diff --git a/.agents/skills/apm-integrations/SKILL.md b/.agents/skills/apm-integrations/SKILL.md index 59399cffeb0..da126bfd222 100644 --- a/.agents/skills/apm-integrations/SKILL.md +++ b/.agents/skills/apm-integrations/SKILL.md @@ -170,7 +170,7 @@ Follow these steps when creating or modifying an integration: 6. **Run tests** — Validate with: ```bash - # Run plugin tests (preferred CI command — handles yarn services automatically) + # Run plugin tests (preferred CI command — handles `npm run services` automatically) PLUGINS="" npm run test:plugins:ci # If the plugin needs external services (databases, message brokers, etc.), diff --git a/.agents/skills/apm-integrations/references/new-integration-guide.md b/.agents/skills/apm-integrations/references/new-integration-guide.md index 30fcefb8e34..903602bfaa9 100644 --- a/.agents/skills/apm-integrations/references/new-integration-guide.md +++ b/.agents/skills/apm-integrations/references/new-integration-guide.md @@ -285,7 +285,7 @@ See [Testing](testing.md) for complete templates. **ESM integration tests** — `packages/datadog-plugin-/test/integration-test/` ```bash -# CI command (preferred) — handles dependency installation via yarn services +# CI command (preferred) — handles dependency installation via `npm run services` PLUGINS="" npm run test:plugins:ci ``` diff --git a/.agents/skills/apm-integrations/references/orchestrion.md b/.agents/skills/apm-integrations/references/orchestrion.md index fb13039fb71..2b49466fd2c 100644 --- a/.agents/skills/apm-integrations/references/orchestrion.md +++ b/.agents/skills/apm-integrations/references/orchestrion.md @@ -8,7 +8,7 @@ source hooks, ESM support, and avoiding runtime monkey-patching. Engine: `@apm-js-collab/code-transformer` (mirror of [nodejs/orchestrion-js](https://github.com/nodejs/orchestrion-js)), vendored at `vendor/dist/@apm-js-collab/code-transformer/`. Installed version is in -`vendor/package-lock.json`. +`vendor/bun.lock`. > **Verify before relying on a field/transform.** The engine is actively > developed and the config surface changes between releases. This doc tracks diff --git a/.agents/skills/apm-integrations/references/testing.md b/.agents/skills/apm-integrations/references/testing.md index d500d0d52a0..2dba676de92 100644 --- a/.agents/skills/apm-integrations/references/testing.md +++ b/.agents/skills/apm-integrations/references/testing.md @@ -191,13 +191,13 @@ describe('esm', () => { ## Running Tests -dd-trace uses a non-standard dependency installation for plugin tests. Libraries under test are installed per-version via `yarn services`, not through the normal `node_modules`. The `:ci` script handles this automatically. +dd-trace uses a non-standard dependency installation for plugin tests. Libraries under test are installed per-version via `npm run services` (which drives `scripts/install_plugin_modules.js` and a bun isolated install per sandbox), not through the normal `node_modules`. The `:ci` script handles this automatically. ```bash -# CI command (preferred) — runs yarn services for dependency installation, then tests +# CI command (preferred) — runs `npm run services` for dependency installation, then tests PLUGINS="" npm run test:plugins:ci -# Unit tests only (assumes yarn services already ran) +# Unit tests only (assumes `npm run services` already ran) PLUGINS="" npm run test:plugins # With external services (e.g., databases, message brokers) diff --git a/.agents/skills/llmobs-testing/references/vcr-cassettes.md b/.agents/skills/llmobs-testing/references/vcr-cassettes.md index 8014e3c6502..08ae26c9f94 100644 --- a/.agents/skills/llmobs-testing/references/vcr-cassettes.md +++ b/.agents/skills/llmobs-testing/references/vcr-cassettes.md @@ -79,7 +79,7 @@ npm run test:llmobs:sdk # everything except the plugin spec `packages/dd-trace/test/llmobs/plugins/@(${PLUGINS})/*.spec.js`. `Cannot find module '…/versions/@'` is a missing version fixture, not a broken spec: -`PLUGINS= yarn services` installs it. The error names the npm package while `PLUGINS` takes +`PLUGINS= npm run services` installs it. The error names the npm package while `PLUGINS` takes the integration key, which is the file name under `packages/datadog-instrumentations/src/` — so `@anthropic-ai/sdk` is `anthropic` and `@google/genai` is `google-genai`. The fixtures live in a gitignored `versions/` directory at the repo root, so a fresh worktree has none of them. diff --git a/.cursor/worktrees.json b/.cursor/worktrees.json index d9cf01692f1..d60701606b5 100644 --- a/.cursor/worktrees.json +++ b/.cursor/worktrees.json @@ -1,5 +1,5 @@ { "scripts": { - "postCreate": "yarn install" + "postCreate": "bun install" } } diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 6fdbe0dd5e9..dfbd491bdd2 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -4,6 +4,7 @@ /.agents/ @DataDog/lang-platform-js /.claude/ @DataDog/lang-platform-js /.github/actions/ @DataDog/lang-platform-js +/.github/audit-allowlist.json @DataDog/lang-platform-js /.github/ISSUE_TEMPLATE/ @DataDog/lang-platform-js /.gitlab/ @DataDog/lang-platform-js /.husky/ @DataDog/lang-platform-js @@ -110,6 +111,7 @@ /packages/dd-trace/src/propagation-hash/ @DataDog/apm-idm-js /packages/dd-trace/test/plugins/ @DataDog/apm-idm-js /packages/dd-trace/test/process-tags.spec.js @DataDog/apm-idm-js +/versions/bunfig.toml @DataDog/lang-platform-js /packages/dd-trace/src/service-naming/ @DataDog/apm-idm-js /packages/dd-trace/test/service-naming/ @DataDog/apm-idm-js /packages/dd-trace/test/payload_tagging.spec.js @DataDog/apm-idm-js @@ -327,6 +329,7 @@ # CI /.github/actions/upload-coverage-artifact/ @DataDog/ci-app-libraries /.github/actions/upload-junit-artifacts/ @DataDog/ci-app-libraries +/.github/all-green/ @DataDog/lang-platform-js /.github/editorconfig-checker/ @Datadog/lang-platform-js /.github/playwright/ @DataDog/ci-app-libraries /.github/selenium/ @DataDog/ci-app-libraries @@ -382,6 +385,9 @@ /.github/pull_request_template.md @DataDog/lang-platform-js /.github/vendored-dependencies.csv @DataDog/lang-platform-js +/docs/bun.lock @DataDog/lang-platform-js +/vendor/bun.lock @DataDog/lang-platform-js + /benchmark/* @DataDog/lang-platform-js /benchmark/openfeature.js @DataDog/lang-platform-js @DataDog/feature-flagging-and-experimentation-sdk /benchmark/sirun/* @DataDog/lang-platform-js diff --git a/.github/actions/datadog-ci/.yarnrc b/.github/actions/datadog-ci/.yarnrc deleted file mode 100644 index 142dad81709..00000000000 --- a/.github/actions/datadog-ci/.yarnrc +++ /dev/null @@ -1 +0,0 @@ -registry "https://registry.npmjs.org" diff --git a/.github/actions/datadog-ci/action.yml b/.github/actions/datadog-ci/action.yml index f5a5b01c117..0fc43103bf3 100644 --- a/.github/actions/datadog-ci/action.yml +++ b/.github/actions/datadog-ci/action.yml @@ -8,6 +8,8 @@ runs: with: node-version: '20' + # The repository's Node setup installs Bun through npm, so this also works in + # container jobs without `unzip`. - uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0 with: max_attempts: 3 @@ -15,7 +17,7 @@ runs: retry_wait_seconds: 30 command: | cd ${{ github.workspace }}/.github/actions/datadog-ci - yarn install --frozen-lockfile + bun --config="${{ github.workspace }}/bunfig.toml" install --frozen-lockfile --ignore-scripts - shell: bash run: echo "${{ github.workspace }}/.github/actions/datadog-ci/node_modules/.bin" >> $GITHUB_PATH diff --git a/.github/actions/datadog-ci/bun.lock b/.github/actions/datadog-ci/bun.lock new file mode 100644 index 00000000000..818dffb4c02 --- /dev/null +++ b/.github/actions/datadog-ci/bun.lock @@ -0,0 +1,15 @@ +{ + "lockfileVersion": 1, + "configVersion": 0, + "workspaces": { + "": { + "name": "datadog-ci", + "dependencies": { + "@datadog/datadog-ci": "5.17.0", + }, + }, + }, + "packages": { + "@datadog/datadog-ci": ["@datadog/datadog-ci@5.17.0", "", { "bin": { "datadog-ci": "dist/bundle.js" } }, "sha512-Orwju9h/kLQnuNr7VoHW/JABbKsK8/Lhh8zDacjR1CqwJBmgwejgmcL3ut9/Vbi6hC5KYlgXybeeMpsdJEWvQQ=="], + } +} diff --git a/.github/actions/datadog-ci/yarn.lock b/.github/actions/datadog-ci/yarn.lock deleted file mode 100644 index ded93d71b02..00000000000 --- a/.github/actions/datadog-ci/yarn.lock +++ /dev/null @@ -1,8 +0,0 @@ -# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY. -# yarn lockfile v1 - - -"@datadog/datadog-ci@5.17.0": - version "5.17.0" - resolved "https://registry.npmjs.org/@datadog/datadog-ci/-/datadog-ci-5.17.0.tgz#88f68eff837d9988564592e0c52a859cd9de7836" - integrity sha512-Orwju9h/kLQnuNr7VoHW/JABbKsK8/Lhh8zDacjR1CqwJBmgwejgmcL3ut9/Vbi6hC5KYlgXybeeMpsdJEWvQQ== diff --git a/.github/actions/install/action.yml b/.github/actions/install/action.yml index b8df400fa2f..449a1ab2eb0 100644 --- a/.github/actions/install/action.yml +++ b/.github/actions/install/action.yml @@ -5,7 +5,11 @@ runs: steps: - uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0 with: - max_attempts: 3 + max_attempts: 2 timeout_minutes: 5 retry_wait_seconds: 30 - command: bun install --linker=hoisted --trust --network-concurrency 8 + shell: bash + # A retry against Bun's partial install state can skip lifecycle scripts. Start every attempt clean. + command: >- + node -e "require('node:fs').rmSync('node_modules', { recursive: true, force: true })" && + bun install --frozen-lockfile --linker=hoisted --network-concurrency 8 diff --git a/.github/actions/node/setup/action.yml b/.github/actions/node/setup/action.yml index 490dd98173f..fb02d4a1216 100644 --- a/.github/actions/node/setup/action.yml +++ b/.github/actions/node/setup/action.yml @@ -81,7 +81,12 @@ runs: run: | MAJOR=$(node -e "process.stdout.write(String(parseInt(process.versions.node)))") echo "supported=$([ "$MAJOR" -ge 12 ] && echo true || echo false)" >> "$GITHUB_OUTPUT" + # `scripts/bun.js` bootstraps the pinned version locally whenever the global one differs, so a + # hard-coded version here would not run the wrong Bun — it would just make every job pay for that + # bootstrap once Dependabot bumps the devDependency. Read the pin instead of restating it. - name: Install Bun if: steps.bun-check.outputs.supported == 'true' shell: bash - run: npm install -g bun@1.3.1 --prefer-offline --no-audit --no-fund + run: | + VERSION=$(node -p "require('./package.json').devDependencies.bun") + npm install -g "bun@$VERSION" --prefer-offline --no-audit --no-fund diff --git a/.github/all-green/bun.lock b/.github/all-green/bun.lock new file mode 100644 index 00000000000..7b64581eb83 --- /dev/null +++ b/.github/all-green/bun.lock @@ -0,0 +1,99 @@ +{ + "lockfileVersion": 1, + "configVersion": 0, + "workspaces": { + "": { + "name": "dd-trace-js-all-green", + "dependencies": { + "@actions/core": "^3.0.1", + "@actions/github": "^9.1.1", + "octokit": "^5.0.3", + }, + }, + }, + "packages": { + "@actions/core": ["@actions/core@3.0.1", "", { "dependencies": { "@actions/exec": "^3.0.0", "@actions/http-client": "^4.0.0" } }, "sha512-a6d/Nwahm9fliVGRhdhofo40HjHQasUPusmc7vBfyky+7Z+P2A1J68zyFVaNcEclc/Se+eO595oAr5nwEIoIUA=="], + + "@actions/exec": ["@actions/exec@3.0.0", "", { "dependencies": { "@actions/io": "^3.0.2" } }, "sha512-6xH/puSoNBXb72VPlZVm7vQ+svQpFyA96qdDBvhB8eNZOE8LtPf9L4oAsfzK/crCL8YZ+19fKYVnM63Sl+Xzlw=="], + + "@actions/github": ["@actions/github@9.1.1", "", { "dependencies": { "@actions/http-client": "^3.0.2", "@octokit/core": "^7.0.6", "@octokit/plugin-paginate-rest": "^14.0.0", "@octokit/plugin-rest-endpoint-methods": "^17.0.0", "@octokit/request": "^10.0.7", "@octokit/request-error": "^7.1.0", "undici": "^6.23.0" } }, "sha512-tL5JbYOBZHc0ngEnCsaDcryUizIUIlQyIMwy1Wkx93H5HzbBJ7TbiPx2PnFjBwZW0Vh05JmfFZhecE6gglYegA=="], + + "@actions/http-client": ["@actions/http-client@4.0.1", "", { "dependencies": { "tunnel": "^0.0.6", "undici": "^6.23.0" } }, "sha512-+Nvd1ImaOZBSoPbsUtEhv+1z99H12xzncCkz0a3RuehINE81FZSe2QTj3uvAPTcJX/SCzUQHQ0D1GrPMbrPitg=="], + + "@actions/io": ["@actions/io@3.0.2", "", {}, "sha512-nRBchcMM+QK1pdjO7/idu86rbJI5YHUKCvKs0KxnSYbVe3F51UfGxuZX4Qy/fWlp6l7gWFwIkrOzN+oUK03kfw=="], + + "@octokit/app": ["@octokit/app@16.1.2", "", { "dependencies": { "@octokit/auth-app": "^8.1.2", "@octokit/auth-unauthenticated": "^7.0.3", "@octokit/core": "^7.0.6", "@octokit/oauth-app": "^8.0.3", "@octokit/plugin-paginate-rest": "^14.0.0", "@octokit/types": "^16.0.0", "@octokit/webhooks": "^14.0.0" } }, "sha512-8j7sEpUYVj18dxvh0KWj6W/l6uAiVRBl1JBDVRqH1VHKAO/G5eRVl4yEoYACjakWers1DjUkcCHyJNQK47JqyQ=="], + + "@octokit/auth-app": ["@octokit/auth-app@8.2.0", "", { "dependencies": { "@octokit/auth-oauth-app": "^9.0.3", "@octokit/auth-oauth-user": "^6.0.2", "@octokit/request": "^10.0.6", "@octokit/request-error": "^7.0.2", "@octokit/types": "^16.0.0", "toad-cache": "^3.7.0", "universal-github-app-jwt": "^2.2.0", "universal-user-agent": "^7.0.0" } }, "sha512-vVjdtQQwomrZ4V46B9LaCsxsySxGoHsyw6IYBov/TqJVROrlYdyNgw5q6tQbB7KZt53v1l1W53RiqTvpzL907g=="], + + "@octokit/auth-oauth-app": ["@octokit/auth-oauth-app@9.0.3", "", { "dependencies": { "@octokit/auth-oauth-device": "^8.0.3", "@octokit/auth-oauth-user": "^6.0.2", "@octokit/request": "^10.0.6", "@octokit/types": "^16.0.0", "universal-user-agent": "^7.0.0" } }, "sha512-+yoFQquaF8OxJSxTb7rnytBIC2ZLbLqA/yb71I4ZXT9+Slw4TziV9j/kyGhUFRRTF2+7WlnIWsePZCWHs+OGjg=="], + + "@octokit/auth-oauth-device": ["@octokit/auth-oauth-device@8.0.3", "", { "dependencies": { "@octokit/oauth-methods": "^6.0.2", "@octokit/request": "^10.0.6", "@octokit/types": "^16.0.0", "universal-user-agent": "^7.0.0" } }, "sha512-zh2W0mKKMh/VWZhSqlaCzY7qFyrgd9oTWmTmHaXnHNeQRCZr/CXy2jCgHo4e4dJVTiuxP5dLa0YM5p5QVhJHbw=="], + + "@octokit/auth-oauth-user": ["@octokit/auth-oauth-user@6.0.2", "", { "dependencies": { "@octokit/auth-oauth-device": "^8.0.3", "@octokit/oauth-methods": "^6.0.2", "@octokit/request": "^10.0.6", "@octokit/types": "^16.0.0", "universal-user-agent": "^7.0.0" } }, "sha512-qLoPPc6E6GJoz3XeDG/pnDhJpTkODTGG4kY0/Py154i/I003O9NazkrwJwRuzgCalhzyIeWQ+6MDvkUmKXjg/A=="], + + "@octokit/auth-token": ["@octokit/auth-token@6.0.0", "", {}, "sha512-P4YJBPdPSpWTQ1NU4XYdvHvXJJDxM6YwpS0FZHRgP7YFkdVxsWcpWGy/NVqlAA7PcPCnMacXlRm1y2PFZRWL/w=="], + + "@octokit/auth-unauthenticated": ["@octokit/auth-unauthenticated@7.0.3", "", { "dependencies": { "@octokit/request-error": "^7.0.2", "@octokit/types": "^16.0.0" } }, "sha512-8Jb1mtUdmBHL7lGmop9mU9ArMRUTRhg8vp0T1VtZ4yd9vEm3zcLwmjQkhNEduKawOOORie61xhtYIhTDN+ZQ3g=="], + + "@octokit/core": ["@octokit/core@7.0.6", "", { "dependencies": { "@octokit/auth-token": "^6.0.0", "@octokit/graphql": "^9.0.3", "@octokit/request": "^10.0.6", "@octokit/request-error": "^7.0.2", "@octokit/types": "^16.0.0", "before-after-hook": "^4.0.0", "universal-user-agent": "^7.0.0" } }, "sha512-DhGl4xMVFGVIyMwswXeyzdL4uXD5OGILGX5N8Y+f6W7LhC1Ze2poSNrkF/fedpVDHEEZ+PHFW0vL14I+mm8K3Q=="], + + "@octokit/endpoint": ["@octokit/endpoint@11.0.3", "", { "dependencies": { "@octokit/types": "^16.0.0", "universal-user-agent": "^7.0.2" } }, "sha512-FWFlNxghg4HrXkD3ifYbS/IdL/mDHjh9QcsNyhQjN8dplUoZbejsdpmuqdA76nxj2xoWPs7p8uX2SNr9rYu0Ag=="], + + "@octokit/graphql": ["@octokit/graphql@9.0.3", "", { "dependencies": { "@octokit/request": "^10.0.6", "@octokit/types": "^16.0.0", "universal-user-agent": "^7.0.0" } }, "sha512-grAEuupr/C1rALFnXTv6ZQhFuL1D8G5y8CN04RgrO4FIPMrtm+mcZzFG7dcBm+nq+1ppNixu+Jd78aeJOYxlGA=="], + + "@octokit/oauth-app": ["@octokit/oauth-app@8.0.3", "", { "dependencies": { "@octokit/auth-oauth-app": "^9.0.2", "@octokit/auth-oauth-user": "^6.0.1", "@octokit/auth-unauthenticated": "^7.0.2", "@octokit/core": "^7.0.5", "@octokit/oauth-authorization-url": "^8.0.0", "@octokit/oauth-methods": "^6.0.1", "@types/aws-lambda": "^8.10.83", "universal-user-agent": "^7.0.0" } }, "sha512-jnAjvTsPepyUaMu9e69hYBuozEPgYqP4Z3UnpmvoIzHDpf8EXDGvTY1l1jK0RsZ194oRd+k6Hm13oRU8EoDFwg=="], + + "@octokit/oauth-authorization-url": ["@octokit/oauth-authorization-url@8.0.0", "", {}, "sha512-7QoLPRh/ssEA/HuHBHdVdSgF8xNLz/Bc5m9fZkArJE5bb6NmVkDm3anKxXPmN1zh6b5WKZPRr3697xKT/yM3qQ=="], + + "@octokit/oauth-methods": ["@octokit/oauth-methods@6.0.2", "", { "dependencies": { "@octokit/oauth-authorization-url": "^8.0.0", "@octokit/request": "^10.0.6", "@octokit/request-error": "^7.0.2", "@octokit/types": "^16.0.0" } }, "sha512-HiNOO3MqLxlt5Da5bZbLV8Zarnphi4y9XehrbaFMkcoJ+FL7sMxH/UlUsCVxpddVu4qvNDrBdaTVE2o4ITK8ng=="], + + "@octokit/openapi-types": ["@octokit/openapi-types@27.0.0", "", {}, "sha512-whrdktVs1h6gtR+09+QsNk2+FO+49j6ga1c55YZudfEG+oKJVvJLQi3zkOm5JjiUXAagWK2tI2kTGKJ2Ys7MGA=="], + + "@octokit/openapi-webhooks-types": ["@octokit/openapi-webhooks-types@12.1.0", "", {}, "sha512-WiuzhOsiOvb7W3Pvmhf8d2C6qaLHXrWiLBP4nJ/4kydu+wpagV5Fkz9RfQwV2afYzv3PB+3xYgp4mAdNGjDprA=="], + + "@octokit/plugin-paginate-graphql": ["@octokit/plugin-paginate-graphql@6.0.0", "", { "peerDependencies": { "@octokit/core": ">=6" } }, "sha512-crfpnIoFiBtRkvPqOyLOsw12XsveYuY2ieP6uYDosoUegBJpSVxGwut9sxUgFFcll3VTOTqpUf8yGd8x1OmAkQ=="], + + "@octokit/plugin-paginate-rest": ["@octokit/plugin-paginate-rest@14.0.0", "", { "dependencies": { "@octokit/types": "^16.0.0" }, "peerDependencies": { "@octokit/core": ">=6" } }, "sha512-fNVRE7ufJiAA3XUrha2omTA39M6IXIc6GIZLvlbsm8QOQCYvpq/LkMNGyFlB1d8hTDzsAXa3OKtybdMAYsV/fw=="], + + "@octokit/plugin-rest-endpoint-methods": ["@octokit/plugin-rest-endpoint-methods@17.0.0", "", { "dependencies": { "@octokit/types": "^16.0.0" }, "peerDependencies": { "@octokit/core": ">=6" } }, "sha512-B5yCyIlOJFPqUUeiD0cnBJwWJO8lkJs5d8+ze9QDP6SvfiXSz1BF+91+0MeI1d2yxgOhU/O+CvtiZ9jSkHhFAw=="], + + "@octokit/plugin-retry": ["@octokit/plugin-retry@8.1.0", "", { "dependencies": { "@octokit/request-error": "^7.0.2", "@octokit/types": "^16.0.0", "bottleneck": "^2.15.3" }, "peerDependencies": { "@octokit/core": ">=7" } }, "sha512-O1FZgXeiGb2sowEr/hYTr6YunGdSAFWnr2fyW39Ah85H8O33ELASQxcvOFF5LE6Tjekcyu2ms4qAzJVhSaJxTw=="], + + "@octokit/plugin-throttling": ["@octokit/plugin-throttling@11.0.3", "", { "dependencies": { "@octokit/types": "^16.0.0", "bottleneck": "^2.15.3" }, "peerDependencies": { "@octokit/core": "^7.0.0" } }, "sha512-34eE0RkFCKycLl2D2kq7W+LovheM/ex3AwZCYN8udpi6bxsyjZidb2McXs69hZhLmJlDqTSP8cH+jSRpiaijBg=="], + + "@octokit/request": ["@octokit/request@10.0.11", "", { "dependencies": { "@octokit/endpoint": "^11.0.3", "@octokit/request-error": "^7.0.2", "@octokit/types": "^16.0.0", "content-type": "^2.0.0", "json-with-bigint": "^3.5.3", "universal-user-agent": "^7.0.2" } }, "sha512-+s7HUxjfFqOMS9VlIwDffq0MikjSAK0gSpG73W+meAvVAvX4MBrHYTK5Bj3Uot55qFT4gzUtfzE4mGWY4Br8/Q=="], + + "@octokit/request-error": ["@octokit/request-error@7.1.0", "", { "dependencies": { "@octokit/types": "^16.0.0" } }, "sha512-KMQIfq5sOPpkQYajXHwnhjCC0slzCNScLHs9JafXc4RAJI+9f+jNDlBNaIMTvazOPLgb4BnlhGJOTbnN0wIjPw=="], + + "@octokit/types": ["@octokit/types@16.0.0", "", { "dependencies": { "@octokit/openapi-types": "^27.0.0" } }, "sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg=="], + + "@octokit/webhooks": ["@octokit/webhooks@14.2.0", "", { "dependencies": { "@octokit/openapi-webhooks-types": "12.1.0", "@octokit/request-error": "^7.0.0", "@octokit/webhooks-methods": "^6.0.0" } }, "sha512-da6KbdNCV5sr1/txD896V+6W0iamFWrvVl8cHkBSPT+YlvmT3DwXa4jxZnQc+gnuTEqSWbBeoSZYTayXH9wXcw=="], + + "@octokit/webhooks-methods": ["@octokit/webhooks-methods@6.0.0", "", {}, "sha512-MFlzzoDJVw/GcbfzVC1RLR36QqkTLUf79vLVO3D+xn7r0QgxnFoLZgtrzxiQErAjFUOdH6fas2KeQJ1yr/qaXQ=="], + + "@types/aws-lambda": ["@types/aws-lambda@8.10.162", "", {}, "sha512-Fn658grtLOci1oxi1391vvDWJRKNGWRSqfxRkmN/Iy3c0tQH1USMKEXcPYHLvope+ZgTFocx9FRQJx1muBL6qw=="], + + "before-after-hook": ["before-after-hook@4.0.0", "", {}, "sha512-q6tR3RPqIB1pMiTRMFcZwuG5T8vwp+vUvEG0vuI6B+Rikh5BfPp2fQ82c925FOs+b0lcFQ8CFrL+KbilfZFhOQ=="], + + "bottleneck": ["bottleneck@2.19.5", "", {}, "sha512-VHiNCbI1lKdl44tGrhNfU3lup0Tj/ZBMJB5/2ZbNXRCPuRCO7ed2mgcK4r17y+KB2EfuYuRaVlwNbAeaWGSpbw=="], + + "content-type": ["content-type@2.0.0", "", {}, "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ=="], + + "json-with-bigint": ["json-with-bigint@3.5.10", "", {}, "sha512-Vcx+JVNEBts/xfcoCS69sKrOhOk/3TVlvlT+XzUOefVKnnrbYSCKpDCm10pohsJFtsJVYnwa/cXRZ4eElzaM6w=="], + + "octokit": ["octokit@5.0.5", "", { "dependencies": { "@octokit/app": "^16.1.2", "@octokit/core": "^7.0.6", "@octokit/oauth-app": "^8.0.3", "@octokit/plugin-paginate-graphql": "^6.0.0", "@octokit/plugin-paginate-rest": "^14.0.0", "@octokit/plugin-rest-endpoint-methods": "^17.0.0", "@octokit/plugin-retry": "^8.0.3", "@octokit/plugin-throttling": "^11.0.3", "@octokit/request-error": "^7.0.2", "@octokit/types": "^16.0.0", "@octokit/webhooks": "^14.0.0" } }, "sha512-4+/OFSqOjoyULo7eN7EA97DE0Xydj/PW5aIckxqQIoFjFwqXKuFCvXUJObyJfBF9Khu4RL/jlDRI9FPaMGfPnw=="], + + "toad-cache": ["toad-cache@3.7.4", "", {}, "sha512-m1TdR/rvT7kgGJZhspNtXdsdYk0fddFpJJFlG5s+UkPFo6lkLoZ3YLOaovPYjq1R75NP5JfeTlSHaOsE09peCg=="], + + "tunnel": ["tunnel@0.0.6", "", {}, "sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg=="], + + "undici": ["undici@6.27.0", "", {}, "sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg=="], + + "universal-github-app-jwt": ["universal-github-app-jwt@2.2.2", "", {}, "sha512-dcmbeSrOdTnsjGjUfAlqNDJrhxXizjAz94ija9Qw8YkZ1uu0d+GoZzyH+Jb9tIIqvGsadUfwg+22k5aDqqwzbw=="], + + "universal-user-agent": ["universal-user-agent@7.0.3", "", {}, "sha512-TmnEAEAsBJVZM/AADELsK76llnwcf9vMKuPz8JflO1frO8Lchitr0fNaN9d+Ap0BjKtqWqd/J17qeDnXh8CL2A=="], + + "@actions/github/@actions/http-client": ["@actions/http-client@3.0.2", "", { "dependencies": { "tunnel": "^0.0.6", "undici": "^6.23.0" } }, "sha512-JP38FYYpyqvUsz+Igqlc/JG6YO9PaKuvqjM3iGvaLqFnJ7TFmcLyy2IDrY0bI0qCQug8E9K+elv5ZNfw62ZJzA=="], + } +} diff --git a/.github/all-green/package.json b/.github/all-green/package.json new file mode 100644 index 00000000000..2919b0da21c --- /dev/null +++ b/.github/all-green/package.json @@ -0,0 +1,9 @@ +{ + "name": "dd-trace-js-all-green", + "private": true, + "dependencies": { + "@actions/core": "^3.0.1", + "@actions/github": "^9.1.1", + "octokit": "^5.0.3" + } +} diff --git a/.github/audit-allowlist.json b/.github/audit-allowlist.json new file mode 100644 index 00000000000..e96c4401688 --- /dev/null +++ b/.github/audit-allowlist.json @@ -0,0 +1,21 @@ +{ + ".": { + "allow": [ + { + "id": "GHSA-5c6j-r48x-rmvq", + "package": "serialize-javascript", + "reason": "Patched in 7.0.3, but mocha declares serialize-javascript@^6.0.2. The vulnerable path is limited to mocha's dev-only parallel test metadata until mocha widens its range." + } + ] + }, + "vendor": { + "level": "moderate", + "allow": [ + { + "id": "GHSA-8988-4f7v-96qf", + "package": "@opentelemetry/core", + "reason": "Patched in 2.8.0, outside the OpenTelemetry 1.x compatibility range bundled for customers. Clearing it requires a deliberate vendored OpenTelemetry major upgrade." + } + ] + } +} diff --git a/.github/chainguard/yarn-dedupe.sts.yaml b/.github/chainguard/yarn-dedupe.sts.yaml deleted file mode 100644 index 69712d20929..00000000000 --- a/.github/chainguard/yarn-dedupe.sts.yaml +++ /dev/null @@ -1,12 +0,0 @@ -issuer: https://token.actions.githubusercontent.com - -subject: repo:DataDog/dd-trace-js:pull_request - -claim_pattern: - event_name: pull_request - ref: refs/pull/[0-9]+/merge - job_workflow_ref: DataDog/dd-trace-js/\.github/workflows/project.yml@refs/pull/[0-9]+/merge - -permissions: - contents: write - diff --git a/.github/dependabot.yml b/.github/dependabot.yml index e9383c430d6..59383563d57 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -66,12 +66,12 @@ updates: # Dependabot bumps deps in package.json; the electron variant is always regenerated # fresh on the next npm install / npm pack. - # Regular npm packages that fall into our supported ranges besides OTEL - - package-ecosystem: "npm" + # Root, docs, and All Green packages installed by Bun + - package-ecosystem: "bun" directories: - "/" - "/docs" - - "/.github/actions/datadog-ci" + - "/.github/all-green" schedule: interval: "weekly" open-pull-requests-limit: 100 @@ -139,8 +139,30 @@ updates: patterns: - "*" + # datadog-ci composite action + - package-ecosystem: "bun" + directory: "/.github/actions/datadog-ci" + schedule: + interval: "weekly" + cooldown: + default-days: 5 + exclude: + - "@datadog/*" + versioning-strategy: "increase" + labels: + - dependabot + - dependencies + - javascript + - semver-patch + groups: + security-production: + applies-to: security-updates + dependency-type: "production" + patterns: + - "*" + # Vendored dependencies - - package-ecosystem: "npm" + - package-ecosystem: "bun" directories: - "/vendor" schedule: diff --git a/.github/playwright/Dockerfile b/.github/playwright/Dockerfile index dedc2a942b7..664ee65e525 100644 --- a/.github/playwright/Dockerfile +++ b/.github/playwright/Dockerfile @@ -1,4 +1,4 @@ -FROM oven/bun:1.3.1@sha256:c1526bc496336087e5bdfaf519746c12ac4d5ebdda6d8a99d27ebd5d9ad7304c AS bun +FROM oven/bun:1.3.14@sha256:e10577f0db68676a7024391c6e5cb4b879ebd17188ab750cf10024a6d700e5c4 AS bun FROM node:24.14.1-bookworm-slim@sha256:e484ae3f1e3c378021c967fd42254f343c302a9263e412280eac32bf5bca7008 ARG PLAYWRIGHT_VERSION diff --git a/.github/workflows/all-green.yml b/.github/workflows/all-green.yml index 83b8e3a5757..2a8b3cf8f03 100644 --- a/.github/workflows/all-green.yml +++ b/.github/workflows/all-green.yml @@ -17,21 +17,26 @@ jobs: permissions: id-token: write steps: - - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4 - id: octo-sts - with: - scope: DataDog/dd-trace-js - policy: all-green - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false sparse-checkout-cone-mode: false sparse-checkout: | .github + bunfig.toml + package.json scripts - uses: ./.github/actions/node with: version: active - - run: yarn add @actions/core @actions/github octokit + - run: bun install --frozen-lockfile --ignore-scripts + working-directory: .github/all-green + - run: ln -s ../.github/all-green/node_modules scripts/node_modules + - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4 + id: octo-sts + with: + scope: DataDog/dd-trace-js + policy: all-green - run: node scripts/all-green.mjs env: DELAY: ${{ github.run_attempt == 1 && '1' || '0' }} # 1 minute on first attempt, no delay on reruns diff --git a/.github/workflows/apm-integrations.yml b/.github/workflows/apm-integrations.yml index efaec6f2ba8..0b42d4303d8 100644 --- a/.github/workflows/apm-integrations.yml +++ b/.github/workflows/apm-integrations.yml @@ -76,7 +76,6 @@ jobs: - uses: ./.github/actions/node with: version: ${{ matrix.node-version }} - - run: yarn config set ignore-engines true - name: Install dependencies uses: ./.github/actions/install - name: Run tests @@ -355,7 +354,6 @@ jobs: with: version: ${{ matrix.node-version }} - uses: ./.github/actions/install - - run: yarn config set ignore-engines true - run: npm run test:plugins:ci - uses: ./.github/actions/coverage with: @@ -1082,8 +1080,7 @@ jobs: sudo ln -s /usr/lib/x86_64-linux-gnu/libaio.so.1t64 /usr/lib/x86_64-linux-gnu/libaio.so.1 sudo sh -c "echo /opt/oracle/instantclient_19_28 > /etc/ld.so.conf.d/oracle-instantclient.conf" sudo ldconfig - - run: yarn config set ignore-engines true - - run: yarn services --ignore-engines + - run: npm run services - run: npm run test:plugins:ci - if: always() uses: ./.github/actions/testagent/logs diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml index f6bc78b82b6..d10b415e108 100644 --- a/.github/workflows/audit.yml +++ b/.github/workflows/audit.yml @@ -2,19 +2,43 @@ name: Audit on: pull_request: - branches: - - dependabot/** + paths: + - ".github/audit-allowlist.json" + - ".github/workflows/audit.yml" + - ".github/actions/datadog-ci/bun.lock" + - ".github/all-green/bun.lock" + - "bun.lock" + - "docs/bun.lock" + - "scripts/audit.js" + - "vendor/bun.lock" + # Dependabot supports Bun version updates but not security updates, so a newly disclosed advisory does not change a + # lockfile or open a pull request that would trigger this workflow. + schedule: + - cron: "0 6 * * 1" + workflow_dispatch: concurrency: group: ${{ github.workflow }}-${{ github.ref == 'refs/heads/master' && github.run_id || github.ref }} cancel-in-progress: true +permissions: + contents: read + jobs: dependencies: runs-on: ubuntu-latest + strategy: + fail-fast: false + matrix: + directory: + - "." + - ".github/actions/datadog-ci" + - ".github/all-green" + - "docs" + - "vendor" steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ./.github/actions/node/latest - - run: yarn audit - - run: yarn audit - working-directory: ./vendor + - run: node scripts/audit.js "$DIRECTORY" + env: + DIRECTORY: ${{ matrix.directory }} diff --git a/.github/workflows/flakiness.yml b/.github/workflows/flakiness.yml index 29a5c290dea..6580e4a5127 100644 --- a/.github/workflows/flakiness.yml +++ b/.github/workflows/flakiness.yml @@ -41,11 +41,11 @@ jobs: .github package.json scripts - yarn.lock + bun.lock - uses: ./.github/actions/node with: version: active - - run: yarn install --frozen-lockfile --ignore-scripts + - run: bun install --frozen-lockfile --ignore-scripts - run: node scripts/flakiness.mjs env: GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }} diff --git a/.github/workflows/instrumentation.yml b/.github/workflows/instrumentation.yml index 3077503a1cb..07ea2d14d50 100644 --- a/.github/workflows/instrumentation.yml +++ b/.github/workflows/instrumentation.yml @@ -157,7 +157,6 @@ jobs: with: version: ${{ matrix.node-version }} - uses: ./.github/actions/install - - run: yarn config set ignore-engines true - run: npm run test:instrumentations:ci - uses: ./.github/actions/coverage with: @@ -638,9 +637,9 @@ jobs: # Disable core dumps since some integration tests intentionally abort and core dump generation takes around 5-10s - uses: ./.github/actions/install - run: sudo sysctl -w kernel.core_pattern='|/bin/false' - - run: npm run test:integration:esbuild:coverage - env: + - env: ESBUILD_VERSION: ${{ matrix.esbuild_version }} + run: npm run test:integration:esbuild:coverage - uses: ./.github/actions/coverage with: flags: instrumentations-integration-esbuild-${{ matrix.esbuild_version }}-${{ matrix.version }} diff --git a/.github/workflows/platform.yml b/.github/workflows/platform.yml index ab4779462e5..77673c807c5 100644 --- a/.github/workflows/platform.yml +++ b/.github/workflows/platform.yml @@ -50,7 +50,7 @@ jobs: && yarn config set --json npmPreapprovedPackages '["@datadog/*","import-in-the-middle"]' && yarn add - name: bun - install: bun add --linker=hoisted + install: bun --config="$GITHUB_WORKSPACE/bunfig.toml" add --linker=hoisted runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 diff --git a/.github/workflows/project.yml b/.github/workflows/project.yml index 28e7f8a3fc3..656eb8da0ce 100644 --- a/.github/workflows/project.yml +++ b/.github/workflows/project.yml @@ -15,7 +15,9 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: - sparse-checkout: .github + sparse-checkout: | + .github + package.json - uses: ./.github/actions/node/latest - name: actionlint id: actionlint @@ -82,6 +84,7 @@ jobs: with: sparse-checkout: | .github + package.json scripts/verify-workflow-job-names.js - uses: ./.github/actions/node/latest - run: npm install yaml @@ -96,18 +99,23 @@ jobs: permissions: id-token: write steps: - - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4 - id: octo-sts - with: - scope: DataDog/dd-trace-js - policy: package-size-report - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: ./.github/actions/node/latest - run: FILENAME=$(npm pack --silent --pack-destination /tmp) && mv /tmp/"$FILENAME" /tmp/dd-trace.tgz - - run: rm -rf ./* + - run: cp bunfig.toml /tmp/dd-trace-bunfig.toml && rm -rf ./* - run: tar -zxf /tmp/dd-trace.tgz -C "$(pwd)" --strip-components=1 - - run: yarn --prod --ignore-optional + # `--ignore-scripts` skips the `prepare` script (the frozen vendor install): + # the packed tarball ships pre-built `vendor/dist/**` artifacts but not + # `vendor/bun.lock`, so a fresh consumer install can't rebuild vendor. + - run: bun --config=/tmp/dd-trace-bunfig.toml install --production --omit=optional --ignore-scripts - run: ls -lisa + - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4 + id: octo-sts + with: + scope: DataDog/dd-trace-js + policy: package-size-report - name: Compute module size tree and report uses: qard/heaviest-objects-in-the-universe@1e02edbdda803a45537a808ede97866db47756d3 # Unreleased with: @@ -152,121 +160,3 @@ jobs: # - uses: ./.github/actions/node/latest # - uses: ./.github/actions/install # - run: node scripts/verify-ci-config.js - - yarn-dedupe: - runs-on: ubuntu-latest - permissions: - contents: read - outputs: - has_changes: ${{ steps.diff.outputs.has_changes }} - steps: - - name: Checkout code - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - fetch-depth: 0 - persist-credentials: false - - - name: Setup Node.js - uses: ./.github/actions/node/latest - - - name: Install dependencies - uses: ./.github/actions/install - - - name: Run npm run dependencies:dedupe - run: npm run dependencies:dedupe - - - name: Prepare yarn.lock update (same-repo PRs only; restricted paths) - id: diff - run: | - set -euo pipefail - - if git diff --quiet; then - echo "has_changes=false" >> "$GITHUB_OUTPUT" - exit 0 - fi - - fail_message() { cat <<'EOF' - ❌ The yarn.lock file needs deduplication! - - The dedupe command has modified your yarn.lock file. - This means there were duplicate dependencies that could be optimized. - - To fix this issue: - 1. Run 'npm run dependencies:dedupe' locally - 2. Commit the updated yarn.lock file - 3. Push your changes - - This helps keep the dependency tree clean. - EOF - } - - changes="$(git diff --name-only)" - if [ "$changes" != "yarn.lock" ]; then - echo "Unexpected changed paths during yarn dedupe:" - echo "$changes" - exit 1 - fi - - # Never push updates to fork PR branches, and don't auto-fix outside PRs. - if [ "${{ github.event_name }}" != "pull_request" ]; then - fail_message - exit 1 - fi - if [ "${{ github.event.pull_request.head.repo.full_name }}" != "${{ github.repository }}" ]; then - fail_message - exit 1 - fi - - cp yarn.lock "${RUNNER_TEMP}/yarn.lock" - echo "has_changes=true" >> "$GITHUB_OUTPUT" - - - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 - if: steps.diff.outputs.has_changes == 'true' - with: - name: yarn-lock - path: ${{ runner.temp }}/yarn.lock - if-no-files-found: error - - yarn-dedupe-push: - # If this job pushes a commit, GitHub will re-trigger the workflow on `pull_request:synchronize` - # with `github.actor == 'dd-octo-sts[bot]'`. Never attempt to mint another token / push again on - # that follow-up run. - if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && needs.yarn-dedupe.outputs.has_changes == 'true' && github.actor != 'dd-octo-sts[bot]' - runs-on: ubuntu-latest - needs: yarn-dedupe - # Security: this job has an STS-minted token, but never runs installs/builds. - # It only updates yarn.lock via the GitHub API. - permissions: - id-token: write - steps: - - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4 - id: octo-sts - with: - scope: DataDog/dd-trace-js - policy: yarn-dedupe - - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 - with: - name: yarn-lock - path: ${{ runner.temp }}/yarn-lock-artifact - - - name: Update yarn.lock via GitHub API (server-created verified commit) - env: - GH_TOKEN: ${{ steps.octo-sts.outputs.token }} - OWNER: ${{ github.repository_owner }} - REPO: ${{ github.event.repository.name }} - BRANCH: ${{ github.event.pull_request.head.ref }} - run: | - set -euo pipefail - - test -f "${{ runner.temp }}/yarn-lock-artifact/yarn.lock" - sha="$(gh api -q '.sha' "repos/${OWNER}/${REPO}/contents/yarn.lock?ref=${BRANCH}")" - base64 -w 0 "${{ runner.temp }}/yarn-lock-artifact/yarn.lock" > "${{ runner.temp }}/yarn-lock-b64.txt" - - jq -n \ - --arg message "chore: deduplicate yarn.lock" \ - --rawfile content "${{ runner.temp }}/yarn-lock-b64.txt" \ - --arg sha "$sha" \ - --arg branch "$BRANCH" \ - '{message: $message, content: $content, sha: $sha, branch: $branch}' \ - | gh api -X PUT "repos/${OWNER}/${REPO}/contents/yarn.lock" --input - diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7ea746c0c64..35400870745 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -161,12 +161,12 @@ jobs: run: | content=$(tr '\n' ' ' < ./package.json) echo "json=$content" >> "$GITHUB_OUTPUT" - - run: yarn + - run: bun install --frozen-lockfile - name: Build working-directory: docs run: | - yarn - yarn build + bun install --frozen-lockfile + bun run build mv out /tmp/out - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: diff --git a/.github/workflows/system-tests.yml b/.github/workflows/system-tests.yml index 46b0d193f4e..7dc1c3d5735 100644 --- a/.github/workflows/system-tests.yml +++ b/.github/workflows/system-tests.yml @@ -22,7 +22,11 @@ jobs: with: path: dd-trace-js - name: Pack dd-trace-js - run: mkdir -p ./binaries && echo "/binaries/$(npm pack --silent --pack-destination ./binaries ./dd-trace-js)" > ./binaries/nodejs-load-from-npm + run: | + mkdir -p binaries + filename=$(npm pack --silent --pack-destination binaries ./dd-trace-js) + test -f "binaries/$filename" + printf '/binaries/%s\n' "$filename" > binaries/nodejs-load-from-npm - name: Upload artifact uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: diff --git a/.github/workflows/test-optimization.yml b/.github/workflows/test-optimization.yml index 93a52b0e120..5ad39c4db7a 100644 --- a/.github/workflows/test-optimization.yml +++ b/.github/workflows/test-optimization.yml @@ -478,7 +478,6 @@ jobs: with: path: ~/.cache/Cypress key: cypress-binary-${{ steps.cypress-version.outputs.resolved }} - - run: yarn config set ignore-engines true - run: npm run test:integration:cypress:coverage env: CYPRESS_VERSION: ${{ matrix.cypress-version }} diff --git a/.github/workflows/update-3rdparty-licenses.yml b/.github/workflows/update-3rdparty-licenses.yml index c67346aef5b..5f8250973b2 100644 --- a/.github/workflows/update-3rdparty-licenses.yml +++ b/.github/workflows/update-3rdparty-licenses.yml @@ -1,84 +1,50 @@ name: Update 3rd-party licenses +# `dd-license-attribution` does not yet read `bun.lock`; the project ships only +# `bun.lock` at the root, so the upstream auto-update tool drops every root +# runtime/optional dep on each run. `scripts/generate-3rdparty-licenses.js` +# regenerates `LICENSE-3rdparty.csv` from `bun.lock`, +# `vendor/bun.lock`, `.github/vendored-dependencies.csv`, and the npm +# registry instead. `scripts/check_licenses.js` (run via `npm run lint`) +# enforces row-level completeness on every PR; this workflow auto-commits the +# regenerated file for bot PRs and surfaces a clear error otherwise. + on: pull_request: paths: - ".github/vendored-dependencies.csv" - - "vendor/package-lock.json" - - "yarn.lock" + - ".github/workflows/update-3rdparty-licenses.yml" + - "LICENSE-3rdparty.csv" + - "bun.lock" + - "bunfig.toml" + - "package.json" + - "scripts/generate-3rdparty-licenses.js" + - "scripts/helpers/concurrency.js" + - "scripts/third-party-dependencies.js" + - "vendor/bun.lock" + - "vendor/package.json" jobs: check-licenses: runs-on: ubuntu-latest permissions: contents: read - id-token: write outputs: needs_update: ${{ steps.check.outputs.needs_update }} is_bot_same_repo: ${{ steps.check.outputs.is_bot_same_repo }} is_release_proposal: ${{ steps.check.outputs.is_release_proposal }} head_oid: ${{ steps.check.outputs.head_oid }} - env: - REPOSITORY_URL: ${{ github.server_url }}/${{ github.repository }} steps: - - name: Get GitHub Token via dd-octo-sts - id: generate-token - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4 - with: - scope: DataDog/dd-trace-js - policy: self.check-licenses - - name: Check out PR branch - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 - with: - python-version: "3.14" - - - name: Check out dd-license-attribution - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - repository: watson/dd-license-attribution - ref: 8ea483b9f735bf8da632c89796789cc2a050a9a6 - path: dd-license-attribution + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - name: Install dd-license-attribution - working-directory: dd-license-attribution - run: | - pip install . + - uses: ./.github/actions/node/latest - - name: Create mirrors.json for PR branch - env: - DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} - HEAD_REF: ${{ github.head_ref }} - run: | - cat > mirrors.json < LICENSE-3rdparty.csv - - - name: Append vendored dependencies from PR - run: | - cat .github/vendored-dependencies.csv >> LICENSE-3rdparty.csv + run: node scripts/generate-3rdparty-licenses.js - name: Check for LICENSE-3rdparty.csv changes id: check @@ -89,14 +55,13 @@ jobs: HEAD_REF: ${{ github.head_ref }} run: | set -e - echo "head_oid=${{ github.event.pull_request.head.sha }}" >> "$GITHUB_OUTPUT" if git diff --ignore-space-at-eol --exit-code LICENSE-3rdparty.csv; then echo "✅ LICENSE-3rdparty.csv is already up to date" echo "needs_update=false" >> "$GITHUB_OUTPUT" else - echo "📝 LICENSE-3rdparty.csv was modified by license attribution command" + echo "📝 LICENSE-3rdparty.csv was modified by the regen script" echo "needs_update=true" >> "$GITHUB_OUTPUT" fi @@ -106,12 +71,7 @@ jobs: echo "is_bot_same_repo=false" >> "$GITHUB_OUTPUT" fi - # Release proposal branches are built by cherry-picking master onto a release - # line and carry their own version-bump bookkeeping (scripts/release/proposal.js - # assumes HEAD is always that bump commit). A commit landed here by this workflow - # breaks that assumption, so these branches are excluded from auto-commit and - # fail loudly instead — the license CSV is already correct on master and should - # never need attribution work done directly on a proposal branch. + # Release tooling requires the version bump to stay at HEAD. if [[ "$HEAD_REF" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-proposal$ ]]; then echo "is_release_proposal=true" >> "$GITHUB_OUTPUT" else @@ -136,22 +96,7 @@ jobs: run: | echo "❌ The LICENSE-3rdparty.csv file needs to be updated!" echo "" - echo "The license attribution command has modified LICENSE-3rdparty.csv." - echo "" - echo "To fix this issue:" - echo "1. Set up dd-license-attribution locally by following the installation instructions in:" - echo " https://github.com/DataDog/dd-license-attribution" - echo "2. Run the license CSV generation command locally:" - echo " dd-license-attribution generate-sbom-csv \\" - echo " --no-scancode-strategy \\" - echo " --no-github-sbom-strategy \\" - echo " https://github.com/datadog/dd-trace-js > LICENSE-3rdparty.csv" - echo "3. Append vendored dependencies:" - echo " cat .github/vendored-dependencies.csv >> LICENSE-3rdparty.csv" - echo "4. Commit the updated LICENSE-3rdparty.csv file" - echo "5. Push your changes" - echo "" - echo "This helps keep the 3rd-party license information accurate." + echo "Run 'node scripts/generate-3rdparty-licenses.js' locally and commit the result." exit 1 auto-commit-licenses: diff --git a/.gitignore b/.gitignore index 21fc16d02f8..ad77b5377e3 100644 --- a/.gitignore +++ b/.gitignore @@ -34,8 +34,6 @@ logs *.log node-*-junit.xml npm-debug.log* -yarn-debug.log* -yarn-error.log* # Runtime data pids @@ -88,9 +86,6 @@ typings/ # Output of 'npm pack' *.tgz -# Yarn Integrity file -.yarn-integrity - # Output of tap .tap/* @@ -112,11 +107,10 @@ node-*-junit.xml # End of https://www.gitignore.io/api/node,macos,visualstudiocode -/versions +/versions/* +!/versions/bunfig.toml .bun .next -bun.lock -bun.lockb package-lock.json out build @@ -129,15 +123,13 @@ acmeair-nodejs !packages/*/test/**/node_modules packages/datadog-plugin-next/test/package.json packages/datadog-plugin-next/test/node_modules -packages/datadog-plugin-next/test/yarn.lock +packages/datadog-plugin-next/test/bun.lock packages/dd-trace/test/appsec/next/*/package.json packages/dd-trace/test/appsec/next/*/node_modules -packages/dd-trace/test/appsec/next/*/yarn.lock +packages/dd-trace/test/appsec/next/*/bun.lock packages/dd-trace/test/plugins/versions/node_modules -packages/dd-trace/test/plugins/versions/yarn.lock !packages/dd-trace/**/telemetry/logs packages/datadog-plugin-azure-functions/test/integration-test/fixtures/node_modules -!vendor/package-lock.json !benchmark/sirun/startup/everything-fixture/package-lock.json vendor.patch __azurite_db_queue__.json diff --git a/.gitlab/prepare-oci-package.sh b/.gitlab/prepare-oci-package.sh index af579f04355..46af2244522 100755 --- a/.gitlab/prepare-oci-package.sh +++ b/.gitlab/prepare-oci-package.sh @@ -4,13 +4,22 @@ set -e cd .. -npm pack +archive=$(npm pack --silent) +test -f "$archive" + +bun=$(node -e "process.stdout.write(require('./scripts/bun').getBunBinary())") mkdir -p packaging/sources -npm install --prefix ./packaging/sources/ dd-trace-*.tgz +tar -xOf "$archive" package/package.json > packaging/sources/package.json +npm pkg delete scripts.prepare --prefix packaging/sources +cp bun.lock packaging/sources/bun.lock +"$bun" --config="$PWD/bunfig.toml" install --production --frozen-lockfile \ + --linker=hoisted --network-concurrency 8 --cwd packaging/sources -rm packaging/sources/*.json # package.json and package-lock.json are unneeded +rm packaging/sources/package.json packaging/sources/bun.lock +mkdir -p packaging/sources/node_modules/dd-trace +tar -xzf "$archive" --strip-components=1 -C packaging/sources/node_modules/dd-trace if [ -n "$CI_COMMIT_TAG" ] && [ -z "$JS_PACKAGE_VERSION" ]; then JS_PACKAGE_VERSION=${CI_COMMIT_TAG##v} @@ -18,7 +27,7 @@ elif [ -z "$CI_COMMIT_TAG" ] && [ -z "$JS_PACKAGE_VERSION" ]; then JS_PACKAGE_VERSION="$(jq --raw-output '.version' package.json)${CI_VERSION_SUFFIX}" fi -echo -n $JS_PACKAGE_VERSION > packaging/sources/version +printf '%s' "$JS_PACKAGE_VERSION" > packaging/sources/version cd packaging diff --git a/.husky/pre-commit b/.husky/pre-commit deleted file mode 100644 index 9096861fade..00000000000 --- a/.husky/pre-commit +++ /dev/null @@ -1,10 +0,0 @@ -#!/usr/bin/env sh -. "$(dirname -- "$0")/_/husky.sh" - -if [ ! -e "node_modules/.bin/yarn-deduplicate" ]; then - echo "yarn-deduplicate is not installed. Run 'yarn install' (with devDependencies) and try again." - exit 1 -fi - -npm run dependencies:dedupe -git add yarn.lock diff --git a/.yarnrc b/.yarnrc deleted file mode 100644 index 31a4f99e020..00000000000 --- a/.yarnrc +++ /dev/null @@ -1,2 +0,0 @@ -ignore-engines true -network-timeout 60000 diff --git a/AGENTS.md b/AGENTS.md index 1c344b7e101..5efff647524 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -3,20 +3,17 @@ ## Prerequisites - Node.js >= 18 -- yarn 1.x +- bun 1.3.14 (matches `devDependencies.bun` in `package.json`) - Docker + docker-compose (for running service dependencies in tests) ## Setup **Package manager policy:** -- Use **yarn only for installing dependencies and services**: - - `yarn add` - - `yarn install` - - `yarn services` -- Use **npm for running scripts and other commands**: `npm run