feat(ci): integrate Datadog CI products for enhanced visibility #119
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| branches: | |
| - '**' | |
| push: | |
| branches: | |
| - main | |
| permissions: | |
| contents: write # Needed to commit coverage badge on main branch | |
| pull-requests: write | |
| security-events: write # Needed for Datadog SAST results | |
| id-token: write # Needed to federate STS token to upload coverage | |
| env: | |
| DD_ENV: ci | |
| DD_SERVICE: pup | |
| jobs: | |
| test: | |
| name: Test and Coverage | |
| runs-on: ubuntu-latest | |
| env: | |
| DD_API_KEY: ${{ secrets.DD_API_KEY }} | |
| DD_SITE: ${{ secrets.DD_SITE || 'datadoghq.com' }} | |
| DD_CIVISIBILITY_AGENTLESS_ENABLED: true | |
| DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true | |
| DD_CIVISIBILITY_ENABLED: true | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 # Fetch full git history for Datadog CI Visibility | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: '1.25' | |
| cache: true | |
| - name: Get Datadog credentials | |
| id: dd-sts # Needed to be able to reference this step's output later | |
| uses: DataDog/dd-sts-action@main # Pin to the main branch to get auto updates for free, or to a specific commit hash if you want stability | |
| with: | |
| policy: public-datadog-pup-sts | |
| - name: Configure Datadog Test Optimization | |
| uses: datadog/test-visibility-github-action@v2 | |
| with: | |
| languages: go | |
| api_key: ${{ steps.dd-sts.outputs.api_key }} | |
| site: datadoghq.com | |
| - name: Install Datadog CI tools | |
| run: | | |
| # Install orchestrion for Go test instrumentation | |
| go install github.com/DataDog/orchestrion@latest | |
| echo "$(go env GOPATH)/bin" >> $GITHUB_PATH | |
| # Install datadog-ci CLI for coverage upload | |
| npm install -g @datadog/datadog-ci | |
| - name: Install bc for floating-point math | |
| run: sudo apt-get update && sudo apt-get install -y bc | |
| - name: Run tests with coverage | |
| env: | |
| DD_CIVISIBILITY_ENABLED: true | |
| DD_ENV: ci | |
| run: | | |
| # Run tests on all packages with race detection | |
| # Use orchestrion to instrument tests for Datadog CI Visibility | |
| if [ -n "$DD_API_KEY" ]; then | |
| echo "Running tests with Datadog CI Visibility enabled" | |
| orchestrion go test -v -race -parallel 8 ./... | |
| # Calculate coverage with orchestrion instrumentation | |
| # Use -count=1 to disable test caching and get accurate coverage | |
| # Use -parallel 8 for faster execution (4.7x faster than sequential) | |
| orchestrion go test -count=1 -parallel 8 -coverprofile=coverage.out -covermode=atomic ./pkg/... | |
| else | |
| echo "Running tests without Datadog CI Visibility (DD_API_KEY not set)" | |
| go test -v -race ./... | |
| go test -count=1 -coverprofile=coverage.out -covermode=atomic ./pkg/... | |
| fi | |
| # Generate HTML coverage report | |
| go tool cover -html=coverage.out -o coverage.html | |
| - name: Calculate coverage | |
| id: coverage | |
| run: | | |
| # Calculate total coverage | |
| COVERAGE=$(go tool cover -func=coverage.out | grep total | awk '{print $3}' | sed 's/%//') | |
| echo "coverage=$COVERAGE" >> $GITHUB_OUTPUT | |
| echo "Total coverage: $COVERAGE%" | |
| # Calculate coverage by package | |
| echo "## Coverage by Package" > coverage_report.txt | |
| echo "" >> coverage_report.txt | |
| go tool cover -func=coverage.out | grep -v "total:" | awk '{print $1, $3}' | sort -t: -k1,1 -u | while read line; do | |
| echo "- $line" >> coverage_report.txt | |
| done | |
| # Get coverage summary | |
| echo "" >> coverage_report.txt | |
| echo "## Summary" >> coverage_report.txt | |
| echo "" >> coverage_report.txt | |
| go tool cover -func=coverage.out | tail -1 >> coverage_report.txt | |
| - name: Upload coverage to Datadog | |
| if: env.DD_API_KEY != '' | |
| env: | |
| DATADOG_API_KEY: ${{ steps.dd-sts.outputs.api_key }} | |
| DD_SITE: datadoghq.com | |
| run: | | |
| # Upload coverage reports to Datadog | |
| datadog-ci coverage upload --format=go-cover coverage.out | |
| - name: Check coverage threshold | |
| run: | | |
| COVERAGE=${{ steps.coverage.outputs.coverage }} | |
| # Lower threshold to account for skipped keychain tests in CI (headless environment) | |
| # Local macOS coverage is ~87%, CI is ~77% due to keychain tests being skipped | |
| THRESHOLD=75.0 | |
| echo "Coverage: $COVERAGE%" | |
| echo "Threshold: $THRESHOLD%" | |
| # Use bc for floating point comparison | |
| if [ $(echo "$COVERAGE < $THRESHOLD" | bc -l) -eq 1 ]; then | |
| echo "❌ Coverage $COVERAGE% is below threshold $THRESHOLD%" | |
| exit 1 | |
| else | |
| echo "✅ Coverage $COVERAGE% meets threshold $THRESHOLD%" | |
| fi | |
| - name: Generate coverage badge data | |
| if: github.event_name == 'pull_request' | |
| id: badge | |
| run: | | |
| COVERAGE=${{ steps.coverage.outputs.coverage }} | |
| # Determine badge color based on coverage | |
| if [ $(echo "$COVERAGE >= 90" | bc -l) -eq 1 ]; then | |
| COLOR="brightgreen" | |
| elif [ $(echo "$COVERAGE >= 80" | bc -l) -eq 1 ]; then | |
| COLOR="green" | |
| elif [ $(echo "$COVERAGE >= 70" | bc -l) -eq 1 ]; then | |
| COLOR="yellow" | |
| elif [ $(echo "$COVERAGE >= 60" | bc -l) -eq 1 ]; then | |
| COLOR="orange" | |
| else | |
| COLOR="red" | |
| fi | |
| echo "color=$COLOR" >> $GITHUB_OUTPUT | |
| - name: Generate PR comment body | |
| if: github.event_name == 'pull_request' | |
| id: comment | |
| env: | |
| COVERAGE: ${{ steps.coverage.outputs.coverage }} | |
| BADGE_COLOR: ${{ steps.badge.outputs.color }} | |
| COMMIT_SHA: ${{ github.event.pull_request.head.sha }} | |
| run: | | |
| # Determine status | |
| if [ $(echo "$COVERAGE >= 80" | bc -l) -eq 1 ]; then | |
| STATUS="✅ PASSED - Coverage meets minimum threshold" | |
| STATUS_EMOJI="✅" | |
| else | |
| STATUS="❌ FAILED - Coverage below minimum threshold" | |
| STATUS_EMOJI="❌" | |
| fi | |
| # Create comment body using heredoc | |
| cat > comment_final.txt << EOF | |
| ## 📊 Test Coverage Report | |
| **Overall Coverage:** ${COVERAGE}%  | |
| **Threshold:** 80% ${STATUS_EMOJI} | |
| <details> | |
| <summary>Coverage by Package</summary> | |
| \`\`\` | |
| $(cat coverage_report.txt) | |
| \`\`\` | |
| </details> | |
| --- | |
| 📈 **Coverage Status:** ${STATUS} | |
| <sub>Updated for commit ${COMMIT_SHA}</sub> | |
| EOF | |
| - name: Comment on PR | |
| if: github.event_name == 'pull_request' | |
| continue-on-error: true # Don't fail CI if comment posting fails | |
| uses: actions/github-script@v8 | |
| env: | |
| COMMENT_BODY: ${{ steps.comment.outputs.comment_body }} | |
| with: | |
| script: | | |
| const fs = require('fs'); | |
| const commentBody = fs.readFileSync('comment_final.txt', 'utf8'); | |
| // Find existing comment | |
| const { data: comments } = await github.rest.issues.listComments({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| issue_number: context.issue.number, | |
| }); | |
| const botComment = comments.find(comment => | |
| comment.user.type === 'Bot' && comment.body.includes('📊 Test Coverage Report') | |
| ); | |
| if (botComment) { | |
| // Update existing comment | |
| await github.rest.issues.updateComment({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| comment_id: botComment.id, | |
| body: commentBody | |
| }); | |
| } else { | |
| // Create new comment | |
| await github.rest.issues.createComment({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| issue_number: context.issue.number, | |
| body: commentBody | |
| }); | |
| } | |
| - name: Generate coverage badge for main branch | |
| if: github.ref == 'refs/heads/main' && github.event_name == 'push' | |
| env: | |
| COVERAGE: ${{ steps.coverage.outputs.coverage }} | |
| run: | | |
| # Determine badge color | |
| if [ $(echo "$COVERAGE >= 90" | bc -l) -eq 1 ]; then | |
| COLOR="brightgreen" | |
| elif [ $(echo "$COVERAGE >= 80" | bc -l) -eq 1 ]; then | |
| COLOR="green" | |
| elif [ $(echo "$COVERAGE >= 70" | bc -l) -eq 1 ]; then | |
| COLOR="yellow" | |
| elif [ $(echo "$COVERAGE >= 60" | bc -l) -eq 1 ]; then | |
| COLOR="orange" | |
| else | |
| COLOR="red" | |
| fi | |
| # Create badge JSON for shields.io endpoint schema | |
| mkdir -p .github/badges | |
| cat > .github/badges/coverage.json << EOF | |
| { | |
| "schemaVersion": 1, | |
| "label": "coverage", | |
| "message": "${COVERAGE}%", | |
| "color": "${COLOR}" | |
| } | |
| EOF | |
| echo "Generated coverage badge: ${COVERAGE}% (${COLOR})" | |
| # Note: Auto-committing badge disabled due to branch protection requiring signed commits | |
| # Badge can be updated manually or via a separate workflow with appropriate permissions | |
| - name: Upload coverage artifacts | |
| uses: actions/upload-artifact@v6 | |
| with: | |
| name: coverage-report | |
| path: | | |
| coverage.out | |
| coverage.html | |
| coverage_report.txt | |
| retention-days: 30 | |
| lint: | |
| name: Lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: '1.25' | |
| cache: true | |
| - name: Install golangci-lint | |
| run: | | |
| curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin latest | |
| echo "$(go env GOPATH)/bin" >> $GITHUB_PATH | |
| - name: Run golangci-lint | |
| run: golangci-lint run --timeout=5m | |
| build: | |
| name: Build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: '1.25' | |
| cache: true | |
| - name: Build | |
| run: go build -v ./... | |
| - name: Build CLI binary | |
| run: go build -o pup . | |
| - name: Verify binary | |
| run: ./pup --version | |
| sast: | |
| name: Datadog Static Analysis | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' | |
| env: | |
| DD_API_KEY: ${{ secrets.DD_API_KEY }} | |
| DD_APP_KEY: ${{ secrets.DD_APP_KEY }} | |
| DD_SITE: ${{ secrets.DD_SITE || 'datadoghq.com' }} | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 # Full history for better SAST analysis | |
| - name: Run Datadog Static Analysis | |
| if: env.DD_API_KEY != '' | |
| run: | | |
| # Install datadog-ci if not already installed | |
| npm install -g @datadog/datadog-ci | |
| # Run static analysis | |
| # This will analyze the code for security vulnerabilities, code quality issues, etc. | |
| datadog-ci sast scan --service=${{ env.DD_SERVICE }} --env=${{ env.DD_ENV }} | |
| - name: SAST disabled notice | |
| if: env.DD_API_KEY == '' | |
| run: | | |
| echo "⚠️ Datadog Static Analysis skipped: DD_API_KEY not configured" | |
| echo "To enable SAST, add DD_API_KEY and DD_APP_KEY as repository secrets" |