Skip to content

Commit ef109ab

Browse files
sarahchen6sarahchen6
committed
Merge branch 'master' into sarahchen6/fix-jdk-25-ea
2 parents 096ddd6 + ef70cfc commit ef109ab

16 files changed

Lines changed: 635 additions & 48 deletions

‎.github/dependabot.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,3 +13,5 @@ updates:
1313
gh-actions-packages:
1414
patterns:
1515
- "*"
16+
cooldown:
17+
default-days: 2

‎.github/workflows/ci.yml‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,14 +18,16 @@ jobs:
1818
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
1919
packages: write # for image publication to GitHub Packages
2020
runs-on: ubuntu-latest
21+
environment:
22+
name: ci-build
2123
steps:
2224
- name: Checkout repository
23-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
25+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
2426
- name: Set up Docker Buildx
2527
id: buildx
26-
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # 3.11.1
28+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # 4.0.0
2729
- name: Login to ghcr.io
28-
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # 3.4.0
30+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # 4.1.0
2931
with:
3032
registry: ghcr.io
3133
username: ${{ github.actor }}
@@ -36,6 +38,8 @@ jobs:
3638
docker-images: false # Do not remove locally built images (including trivy scanner)
3739
- name: Build images
3840
id: build
41+
env:
42+
ORACLE_JAVA8_TOKEN: ${{ secrets.ORACLE_JAVA8_TOKEN }}
3943
run: ./build
4044
- name: Test images
4145
run: ./build --test
@@ -44,7 +48,7 @@ jobs:
4448
- name: Push images
4549
run: ./build --push
4650
- name: Run Trivy vulnerability scanner
47-
uses: aquasecurity/trivy-action@76071ef0d7ec797419534a183b498b4d6366cf37 # v0.31.0
51+
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
4852
with:
4953
image-ref: '${{ steps.build.outputs.LATEST_IMAGE_TAG }}'
5054
format: 'sarif'
@@ -55,6 +59,6 @@ jobs:
5559
TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db
5660
TRIVY_JAVA_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-java-db,public.ecr.aws/aquasecurity/trivy-java-db
5761
- name: Upload Trivy scan results to GitHub Security tab
58-
uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
62+
uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
5963
with:
6064
sarif_file: 'trivy-results.sarif'

‎.github/workflows/create-test-mirror-pr.yml‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
name: Create test image mirror PR
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
pr_number:
7+
description: "PR number in dd-trace-java-docker-build (e.g. 123)"
8+
required: true
9+
10+
jobs:
11+
create-test-mirror-pr:
12+
runs-on: ubuntu-latest
13+
permissions:
14+
id-token: write # Required for OIDC token federation
15+
contents: read
16+
pull-requests: write
17+
steps:
18+
- uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
19+
id: octo-sts
20+
with:
21+
scope: DataDog/images
22+
policy: dd-trace-java-docker-build.update-mirror
23+
24+
- name: Checkout DataDog/dd-trace-java-docker-build
25+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
26+
with:
27+
path: dd-trace-java-docker-build
28+
29+
- name: Checkout DataDog/images
30+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
31+
with:
32+
repository: DataDog/images
33+
token: ${{ steps.octo-sts.outputs.token }}
34+
path: images
35+
36+
- name: Capture images HEAD SHA
37+
id: images-head
38+
run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
39+
working-directory: images
40+
41+
- name: Install crane
42+
run: |
43+
CRANE_VERSION="0.20.2"
44+
curl -fsSL "https://github.com/google/go-containerregistry/releases/download/v${CRANE_VERSION}/go-containerregistry_Linux_x86_64.tar.gz" -o crane.tar.gz
45+
tar -xzf crane.tar.gz crane
46+
sudo mv crane /usr/local/bin/crane
47+
rm crane.tar.gz
48+
49+
- name: Resolve digests and add new or update existing digests in mirror files
50+
id: update-mirror
51+
env:
52+
PR_NUMBER: ${{ github.event.inputs.pr_number }}
53+
run: bash "${GITHUB_WORKSPACE}/dd-trace-java-docker-build/scripts/create-test-mirror-entries.sh"
54+
working-directory: images
55+
56+
- name: Define branch name
57+
id: define-branch
58+
run: echo "branch=ci/add-dd-trace-java-docker-build-test-images-pr${{ github.event.inputs.pr_number }}" >> "$GITHUB_OUTPUT"
59+
60+
- name: Commit changes
61+
id: create-commit
62+
env:
63+
PR_NUMBER: ${{ github.event.inputs.pr_number }}
64+
MODE: ${{ steps.update-mirror.outputs.mode }}
65+
run: |
66+
git config user.name "github-actions[bot]"
67+
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
68+
git add mirror.yaml mirror.lock.yaml
69+
if git diff --cached --quiet; then
70+
echo "No changes detected in mirror files; skipping commit."
71+
echo "has_changes=false" >> "$GITHUB_OUTPUT"
72+
exit 0
73+
fi
74+
git commit -m "chore: Update dd-trace-java-docker-build test image digests for PR #${PR_NUMBER}"
75+
echo "has_changes=true" >> "$GITHUB_OUTPUT"
76+
echo "commit=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
77+
working-directory: images
78+
79+
- name: Push changes
80+
if: ${{ steps.create-commit.outputs.has_changes == 'true' }}
81+
uses: DataDog/commit-headless@ad3668640012ec69186398f43d61923f6878bbbe # action/v3.2.0
82+
with:
83+
target: DataDog/images
84+
token: "${{ steps.octo-sts.outputs.token }}"
85+
branch: "${{ steps.define-branch.outputs.branch }}"
86+
head-sha: "${{ steps.images-head.outputs.sha }}"
87+
create-branch: true
88+
command: push
89+
commits: "${{ steps.create-commit.outputs.commit }}"
90+
working-directory: images
91+
92+
- name: Create pull request
93+
id: images-pr
94+
if: ${{ steps.create-commit.outputs.has_changes == 'true' }}
95+
env:
96+
GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
97+
PR_NUMBER: ${{ github.event.inputs.pr_number }}
98+
run: |
99+
PR_URL=$(gh pr create \
100+
--repo DataDog/images \
101+
--title "Update dd-trace-java-docker-build test images for PR #${PR_NUMBER}" \
102+
--base master \
103+
--head "${{ steps.define-branch.outputs.branch }}" \
104+
--body "Adds/updates mirror entries for \`${PR_NUMBER}_merge-*\` test images from DataDog/dd-trace-java-docker-build#${PR_NUMBER}. These images should be removed after testing.")
105+
echo "pr_url=${PR_URL}" >> "$GITHUB_OUTPUT"
106+
107+
- name: Comment on source PR with mirror cleanup reminder
108+
if: ${{ steps.update-mirror.outputs.mode == 'add' && steps.create-commit.outputs.has_changes == 'true' }}
109+
env:
110+
GH_TOKEN: ${{ github.token }}
111+
PR_NUMBER: ${{ github.event.inputs.pr_number }}
112+
IMAGES_PR_URL: ${{ steps.images-pr.outputs.pr_url }}
113+
run: |
114+
gh pr comment "${PR_NUMBER}" \
115+
--repo DataDog/dd-trace-java-docker-build \
116+
--body "Mirrored test images for \`${PR_NUMBER}_merge-*\` were added in ${IMAGES_PR_URL}. When you've finished validating the image, please remove the mirrored test images."

‎.github/workflows/delete-test-mirror-pr.yml‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
name: Delete test image mirror PR
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
pr_number:
7+
description: "PR number in dd-trace-java-docker-build (e.g. 123)"
8+
required: true
9+
10+
jobs:
11+
delete-test-mirror-pr:
12+
runs-on: ubuntu-latest
13+
permissions:
14+
id-token: write # Required for OIDC token federation
15+
contents: read
16+
steps:
17+
- uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
18+
id: octo-sts
19+
with:
20+
scope: DataDog/images
21+
policy: dd-trace-java-docker-build.update-mirror
22+
23+
- name: Checkout DataDog/dd-trace-java-docker-build
24+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
25+
with:
26+
path: dd-trace-java-docker-build
27+
28+
- name: Checkout DataDog/images
29+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
30+
with:
31+
repository: DataDog/images
32+
token: ${{ steps.octo-sts.outputs.token }}
33+
path: images
34+
35+
- name: Capture images HEAD SHA
36+
id: images-head
37+
run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
38+
working-directory: images
39+
40+
- name: Remove test mirror entries
41+
env:
42+
PR_NUMBER: ${{ github.event.inputs.pr_number }}
43+
run: bash "${GITHUB_WORKSPACE}/dd-trace-java-docker-build/scripts/delete-test-mirror-entries.sh"
44+
working-directory: images
45+
46+
- name: Define branch name
47+
id: define-branch
48+
run: echo "branch=ci/delete-dd-trace-java-docker-build-test-images-pr${{ github.event.inputs.pr_number }}" >> "$GITHUB_OUTPUT"
49+
50+
- name: Commit changes
51+
id: create-commit
52+
env:
53+
PR_NUMBER: ${{ github.event.inputs.pr_number }}
54+
run: |
55+
git config user.name "github-actions[bot]"
56+
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
57+
git add mirror.yaml mirror.lock.yaml
58+
if git diff --cached --quiet; then
59+
echo "::error::Expected mirror file deletions but found no changes."
60+
exit 1
61+
fi
62+
git commit -m "chore: Remove dd-trace-java-docker-build test images for PR #${PR_NUMBER}"
63+
echo "commit=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
64+
working-directory: images
65+
66+
- name: Push changes
67+
uses: DataDog/commit-headless@ad3668640012ec69186398f43d61923f6878bbbe # action/v3.2.0
68+
with:
69+
target: DataDog/images
70+
token: "${{ steps.octo-sts.outputs.token }}"
71+
branch: "${{ steps.define-branch.outputs.branch }}"
72+
head-sha: "${{ steps.images-head.outputs.sha }}"
73+
create-branch: true
74+
command: push
75+
commits: "${{ steps.create-commit.outputs.commit }}"
76+
working-directory: images
77+
78+
- name: Create pull request
79+
env:
80+
GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
81+
PR_NUMBER: ${{ github.event.inputs.pr_number }}
82+
run: |
83+
gh pr create \
84+
--repo DataDog/images \
85+
--title "Remove dd-trace-java-docker-build test images for PR #${PR_NUMBER}" \
86+
--base master \
87+
--head "${{ steps.define-branch.outputs.branch }}" \
88+
--body "Removes mirror.yaml and mirror.lock.yaml entries for \`${PR_NUMBER}_merge-*\` test images from DataDog/dd-trace-java-docker-build#${PR_NUMBER}."

‎.github/workflows/docker-tag.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: Tag new images version
1+
name: Tag new images version # triggers update-mirror-digests workflow
22
on:
33
schedule:
44
# Quarterly schedule, roughly aligned with JDK CPU
@@ -14,9 +14,9 @@ jobs:
1414
packages: write
1515
steps:
1616
- name: Checkout repository
17-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
17+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
1818
- name: Login to ghcr.io
19-
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # 3.4.0
19+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # 4.1.0
2020
with:
2121
registry: ghcr.io
2222
username: ${{ github.actor }}

‎.github/workflows/keep-alive.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717
contents: write # Required to push changes to the repository
1818
steps:
1919
- name: Checkout repository
20-
uses: actions/checkout@v4
20+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2121

2222
- name: Set up Git
2323
run: |

0 commit comments

Comments
 (0)