Skip to content

Commit 622190d

Browse files
authored
Merge branch 'main' into yiming.luo/clarify-span-dedup-log
2 parents 8de565b + 56d4b5b commit 622190d

70 files changed

Lines changed: 3805 additions & 2139 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.github/copilot-instructions.md

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# Copilot Code Review Instructions
2+
3+
## Security — PII and Secrets
4+
5+
Flag any logging statements (`log::info!`, `log::debug!`, `log::warn!`, `log::error!`,
6+
`tracing::info!`, `tracing::debug!`, `tracing::warn!`, `tracing::error!`, or unqualified
7+
`info!`, `debug!`, `warn!`, `error!` macros (e.g., via `use tracing::{info, debug, warn, error}`))
8+
that may log:
9+
- HTTP request/response headers (Authorization, Cookie, X-API-Key, or similar)
10+
- HTTP request/response bodies or raw payloads
11+
- Any PII fields (e.g., email, name, user_id, ip_address, phone, ssn, date_of_birth)
12+
- API keys, tokens, secrets, or credentials
13+
- Structs or types that contain any of the above fields
14+
- `SendData` values or any variable that contains a `SendData` object (e.g.,
15+
`traces_with_tags` or similar variables built via `.with_api_key(...).build()`),
16+
since these embed the Datadog API key
17+
18+
Suggest redacting or omitting the sensitive field rather than logging it.
19+
20+
## Security — Unsafe Rust
21+
22+
Flag new `unsafe` blocks and explain what invariant the author must uphold to make the
23+
block safe. If there is a safe alternative, suggest it.
24+
25+
## Security — Error Handling
26+
27+
Flag cases where errors are silently swallowed (empty `catch`, `.ok()` without
28+
handling, `let _ = result`) or where operations like `.unwrap()`/`.expect()` may panic,
29+
in code paths that handle external input or network responses.

.github/dependabot.yml

Lines changed: 0 additions & 10 deletions
This file was deleted.

.github/workflows/codeql-analysis.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ jobs:
2929

3030
# Initializes the CodeQL tools for scanning.
3131
- name: Initialize CodeQL
32-
uses: github/codeql-action/init@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0
32+
uses: github/codeql-action/init@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
3333
with:
3434
languages: ${{ matrix.language }}
3535
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -38,7 +38,7 @@ jobs:
3838
# queries: ./path/to/local/query, your-org/your-repo/queries@main
3939

4040
- name: Autobuild
41-
uses: github/codeql-action/autobuild@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0
41+
uses: github/codeql-action/autobuild@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
4242

4343
- name: Perform CodeQL Analysis
44-
uses: github/codeql-action/analyze@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0
44+
uses: github/codeql-action/analyze@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
name: Nightly serverless-init build
2+
3+
on:
4+
schedule:
5+
# 2 AM UTC (~9-10 PM ET), daily
6+
- cron: "0 2 * * *"
7+
workflow_dispatch:
8+
9+
env:
10+
IMAGE_NAME: datadog/datadog-lambda-extension/serverless-init
11+
REGISTRY: ghcr.io
12+
13+
jobs:
14+
build-nightly:
15+
runs-on: ubuntu-22.04
16+
permissions:
17+
contents: read
18+
packages: write
19+
strategy:
20+
matrix:
21+
arrays:
22+
- { dockerFile: "Dockerfile.serverless-init.build", isAlpine: "false", tagSuffix: "" }
23+
- { dockerFile: "Dockerfile.serverless-init.alpine.build", isAlpine: "true", tagSuffix: "-alpine" }
24+
name: "Nightly Build (isAlpine: ${{ matrix.arrays.isAlpine }})"
25+
steps:
26+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
27+
28+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
29+
with:
30+
repository: DataDog/datadog-agent
31+
ref: main
32+
path: datadog-agent
33+
34+
- name: Compute version tags
35+
id: meta
36+
run: |
37+
STAMP=$(date -u +%Y%m%d)
38+
SHORT_SHA=$(git -C datadog-agent rev-parse --short=8 HEAD)
39+
AGENT_VERSION=$(grep -m 1 -E '^[0-9]+\.[0-9]+\.[0-9]+$' datadog-agent/CHANGELOG.rst) || { echo "ERROR: could not detect agent version from datadog-agent's CHANGELOG.rst"; exit 1; }
40+
echo "stamp=${STAMP}" >> "$GITHUB_OUTPUT"
41+
echo "short_sha=${SHORT_SHA}" >> "$GITHUB_OUTPUT"
42+
echo "version=nightly-${STAMP}-${SHORT_SHA}" >> "$GITHUB_OUTPUT"
43+
echo "agent_version=${AGENT_VERSION}" >> "$GITHUB_OUTPUT"
44+
45+
# Pin QEMU to a known-good version. See release-serverless-init.yml
46+
# and test-qemu-versions.yml for context on QEMU breakage history.
47+
- name: Set up QEMU
48+
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
49+
with:
50+
image: tonistiigi/binfmt:qemu-v10.1.3
51+
52+
- name: Set up Docker Buildx
53+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
54+
55+
- name: Build binaries
56+
working-directory: ./scripts
57+
run: ./build_serverless_init.sh
58+
env:
59+
AGENT_PATH: datadog-agent
60+
VERSION: ${{ steps.meta.outputs.version }}
61+
AGENT_VERSION: ${{ steps.meta.outputs.agent_version }}
62+
SERVERLESS_INIT: "true"
63+
ALPINE: ${{ matrix.arrays.isAlpine }}
64+
65+
- name: Set up build directory and copy binaries
66+
run: cp -r .layers/. ./scripts/bin/
67+
68+
- name: Set up tracer installation script
69+
run: cp ./scripts/serverless_init_dotnet.sh ./scripts/bin/
70+
71+
- name: Login to GHCR
72+
uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
73+
with:
74+
registry: ${{ env.REGISTRY }}
75+
username: ${{ github.actor }}
76+
password: ${{ secrets.GITHUB_TOKEN }}
77+
78+
- name: Build and push
79+
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
80+
with:
81+
context: ./scripts
82+
file: ./scripts/${{ matrix.arrays.dockerFile }}
83+
push: true
84+
tags: |
85+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest-main${{ matrix.arrays.tagSuffix }}
86+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:main-${{ steps.meta.outputs.stamp }}-${{ steps.meta.outputs.short_sha }}${{ matrix.arrays.tagSuffix }}
87+
provenance: false
88+
platforms: linux/amd64,linux/arm64
89+
90+
retry:
91+
needs: [build-nightly]
92+
if: failure() && fromJSON(github.run_attempt) < 2
93+
runs-on: ubuntu-22.04
94+
permissions:
95+
actions: write
96+
steps:
97+
- name: Retry failed action
98+
env:
99+
GH_REPO: ${{ github.repository }}
100+
GH_TOKEN: ${{ github.token }}
101+
run: gh workflow run retry-workflow.yml -F run_id=${{ github.run_id }}
102+
103+
notify:
104+
needs: [build-nightly]
105+
if: failure() && fromJSON(github.run_attempt) >= 2
106+
runs-on: ubuntu-22.04
107+
steps:
108+
- name: Notify Slack
109+
env:
110+
SLACK_CHANNEL: "#serverless-agent"
111+
SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
112+
run: |
113+
OPS_MESSAGE=":gh-check-failed: Nightly serverless-init build failed!
114+
115+
The nightly build from datadog-agent main did not succeed after retry.
116+
117+
See ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID} for details."
118+
119+
curl -H "Content-type: application/json" -X POST "$SLACK_WEBHOOK" \
120+
-d "$(jq -n --arg channel "$SLACK_CHANNEL" --arg text "$OPS_MESSAGE" '{channel: $channel, text: $text}')"

.github/workflows/release-serverless-init.yml

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ on:
2222
- "no"
2323
agentVersion:
2424
type: string
25-
description: Datadog agent version
25+
description: Datadog agent version (default latest release tag from Datadog agent branch)
2626
agentBranch:
2727
type: string
2828
description: Datadog agent branch or tag name (default main)
@@ -53,6 +53,15 @@ jobs:
5353
ref: ${{ github.event.inputs.agentBranch }}
5454
path: datadog-agent
5555

56+
- name: Compute agent version
57+
id: meta
58+
run: |
59+
AGENT_VERSION="${{ github.event.inputs.agentVersion }}"
60+
if [ -z "$AGENT_VERSION" ]; then
61+
AGENT_VERSION=$(grep -m 1 -E '^[0-9]+\.[0-9]+\.[0-9]+$' datadog-agent/CHANGELOG.rst) || { echo "ERROR: could not detect agent version from datadog-agent's CHANGELOG.rst; set the Datadog agent version manually"; exit 1; }
62+
fi
63+
echo "agent_version=${AGENT_VERSION}" >> "$GITHUB_OUTPUT"
64+
5665
# Pin QEMU to a known-good version. The default (binfmt:latest) has broken
5766
# arm64 emulation multiple times due to QEMU segfaults in libc-bin triggers:
5867
# - Feb 2025: qemu-v9.2.0 — PR #571 pinned, PR #581 reverted to :latest
@@ -76,7 +85,7 @@ jobs:
7685
VERSION: ${{ github.event.inputs.tag }}
7786
SERVERLESS_INIT: true
7887
ALPINE: ${{ matrix.arrays.isAlpine }}
79-
AGENT_VERSION: ${{ github.event.inputs.agentVersion }}
88+
AGENT_VERSION: ${{ steps.meta.outputs.agent_version }}
8089

8190
- name: Set up build directory and copy binaries
8291
run: |

.github/workflows/rs_ci.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@ jobs:
135135
- uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606 # v1.15.4
136136
with:
137137
cache: false
138-
- uses: taiki-e/install-action@c12d62a803cbdfe2e7263af15f5a9548065cb4f2 # v2.69.3
138+
- uses: taiki-e/install-action@328a871ad8f62ecac78390391f463ccabc974b72 # v2.69.9
139139
with:
140140
tool: nextest@0.9
141141
- uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9

.github/workflows/secrets-scan.yml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: Secrets Scan
2+
3+
on:
4+
pull_request:
5+
push:
6+
branches:
7+
- main
8+
9+
jobs:
10+
gitleaks:
11+
name: Secrets Scan
12+
runs-on: ubuntu-22.04
13+
permissions:
14+
contents: read
15+
steps:
16+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
17+
with:
18+
fetch-depth: 0
19+
20+
- name: Run gitleaks
21+
uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9
22+
with:
23+
args: --redact
24+
env:
25+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
26+
GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}

.github/workflows/serverless-init-vulnerability-scan.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ jobs:
3535
runs-on: ubuntu-22.04
3636
steps:
3737
- name: Scan latest serverless-init image with grype
38-
uses: anchore/scan-action@7037fa011853d5a11690026fb85feee79f4c946c # v7.3.2
38+
uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
3939
with:
4040
image: "datadog/serverless-init:latest"
4141
only-fixed: true
@@ -44,7 +44,7 @@ jobs:
4444
output-format: table
4545

4646
- name: Scan latest-alpine serverless-init image with grype
47-
uses: anchore/scan-action@7037fa011853d5a11690026fb85feee79f4c946c # v7.3.2
47+
uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
4848
with:
4949
image: "datadog/serverless-init:latest-alpine"
5050
only-fixed: true

.github/workflows/vulnerability-scan.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ jobs:
3737
runs-on: ubuntu-22.04
3838
steps:
3939
- name: Scan latest release image with grype
40-
uses: anchore/scan-action@7037fa011853d5a11690026fb85feee79f4c946c # v7.3.2
40+
uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
4141
with:
4242
image: "public.ecr.aws/datadog/lambda-extension:latest"
4343
only-fixed: true
@@ -46,7 +46,7 @@ jobs:
4646
output-format: table
4747

4848
- name: Scan latest-alpine release image with grype
49-
uses: anchore/scan-action@7037fa011853d5a11690026fb85feee79f4c946c # v7.3.2
49+
uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
5050
with:
5151
image: "public.ecr.aws/datadog/lambda-extension:latest-alpine"
5252
only-fixed: true

.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,3 +30,4 @@ integration-tests/cdk.context.json
3030

3131
.gitlab/pipeline*
3232
/CLAUDE.md
33+
/AGENTS.md

0 commit comments

Comments
 (0)