Revert "Merge pull request #5594 from DataDog/apmlp-1090-remove-jruby… #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Static Analysis | |
| on: # yamllint disable-line rule:truthy | |
| push: | |
| branches: | |
| - master | |
| pull_request: | |
| branches: | |
| - master | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref == 'refs/heads/master' && github.run_id || github.ref }} | |
| cancel-in-progress: true | |
| # Default permissions for all jobs | |
| permissions: {} | |
| jobs: | |
| build: | |
| name: build | |
| runs-on: ubuntu-24.04 | |
| container: | |
| image: ghcr.io/datadog/images-rb/engines/ruby:4.0-gnu-gcc-g47f47df86aeb379fb8b31dc6ad91a91bb3c97516 | |
| env: | |
| BUNDLE_GEMFILE: gemfiles/ruby-4.0.gemfile | |
| BUNDLE_FROZEN: "true" | |
| outputs: | |
| lockfile: ${{ steps.bundle-cache.outputs.lockfile }} | |
| cache-key: ${{ steps.bundle-cache.outputs.cache-key }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Prepare bundle cache | |
| id: bundle-cache | |
| uses: ./.github/actions/bundle-cache | |
| standard: | |
| name: standard/lint | |
| runs-on: ubuntu-24.04 | |
| needs: ['build'] | |
| container: | |
| image: ghcr.io/datadog/images-rb/engines/ruby:4.0-gnu-gcc-g47f47df86aeb379fb8b31dc6ad91a91bb3c97516 | |
| env: | |
| BUNDLE_GEMFILE: gemfiles/ruby-4.0.gemfile | |
| BUNDLE_FROZEN: "true" | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Restore bundle cache | |
| uses: ./.github/actions/bundle-restore | |
| with: | |
| lockfile: ${{ needs.build.outputs.lockfile }} | |
| cache-key: ${{ needs.build.outputs.cache-key }} | |
| - run: bundle exec rubocop -D | |
| - run: bundle exec rake standard | |
| rubocop: | |
| name: rubocop/lint | |
| runs-on: ubuntu-24.04 | |
| needs: ['build'] | |
| container: | |
| image: ghcr.io/datadog/images-rb/engines/ruby:4.0-gnu-gcc-g47f47df86aeb379fb8b31dc6ad91a91bb3c97516 | |
| env: | |
| BUNDLE_GEMFILE: gemfiles/ruby-4.0.gemfile | |
| BUNDLE_FROZEN: "true" | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Restore bundle cache | |
| uses: ./.github/actions/bundle-restore | |
| with: | |
| lockfile: ${{ needs.build.outputs.lockfile }} | |
| cache-key: ${{ needs.build.outputs.cache-key }} | |
| - run: bundle exec rake rubocop | |
| steep: | |
| name: steep/typecheck | |
| runs-on: ubuntu-24.04 | |
| needs: ['build'] | |
| container: | |
| image: ghcr.io/datadog/images-rb/engines/ruby:4.0-gnu-gcc-g47f47df86aeb379fb8b31dc6ad91a91bb3c97516 | |
| env: | |
| BUNDLE_GEMFILE: gemfiles/ruby-4.0.gemfile | |
| BUNDLE_FROZEN: "true" | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Restore bundle cache | |
| uses: ./.github/actions/bundle-restore | |
| with: | |
| lockfile: ${{ needs.build.outputs.lockfile }} | |
| cache-key: ${{ needs.build.outputs.cache-key }} | |
| - name: Check for stale signature files | |
| run: bundle exec rake rbs:stale | |
| - name: Check for missing signature files | |
| run: bundle exec rake rbs:missing | |
| - name: Check types | |
| run: bundle exec rake steep:check | |
| - name: Record stats | |
| run: bundle exec rake steep:stats[md] >> "$GITHUB_STEP_SUMMARY" | |
| bundler-audit: | |
| name: bundler-audit | |
| # TODO: re-enable once the pre-existing high/critical CVE backlog across | |
| # the 368 eligible lockfiles is triaged (either fixed or reviewed into | |
| # .bundler-audit.yml). Until then this job would fail on every PR. | |
| if: false | |
| runs-on: ubuntu-24.04 | |
| needs: ['build'] | |
| container: | |
| image: ghcr.io/datadog/images-rb/engines/ruby:4.0-gnu-gcc-g47f47df86aeb379fb8b31dc6ad91a91bb3c97516 | |
| env: | |
| BUNDLE_GEMFILE: gemfiles/ruby-4.0.gemfile | |
| BUNDLE_FROZEN: "true" | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Restore bundle cache | |
| uses: ./.github/actions/bundle-restore | |
| with: | |
| lockfile: ${{ needs.build.outputs.lockfile }} | |
| cache-key: ${{ needs.build.outputs.cache-key }} | |
| - run: bundle exec rake dependency:audit | |
| checksum-coverage: | |
| name: checksum-coverage | |
| runs-on: ubuntu-24.04 | |
| needs: ['build'] | |
| container: | |
| image: ghcr.io/datadog/images-rb/engines/ruby:4.0-gnu-gcc-g47f47df86aeb379fb8b31dc6ad91a91bb3c97516 | |
| env: | |
| BUNDLE_GEMFILE: gemfiles/ruby-4.0.gemfile | |
| BUNDLE_FROZEN: "true" | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Restore bundle cache | |
| uses: ./.github/actions/bundle-restore | |
| with: | |
| lockfile: ${{ needs.build.outputs.lockfile }} | |
| cache-key: ${{ needs.build.outputs.cache-key }} | |
| - run: bundle exec rake dependency:checksum_coverage | |
| semgrep: | |
| name: semgrep/ci | |
| runs-on: ubuntu-24.04 | |
| container: semgrep/semgrep:1.169.0 # PENDING: Possible to be rate limited. | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - run: | | |
| semgrep ci \ | |
| --include=bin/* \ | |
| --include=ext/* \ | |
| --include=lib/* \ | |
| --exclude-rule=ruby.lang.security.model-attributes-attr-accessible.model-attributes-attr-accessible | |
| env: | |
| SEMGREP_RULES: p/default | |
| zizmor: | |
| name: zizmor | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Get GitHub Token via dd-octo-sts | |
| id: generate-token | |
| uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4 | |
| with: | |
| scope: DataDog/dd-trace-rb | |
| policy: self.check | |
| - name: Run zizmor | |
| uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1 | |
| with: | |
| version: 1.26.1 | |
| min-severity: low | |
| advanced-security: false | |
| token: ${{ steps.generate-token.outputs.token }} | |
| actionlint: | |
| name: actionlint | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Run actionlint | |
| env: | |
| ACTIONLINT_IMAGE: rhysd/actionlint@sha256:96d4a8c87dbbfb3bdd324f8fdc285fc3df5261e2decc619a4dd7e8ee52bbfd46 # 1.7.8 | |
| run: | | |
| docker run --rm \ | |
| --volume "$GITHUB_WORKSPACE:/repo:ro" \ | |
| --workdir /repo \ | |
| "$ACTIONLINT_IMAGE" \ | |
| -color | |
| yaml-lint: | |
| name: yaml-lint | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - run: pip install yamllint | |
| - name: Run yamllint | |
| run: yamllint --strict . | |
| complete: | |
| name: Static Analysis (complete) | |
| needs: | |
| - 'steep' | |
| - 'standard' | |
| - 'rubocop' | |
| - 'semgrep' | |
| - 'zizmor' | |
| - 'actionlint' | |
| - 'yaml-lint' | |
| - 'checksum-coverage' | |
| # TODO: add 'bundler-audit' back to this list | |
| # once those jobs are no longer disabled (see their `if: false` above) | |
| # — a skipped dependency would otherwise make this aggregate job skip too. | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - run: echo "Done" |