Skip to content

Commit e024c38

Browse files
PerfectSlayerPerfectSlayer
authored
Upgrade GitHub workflows (#7531)
* feat: Add permissions description to add-milestone-to-pull-requests workflow * feat: Add permissions description to add-release-to-cloudfoundry workflow * feat: Update and pin actions version of ci-static-analysis workflow * feat: Rename ci-static-analysis workflow * feat: Make sure submodules are checkout before analysis * feat: Upgrade codeql-analysis Remove to analize-changes-with-github-codeql Remove sarif upload as workflow run artifact Upgrade GitHub actions and datadog-ci CLI * feat: Merge all code scanners into a single workflow * feat: Add permissions description for comment-on-submodule-update workflow * feat: Update create-next-milestone-workflow Update GitHub actions version Add permissions description * feat: Add permissions description for draft-release-notes-on-tag workflow * feat: Upload trivy results to Datadog * feat: Upgradle lib-injection-prune-registry Rename to prune-github-container-registry Remove dd-lib-java-init-test-app cleanup as it is no more used * feat: Add permissions descriptiof of update-download-releases workflow * feat: Update GitHub actions version * chore: Clean up update-gradle-description permissions description * feat: Add permissions description of update-issues-on-release workflow * chore: Remove gradle-wrapper-validation workflow * chore: Fix typo Fix file extension Fix formatting * feat: Add documentation about allowed actions * chore: Fix typo * feat: Improve and unify build command
1 parent 7438ef7 commit e024c38

16 files changed

Lines changed: 203 additions & 235 deletions

‎.github/workflows/README.md‎

Lines changed: 22 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -74,52 +74,46 @@ _Action:_
7474

7575
_Recovery:_ Check at the milestone for the related issues and update them manually.
7676

77+
### prune-github-container-registry [🔗](prune-github-container-registry.yaml)
78+
79+
_Trigger:_ Every week or manually.
80+
81+
_Action:_ Clean up old lib-injection OCI images from GitHub Container Registry.
82+
83+
_Recovery:_ Manually trigger the action again.
84+
7785
## Code Quality and Security
7886

79-
### ci-static-analysis [🔗](ci-static-analysis.yml)
87+
### analyze-changes [🔗](analyze-changes-with-github-codeql.yaml)
8088

81-
_Trigger:_ When pushing commits to `master` or any pull request to `master`.
89+
_Trigger:_ When pushing commits to `master` or any pull request targeting `master`.
8290

83-
_Actions:_ Run [DataDog Static Analysis](https://docs.datadoghq.com/static_analysis/) and upload result to DataDog Code Analysis.
91+
_Action:_
92+
* Run [DataDog Static Analysis](https://docs.datadoghq.com/static_analysis/) and upload result to DataDog Code Analysis,
93+
* Run [GitHub CodeQL](https://codeql.github.com/) action, upload result to GitHub security tab and DataDog Code Analysis -- do not apply to pull request, only when pushing to `master`,
94+
* Run [Trivy security scanner](https://github.com/aquasecurity/trivy) on built artifacts and upload result to GitHub security tab.
8495

8596
### comment-on-submodule-update [🔗](comment-on-submodule-update.yaml)
8697

8798
_Trigger:_ When creating a PR commits to `master` or a `release/*` branch with a Git Submodule update.
8899

89100
_Action:_ Notify the PR author through comments that about the Git Submodule update.
90101

91-
### codeql-analysis [🔗](codeql-analysis.yml)
92-
93-
_Trigger:_ When pushing commits to `master`.
94-
95-
_Action:_ Run GitHub CodeQL action, upload result to GitHub security tab and DataDog Code Analysis.
96-
97-
### update-gradle-dependencies [🔗](trivy-analysis.yml)
102+
### update-gradle-dependencies [🔗](update-gradle-dependencies.yml)
98103

99104
_Trigger:_ Every week or manually.
100105

101106
_Action:_ Create a PR updating the Grade dependencies and their locking files.
102107

103108
_Recovery:_ Manually trigger the action again.
104109

105-
### trivy-analysis [🔗](trivy-analysis.yml)
106110

107-
_Trigger:_ When pushing commits to `master` or any pull request to `master`.
111+
## Maintenance
108112

109-
_Action:_ Run Trivy security scanner on built artifacts and upload result to GitHub security tab.
113+
GitHub actions should be part of the [repository allowed actions to run](https://github.com/DataDog/dd-trace-java/settings/actions).
114+
While GitHub owned actions are allowed by default, the other ones must be declared.
110115

111-
### gradle-wrapper-validation [🔗](gradle-wrapper-validation.yaml.disabled)
112-
113-
**DISABLED** - GitHub provides a way to disable actions rather than changing their extensions.
114-
115-
_Comment:_ To delete?
116-
117-
## Lib Injection
118-
119-
### lib-injection-prune-registry [🔗](lib-injection-prune-registry.yaml)
120-
121-
_Trigger:_ Every week or manually.
122-
123-
_Action:_ Clean up old lib-injection Docker images from GHCR.
124-
125-
_Recovery:_ Manually trigger the action again.
116+
Run the following script to get the list of actions to declare according the state of your working copy:
117+
```bash
118+
find .github/workflows -name "*.yaml" -exec awk '/uses:/{print $2 ","}' {} \; | grep -vE '^(actions|github)/' | sort | uniq
119+
```

‎.github/workflows/add-milestone-to-pull-requests.yaml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,12 @@ on:
55
branches:
66
- master
77
- release/v*
8-
98
jobs:
109
add_milestone_to_merged:
11-
if: github.event.pull_request.merged && github.event.pull_request.milestone == null
1210
name: Add milestone to merged pull requests
11+
permissions:
12+
issues: write # Required to update the milestone of a pull request
13+
if: github.event.pull_request.merged && github.event.pull_request.milestone == null
1314
runs-on: ubuntu-latest
1415
steps:
1516
- name: Add milestone to merged pull requests

‎.github/workflows/add-release-to-cloudfoundry.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ on:
55
- released
66
jobs:
77
update-releases:
8+
permissions:
9+
contents: write # Required to commit and push changes to the repository
810
runs-on: ubuntu-latest
911
steps:
1012
- name: Checkout "cloudfoundry" branch

‎.github/workflows/analyze-changes.yaml‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
name: Analyze changes
2+
3+
on:
4+
push:
5+
branches: [ master ]
6+
pull_request:
7+
# The branches below must be a subset of the branches above
8+
branches: [ master ]
9+
10+
jobs:
11+
datadog-static-analyzer:
12+
name: Analyze changes with DataDog Static Analyzer
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Checkout repository
16+
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # 4.1.6
17+
with:
18+
submodules: 'recursive'
19+
- name: Check code meets quality standards
20+
id: datadog-static-analysis
21+
uses: DataDog/datadog-static-analyzer-github-action@c74aff158c8cc1c3e285660713bcaa5f9c6d696e # v1
22+
with:
23+
dd_app_key: ${{ secrets.DD_APP_KEY }}
24+
dd_api_key: ${{ secrets.DD_API_KEY }}
25+
dd_site: datad0g.com
26+
dd_service: "dd-trace-java"
27+
dd_env: "ci"
28+
cpu_count: 2
29+
enable_performance_statistics: false
30+
31+
codeql:
32+
name: Analyze changes with GitHub CodeQL
33+
# Don’t run on PR, only when pushing to master
34+
if: github.event_name == 'push' && github.ref == 'refs/heads/master'
35+
runs-on: ubuntu-latest
36+
permissions:
37+
actions: read
38+
contents: read
39+
security-events: write # Required to upload the results to the Security tab
40+
41+
steps:
42+
- name: Checkout repository
43+
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # 4.1.6
44+
with:
45+
submodules: 'recursive'
46+
- name: Initialize CodeQL
47+
uses: github/codeql-action/init@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v3.26.6
48+
with:
49+
languages: 'java'
50+
build-mode: 'manual'
51+
- name: Build dd-trace-java for creating the CodeQL database
52+
run: |
53+
GRADLE_OPTS="-Dorg.gradle.jvmargs='-Xmx2G -Xms2G'" \
54+
JAVA_HOME=$JAVA_HOME_8_X64 \
55+
JAVA_8_HOME=$JAVA_HOME_8_X64 \
56+
JAVA_11_HOME=$JAVA_HOME_11_X64 \
57+
JAVA_17_HOME=$JAVA_HOME_17_X64 \
58+
JAVA_21_HOME=$JAVA_HOME_21_X64 \
59+
./gradlew clean :dd-java-agent:shadowJar \
60+
--build-cache --parallel --stacktrace --no-daemon --max-workers=4
61+
- name: Perform CodeQL Analysis and upload results to GitHub Security tab
62+
uses: github/codeql-action/analyze@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v3.26.6
63+
64+
- name: Upload results to Datadog CI Static Analysis
65+
run: |
66+
wget --no-verbose https://github.com/DataDog/datadog-ci/releases/download/v2.42.0/datadog-ci_linux-x64 -O datadog-ci
67+
chmod +x datadog-ci
68+
./datadog-ci sarif upload /home/runner/work/dd-trace-java/results/java.sarif --service dd-trace-java --env ci
69+
env:
70+
DD_API_KEY: ${{ secrets.DD_API_KEY }}
71+
DD_SITE: datad0g.com
72+
73+
trivy:
74+
name: Analyze changes with Trivy
75+
runs-on: ubuntu-latest
76+
permissions:
77+
actions: read
78+
contents: read
79+
security-events: write # Required to upload the results to the Security tab
80+
81+
steps:
82+
- name: Checkout repository
83+
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # 4.1.6
84+
with:
85+
submodules: 'recursive'
86+
87+
- name: Remove old artifacts
88+
run: |
89+
MVN_LOCAL_REPO=$(./mvnw help:evaluate -Dexpression=settings.localRepository -q -DforceStdout)
90+
echo "MVN_LOCAL_REPO=${MVN_LOCAL_REPO}" >> "$GITHUB_ENV"
91+
rm -rf "${MVN_LOCAL_REPO}/com/datadoghq"
92+
93+
- name: Build and publish artifacts locally
94+
run: |
95+
GRADLE_OPTS="-Dorg.gradle.jvmargs='-Xmx2G -Xms2G'" \
96+
JAVA_HOME=$JAVA_HOME_8_X64 \
97+
JAVA_8_HOME=$JAVA_HOME_8_X64 \
98+
JAVA_11_HOME=$JAVA_HOME_11_X64 \
99+
JAVA_17_HOME=$JAVA_HOME_17_X64 \
100+
JAVA_21_HOME=$JAVA_HOME_21_X64 \
101+
./gradlew clean publishToMavenLocal \
102+
--build-cache --parallel --stacktrace --no-daemon --max-workers=4
103+
104+
- name: Copy published artifacts
105+
run: |
106+
mkdir -p ./workspace/.trivy
107+
cp -RP "${MVN_LOCAL_REPO}/com/datadoghq" ./workspace/.trivy/
108+
ls -laR "./workspace/.trivy"
109+
110+
- name: Run Trivy security scanner
111+
uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 # v0.24.0
112+
with:
113+
scan-type: rootfs
114+
scan-ref: './workspace/.trivy/'
115+
format: 'sarif'
116+
output: 'trivy-results.sarif'
117+
severity: 'CRITICAL,HIGH'
118+
limit-severities-for-sarif: true
119+
120+
- name: Upload Trivy scan results to GitHub Security tab
121+
uses: github/codeql-action/upload-sarif@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v3.26.6
122+
if: always()
123+
with:
124+
sarif_file: 'trivy-results.sarif'
125+
126+
- name: Upload results to Datadog CI Static Analysis
127+
run: |
128+
wget --no-verbose https://github.com/DataDog/datadog-ci/releases/download/v2.42.0/datadog-ci_linux-x64 -O datadog-ci
129+
chmod +x datadog-ci
130+
./datadog-ci sarif upload trivy-results.sarif --service dd-trace-java --env ci
131+
env:
132+
DD_API_KEY: ${{ secrets.DD_API_KEY }}
133+
DD_SITE: datad0g.com

‎.github/workflows/ci-static-analysis.yml‎

Lines changed: 0 additions & 25 deletions
This file was deleted.

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 0 additions & 54 deletions
This file was deleted.

‎.github/workflows/comment-on-submodule-update.yaml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,13 @@ on:
1010

1111
jobs:
1212
comment_on_submodule_update:
13+
permissions:
14+
issues: write # Required to create a comment on the pull request
1315
runs-on: ubuntu-latest
1416

1517
steps:
1618
- name: Post comment on submodule update
17-
uses: actions/github-script@d556feaca394842dc55e4734bf3bb9f685482fa0 # 6.3.3
19+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # 7.0.1
1820
with:
1921
github-token: ${{secrets.GITHUB_TOKEN}}
2022
script: |

‎.github/workflows/create-next-milestone.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,15 +5,17 @@ on:
55

66
jobs:
77
create_next_milestone:
8+
permissions:
9+
issues: write # Required to create a milestone
810
runs-on: ubuntu-latest
911
steps:
1012
- name: Get next minor version
1113
id: semvers
12-
uses: WyriHaximus/github-action-next-semvers@33d116a4c239252582a60a1ba8dbba63ad493ffd # 1.1.0
14+
uses: WyriHaximus/github-action-next-semvers@18aa9ed4152808ab99b88d71f5481e41f8d89930 # 1.2.1
1315
with:
1416
version: ${{ github.event.milestone.title }}
1517
- name: Create next milestone
16-
uses: WyriHaximus/github-action-create-milestone@b86699ba7511fa3b61154ac8675d86b01938fc16 # 1.0.0
18+
uses: WyriHaximus/github-action-create-milestone@bb0276ee386c630b476fa3ca788457bf3daa7c2e # 1.1.1
1719
with:
1820
title: ${{ steps.semvers.outputs.minor }}
1921
env:

‎.github/workflows/draft-release-notes-on-tag.yaml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,14 @@ on:
66
jobs:
77
draft_release_notes:
88
name: Draft release notes
9+
permissions:
10+
contents: write # Required to create a release
911
if: (github.event.ref_type == 'tag' && github.event.master_branch == 'master') || github.event_name == 'workflow_dispatch'
1012
runs-on: ubuntu-latest
1113
steps:
1214
- name: Get milestone title
1315
id: milestoneTitle
14-
uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # 6.4.1
16+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # 7.0.1
1517
with:
1618
result-encoding: string
1719
script: |

‎.github/workflows/gradle-wrapper-validation.yaml.disabled‎

Lines changed: 0 additions & 11 deletions
This file was deleted.

0 commit comments

Comments
 (0)