion module)
if: matrix.os == 'ubuntu-latest'
timeout-minutes: 10
shell: bash
run: |
(
cd modules/ruby &&
../../bazelw test //... \
--override_module=datadog-rules-test-optimization=../..
)
- name: Build examples
timeout-minutes: 20
shell: bash
run: |
if [[ "${{ runner.os }}" == "Windows" ]]; then
# Linux/macOS already build the full example matrix, including Go.
# Keep Windows coverage on the non-Go examples until the vendored
# rules_go Orchestrion stdlib action is stable there.
./bazelw --output_user_root=C:/b build \
-- \
//examples/... \
-//examples/single_service/src/go-project/... \
-//examples/multi_service/src/go-project/...
else
./bazelw build //examples/...
fi
- name: Test examples
timeout-minutes: 20
shell: bash
# --enable_runfiles is required on Windows so the dd_topt_java_test
# example can resolve -javaagent via $(rootpath); no-op on Linux/macOS.
run: |
if [[ "${{ runner.os }}" == "Windows" ]]; then
./bazelw --output_user_root=C:/b test \
--enable_runfiles \
--test_output=errors \
-- \
//examples/... \
-//examples/single_service/src/go-project/... \
-//examples/multi_service/src/go-project/...
else
./bazelw test //examples/... --test_output=errors
fi
- name: Exercise single-service runtests script (dry-run)
shell: bash
# Keep CI deterministic and secret-free: this validates script wiring
# and command construction without requiring live Datadog credentials.
run: RUNTESTS_DRY_RUN=1 bash ./examples/single_service/runtests.sh
- name: Exercise multi-service runtests script (dry-run)
shell: bash
# Keep CI deterministic and secret-free: this validates script wiring
# and command construction without requiring live Datadog credentials.
run: RUNTESTS_DRY_RUN=1 bash ./examples/multi_service/runtests.sh
# Exercises the uploader end-to-end against a local mock server.
- name: Run mock server integration tests (Linux)
if: runner.os == 'Linux'
# The guided Orchestrion bootstrap coverage in this harness now performs
# a full cold-start bootstrap before the mocked runtime assertions. Keep
# this lane bounded, but give it enough headroom to finish on slower
# GitHub-hosted Linux runners.
timeout-minutes: 30
shell: bash
run: ./tools/tests/integration/run_mock_server_tests.sh
- name: Ensure jq is available (Windows)
if: runner.os == 'Windows'
shell: pwsh
run: |
if (Get-Command jq -ErrorAction SilentlyContinue) {
jq --version
exit 0
}
choco install jq --no-progress -y
jq --version
# Runs the same integration harness on Windows.
- name: Run mock server integration tests (Windows)
if: runner.os == 'Windows'
timeout-minutes: 15
shell: pwsh
run: ./tools/tests/integration/run_mock_server_tests.ps1
rules-go-variant-smoke:
needs: changes
if: ${{ needs.changes.outputs.run_full_ci == 'true' }}
timeout-minutes: 45
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
# The variant verifier and smoke harness inspect the vendored fork
# contract directly, so keep the checkout complete for maintainer
# diagnostics instead of relying on a shallow history.
fetch-depth: 0
- name: Set up Python
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: ${{ env.GO_VERSION }}
- name: Install Bazelisk
shell: bash
run: |
GO111MODULE=on go install github.com/bazelbuild/bazelisk@v1.28.1
echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
- name: Run vendored rules_go base smoke coverage
shell: bash
run: RULES_GO_VARIANT=base ./tools/dev/run_rules_go_variant_smoke.sh
- name: Run vendored rules_go complete smoke coverage
shell: bash
run: RULES_GO_VARIANT=complete ./tools/dev/run_rules_go_variant_smoke.sh
workspace-compat:
needs: changes
if: ${{ needs.changes.outputs.run_full_ci == 'true' }}
timeout-minutes: 45
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Set up Python
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: ${{ env.GO_VERSION }}
- name: Install Bazelisk
shell: bash
run: |
GO111MODULE=on go install github.com/bazelbuild/bazelisk@v1.28.1
echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
- name: Validate WORKSPACE Go companion path (base, general)
shell: bash
run: |
USE_BAZEL_VERSION=8.4.1 RULES_GO_VARIANT=base \
./tools/tests/integration/run_workspace_go_integration.sh
- name: Validate WORKSPACE Go companion path (complete, general)
shell: bash
run: |
USE_BAZEL_VERSION=8.4.1 RULES_GO_VARIANT=complete \
./tools/tests/integration/run_workspace_go_integration.sh
- name: Validate Bzlmod Go companion path (base, general)
shell: bash
run: |
USE_BAZEL_VERSION=8.4.1 RULES_GO_VARIANT=base \
./tools/tests/integration/run_bzlmod_go_integration.sh
- name: Validate Bzlmod Go companion path (complete, general)
shell: bash
run: |
USE_BAZEL_VERSION=8.4.1 RULES_GO_VARIANT=complete \
./tools/tests/integration/run_bzlmod_go_integration.sh
- name: Validate WORKSPACE Go companion path (base, test_optimization)
shell: bash
run: |
USE_BAZEL_VERSION=8.4.1 RULES_GO_VARIANT=base ORCHESTRION_MODE=test_optimization \
./tools/tests/integration/run_workspace_go_integration.sh
- name: Validate WORKSPACE Go companion path (complete, test_optimization)
shell: bash
run: |
USE_BAZEL_VERSION=8.4.1 RULES_GO_VARIANT=complete ORCHESTRION_MODE=test_optimization \
./tools/tests/integration/run_workspace_go_integration.sh
- name: Validate Bzlmod Go companion path (base, test_optimization)
shell: bash
run: |
USE_BAZEL_VERSION=8.4.1 RULES_GO_VARIANT=base ORCHESTRION_MODE=test_optimization \
./tools/tests/integration/run_bzlmod_go_integration.sh
- name: Validate Bzlmod Go companion path (complete, test_optimization)
shell: bash
run: |
USE_BAZEL_VERSION=8.4.1 RULES_GO_VARIANT=complete ORCHESTRION_MODE=test_optimization \
./tools/tests/integration/run_bzlmod_go_integration.sh
coverage-tools:
needs: changes
if: ${{ needs.changes.outputs.run_full_ci == 'true' }}
timeout-minutes: 15
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Set up Python
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Install Python tooling dependencies
shell: bash
run: python3 -m pip install --require-hashes -r tools/requirements.txt
- name: Verify Python tooling tests through Bazel
shell: bash
run: ./bazelw test //tools/tests/python:python_tools_test
- name: Enforce minimum tools coverage signal
shell: bash
env:
TOOLS_COVERAGE_MIN: "40.0"
run: |
# Coverage is collected via Python's trace module for file-level signal,
# while the Bazel step above keeps runtime wiring parity verified.
TOOLS_COVERAGE_MIN="$TOOLS_COVERAGE_MIN" python3 - <<'PY'
import os
import pathlib
import runpy
import sys
import trace
repo_root = pathlib.Path.cwd()
min_raw = os.environ.get("TOOLS_COVERAGE_MIN")
if min_raw is None or min_raw.strip() == "":
print("error: TOOLS_COVERAGE_MIN must be provided")
sys.exit(2)
min_pct = float(min_raw)
targets = [
repo_root / "tools/core/validate_payload_schema.py",
repo_root / "tools/core/schemas/sync_agentless_schema.py",
repo_root / "tools/dev/check_module_versions.py",
repo_root / "tools/dev/lint_uploader_templates.py",
]
tracer = trace.Trace(count=True, trace=False)
exit_code = 0
try:
tracer.runctx(
'runpy.run_path("tools/tests/python/test_python_tools.py", run_name="__main__")',
{"runpy": runpy},
{},
)
except SystemExit as exc:
code = exc.code
if code is None:
exit_code = 0
elif isinstance(code, int):
exit_code = code
else:
print(code)
exit_code = 1
if exit_code != 0:
sys.exit(exit_code)
counts = tracer.results().counts
lines_found = 0
lines_hit = 0
for target in targets:
target_path = target.resolve()
source_lines = target_path.read_text(encoding="utf-8").splitlines()
executable_lines = [
idx
for idx, line in enumerate(source_lines, start=1)
if line.strip() and not line.lstrip().startswith("#")
]
hit_lines = set()
for (filename, lineno), count in counts.items():
if count <= 0:
continue
try:
if pathlib.Path(filename).resolve() == target_path:
hit_lines.add(lineno)
except OSError:
continue
found = len(executable_lines)
hit = len([ln for ln in executable_lines if ln in hit_lines])
lines_found += found
lines_hit += hit
print(f"tools coverage file: {target_path} -> {hit}/{found} lines hit")
if lines_found <= 0:
print("error: tools coverage probe found zero executable lines")
sys.exit(1)
pct = (lines_hit / lines_found) * 100.0
print(f"tools coverage total: {lines_hit}/{lines_found} lines hit ({pct:.2f}%)")
if pct < min_pct:
print(
f"error: tools coverage {pct:.2f}% is below minimum {min_pct:.2f}%"
)
sys.exit(1)
PY
shared-validation:
needs: changes
uses: ./.github/workflows/shared-validation.yml
with:
docs_only: ${{ needs.changes.outputs.docs_only == 'true' }}
python_version: "3.11"
run_buildifier: true
verify_bazelrc_sync: true
run_gofmt: true
run_powershell_lint: true
run_schema_validation: true
run_fixture_json_validation: true
run_schema_parser_parity: true
# Policy: keep the hermetic lane Linux-only for now.
# Rationale: sandbox/network-blocking semantics are most reliable on Linux;
# macOS/Windows are still covered by the standard test+integration matrix.
bazel-tests-hermetic:
needs: changes
if: ${{ needs.changes.outputs.run_full_ci == 'true' }}
timeout-minutes: 45
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Run Bazel tests (hermetic lane)
timeout-minutes: 25
shell: bash
run: |
./bazelw test //tools/... \
--spawn_strategy=sandboxed \
--strategy=TestRunner=sandboxed \
--incompatible_strict_action_env \
--sandbox_default_allow_network=false \
--modify_execution_info=TestRunner=+block-network \
--test_env=TZ=UTC \
--test_env=LANG=C \
--test_env=LC_ALL=C \
--enable_runfiles
- name: Run Bazel tests (go companion hermetic lane)
timeout-minutes: 10
shell: bash
run: |
(
cd modules/go &&
../../bazelw test //... \
--override_module=datadog-rules-test-optimization=../.. \
--spawn_strategy=sandboxed \
--strategy=TestRunner=sandboxed \
--incompatible_strict_action_env \
--sandbox_default_allow_network=false \
--modify_execution_info=TestRunner=+block-network \
--test_env=TZ=UTC \
--test_env=LANG=C \
--test_env=LC_ALL=C \
--enable_runfiles
)
- name: Run Bazel tests (python companion hermetic lane)
timeout-minutes: 10
shell: bash
run: |
(
cd modules/python &&
../../bazelw test //... \
--override_module=datadog-rules-test-optimization=../.. \
--spawn_strategy=sandboxed \
--strategy=TestRunner=sandboxed \
--incompatible_strict_action_env \
--sandbox_default_allow_network=false \
--modify_execution_info=TestRunner=+block-network \
--test_env=TZ=UTC \
--test_env=LANG=C \
--test_env=LC_ALL=C \
--enable_runfiles
)
- name: Run Bazel tests (java companion hermetic lane)
timeout-minutes: 10
shell: bash
run: |
(
cd modules/java &&
../../bazelw test //... \
--override_module=datadog-rules-test-optimization=../.. \
--spawn_strategy=sandboxed \
--strategy=TestRunner=sandboxed \
--incompatible_strict_action_env \
--sandbox_default_allow_network=false \
--modify_execution_info=TestRunner=+block-network \
--test_env=TZ=UTC \
--test_env=LANG=C \
--test_env=LC_ALL=C \
--enable_runfiles
)
- name: Run Bazel tests (nodejs companion hermetic lane)
timeout-minutes: 10
shell: bash
run: |
(
cd modules/nodejs &&
../../bazelw test //... \
--override_module=datadog-rules-test-optimization=../.. \
--spawn_strategy=sandboxed \
--strategy=TestRunner=sandboxed \
--incompatible_strict_action_env \
--sandbox_default_allow_network=false \
--modify_execution_info=TestRunner=+block-network \
--test_env=TZ=UTC \
--test_env=LANG=C \
--test_env=LC_ALL=C \
--enable_runfiles
)
- name: Run Bazel tests (dotnet companion hermetic lane)
timeout-minutes: 10
shell: bash
run: |
(
cd modules/dotnet &&
../../bazelw test //... \
--override_module=datadog-rules-test-optimization=../.. \
--spawn_strategy=sandboxed \
--strategy=TestRunner=sandboxed \
--incompatible_strict_action_env \
--sandbox_default_allow_network=false \
--modify_execution_info=TestRunner=+block-network \
--test_env=TZ=UTC \
--test_env=LANG=C \
--test_env=LC_ALL=C \
--enable_runfiles
)
- name: Run Bazel tests (ruby companion hermetic lane)
timeout-minutes: 10
shell: bash
run: |
(
cd modules/ruby &&
../../bazelw test //... \
--override_module=datadog-rules-test-optimization=../.. \
--spawn_strategy=sandboxed \
--strategy=TestRunner=sandboxed \
--incompatible_strict_action_env \
--sandbox_default_allow_network=false \
--modify_execution_info=TestRunner=+block-network \
--test_env=TZ=UTC \
--test_env=LANG=C \
--test_env=LC_ALL=C \
--enable_runfiles
)