vaccine.yml

name: Vaccine

on:
  push:
  schedule:
    - cron: '0 7 * * *'
  workflow_dispatch:
    inputs:
      dd-lib-ruby-init-tag:
        description: 'dd-lib-ruby-init image tag'
        required: true
        default: 'latest_snapshot'
      trigger-id:
        description: 'Trigger ID'
        required: false
        default: ''

run-name: "dd-lib-ruby-init:${{ inputs.dd-lib-ruby-init-tag || 'latest_snapshot' }}${{ inputs.trigger-id && format(' {0}', inputs.trigger-id) }}"

jobs:
  inoculate:
    permissions:
      id-token: write # This is required for ecr-login to work - it allows generating short lived oidc tokens used in cross-auth
    name: ${{ matrix.engine.name }} ${{ matrix.engine.version }} with ${{ matrix.command }}
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        command:
          - rails s
          - bin/rails s
          - bundle exec rails s
        engine:
          - name: ruby
            version: '3.4'
            validate: true
          - name: ruby
            version: '3.3'
            validate: true
          - name: ruby
            version: '3.2'
            validate: true
          - name: ruby
            version: '3.1'
            validate: true
          - name: ruby
            version: '3.0'
            validate: true
          - name: ruby
            version: '2.7'
            validate: true
          - name: ruby
            version: '2.6'
            validate: true
          - name: ruby
            version: '2.5'
            validate: false
          - name: ruby
            version: '2.4'
            validate: false
          - name: ruby
            version: '2.3'
            validate: false
        include:
          - engine:
              name: ruby
              version: '2.2'
              validate: false
            command: 'ruby hello.rb'
          - engine:
              name: ruby
              version: '2.1'
              validate: false
            command: 'ruby hello.rb'
          - engine:
              name: ruby
              version: '2.0'
              validate: false
            command: 'ruby hello.rb'
          - engine:
              name: ruby
              version: '1.9'
              validate: false
            command: 'ruby hello.rb'
          - engine:
              name: ruby
              version: '1.8'
              validate: false
            command: 'ruby hello.rb'
    steps:
      - uses: actions/checkout@v4
      - uses: ruby/setup-ruby@v1
        with:
          ruby-version: .ruby-version
      - run: bundle install
      # Prepare mock server 'catadog', https://github.com/DataDog/catadog
      - name: Create catadog records directory
        run: mkdir $GITHUB_WORKSPACE/records
      - name: Setup helpers
        run: |
          cat > retry.sh <<'BASH'
          function retry () {
            local times=999
            local backoff=1
            local rc=0

            if [[ $2 == 'times' ]]; then
              times="$1"
              shift 2
            fi

            if [[ $2 == 'backoff' ]]; then
              backoff="${1//s}"
              shift 2
            fi

            for try in $(seq 1 $(( ${times} + 1 )) ); do
              if "$@"; then return; else rc=$?; fi;

              delay=$(( ${backoff} * ${try} ))
              if [[ $try -le $times ]]; then
                echo "attempt ${try} failed; retrying in ${delay}s"
                sleep ${delay}
              fi
            done

            return $rc
          }
          BASH
      - name: Install catadog
        run: |
          source retry.sh

          retry 5 times 5s backoff docker pull ghcr.io/datadog/catadog:latest

      - name: Spawn catadog
        run: |
          docker run -d \
            --name catadog \
            -v $GITHUB_WORKSPACE/records:/records \
            -p 8128:8128 \
            ghcr.io/datadog/catadog:latest \
            "-h 0.0.0.0 --mock :Sink --no-forward --record /records"
      - name: Wait for catadog
        run: curl -I --retry 12 -f --retry-all-errors --retry-delay 5 -s http://localhost:8128/catadog
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4
        with:
          role-to-assume: arn:aws:iam::235494822917:role/github-actions-oidc
          aws-region: us-east-1
      - name: Set AWS ECR info
        id: ecr
        run: |
          IDENTITY="$(aws sts get-caller-identity --query 'Account' --output text)"
          REGION="$(aws configure get region || true)"

          if [[ -z "${IDENTITY}" ]]; then
             echo 'IDENTITY empty' 2>&1
             exit 1
          fi

          REGION="${REGION:-${AWS_DEFAULT_REGION}}"

          echo "identity=${IDENTITY}" | tee -a "$GITHUB_OUTPUT"
          echo "region=${REGION}" | tee -a "$GITHUB_OUTPUT"
      - name: Login to Amazon ECR
        id: ecr-login
        run: |
          source retry.sh

          retry 5 times 5s backoff bash -c 'aws ecr get-login-password | docker login -u AWS --password-stdin "https://${{ steps.ecr.outputs.identity }}.dkr.ecr.${{ steps.ecr.outputs.region }}.amazonaws.com"'
      # Prepare vaccine
      - name: Prepare vaccine volume
        run: |
          docker create \
            --name init \
            -v vaccine:/datadog-init/package \
            235494822917.dkr.ecr.us-east-1.amazonaws.com/ssi/dd-lib-ruby-init:${{ inputs.dd-lib-ruby-init-tag || 'latest_snapshot' }}
      - name: Build patient:${{ matrix.engine.name }}-${{ matrix.engine.version }}
        run: |
          docker build \
            --tag patient:${{ matrix.engine.name }}-${{ matrix.engine.version }} \
            --file src/${{ matrix.engine.name }}/${{ matrix.engine.version }}/Dockerfile \
            src
      - name: Inject vaccine
        run: |
          docker run -d \
            --name inoculation \
            --network host \
            -v vaccine:/vaccine \
            -e RUBYOPT=-r/vaccine/host_inject \
            -e DD_TRACE_DEBUG=true \
            -e DD_INSTRUMENTATION_TELEMETRY_ENABLED=false \
            -e DD_AGENT_HOST=localhost \
            -e DD_TRACE_AGENT_PORT=8128 \
            -e DD_CRASHTRACKING_ENABLED=true \
            -p 3000:3000 \
            patient:${{ matrix.engine.name }}-${{ matrix.engine.version }} \
            "${{ matrix.command }} -b 0.0.0.0"
      - name: Generate traces
        run: curl -v --retry 12 -f --retry-all-errors --retry-delay 5 -s -o /dev/null http://localhost:3000
      - name: Inspect injection logs
        if: always()
        run: docker logs inoculation
      - name: Crash puma server
        run: sleep 2 && docker exec inoculation bash -c "pgrep -f puma | xargs kill -SEGV" || true
      - name: List records
        run: sleep 2 && ls -al $GITHUB_WORKSPACE/records
      - name: Inspect injection logs
        run: docker logs inoculation
      - if: ${{ matrix.engine.validate }}
        name: Validate crash report
        run: RECORDS_DIR=$GITHUB_WORKSPACE/records bundle exec rspec

  status-check:
    runs-on: ubuntu-24.04
    needs: inoculate
    steps:
      - if: ${{ needs.inoculate.result == 'success' }}
        name: Signal success
        run: exit 0
      - if: ${{ needs.inoculate.result != 'success' }}
        name: Signal failure
        run: exit 1

  notify:
    runs-on: ubuntu-24.04
    needs: inoculate
    if: always() && github.event_name == 'schedule'
    steps:
      - if: ${{ needs.inoculate.result == 'success' }}
        name: Notify on success
        uses: slackapi/slack-github-action@v1.26.0
        env:
          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
        with:
          channel-id: ${{ vars.SLACK_CHANNEL_ID }}
          slack-message: |-
            :github: ${{ github.repository }}: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}

            :github-check: ${{ github.ref_type }}: ${{ github.ref_name }}
      - if: ${{ needs.inoculate.result == 'failure' }}
        name: Notify on failure
        uses: slackapi/slack-github-action@v1.26.0
        env:
          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
        with:
          channel-id: ${{ vars.SLACK_CHANNEL_ID }}
          slack-message: |-
            :github: ${{ github.repository }}: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}

            :red-light: ${{ github.ref_type }}: ${{ github.ref_name }}