Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 26 additions & 0 deletions .github/workflows/system_tests.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
name: System Tests

on:
push:
branches:
- main
workflow_dispatch: {}
schedule:
- cron: '00 03 * * 1-5'
pull_request:

jobs:
system-tests:
uses: DataDog/system-tests/.github/workflows/system-tests.yml@main

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Pin reusable workflow ref before passing API key secrets

This job passes DD_API_KEY/TEST_OPTIMIZATION_API_KEY into a reusable workflow referenced by mutable @main, so any upstream change on DataDog/system-tests immediately executes here with access to those secrets. In the event of an upstream compromise or an unintended change, secrets can be exposed without any commit in this repository; pinning to an immutable commit SHA avoids that supply-chain risk.

Useful? React with 👍 / 👎.

secrets:
DD_API_KEY: ${{ secrets.DD_API_KEY }}
TEST_OPTIMIZATION_API_KEY: ${{ secrets.DD_API_KEY }}
permissions:
contents: read
packages: write
with:
library: php
scenarios_groups: tracer-release
skip_empty_scenarios: true
_system_tests_dev_mode: true
push_to_test_optimization: true
39 changes: 39 additions & 0 deletions .gitlab/generate-package.php
Original file line number Diff line number Diff line change
Expand Up @@ -1223,6 +1223,45 @@
when: always
paths:
- .cache/
after_script:
- |
set +e
echo "=== Uploading system-tests JUnit results to Test Optimization ==="

# Check that there are JUnit files to upload
ls system-tests/logs*/reportJunit.xml >/dev/null 2>&1
if [ $? -ne 0 ]; then echo "No JUnit XML files found, skipping upload"; exit 0; fi

# Download datadog-ci standalone binary
echo "Downloading datadog-ci..."
curl -L --fail "https://github.com/DataDog/datadog-ci/releases/latest/download/datadog-ci_linux-x64" -o /tmp/datadog-ci
if [ $? -ne 0 ]; then echo "Failed to download datadog-ci"; exit 0; fi
chmod +x /tmp/datadog-ci

# Download and extract Vault CLI
echo "Downloading Vault..."
VAULT_VERSION="1.20.0"
curl -L --fail "https://releases.hashicorp.com/vault/${VAULT_VERSION}/vault_${VAULT_VERSION}_linux_amd64.zip" -o /tmp/vault.zip
if [ $? -ne 0 ]; then echo "Failed to download Vault"; exit 0; fi
python3 -c "import zipfile; zipfile.ZipFile('/tmp/vault.zip').extractall('/tmp/')"
chmod +x /tmp/vault

# Fetch API key from Vault
echo "Fetching API key from Vault..."
VAULT_JSON=$(/tmp/vault kv get --format=json "kv/k8s/gitlab-runner/dd-trace-php/datadoghq-api-key" 2>&1)
if [ $? -ne 0 ]; then echo "Failed to fetch API key from Vault: $VAULT_JSON"; exit 0; fi
export DATADOG_API_KEY=$(echo "$VAULT_JSON" | python3 -c "import sys,json; print(json.loads(sys.stdin.read())['data']['data']['key'])")
export DATADOG_SITE="datadoghq.com"

# Upload JUnit results
echo "Uploading JUnit results..."
/tmp/datadog-ci junit upload \
system-tests/logs*/reportJunit.xml \
Comment on lines +1258 to +1259

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Check junit upload exit status before declaring completion

Because this block runs with set +e, datadog-ci junit upload can fail (for example on transient network/auth/API errors) and the script will still continue to print Upload complete. That creates a false-success signal while silently dropping test results from Test Optimization; explicitly checking the upload command status and logging a failure path would prevent this blind spot.

Useful? React with 👍 / 👎.

--service system-tests \
--env ci \
--verbose \
--xpath-tag "test.codeowners=/testcase/properties/property[@name='test.codeowners']"
echo "=== Upload complete ==="
artifacts:
paths:
- "system-tests/logs_parametric/"
Expand Down
Loading