ci.yml

# Unless explicitly stated otherwise all files in this repository are licensed under
# the Apache 2.0 License.
#
# This product includes software developed at Datadog
# (https://www.datadoghq.com/) Copyright 2025-Present Datadog, Inc.

name: CI

on:
  pull_request:
  push:
    branches:
      - main
      - "feature/**"

permissions:
  contents: read

env:
  # Keep the host Go toolchain aligned with the public WORKSPACE Go fixture and
  # the current default tracer pin exercised by that fixture.
  GO_VERSION: "1.25.0"
  PYTHON_VERSION: "3.11"
  BUILDIFIER_VERSION: "8.2.1"
  BUILDIFIER_SHA256_LINUX_AMD64: "6ceb7b0ab7cf66fceccc56a027d21d9cc557a7f34af37d2101edb56b92fcfa1a"

concurrency:
  # Keep one active run per workflow/ref to avoid wasting CI minutes when
  # multiple commits are pushed quickly to the same branch.
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # Keep the workflow itself running on every PR update so required checks still
  # report a concrete result. Heavy jobs can then opt out cleanly on docs-only
  # changes instead of leaving branch protection checks stuck in a pending state.
  changes:
    timeout-minutes: 5
    runs-on: ubuntu-latest
    outputs:
      docs_only: ${{ steps.classify.outputs.docs_only }}
      run_full_ci: ${{ steps.classify.outputs.run_full_ci }}
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0

      - name: Classify changed files
        id: classify
        shell: bash
        env:
          EVENT_NAME: ${{ github.event_name }}
          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          PUSH_BEFORE_SHA: ${{ github.event.before }}
          PUSH_AFTER_SHA: ${{ github.sha }}
        run: |
          set -euo pipefail

          case "${EVENT_NAME}" in
            pull_request)
              base_sha="${PR_BASE_SHA}"
              head_sha="${PR_HEAD_SHA}"
              ;;
            push)
              base_sha="${PUSH_BEFORE_SHA}"
              head_sha="${PUSH_AFTER_SHA}"
              ;;
            *)
              base_sha=""
              head_sha=""
              ;;
          esac

          while IFS= read -r line; do
            echo "${line}" >> "${GITHUB_OUTPUT}"
          done < <(./tools/dev/classify_ci_changes.sh "${base_sha}" "${head_sha}")

  bazel-tests:
    needs: changes
    if: ${{ needs.changes.outputs.run_full_ci == 'true' }}
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      # Fresh-run policy: keep this lane intentionally cacheless so every CI run
      # re-evaluates repository rules from scratch.
      # Guardrail: do not add Bazel cache steps (actions/cache, disk cache,
      # remote cache) here without explicit maintainer approval.
      - name: Run Bazel tests
        timeout-minutes: 25
        shell: bash
        run: ./bazelw test //tools/... --test_output=errors

      - name: Run Bazel tests (go companion module)
        if: matrix.os == 'ubuntu-latest'
        timeout-minutes: 10
        shell: bash
        run: |
          (
            cd modules/go &&
            ../../bazelw test //... \
              --override_module=datadog-rules-test-optimization=../..
          )

      - name: Run Bazel tests (python companion module)
        if: matrix.os == 'ubuntu-latest'
        timeout-minutes: 10
        shell: bash
        run: |
          (
            cd modules/python &&
            ../../bazelw test //... \
              --override_module=datadog-rules-test-optimization=../..
          )

      - name: Run Bazel tests (java companion module)
        if: matrix.os == 'ubuntu-latest'
        timeout-minutes: 10
        shell: bash
        run: |
          (
            cd modules/java &&
            ../../bazelw test //... \
              --override_module=datadog-rules-test-optimization=../..
          )

      - name: Run Bazel tests (nodejs companion module)
        if: matrix.os == 'ubuntu-latest'
        timeout-minutes: 10
        shell: bash
        run: |
          (
            cd modules/nodejs &&
            ../../bazelw test //... \
              --override_module=datadog-rules-test-optimization=../..
          )

      - name: Run Bazel tests (dotnet companion module)
        if: matrix.os == 'ubuntu-latest'
        timeout-minutes: 10
        shell: bash
        run: |
          (
            cd modules/dotnet &&
            ../../bazelw test //... \
              --override_module=datadog-rules-test-optimization=../..
          )

      - name: Run Bazel tests (ruby companion module)
        if: matrix.os == 'ubuntu-latest'
        timeout-minutes: 10
        shell: bash
        run: |
          (
            cd modules/ruby &&
            ../../bazelw test //... \
              --override_module=datadog-rules-test-optimization=../..
          )

      - name: Build examples
        timeout-minutes: 20
        shell: bash
        run: |
          if [[ "${{ runner.os }}" == "Windows" ]]; then
            # Linux/macOS already build the full example matrix, including Go.
            # Keep Windows coverage on the non-Go examples until the vendored
            # rules_go Orchestrion stdlib action is stable there.
            ./bazelw --output_user_root=C:/b build \
              -- \
              //examples/... \
              -//examples/single_service/src/go-project/... \
              -//examples/multi_service/src/go-project/...
          else
            ./bazelw build //examples/...
          fi

      - name: Test examples
        timeout-minutes: 20
        shell: bash
        # --enable_runfiles is required on Windows so the dd_topt_java_test
        # example can resolve -javaagent via $(rootpath); no-op on Linux/macOS.
        run: |
          if [[ "${{ runner.os }}" == "Windows" ]]; then
            ./bazelw --output_user_root=C:/b test \
              --enable_runfiles \
              --test_output=errors \
              -- \
              //examples/... \
              -//examples/single_service/src/go-project/... \
              -//examples/multi_service/src/go-project/...
          else
            ./bazelw test //examples/... --test_output=errors
          fi

      - name: Exercise single-service runtests script (dry-run)
        shell: bash
        # Keep CI deterministic and secret-free: this validates script wiring
        # and command construction without requiring live Datadog credentials.
        run: RUNTESTS_DRY_RUN=1 bash ./examples/single_service/runtests.sh

      - name: Exercise multi-service runtests script (dry-run)
        shell: bash
        # Keep CI deterministic and secret-free: this validates script wiring
        # and command construction without requiring live Datadog credentials.
        run: RUNTESTS_DRY_RUN=1 bash ./examples/multi_service/runtests.sh

      # Exercises the uploader end-to-end against a local mock server.
      - name: Run mock server integration tests (Linux)
        if: runner.os == 'Linux'
        # The guided Orchestrion bootstrap coverage in this harness now performs
        # a full cold-start bootstrap before the mocked runtime assertions. Keep
        # this lane bounded, but give it enough headroom to finish on slower
        # GitHub-hosted Linux runners.
        timeout-minutes: 30
        shell: bash
        run: ./tools/tests/integration/run_mock_server_tests.sh

      - name: Ensure jq is available (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          if (Get-Command jq -ErrorAction SilentlyContinue) {
            jq --version
            exit 0
          }
          choco install jq --no-progress -y
          jq --version

      # Runs the same integration harness on Windows.
      - name: Run mock server integration tests (Windows)
        if: runner.os == 'Windows'
        timeout-minutes: 15
        shell: pwsh
        run: ./tools/tests/integration/run_mock_server_tests.ps1

  rules-go-variant-smoke:
    needs: changes
    if: ${{ needs.changes.outputs.run_full_ci == 'true' }}
    # This job runs the smoke harness serially for every supported upstream.
    # Keep enough headroom as the registry grows.
    timeout-minutes: 75
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          # The variant verifier and smoke harness inspect the vendored fork
          # contract directly, so keep the checkout complete for maintainer
          # diagnostics instead of relying on a shallow history.
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: Install Bazelisk
        shell: bash
        run: |
          GO111MODULE=on go install github.com/bazelbuild/bazelisk@v1.28.1
          echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"

      - name: Run vendored rules_go smoke coverage
        shell: bash
        run: |
          while IFS= read -r upstream; do
            RULES_GO_UPSTREAM="${upstream}" \
            RULES_GO_VARIANT="base" \
              ./tools/dev/run_rules_go_variant_smoke.sh
          done < <(python3 tools/dev/materialize_rules_go_fork.py list-upstreams)

  workspace-compat:
    needs: changes
    if: ${{ needs.changes.outputs.run_full_ci == 'true' }}
    timeout-minutes: 90
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: Install Bazelisk
        shell: bash
        run: |
          GO111MODULE=on go install github.com/bazelbuild/bazelisk@v1.28.1
          echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"

      - name: Validate Go companion consumer paths
        shell: bash
        run: |
          while IFS= read -r upstream; do
            for mode in general test_optimization; do
              USE_BAZEL_VERSION=8.4.1 \
              RULES_GO_UPSTREAM="${upstream}" \
              RULES_GO_VARIANT="base" \
              ORCHESTRION_MODE="${mode}" \
                ./tools/tests/integration/run_workspace_go_integration.sh

              USE_BAZEL_VERSION=8.4.1 \
              RULES_GO_UPSTREAM="${upstream}" \
              RULES_GO_VARIANT="base" \
              ORCHESTRION_MODE="${mode}" \
                ./tools/tests/integration/run_bzlmod_go_integration.sh
            done
          done < <(python3 tools/dev/materialize_rules_go_fork.py list-upstreams)

  coverage-tools:
    needs: changes
    if: ${{ needs.changes.outputs.run_full_ci == 'true' }}
    timeout-minutes: 15
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install Python tooling dependencies
        shell: bash
        run: python3 -m pip install --require-hashes -r tools/requirements.txt

      - name: Verify Python tooling tests through Bazel
        shell: bash
        run: ./bazelw test //tools/tests/python:python_tools_test

      - name: Enforce minimum tools coverage signal
        shell: bash
        env:
          TOOLS_COVERAGE_MIN: "40.0"
        run: |
          # Coverage is collected via Python's trace module for file-level signal,
          # while the Bazel step above keeps runtime wiring parity verified.
          TOOLS_COVERAGE_MIN="$TOOLS_COVERAGE_MIN" python3 - <<'PY'
          import os
          import pathlib
          import runpy
          import sys
          import trace

          repo_root = pathlib.Path.cwd()
          min_raw = os.environ.get("TOOLS_COVERAGE_MIN")
          if min_raw is None or min_raw.strip() == "":
              print("error: TOOLS_COVERAGE_MIN must be provided")
              sys.exit(2)
          min_pct = float(min_raw)
          targets = [
              repo_root / "tools/core/validate_payload_schema.py",
              repo_root / "tools/core/schemas/sync_agentless_schema.py",
              repo_root / "tools/dev/check_module_versions.py",
              repo_root / "tools/dev/lint_uploader_templates.py",
          ]

          tracer = trace.Trace(count=True, trace=False)
          exit_code = 0
          try:
              tracer.runctx(
                  'runpy.run_path("tools/tests/python/test_python_tools.py", run_name="__main__")',
                  {"runpy": runpy},
                  {},
              )
          except SystemExit as exc:
              code = exc.code
              if code is None:
                  exit_code = 0
              elif isinstance(code, int):
                  exit_code = code
              else:
                  print(code)
                  exit_code = 1

          if exit_code != 0:
              sys.exit(exit_code)

          counts = tracer.results().counts
          lines_found = 0
          lines_hit = 0

          for target in targets:
              target_path = target.resolve()
              source_lines = target_path.read_text(encoding="utf-8").splitlines()
              executable_lines = [
                  idx
                  for idx, line in enumerate(source_lines, start=1)
                  if line.strip() and not line.lstrip().startswith("#")
              ]
              hit_lines = set()
              for (filename, lineno), count in counts.items():
                  if count <= 0:
                      continue
                  try:
                      if pathlib.Path(filename).resolve() == target_path:
                          hit_lines.add(lineno)
                  except OSError:
                      continue
              found = len(executable_lines)
              hit = len([ln for ln in executable_lines if ln in hit_lines])
              lines_found += found
              lines_hit += hit
              print(f"tools coverage file: {target_path} -> {hit}/{found} lines hit")

          if lines_found <= 0:
              print("error: tools coverage probe found zero executable lines")
              sys.exit(1)

          pct = (lines_hit / lines_found) * 100.0
          print(f"tools coverage total: {lines_hit}/{lines_found} lines hit ({pct:.2f}%)")
          if pct < min_pct:
              print(
                  f"error: tools coverage {pct:.2f}% is below minimum {min_pct:.2f}%"
              )
              sys.exit(1)
          PY

  shared-validation:
    needs: changes
    uses: ./.github/workflows/shared-validation.yml
    with:
      docs_only: ${{ needs.changes.outputs.docs_only == 'true' }}
      python_version: "3.11"
      run_buildifier: true
      verify_bazelrc_sync: true
      run_gofmt: true
      run_powershell_lint: true
      run_schema_validation: true
      run_fixture_json_validation: true
      run_schema_parser_parity: true
      run_rules_go_fork_drift: true

  # Policy: keep the hermetic lane Linux-only for now.
  # Rationale: sandbox/network-blocking semantics are most reliable on Linux;
  # macOS/Windows are still covered by the standard test+integration matrix.
  bazel-tests-hermetic:
    needs: changes
    if: ${{ needs.changes.outputs.run_full_ci == 'true' }}
    timeout-minutes: 45
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Run Bazel tests (hermetic lane)
        timeout-minutes: 25
        shell: bash
        run: |
          ./bazelw test //tools/... \
          --spawn_strategy=sandboxed \
          --strategy=TestRunner=sandboxed \
          --incompatible_strict_action_env \
          --sandbox_default_allow_network=false \
          --modify_execution_info=TestRunner=+block-network \
          --test_env=TZ=UTC \
          --test_env=LANG=C \
          --test_env=LC_ALL=C \
          --enable_runfiles

      - name: Run Bazel tests (go companion hermetic lane)
        timeout-minutes: 10
        shell: bash
        run: |
          (
            cd modules/go &&
            ../../bazelw test //... \
              --override_module=datadog-rules-test-optimization=../.. \
              --spawn_strategy=sandboxed \
              --strategy=TestRunner=sandboxed \
              --incompatible_strict_action_env \
              --sandbox_default_allow_network=false \
              --modify_execution_info=TestRunner=+block-network \
              --test_env=TZ=UTC \
              --test_env=LANG=C \
              --test_env=LC_ALL=C \
              --enable_runfiles
          )

      - name: Run Bazel tests (python companion hermetic lane)
        timeout-minutes: 10
        shell: bash
        run: |
          (
            cd modules/python &&
            ../../bazelw test //... \
              --override_module=datadog-rules-test-optimization=../.. \
              --spawn_strategy=sandboxed \
              --strategy=TestRunner=sandboxed \
              --incompatible_strict_action_env \
              --sandbox_default_allow_network=false \
              --modify_execution_info=TestRunner=+block-network \
              --test_env=TZ=UTC \
              --test_env=LANG=C \
              --test_env=LC_ALL=C \
              --enable_runfiles
          )

      - name: Run Bazel tests (java companion hermetic lane)
        timeout-minutes: 10
        shell: bash
        run: |
          (
            cd modules/java &&
            ../../bazelw test //... \
              --override_module=datadog-rules-test-optimization=../.. \
              --spawn_strategy=sandboxed \
              --strategy=TestRunner=sandboxed \
              --incompatible_strict_action_env \
              --sandbox_default_allow_network=false \
              --modify_execution_info=TestRunner=+block-network \
              --test_env=TZ=UTC \
              --test_env=LANG=C \
              --test_env=LC_ALL=C \
              --enable_runfiles
          )

      - name: Run Bazel tests (nodejs companion hermetic lane)
        timeout-minutes: 10
        shell: bash
        run: |
          (
            cd modules/nodejs &&
            ../../bazelw test //... \
              --override_module=datadog-rules-test-optimization=../.. \
              --spawn_strategy=sandboxed \
              --strategy=TestRunner=sandboxed \
              --incompatible_strict_action_env \
              --sandbox_default_allow_network=false \
              --modify_execution_info=TestRunner=+block-network \
              --test_env=TZ=UTC \
              --test_env=LANG=C \
              --test_env=LC_ALL=C \
              --enable_runfiles
          )

      - name: Run Bazel tests (dotnet companion hermetic lane)
        timeout-minutes: 10
        shell: bash
        run: |
          (
            cd modules/dotnet &&
            ../../bazelw test //... \
              --override_module=datadog-rules-test-optimization=../.. \
              --spawn_strategy=sandboxed \
              --strategy=TestRunner=sandboxed \
              --incompatible_strict_action_env \
              --sandbox_default_allow_network=false \
              --modify_execution_info=TestRunner=+block-network \
              --test_env=TZ=UTC \
              --test_env=LANG=C \
              --test_env=LC_ALL=C \
              --enable_runfiles
          )

      - name: Run Bazel tests (ruby companion hermetic lane)
        timeout-minutes: 10
        shell: bash
        run: |
          (
            cd modules/ruby &&
            ../../bazelw test //... \
              --override_module=datadog-rules-test-optimization=../.. \
              --spawn_strategy=sandboxed \
              --strategy=TestRunner=sandboxed \
              --incompatible_strict_action_env \
              --sandbox_default_allow_network=false \
              --modify_execution_info=TestRunner=+block-network \
              --test_env=TZ=UTC \
              --test_env=LANG=C \
              --test_env=LC_ALL=C \
              --enable_runfiles
          )