Merge pull request #81 from datadog-labs/docs/update-readme-marketing… #166
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| branches: | |
| - '**' | |
| push: | |
| branches: | |
| - main | |
| permissions: | |
| contents: write # Needed to commit coverage badge on main branch | |
| pull-requests: write | |
| security-events: write # Needed for Datadog SAST results | |
| id-token: write # Needed to federate STS token to upload coverage | |
| env: | |
| DD_ENV: ci | |
| DD_SERVICE: pup | |
| jobs: | |
| test: | |
| name: Test and Coverage | |
| runs-on: ubuntu-latest | |
| env: | |
| DD_API_KEY: ${{ secrets.DD_API_KEY }} | |
| DD_SITE: ${{ secrets.DD_SITE || 'datadoghq.com' }} | |
| DD_CIVISIBILITY_AGENTLESS_ENABLED: true | |
| DD_CIVISIBILITY_GIT_UPLOAD_ENABLED: true | |
| DD_CIVISIBILITY_ENABLED: true | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 # Fetch full git history for Datadog CI Visibility | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: '1.25' | |
| cache: true | |
| - name: Get Datadog credentials | |
| if: github.ref == 'refs/heads/main' | |
| id: dd-sts # Needed to be able to reference this step's output later | |
| uses: DataDog/dd-sts-action@main # Pin to the main branch to get auto updates for free, or to a specific commit hash if you want stability | |
| with: | |
| policy: public-datadog-pup-sts | |
| - name: Configure Datadog Test Optimization | |
| if: github.ref == 'refs/heads/main' | |
| uses: datadog/test-visibility-github-action@v2 | |
| with: | |
| languages: go | |
| api_key: ${{ steps.dd-sts.outputs.api_key }} | |
| site: datadoghq.com | |
| - name: Install Datadog CI tools | |
| if: github.ref == 'refs/heads/main' | |
| run: | | |
| # Install orchestrion for Go test instrumentation | |
| go install github.com/DataDog/orchestrion@latest | |
| echo "$(go env GOPATH)/bin" >> $GITHUB_PATH | |
| # Install datadog-ci CLI for coverage upload | |
| npm install -g @datadog/datadog-ci | |
| - name: Install bc for floating-point math | |
| run: sudo apt-get update && sudo apt-get install -y bc | |
| - name: Run tests with coverage | |
| env: | |
| DD_CIVISIBILITY_ENABLED: true | |
| DD_ENV: ci | |
| run: | | |
| # Run tests on all packages with race detection | |
| # Use orchestrion to instrument tests for Datadog CI Visibility | |
| # IMPORTANT: Use -parallel 256 with orchestrion. The test-visibility-github-action | |
| # sets GOFLAGS='-toolexec=orchestrion toolexec' which auto-injects t.Parallel() | |
| # into ALL subtests. With the default parallel limit (GOMAXPROCS=2 on runners), | |
| # this deadlocks table-driven tests where parent tests wait for subtests that are | |
| # blocked waiting for parallel slots. A high limit avoids the deadlock. | |
| if [ -n "$DD_API_KEY" ]; then | |
| echo "Running tests with Datadog CI Visibility enabled" | |
| orchestrion go test -v -race -parallel 256 ./... | |
| else | |
| echo "Running tests without Datadog CI Visibility (DD_API_KEY not set)" | |
| go test -v -race ./... | |
| fi | |
| # Coverage collection: run WITHOUT orchestrion/ITR to ensure ALL tests execute. | |
| # Intelligent Test Runner skips tests it deems unaffected by code changes, | |
| # which breaks coverage on dependency-only PRs (e.g., go.mod updates). | |
| # GOFLAGS is cleared to remove the '-toolexec=orchestrion toolexec' injected | |
| # by test-visibility-github-action. | |
| GOFLAGS="" go test -count=1 -coverprofile=coverage.out -covermode=atomic ./pkg/... | |
| # Generate HTML coverage report | |
| go tool cover -html=coverage.out -o coverage.html | |
| - name: Calculate coverage | |
| id: coverage | |
| run: | | |
| # Calculate total coverage | |
| COVERAGE=$(go tool cover -func=coverage.out | grep total | awk '{print $3}' | sed 's/%//') | |
| echo "coverage=$COVERAGE" >> $GITHUB_OUTPUT | |
| echo "Total coverage: $COVERAGE%" | |
| # Calculate coverage by package | |
| echo "## Coverage by Package" > coverage_report.txt | |
| echo "" >> coverage_report.txt | |
| go tool cover -func=coverage.out | grep -v "total:" | awk '{print $1, $3}' | sort -t: -k1,1 -u | while read line; do | |
| echo "- $line" >> coverage_report.txt | |
| done | |
| # Get coverage summary | |
| echo "" >> coverage_report.txt | |
| echo "## Summary" >> coverage_report.txt | |
| echo "" >> coverage_report.txt | |
| go tool cover -func=coverage.out | tail -1 >> coverage_report.txt | |
| - name: Upload coverage to Datadog | |
| if: github.ref == 'refs/heads/main' | |
| env: | |
| DATADOG_API_KEY: ${{ steps.dd-sts.outputs.api_key }} | |
| DD_SITE: datadoghq.com | |
| run: | | |
| # Upload coverage reports to Datadog | |
| datadog-ci coverage upload --format=go-coverprofile coverage.out | |
| - name: Check coverage threshold | |
| run: | | |
| COVERAGE=${{ steps.coverage.outputs.coverage }} | |
| # Lower threshold to account for skipped keychain tests in CI (headless environment) | |
| # Local macOS coverage is ~87%, CI is ~77% due to keychain tests being skipped | |
| THRESHOLD=75.0 | |
| echo "Coverage: $COVERAGE%" | |
| echo "Threshold: $THRESHOLD%" | |
| # Use bc for floating point comparison | |
| if [ $(echo "$COVERAGE < $THRESHOLD" | bc -l) -eq 1 ]; then | |
| echo "❌ Coverage $COVERAGE% is below threshold $THRESHOLD%" | |
| exit 1 | |
| else | |
| echo "✅ Coverage $COVERAGE% meets threshold $THRESHOLD%" | |
| fi | |
| - name: Generate coverage badge for main branch | |
| if: github.ref == 'refs/heads/main' && github.event_name == 'push' | |
| env: | |
| COVERAGE: ${{ steps.coverage.outputs.coverage }} | |
| run: | | |
| # Determine badge color | |
| if [ $(echo "$COVERAGE >= 90" | bc -l) -eq 1 ]; then | |
| COLOR="brightgreen" | |
| elif [ $(echo "$COVERAGE >= 80" | bc -l) -eq 1 ]; then | |
| COLOR="green" | |
| elif [ $(echo "$COVERAGE >= 70" | bc -l) -eq 1 ]; then | |
| COLOR="yellow" | |
| elif [ $(echo "$COVERAGE >= 60" | bc -l) -eq 1 ]; then | |
| COLOR="orange" | |
| else | |
| COLOR="red" | |
| fi | |
| # Create badge JSON for shields.io endpoint schema | |
| mkdir -p .github/badges | |
| cat > .github/badges/coverage.json << EOF | |
| { | |
| "schemaVersion": 1, | |
| "label": "coverage", | |
| "message": "${COVERAGE}%", | |
| "color": "${COLOR}" | |
| } | |
| EOF | |
| echo "Generated coverage badge: ${COVERAGE}% (${COLOR})" | |
| # Note: Auto-committing badge disabled due to branch protection requiring signed commits | |
| # Badge can be updated manually or via a separate workflow with appropriate permissions | |
| - name: Upload coverage artifacts | |
| uses: actions/upload-artifact@v6 | |
| with: | |
| name: coverage-report | |
| path: | | |
| coverage.out | |
| coverage.html | |
| coverage_report.txt | |
| retention-days: 30 | |
| lint: | |
| name: Lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: '1.25' | |
| cache: true | |
| - name: Install golangci-lint | |
| run: | | |
| curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin latest | |
| echo "$(go env GOPATH)/bin" >> $GITHUB_PATH | |
| - name: Run golangci-lint | |
| run: golangci-lint run --timeout=5m | |
| build: | |
| name: Build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: '1.25' | |
| cache: true | |
| - name: Build | |
| run: go build -v ./... | |
| - name: Build CLI binary | |
| run: go build -o pup . | |
| - name: Verify binary | |
| run: ./pup --version | |
| sast: | |
| name: Datadog Static Analysis | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' | |
| env: | |
| DD_API_KEY: ${{ secrets.DD_API_KEY }} | |
| DD_APP_KEY: ${{ secrets.DD_APP_KEY }} | |
| DD_SITE: ${{ secrets.DD_SITE || 'datadoghq.com' }} | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 # Full history for better SAST analysis | |
| - name: Run Datadog Static Analysis | |
| if: env.DD_API_KEY != '' | |
| run: | | |
| # Install datadog-ci if not already installed | |
| npm install -g @datadog/datadog-ci | |
| # Run static analysis | |
| # This will analyze the code for security vulnerabilities, code quality issues, etc. | |
| datadog-ci sast scan --service=${{ env.DD_SERVICE }} --env=${{ env.DD_ENV }} | |
| - name: SAST disabled notice | |
| if: env.DD_API_KEY == '' | |
| run: | | |
| echo "⚠️ Datadog Static Analysis skipped: DD_API_KEY not configured" | |
| echo "To enable SAST, add DD_API_KEY and DD_APP_KEY as repository secrets" |