check.yml

name: Static Analysis

on: # yamllint disable-line rule:truthy
  push:
    branches:
      - master
  pull_request:
    branches:
      - master

concurrency:
  group: ${{ github.workflow }}-${{ github.ref == 'refs/heads/master' && github.run_id || github.ref }}
  cancel-in-progress: true

# Default permissions for all jobs
permissions: {}

jobs:
  build:
    name: build
    runs-on: ubuntu-24.04
    container:
      image: ghcr.io/datadog/images-rb/engines/ruby:4.0-gnu-gcc-g47f47df86aeb379fb8b31dc6ad91a91bb3c97516
      env:
        BUNDLE_GEMFILE: gemfiles/ruby-4.0.gemfile
        BUNDLE_FROZEN: "true"
    outputs:
      lockfile: ${{ steps.bundle-cache.outputs.lockfile }}
      cache-key: ${{ steps.bundle-cache.outputs.cache-key }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Prepare bundle cache
        id: bundle-cache
        uses: ./.github/actions/bundle-cache

  standard:
    name: standard/lint
    runs-on: ubuntu-24.04
    needs: ['build']
    container:
      image: ghcr.io/datadog/images-rb/engines/ruby:4.0-gnu-gcc-g47f47df86aeb379fb8b31dc6ad91a91bb3c97516
      env:
        BUNDLE_GEMFILE: gemfiles/ruby-4.0.gemfile
        BUNDLE_FROZEN: "true"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Restore bundle cache
        uses: ./.github/actions/bundle-restore
        with:
          lockfile: ${{ needs.build.outputs.lockfile }}
          cache-key: ${{ needs.build.outputs.cache-key }}
      - run: bundle exec rubocop -D
      - run: bundle exec rake standard

  rubocop:
    name: rubocop/lint
    runs-on: ubuntu-24.04
    needs: ['build']
    container:
      image: ghcr.io/datadog/images-rb/engines/ruby:4.0-gnu-gcc-g47f47df86aeb379fb8b31dc6ad91a91bb3c97516
      env:
        BUNDLE_GEMFILE: gemfiles/ruby-4.0.gemfile
        BUNDLE_FROZEN: "true"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Restore bundle cache
        uses: ./.github/actions/bundle-restore
        with:
          lockfile: ${{ needs.build.outputs.lockfile }}
          cache-key: ${{ needs.build.outputs.cache-key }}
      - run: bundle exec rake rubocop

  steep:
    name: steep/typecheck
    runs-on: ubuntu-24.04
    needs: ['build']
    container:
      image: ghcr.io/datadog/images-rb/engines/ruby:4.0-gnu-gcc-g47f47df86aeb379fb8b31dc6ad91a91bb3c97516
      env:
        BUNDLE_GEMFILE: gemfiles/ruby-4.0.gemfile
        BUNDLE_FROZEN: "true"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Restore bundle cache
        uses: ./.github/actions/bundle-restore
        with:
          lockfile: ${{ needs.build.outputs.lockfile }}
          cache-key: ${{ needs.build.outputs.cache-key }}
      - name: Check for stale signature files
        run: bundle exec rake rbs:stale
      - name: Check for missing signature files
        run: bundle exec rake rbs:missing
      - name: Check types
        run: bundle exec rake steep:check
      - name: Record stats
        run: bundle exec rake steep:stats[md] >> "$GITHUB_STEP_SUMMARY"

  bundler-audit:
    name: bundler-audit
    # TODO: re-enable once the pre-existing high/critical CVE backlog across
    # the 368 eligible lockfiles is triaged (either fixed or reviewed into
    # .bundler-audit.yml). Until then this job would fail on every PR.
    if: false
    runs-on: ubuntu-24.04
    needs: ['build']
    container:
      image: ghcr.io/datadog/images-rb/engines/ruby:4.0-gnu-gcc-g47f47df86aeb379fb8b31dc6ad91a91bb3c97516
      env:
        BUNDLE_GEMFILE: gemfiles/ruby-4.0.gemfile
        BUNDLE_FROZEN: "true"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Restore bundle cache
        uses: ./.github/actions/bundle-restore
        with:
          lockfile: ${{ needs.build.outputs.lockfile }}
          cache-key: ${{ needs.build.outputs.cache-key }}
      - run: bundle exec rake dependency:audit

  checksum-coverage:
    name: checksum-coverage
    runs-on: ubuntu-24.04
    needs: ['build']
    container:
      image: ghcr.io/datadog/images-rb/engines/ruby:4.0-gnu-gcc-g47f47df86aeb379fb8b31dc6ad91a91bb3c97516
      env:
        BUNDLE_GEMFILE: gemfiles/ruby-4.0.gemfile
        BUNDLE_FROZEN: "true"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Restore bundle cache
        uses: ./.github/actions/bundle-restore
        with:
          lockfile: ${{ needs.build.outputs.lockfile }}
          cache-key: ${{ needs.build.outputs.cache-key }}
      - run: bundle exec rake dependency:checksum_coverage

  semgrep:
    name: semgrep/ci
    runs-on: ubuntu-24.04
    container: semgrep/semgrep:1.169.0 # PENDING: Possible to be rate limited.
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - run: |
          semgrep ci \
          --include=bin/* \
          --include=ext/* \
          --include=lib/* \
          --exclude-rule=ruby.lang.security.model-attributes-attr-accessible.model-attributes-attr-accessible
        env:
          SEMGREP_RULES: p/default

  zizmor:
    name: zizmor
    runs-on: ubuntu-24.04
    permissions:
      id-token: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Get GitHub Token via dd-octo-sts
        id: generate-token
        uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
        with:
          scope: DataDog/dd-trace-rb
          policy: self.check
      - name: Run zizmor
        uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1
        with:
          version: 1.26.1
          min-severity: low
          advanced-security: false
          token: ${{ steps.generate-token.outputs.token }}

  actionlint:
    name: actionlint
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Run actionlint
        env:
          ACTIONLINT_IMAGE: rhysd/actionlint@sha256:96d4a8c87dbbfb3bdd324f8fdc285fc3df5261e2decc619a4dd7e8ee52bbfd46 # 1.7.8
        run: |
          docker run --rm \
            --volume "$GITHUB_WORKSPACE:/repo:ro" \
            --workdir /repo \
            "$ACTIONLINT_IMAGE" \
            -color

  yaml-lint:
    name: yaml-lint
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - run: pip install yamllint
      - name: Run yamllint
        run: yamllint --strict .

  complete:
    name: Static Analysis (complete)
    needs:
      - 'steep'
      - 'standard'
      - 'rubocop'
      - 'semgrep'
      - 'zizmor'
      - 'actionlint'
      - 'yaml-lint'
      - 'checksum-coverage'
      # TODO: add 'bundler-audit' back to this list
      # once those jobs are no longer disabled (see their `if: false` above)
      # — a skipped dependency would otherwise make this aggregate job skip too.
    runs-on: ubuntu-24.04
    steps:
      - run: echo "Done"