fix(iast): guard taint queries without a context #100502
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: System Tests | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - mq-working-branch-* | |
| pull_request: {} | |
| workflow_dispatch: {} | |
| schedule: | |
| - cron: '00 04 * * *' | |
| permissions: | |
| id-token: write | |
| contents: read | |
| packages: write | |
| jobs: | |
| should-run: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| run: ${{ steps.check.outputs.run }} | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| fetch-depth: 0 | |
| - name: Check if relevant paths changed | |
| id: check | |
| run: | | |
| .github/scripts/should-run.sh "${{ github.event_name }}" \ | |
| "${{ github.event.pull_request.base.sha }}" | |
| download-s3-wheels: | |
| needs: [should-run] | |
| if: needs.should-run.outputs.run == 'true' && (github.event_name != 'schedule' || github.event.repository.fork == false) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: Resolve commit SHA | |
| id: resolve-sha | |
| run: | | |
| if [ "${{ github.event_name }}" = "pull_request" ]; then | |
| echo "sha=${{ github.event.pull_request.head.sha }}" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "sha=${{ github.sha }}" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Download wheels from S3 | |
| run: | | |
| bash scripts/download-s3-wheels.sh \ | |
| "${{ steps.resolve-sha.outputs.sha }}" \ | |
| ./wheels \ | |
| manylinux2014_x86_64 | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 | |
| with: | |
| name: wheels-manylinux_x86_64 | |
| path: ./wheels/*.whl | |
| serverless-system-tests-build-layer: | |
| runs-on: ubuntu-latest | |
| needs: [download-s3-wheels] | |
| steps: | |
| - name: Checkout datadog-lambda-python | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| repository: "DataDog/datadog-lambda-python" | |
| - name: Download wheel to binaries directory | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: wheels-manylinux_x86_64 | |
| path: artifacts/ | |
| - name: Build datadog_lambda layer | |
| run: | | |
| wheel_path=$(find ./artifacts -name "*cp313*manylinux*.whl" | head -n 1) | |
| ARCH=amd64 PYTHON_VERSION=3.13 DD_TRACE_WHEEL=$wheel_path ./scripts/build_layers.sh | |
| - name: Upload layer artifact | |
| uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 | |
| with: | |
| path: .layers/datadog_lambda_py-amd64-3.13.zip | |
| name: serverless_system_tests_binaries | |
| serverless-system-tests: | |
| needs: [serverless-system-tests-build-layer] | |
| # Automatically managed, use scripts/update-system-tests-version to update | |
| uses: DataDog/system-tests/.github/workflows/system-tests.yml@77e6da9b53639436525bf7bfb076723e18e102c3 | |
| secrets: inherit | |
| with: | |
| library: python_lambda | |
| ref: '77e6da9b53639436525bf7bfb076723e18e102c3' | |
| binaries_artifact: serverless_system_tests_binaries | |
| scenarios_groups: lambda_end_to_end | |
| skip_empty_scenarios: true | |
| push_to_test_optimization: true | |
| integration-frameworks-combine-wheels: | |
| runs-on: ubuntu-latest | |
| needs: [download-s3-wheels] | |
| steps: | |
| - name: Download wheels to binaries directory | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| pattern: wheels-* | |
| path: binaries/ | |
| merge-multiple: true | |
| - name: Upload combined wheels | |
| uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0 | |
| with: | |
| name: integration-frameworks-wheels | |
| path: binaries/ | |
| integration-frameworks-system-tests: | |
| if: github.event_name != 'schedule' || github.event.repository.fork == false | |
| needs: [integration-frameworks-combine-wheels] | |
| # Automatically managed, use scripts/update-system-tests-version to update | |
| uses: DataDog/system-tests/.github/workflows/system-tests.yml@77e6da9b53639436525bf7bfb076723e18e102c3 | |
| secrets: inherit | |
| with: | |
| library: python | |
| ref: '77e6da9b53639436525bf7bfb076723e18e102c3' | |
| scenarios: INTEGRATION_FRAMEWORKS | |
| binaries_artifact: integration-frameworks-wheels | |
| push_to_test_optimization: true | |
| tracer-release: | |
| needs: | |
| - download-s3-wheels | |
| uses: DataDog/system-tests/.github/workflows/system-tests.yml@77e6da9b53639436525bf7bfb076723e18e102c3 | |
| with: | |
| library: python | |
| ref: '77e6da9b53639436525bf7bfb076723e18e102c3' | |
| binaries_artifact: wheels-manylinux_x86_64 | |
| desired_execution_time: 900 | |
| scenarios_groups: tracer-release | |
| skip_empty_scenarios: ${{github.event_name == 'pull_request'}} | |
| push_to_test_optimization: true | |
| finished: | |
| name: system-tests finished | |
| runs-on: ubuntu-latest | |
| needs: [serverless-system-tests, integration-frameworks-system-tests, tracer-release] | |
| if: always() | |
| steps: | |
| - name: Print results | |
| run: | | |
| echo "serverless-system-tests: ${{ needs.serverless-system-tests.result }}" | |
| echo "integration-frameworks-system-tests: ${{ needs.integration-frameworks-system-tests.result }}" | |
| echo "tracer-release: ${{ needs.tracer-release.result }}" | |
| - name: Fail if any dependency failed or was cancelled | |
| if: | | |
| needs.serverless-system-tests.result == 'failure' || | |
| needs.serverless-system-tests.result == 'cancelled' || | |
| needs.integration-frameworks-system-tests.result == 'failure' || | |
| needs.integration-frameworks-system-tests.result == 'cancelled'|| | |
| needs.tracer-release.result == 'failure' || | |
| needs.tracer-release.result == 'cancelled' | |
| run: exit 1 |