Skip to content

Commit 0f508fe

Browse files
cataphractcataphract
authored
Merge branch 'master' into estringana/add-laminas-appsec-integration
2 parents b9e9bbf + 09d8943 commit 0f508fe

95 files changed

Lines changed: 4953 additions & 510 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/chainguard/gitlab-ci-libdatadog-latest.sts.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
issuer: https://gitlab.ddbuild.io
2+
3+
subject_pattern: "project_path:DataDog/apm-reliability/dd-trace-php:ref_type:(branch|tag):ref:.*"
4+
5+
permissions:
6+
contents: write
7+
pull_requests: write

‎.github/chainguard/self.add-asset-to-gh-release.sts.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
issuer: https://token.actions.githubusercontent.com
2+
3+
subject_pattern: "repo:DataDog/dd-trace-php:ref:refs/heads/.+"
4+
5+
claim_pattern:
6+
event_name: workflow_dispatch
7+
repository: DataDog/dd-trace-php
8+
job_workflow_ref: DataDog/dd-trace-php/\.github/workflows/add-asset-to-gh-release\.yml@refs/heads/.+
9+
10+
permissions:
11+
contents: write

‎.github/chainguard/self.auto-add-pr-to-milestone.sts.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
issuer: https://token.actions.githubusercontent.com
2+
3+
subject_pattern: "repo:DataDog/dd-trace-php:pull_request"
4+
5+
claim_pattern:
6+
event_name: pull_request
7+
repository: DataDog/dd-trace-php
8+
job_workflow_ref: DataDog/dd-trace-php/\.github/workflows/auto_add_pr_to_miletone\.yml@refs/(pull/[0-9]+/merge|heads/.+)
9+
10+
permissions:
11+
issues: write
12+
pull_requests: write

‎.github/chainguard/self.auto-check-snapshots.sts.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
issuer: https://token.actions.githubusercontent.com
2+
3+
subject_pattern: "repo:DataDog/dd-trace-php:pull_request"
4+
5+
claim_pattern:
6+
event_name: pull_request
7+
repository: DataDog/dd-trace-php
8+
job_workflow_ref: DataDog/dd-trace-php/\.github/workflows/auto_check_snapshots\.yml@refs/(pull/[0-9]+/merge|heads/.+)
9+
10+
permissions:
11+
pull_requests: write

‎.github/chainguard/self.auto-label-prs.sts.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
issuer: https://token.actions.githubusercontent.com
2+
3+
subject_pattern: "repo:DataDog/dd-trace-php:pull_request"
4+
5+
claim_pattern:
6+
event_name: pull_request
7+
repository: DataDog/dd-trace-php
8+
job_workflow_ref: DataDog/dd-trace-php/\.github/workflows/auto_label_prs\.yml@refs/(pull/[0-9]+/merge|heads/.+)
9+
10+
permissions:
11+
contents: read
12+
issues: write
13+
pull_requests: write

‎.gitignore‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
**/vendor
22
!/ext/vendor
3-
tmp/build_extension/
3+
tmp/
44
composer.lock*
55
**/core*
66
.DS_Store

‎.gitlab-ci.yml‎

Lines changed: 59 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,16 +25,41 @@ generate-templates:
2525
tags: [ "arch:amd64" ]
2626
needs: []
2727
script:
28-
- php ./.gitlab/generate-package.php | tee .gitlab/package-gen.yml
29-
- php ./.gitlab/generate-tracer.php | tee .gitlab/tracer-gen.yml
30-
- php ./.gitlab/generate-appsec.php | tee .gitlab/appsec-gen.yml
28+
- |
29+
touch libdatadog.env # always present so dotenv artifact never errors
30+
# On libdatadog CI schedule: fetch the latest SHA from GitHub, export it so
31+
# generate-common.php can embed it directly in compilation job before_scripts.
32+
if [ "${SCHEDULED_LIBDATADOG_LATEST:-}" = "true" ]; then
33+
set -x
34+
apt update
35+
apt install -y git
36+
LIBDATADOG_PINNED_SHA=$(git ls-tree HEAD libdatadog | awk '{print $3}')
37+
LIBDATADOG_OVERRIDE_SHA=$(git ls-remote https://github.com/DataDog/libdatadog main | cut -f1)
38+
export LIBDATADOG_OVERRIDE_SHA LIBDATADOG_PINNED_SHA
39+
printf 'LIBDATADOG_OVERRIDE_SHA=%s\nLIBDATADOG_PINNED_SHA=%s\n' "$LIBDATADOG_OVERRIDE_SHA" "$LIBDATADOG_PINNED_SHA" >> libdatadog.env
40+
if [ "$LIBDATADOG_OVERRIDE_SHA" = "$LIBDATADOG_PINNED_SHA" ]; then
41+
echo 'LIBDATADOG_NO_CHANGES=true' >> libdatadog.env
42+
else
43+
echo 'LIBDATADOG_NO_CHANGES=false' >> libdatadog.env
44+
fi
45+
elif [ "${CI_COMMIT_BRANCH:-}" = "bot/libdatadog-latest" ]; then
46+
# Feedback run after a bot commit: the submodule already points to the tested SHA.
47+
# Don't export — generate-common.php must not inject fetch/checkout (no-op anyway).
48+
LIBDATADOG_SHA=$(git ls-tree HEAD libdatadog | awk '{print $3}')
49+
printf 'LIBDATADOG_OVERRIDE_SHA=%s\nLIBDATADOG_FEEDBACK_RUN=true\n' "$LIBDATADOG_SHA" >> libdatadog.env
50+
fi
51+
- php ./.gitlab/generate-package.php | tee .gitlab/package-gen.yml
52+
- php ./.gitlab/generate-tracer.php | tee .gitlab/tracer-gen.yml
53+
- php ./.gitlab/generate-appsec.php | tee .gitlab/appsec-gen.yml
3154
- php ./.gitlab/generate-profiler.php | tee .gitlab/profiler-gen.yml
32-
- php ./.gitlab/generate-shared.php | tee .gitlab/shared-gen.yml
55+
- php ./.gitlab/generate-shared.php | tee .gitlab/shared-gen.yml
3356
variables:
3457
GIT_SUBMODULE_STRATEGY: none
3558
artifacts:
3659
paths:
3760
- .gitlab/*-gen.yml
61+
reports:
62+
dotenv: libdatadog.env
3863

3964
tracer-trigger:
4065
stage: tests
@@ -96,3 +121,33 @@ package-trigger:
96121
PARENT_PIPELINE_ID: $CI_PIPELINE_ID
97122
GIT_SUBMODULE_PATHS: libdatadog appsec/third_party/cpp-base64 appsec/third_party/libddwaf appsec/third_party/libddwaf-rust appsec/third_party/msgpack-c
98123
NIGHTLY_BUILD: $NIGHTLY_BUILD
124+
125+
# Runs after the full CI completes. Triggered in two situations:
126+
# 1. Scheduled libdatadog CI run (SCHEDULED_LIBDATADOG_LATEST=true)
127+
# 2. Push to bot/libdatadog-latest by the bot — feeds CI results back so we can verify whether Claude's fixes actually worked. The [no-ci-feedback] marker in bot commits prevents triggering a third run.
128+
analyze-and-create-pr:
129+
stage: deploy
130+
rules:
131+
- if: $SCHEDULED_LIBDATADOG_LATEST == "true"
132+
when: always
133+
- if: '$CI_COMMIT_BRANCH == "bot/libdatadog-latest" && $CI_COMMIT_AUTHOR =~ /github-actions\[bot\]/ && $CI_COMMIT_MESSAGE !~ /\[no-ci-feedback\]/'
134+
when: always
135+
- when: never
136+
needs:
137+
- job: generate-templates
138+
artifacts: true
139+
- tracer-trigger
140+
- appsec-trigger
141+
- profiler-trigger
142+
- shared-trigger
143+
- package-trigger
144+
trigger:
145+
include:
146+
- local: .gitlab/libdatadog-latest.yml
147+
strategy: depend
148+
variables:
149+
LIBDATADOG_OVERRIDE_SHA: $LIBDATADOG_OVERRIDE_SHA
150+
LIBDATADOG_PINNED_SHA: $LIBDATADOG_PINNED_SHA
151+
LIBDATADOG_NO_CHANGES: $LIBDATADOG_NO_CHANGES
152+
LIBDATADOG_FEEDBACK_RUN: $LIBDATADOG_FEEDBACK_RUN
153+
PARENT_PIPELINE_ID: $CI_PIPELINE_ID

‎.gitlab/benchmarks.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -137,6 +137,7 @@ workflow:
137137
UPSTREAM_PROJECT_NAME: $CI_PROJECT_NAME
138138
UPSTREAM_BRANCH: $CI_COMMIT_REF_NAME
139139
UPSTREAM_COMMIT_SHA: $CI_COMMIT_SHA
140+
DD_SIDECAR_DISABLE_DIRECT_EXEC: 1
140141

141142
benchmarks-profiler:
142143
extends: .microbenchmarks

‎.gitlab/compile_extension.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#!/usr/bin/env bash
2-
set -eo pipefail
2+
set -xeo pipefail
33

44
SWITCH_PHP_VERSION=${SWITCH_PHP_VERSION:-}
55
WITH_ASAN=${WITH_ASAN:-}
@@ -20,7 +20,7 @@ if [ "${WITH_ASAN}" -eq "1" ]; then
2020
export COMPILE_ASAN=1
2121
fi
2222
# Compile Rust and PHP in parallel
23-
./compile_rust.sh &
23+
SHARED=1 ./compile_rust.sh &
2424
make -j static &
2525
wait
2626

‎.gitlab/generate-appsec.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@
2929
variables:
3030
FF_ENABLE_BASH_EXIT_CODE_CHECK: "true"
3131
FF_USE_NEW_BASH_EVAL_STRATEGY: "true"
32+
MAVEN_REPOSITORY_PROXY: "https://depot-read-api-java.us1.ddbuild.io/magicmirror/magicmirror/@current/"
3233
CI_REGISTRY_USER:
3334
value: ""
3435
description: "Your docker hub username"

0 commit comments

Comments
 (0)