feat(supabase): add tracing integration #40918
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Project | |
| on: | |
| pull_request: | |
| push: | |
| branches: [master, mq-working-branch-master-*] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref == 'refs/heads/master' && github.run_id || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| actionlint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| sparse-checkout: .github | |
| - uses: ./.github/actions/node/latest | |
| - name: actionlint | |
| id: actionlint | |
| uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2.2.0 | |
| with: | |
| matcher: true | |
| fail-on-error: true | |
| shellcheck: true | |
| - name: actionlint Summary | |
| if: ${{ steps.actionlint.outputs.exit-code != 0 }} | |
| run: | | |
| echo "Used actionlint version ${{ steps.actionlint.outputs.version-semver }}" | |
| echo "Used actionlint release ${{ steps.actionlint.outputs.version-tag }}" | |
| echo "actionlint ended with ${{ steps.actionlint.outputs.exit-code }} exit code" | |
| echo "actionlint ended because '${{ steps.actionlint.outputs.exit-message }}'" | |
| echo "actionlint found ${{ steps.actionlint.outputs.total-errors }} errors" | |
| echo "actionlint checked ${{ steps.actionlint.outputs.total-files }} files" | |
| echo "actionlint cache used: ${{ steps.actionlint.outputs.cache-hit }}" | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: ./.github/actions/node/latest | |
| - uses: ./.github/actions/install | |
| - run: npm run lint | |
| lint-editorconfig: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - run: docker build -q -t ec .github/editorconfig-checker && docker run --rm --volume="$PWD":/check ec | |
| release-scripts: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: ./.github/actions/node/latest | |
| - uses: ./.github/actions/install | |
| - run: npm run test:release | |
| - run: npm run test:scripts | |
| generated-config-types: | |
| runs-on: ubuntu-latest | |
| name: Generated config types | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: ./.github/actions/node/latest | |
| - run: npm run verify:config:types | |
| generated-rewriter-targets: | |
| runs-on: ubuntu-latest | |
| name: Generated rewriter targets | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: ./.github/actions/node/latest | |
| - run: npm run verify:rewriter:targets | |
| workflow-job-names: | |
| runs-on: ubuntu-latest | |
| name: Workflow job names (unique) | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| sparse-checkout: | | |
| .github | |
| scripts/verify-workflow-job-names.js | |
| - uses: ./.github/actions/node/latest | |
| - run: npm install yaml | |
| - run: node scripts/verify-workflow-job-names.js | |
| # The package size is especially useful in constrained environments, so the | |
| # computation is done only on the package that would be installed there. | |
| # In order to do that, the current folder is wiped and replaced with what | |
| # would be installed is those environments before running the computation. | |
| package-size-report: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| id-token: write | |
| steps: | |
| - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4 | |
| id: octo-sts | |
| with: | |
| scope: DataDog/dd-trace-js | |
| policy: package-size-report | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: ./.github/actions/node/latest | |
| - run: FILENAME=$(npm pack --silent --pack-destination /tmp) && mv /tmp/"$FILENAME" /tmp/dd-trace.tgz | |
| - run: rm -rf ./* | |
| - run: tar -zxf /tmp/dd-trace.tgz -C "$(pwd)" --strip-components=1 | |
| - run: yarn --prod --ignore-optional | |
| - run: ls -lisa | |
| - name: Compute module size tree and report | |
| uses: qard/heaviest-objects-in-the-universe@1e02edbdda803a45537a808ede97866db47756d3 # Unreleased | |
| with: | |
| github-token: ${{ steps.octo-sts.outputs.token }} | |
| static-analysis: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| id-token: write | |
| name: Datadog Static Analyzer | |
| if: github.actor != 'dependabot[bot]' && github.event_name != 'pull_request' | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: ./.github/actions/dd-sts-api-key | |
| id: dd-sts-api-key | |
| - uses: ./.github/actions/dd-sts-app-key | |
| id: dd-sts-app-key | |
| - name: Check code meets quality and security standards | |
| id: datadog-static-analysis | |
| uses: DataDog/datadog-static-analyzer-github-action@8340f18875fcefca86844b5f947ce2431387e552 # v3.0.0 | |
| with: | |
| dd_api_key: ${{ steps.dd-sts-api-key.outputs.api_key }} | |
| dd_app_key: ${{ steps.dd-sts-app-key.outputs.app_key }} | |
| dd_site: datadoghq.com | |
| cpu_count: 2 | |
| typescript: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: ./.github/actions/node/latest | |
| - uses: ./.github/actions/install | |
| - run: npm run type:doc:test | |
| - run: npm run type:doc:build | |
| # TODO: Remove need for `npm show` before re-enabling to avoid rate limit errors. | |
| # verify-yaml: | |
| # runs-on: ubuntu-latest | |
| # steps: | |
| # - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| # - uses: ./.github/actions/node/latest | |
| # - uses: ./.github/actions/install | |
| # - run: node scripts/verify-ci-config.js | |
| yarn-dedupe: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| outputs: | |
| has_changes: ${{ steps.diff.outputs.has_changes }} | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Setup Node.js | |
| uses: ./.github/actions/node/latest | |
| - name: Install dependencies | |
| uses: ./.github/actions/install | |
| - name: Run npm run dependencies:dedupe | |
| run: npm run dependencies:dedupe | |
| - name: Prepare yarn.lock update (same-repo PRs only; restricted paths) | |
| id: diff | |
| run: | | |
| set -euo pipefail | |
| if git diff --quiet; then | |
| echo "has_changes=false" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| fail_message() { cat <<'EOF' | |
| ❌ The yarn.lock file needs deduplication! | |
| The dedupe command has modified your yarn.lock file. | |
| This means there were duplicate dependencies that could be optimized. | |
| To fix this issue: | |
| 1. Run 'npm run dependencies:dedupe' locally | |
| 2. Commit the updated yarn.lock file | |
| 3. Push your changes | |
| This helps keep the dependency tree clean. | |
| EOF | |
| } | |
| changes="$(git diff --name-only)" | |
| if [ "$changes" != "yarn.lock" ]; then | |
| echo "Unexpected changed paths during yarn dedupe:" | |
| echo "$changes" | |
| exit 1 | |
| fi | |
| # Never push updates to fork PR branches, and don't auto-fix outside PRs. | |
| if [ "${{ github.event_name }}" != "pull_request" ]; then | |
| fail_message | |
| exit 1 | |
| fi | |
| if [ "${{ github.event.pull_request.head.repo.full_name }}" != "${{ github.repository }}" ]; then | |
| fail_message | |
| exit 1 | |
| fi | |
| cp yarn.lock "${RUNNER_TEMP}/yarn.lock" | |
| echo "has_changes=true" >> "$GITHUB_OUTPUT" | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| if: steps.diff.outputs.has_changes == 'true' | |
| with: | |
| name: yarn-lock | |
| path: ${{ runner.temp }}/yarn.lock | |
| if-no-files-found: error | |
| yarn-dedupe-push: | |
| # If this job pushes a commit, GitHub will re-trigger the workflow on `pull_request:synchronize` | |
| # with `github.actor == 'dd-octo-sts[bot]'`. Never attempt to mint another token / push again on | |
| # that follow-up run. | |
| if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && needs.yarn-dedupe.outputs.has_changes == 'true' && github.actor != 'dd-octo-sts[bot]' | |
| runs-on: ubuntu-latest | |
| needs: yarn-dedupe | |
| # Security: this job has an STS-minted token, but never runs installs/builds. | |
| # It only updates yarn.lock via the GitHub API. | |
| permissions: | |
| id-token: write | |
| steps: | |
| - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4 | |
| id: octo-sts | |
| with: | |
| scope: DataDog/dd-trace-js | |
| policy: yarn-dedupe | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: yarn-lock | |
| path: ${{ runner.temp }}/yarn-lock-artifact | |
| - name: Update yarn.lock via GitHub API (server-created verified commit) | |
| env: | |
| GH_TOKEN: ${{ steps.octo-sts.outputs.token }} | |
| OWNER: ${{ github.repository_owner }} | |
| REPO: ${{ github.event.repository.name }} | |
| BRANCH: ${{ github.event.pull_request.head.ref }} | |
| run: | | |
| set -euo pipefail | |
| test -f "${{ runner.temp }}/yarn-lock-artifact/yarn.lock" | |
| sha="$(gh api -q '.sha' "repos/${OWNER}/${REPO}/contents/yarn.lock?ref=${BRANCH}")" | |
| base64 -w 0 "${{ runner.temp }}/yarn-lock-artifact/yarn.lock" > "${{ runner.temp }}/yarn-lock-b64.txt" | |
| jq -n \ | |
| --arg message "chore: deduplicate yarn.lock" \ | |
| --rawfile content "${{ runner.temp }}/yarn-lock-b64.txt" \ | |
| --arg sha "$sha" \ | |
| --arg branch "$BRANCH" \ | |
| '{message: $message, content: $content, sha: $sha, branch: $branch}' \ | |
| | gh api -X PUT "repos/${OWNER}/${REPO}/contents/yarn.lock" --input - |