split Dockerfile linux build #16
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -11,7 +11,7 @@ on: | |
| jobs: | ||
| mac_job: | ||
| name: macOS | ||
| runs-on: macos-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: actions/setup-go@v5 | ||
|
|
@@ -75,7 +75,7 @@ jobs: | |
|
|
||
| linux_arm64_job: | ||
| name: linux-arm64 | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Set up QEMU | ||
|
|
@@ -99,18 +99,59 @@ jobs: | |
| cp -rf ./native/* external/internal/civisibility/native/ | ||
| - name: Build and run linux-arm64 | ||
| run: | | ||
| docker buildx build --platform linux/arm64 --build-arg GOARCH=arm64 --build-arg FILE_NAME=linux-arm64-libtestoptimization -t libtestoptimization-builder-static:arm64 -f ./Dockerfile-static ../../.. --load | ||
| docker run --rm -v ./output:/libtestoptimization libtestoptimization-builder-static:arm64 | ||
|
|
||
| docker buildx build --platform linux/arm64 --build-arg GOARCH=arm64 --build-arg FILE_NAME=linux-arm64-libtestoptimization -t libtestoptimization-builder-dynamic:arm64 -f ./Dockerfile-dynamic ../../.. --load | ||
| docker run --rm -v ./output:/libtestoptimization libtestoptimization-builder-dynamic:arm64 | ||
| working-directory: external/internal/civisibility/native | ||
| - name: Upload artifact | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: linux-arm64-artifact | ||
| path: external/internal/civisibility/native/output/*.zip* | ||
|
|
||
| linux_arm64_musl_job: | ||
| name: linux-arm64-musl | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Set up QEMU | ||
| uses: docker/setup-qemu-action@v3 | ||
|
There was a problem hiding this comment. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)Pin GitHub Actions by commit hash to ensure supply chain security. Using a branch ( - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
|
There was a problem hiding this comment. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)Pin GitHub Actions by commit hash to ensure supply chain security. Using a branch ( - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||
| - name: Checkout external repository | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| repository: "DataDog/dd-trace-go" | ||
| ref: "main" | ||
| token: ${{ secrets.GITHUB_TOKEN }} | ||
| path: external | ||
| - name: Copy build files | ||
| run: | | ||
| # Create the directory if it doesn't exist | ||
| mkdir -p external/internal/civisibility/native | ||
| # Copy the build files | ||
| cp -rf ./build/* external/internal/civisibility/native/ | ||
| # Copy the native files | ||
| cp -rf ./native/* external/internal/civisibility/native/ | ||
| - name: Build and run linux-arm64-musl | ||
| run: | | ||
| docker buildx build --platform linux/arm64 --build-arg GOARCH=arm64 --build-arg FILE_NAME=linux-arm64-libtestoptimization -t libtestoptimization-builder-static:arm64 -f ./Dockerfile-static-alpine ../../.. --load | ||
| docker run --rm -v ./output:/libtestoptimization libtestoptimization-builder-static:arm64 | ||
|
|
||
| docker buildx build --platform linux/arm64 --build-arg GOARCH=arm64 --build-arg FILE_NAME=linux-arm64-libtestoptimization -t libtestoptimization-builder-dynamic:arm64 -f ./Dockerfile-dynamic-alpine ../../.. --load | ||
| docker run --rm -v ./output:/libtestoptimization libtestoptimization-builder-dynamic:arm64 | ||
| working-directory: external/internal/civisibility/native | ||
| - name: Upload artifact | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: linux-arm64-musl-artifact | ||
| path: external/internal/civisibility/native/output/*.zip* | ||
|
|
||
| linux_amd64_job: | ||
| name: linux-amd64 | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Checkout external repository | ||
|
|
@@ -130,8 +171,11 @@ jobs: | |
| cp -rf ./native/* external/internal/civisibility/native/ | ||
| - name: Build and run linux-amd64 | ||
| run: | | ||
| docker build --platform linux/amd64 --build-arg GOARCH=amd64 --build-arg FILE_NAME=linux-x64-libtestoptimization -t libtestoptimization-builder-static:amd64 -f ./Dockerfile-static ../../.. | ||
| docker run --rm -v ./output:/libtestoptimization libtestoptimization-builder-static:amd64 | ||
|
|
||
| docker build --platform linux/amd64 --build-arg GOARCH=amd64 --build-arg FILE_NAME=linux-x64-libtestoptimization -t libtestoptimization-builder-dynamic:amd64 -f ./Dockerfile-dynamic ../../.. | ||
| docker run --rm -v ./output:/libtestoptimization libtestoptimization-builder-dynamic:amd64 | ||
| working-directory: external/internal/civisibility/native | ||
| - name: Build and run android-arm64 | ||
| run: | | ||
|
|
@@ -144,6 +188,40 @@ jobs: | |
| name: linux-amd64-artifact | ||
| path: external/internal/civisibility/native/output/*.zip* | ||
|
|
||
| linux_amd64_musl_job: | ||
| name: linux-amd64-musl | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Checkout external repository | ||
| uses: actions/checkout@v4 | ||
|
There was a problem hiding this comment. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)Pin GitHub Actions by commit hash to ensure supply chain security. Using a branch ( - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||
| with: | ||
| repository: "DataDog/dd-trace-go" | ||
| ref: "main" | ||
| token: ${{ secrets.GITHUB_TOKEN }} | ||
| path: external | ||
| - name: Copy build files | ||
| run: | | ||
| # Create the directory if it doesn't exist | ||
| mkdir -p external/internal/civisibility/native | ||
| # Copy the build files | ||
| cp -rf ./build/* external/internal/civisibility/native/ | ||
| # Copy the native files | ||
| cp -rf ./native/* external/internal/civisibility/native/ | ||
| - name: Build and run linux-amd64 | ||
| run: | | ||
| docker build --platform linux/amd64 --build-arg GOARCH=amd64 --build-arg FILE_NAME=linux-x64-libtestoptimization -t libtestoptimization-builder-static:amd64 -f ./Dockerfile-static-alpine ../../.. | ||
| docker run --rm -v ./output:/libtestoptimization libtestoptimization-builder-static:amd64 | ||
|
|
||
| docker build --platform linux/amd64 --build-arg GOARCH=amd64 --build-arg FILE_NAME=linux-x64-libtestoptimization -t libtestoptimization-builder-dynamic:amd64 -f ./Dockerfile-dynamic-alpine ../../.. | ||
| docker run --rm -v ./output:/libtestoptimization libtestoptimization-builder-dynamic:amd64 | ||
| working-directory: external/internal/civisibility/native | ||
| - name: Upload artifact | ||
| uses: actions/upload-artifact@v4 | ||
|
There was a problem hiding this comment. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)Pin GitHub Actions by commit hash to ensure supply chain security. Using a branch ( - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||
| with: | ||
| name: linux-amd64-musl-artifact | ||
| path: external/internal/civisibility/native/output/*.zip* | ||
|
|
||
| windows_job: | ||
| name: windows | ||
| runs-on: windows-latest | ||
|
|
@@ -222,7 +300,7 @@ jobs: | |
|
|
||
| collect_artifacts: | ||
| name: Collect all artifacts | ||
| needs: [mac_job, linux_arm64_job, linux_amd64_job, windows_job, linux_arm64_musl_job, linux_amd64_musl_job] | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: write | ||
|
|
@@ -244,6 +322,16 @@ jobs: | |
| with: | ||
| name: linux-amd64-artifact | ||
| path: artifacts | ||
| - name: Download artifacts from linux-arm64-musl job | ||
| uses: actions/download-artifact@v4 | ||
|
There was a problem hiding this comment. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)Pin GitHub Actions by commit hash to ensure supply chain security. Using a branch ( - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||
| with: | ||
| name: linux-arm64-musl-artifact | ||
| path: artifacts | ||
| - name: Download artifacts from linux-amd64-musl job | ||
| uses: actions/download-artifact@v4 | ||
|
There was a problem hiding this comment. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)Pin GitHub Actions by commit hash to ensure supply chain security. Using a branch ( - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||
| with: | ||
| name: linux-amd64-musl-artifact | ||
| path: artifacts | ||
| - name: Download artifacts from windows job | ||
| uses: actions/download-artifact@v4 | ||
| with: | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -195,6 +195,94 @@ jobs: | |
| script: | | ||
| await github.rest.checks.update({ owner: context.repo.owner, repo: context.repo.repo, check_run_id: parseInt("${{ steps.create_check.outputs.check_run_id }}"), status: "completed", conclusion: "${{ job.status }}" === "success" ? "success" : "failure" }); | ||
|
|
||
| linux-amd64-musl-test-docker: | ||
| name: Run Python SDK Tests on Linux AMD64 Alpine with Docker | ||
| needs: download-artifacts | ||
| runs-on: ubuntu-latest | ||
| defaults: | ||
| run: | ||
| working-directory: sdks/python/test-optimization-sdk | ||
| env: | ||
| TEST_OPTIMIZATION_SDK_NATIVE_SEARCH_PATH: ${{ github.workspace }}/build_artifacts | ||
| JOB_DISPLAY_NAME: Run Python SDK Tests on Linux AMD64 Alpine with Docker | ||
|
|
||
| steps: | ||
| - name: Create Check | ||
| id: create_check | ||
| uses: actions/github-script@v7 | ||
| with: | ||
| script: | | ||
| const checkRun = await github.rest.checks.create({ owner: context.repo.owner, repo: context.repo.repo, name: process.env.JOB_DISPLAY_NAME, head_sha: context.sha, status: "in_progress" }); | ||
| core.setOutput("check_run_id", checkRun.data.id); | ||
|
|
||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
There was a problem hiding this comment. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)Pin GitHub Actions by commit hash to ensure supply chain security. Using a branch ( - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||
|
|
||
| - name: Download test artifacts | ||
| uses: actions/download-artifact@v4 | ||
|
There was a problem hiding this comment. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)Pin GitHub Actions by commit hash to ensure supply chain security. Using a branch ( - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||
| with: | ||
| name: test-artifacts | ||
| path: ${{ github.workspace }}/build_artifacts | ||
|
|
||
| - name: Build and run tests | ||
| run: | | ||
| docker build -t python-test-optimization-sdk-test -f ./Dockerfile-alpine . | ||
| docker run -v ${{ github.workspace }}/build_artifacts:/build_artifacts -e TEST_OPTIMIZATION_SDK_NATIVE_SEARCH_PATH=/build_artifacts python-test-optimization-sdk-test | ||
|
|
||
| - name: Update Check | ||
| if: always() | ||
| uses: actions/github-script@v7 | ||
| with: | ||
| script: | | ||
| await github.rest.checks.update({ owner: context.repo.owner, repo: context.repo.repo, check_run_id: parseInt("${{ steps.create_check.outputs.check_run_id }}"), status: "completed", conclusion: "${{ job.status }}" === "success" ? "success" : "failure" }); | ||
|
|
||
| linux-arm64-musl-test: | ||
| name: Run Python SDK Tests on Linux ARM64 Alpine | ||
| needs: download-artifacts | ||
| runs-on: ubuntu-latest | ||
| defaults: | ||
| run: | ||
| working-directory: sdks/python/test-optimization-sdk | ||
| env: | ||
| TEST_OPTIMIZATION_SDK_NATIVE_SEARCH_PATH: ${{ github.workspace }}/build_artifacts | ||
| JOB_DISPLAY_NAME: Run Python SDK Tests on Linux ARM64 Alpine | ||
|
|
||
| steps: | ||
| - name: Create Check | ||
| id: create_check | ||
| uses: actions/github-script@v7 | ||
|
There was a problem hiding this comment. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)Pin GitHub Actions by commit hash to ensure supply chain security. Using a branch ( - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||
| with: | ||
| script: | | ||
| const checkRun = await github.rest.checks.create({ owner: context.repo.owner, repo: context.repo.repo, name: process.env.JOB_DISPLAY_NAME, head_sha: context.sha, status: "in_progress" }); | ||
| core.setOutput("check_run_id", checkRun.data.id); | ||
|
|
||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Download test artifacts | ||
| uses: actions/download-artifact@v4 | ||
| with: | ||
| name: test-artifacts | ||
| path: ${{ github.workspace }}/build_artifacts | ||
|
|
||
| - name: Set up QEMU | ||
| uses: docker/setup-qemu-action@v3 | ||
|
There was a problem hiding this comment. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)Pin GitHub Actions by commit hash to ensure supply chain security. Using a branch ( - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||
|
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
|
There was a problem hiding this comment. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)Pin GitHub Actions by commit hash to ensure supply chain security. Using a branch ( - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||
|
|
||
| - name: Build and run tests | ||
| run: | | ||
| docker buildx build --platform linux/arm64 -t python-test-optimization-sdk-test -f ./Dockerfile-alpine . --load | ||
| docker run -v ${{ github.workspace }}/build_artifacts:/build_artifacts -e TEST_OPTIMIZATION_SDK_NATIVE_SEARCH_PATH=/build_artifacts python-test-optimization-sdk-test | ||
|
|
||
| - name: Update Check | ||
| if: always() | ||
| uses: actions/github-script@v7 | ||
| with: | ||
| script: | | ||
| await github.rest.checks.update({ owner: context.repo.owner, repo: context.repo.repo, check_run_id: parseInt("${{ steps.create_check.outputs.check_run_id }}"), status: "completed", conclusion: "${{ job.status }}" === "success" ? "success" : "failure" }); | ||
|
|
||
| macos-test: | ||
| name: Run Python SDK Tests on macOS | ||
| needs: download-artifacts | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -189,6 +189,93 @@ jobs: | |
| script: | | ||
| await github.rest.checks.update({ owner: context.repo.owner, repo: context.repo.repo, check_run_id: parseInt("${{ steps.create_check.outputs.check_run_id }}"), status: "completed", conclusion: "${{ job.status }}" === "success" ? "success" : "failure" }); | ||
|
|
||
| linux-amd64-musl-test-docker: | ||
| name: Run Rust SDK Tests on Linux AMD64 Alpine with Docker | ||
| needs: download-artifacts | ||
| runs-on: ubuntu-latest | ||
| defaults: | ||
| run: | ||
| working-directory: sdks/rust/test-optimization-sdk | ||
| env: | ||
| TEST_OPTIMIZATION_SDK_NATIVE_SEARCH_PATH: ${{ github.workspace }}/build_artifacts | ||
| JOB_DISPLAY_NAME: Run Rust SDK Tests on Linux AMD64 Alpine with Docker | ||
|
|
||
| steps: | ||
| - name: Create Check | ||
| id: create_check | ||
| uses: actions/github-script@v7 | ||
| with: | ||
| script: | | ||
| const checkRun = await github.rest.checks.create({ owner: context.repo.owner, repo: context.repo.repo, name: process.env.JOB_DISPLAY_NAME, head_sha: context.sha, status: "in_progress" }); | ||
| core.setOutput("check_run_id", checkRun.data.id); | ||
|
|
||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
There was a problem hiding this comment. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)Pin GitHub Actions by commit hash to ensure supply chain security. Using a branch ( - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||
|
|
||
| - name: Download test artifacts | ||
| uses: actions/download-artifact@v4 | ||
| with: | ||
| name: test-artifacts | ||
| path: ${{ github.workspace }}/build_artifacts | ||
|
|
||
| - name: Build and run tests | ||
| run: | | ||
| docker build -t test-optimization-sdk-test -f ./Dockerfile-alpine . | ||
| docker run -v ${{ github.workspace }}/build_artifacts:/build_artifacts -e TEST_OPTIMIZATION_SDK_NATIVE_SEARCH_PATH=/build_artifacts test-optimization-sdk-test | ||
|
|
||
| - name: Update Check | ||
| if: always() | ||
| uses: actions/github-script@v7 | ||
| with: | ||
| script: | | ||
| await github.rest.checks.update({ owner: context.repo.owner, repo: context.repo.repo, check_run_id: parseInt("${{ steps.create_check.outputs.check_run_id }}"), status: "completed", conclusion: "${{ job.status }}" === "success" ? "success" : "failure" }); | ||
|
|
||
| linux-arm64-musl-test: | ||
| name: Run Rust SDK Tests on Linux ARM64 Alpine | ||
| needs: download-artifacts | ||
| runs-on: ubuntu-latest | ||
| defaults: | ||
| run: | ||
| working-directory: sdks/rust/test-optimization-sdk | ||
| env: | ||
| TEST_OPTIMIZATION_SDK_NATIVE_SEARCH_PATH: ${{ github.workspace }}/build_artifacts | ||
| JOB_DISPLAY_NAME: Run Rust SDK Tests on Linux ARM64 Alpine | ||
| steps: | ||
| - name: Create Check | ||
| id: create_check | ||
| uses: actions/github-script@v7 | ||
|
There was a problem hiding this comment. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)Pin GitHub Actions by commit hash to ensure supply chain security. Using a branch ( - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||
| with: | ||
| script: | | ||
| const checkRun = await github.rest.checks.create({ owner: context.repo.owner, repo: context.repo.repo, name: process.env.JOB_DISPLAY_NAME, head_sha: context.sha, status: "in_progress" }); | ||
| core.setOutput("check_run_id", checkRun.data.id); | ||
|
|
||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Download test artifacts | ||
| uses: actions/download-artifact@v4 | ||
|
There was a problem hiding this comment. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)Pin GitHub Actions by commit hash to ensure supply chain security. Using a branch ( - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||
| with: | ||
| name: test-artifacts | ||
| path: ${{ github.workspace }}/build_artifacts | ||
|
|
||
| - name: Set up QEMU | ||
| uses: docker/setup-qemu-action@v3 | ||
|
There was a problem hiding this comment. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)Pin GitHub Actions by commit hash to ensure supply chain security. Using a branch ( - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||
|
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
|
There was a problem hiding this comment. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)Pin GitHub Actions by commit hash to ensure supply chain security. Using a branch ( - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||
|
|
||
| - name: Build and run tests | ||
| run: | | ||
| docker buildx build --platform linux/arm64 -t test-optimization-sdk-test -f ./Dockerfile-alpine . --load | ||
| docker run -v ${{ github.workspace }}/build_artifacts:/build_artifacts -e TEST_OPTIMIZATION_SDK_NATIVE_SEARCH_PATH=/build_artifacts test-optimization-sdk-test | ||
|
|
||
| - name: Update Check | ||
| if: always() | ||
| uses: actions/github-script@v7 | ||
| with: | ||
| script: | | ||
| await github.rest.checks.update({ owner: context.repo.owner, repo: context.repo.repo, check_run_id: parseInt("${{ steps.create_check.outputs.check_run_id }}"), status: "completed", conclusion: "${{ job.status }}" === "success" ? "success" : "failure" }); | ||
|
|
||
| macos-test: | ||
| name: Run Rust SDK Tests on macOS | ||
| needs: download-artifacts | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🟠 Code Vulnerability
Workflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)
Pin GitHub Actions by commit hash to ensure supply chain security.
Using a branch (
@main) or tag (@v1) allows for implicit updates, which can introduce unexpected or malicious changes. Instead, always pin actions to a full length commit SHA. You can find the commit SHA for the latest tag from the action’s repository and ensure frequent updates via auto-updaters such as dependabot. Include a comment with the corresponding full-length SemVer tag for clarity: