release.yml

# Unless explicitly stated otherwise all files in this repository are licensed under
# the Apache 2.0 License.
#
# This product includes software developed at Datadog
# (https://www.datadoghq.com/) Copyright 2025-Present Datadog, Inc.

name: Release

on:
  workflow_dispatch:
  push:
    tags:
      - "v*"

permissions:
  contents: read

env:
  # Keep the host Go toolchain aligned with the CI mock-server harness.
  GO_VERSION: "1.25.0"
  PYTHON_VERSION: "3.11"

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release-validation:
    timeout-minutes: 60
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: Run core Bazel tests
        shell: bash
        run: ./bazelw test //tools/...

      - name: Run companion Bazel tests (go module)
        shell: bash
        run: |
          (
            cd modules/go &&
            ../../bazelw test //... \
              --override_module=datadog-rules-test-optimization=../..
          )

      - name: Run companion Bazel tests (python module)
        shell: bash
        run: |
          (
            cd modules/python &&
            ../../bazelw test //... \
              --override_module=datadog-rules-test-optimization=../..
          )

      - name: Run companion Bazel tests (java module)
        shell: bash
        run: |
          (
            cd modules/java &&
            ../../bazelw test //... \
              --override_module=datadog-rules-test-optimization=../..
          )

      - name: Run companion Bazel tests (nodejs module)
        shell: bash
        run: |
          (
            cd modules/nodejs &&
            ../../bazelw test //... \
              --override_module=datadog-rules-test-optimization=../..
          )

      - name: Run companion Bazel tests (dotnet module)
        shell: bash
        run: |
          (
            cd modules/dotnet &&
            ../../bazelw test //... \
              --override_module=datadog-rules-test-optimization=../..
          )

      - name: Run companion Bazel tests (ruby module)
        shell: bash
        run: |
          (
            cd modules/ruby &&
            ../../bazelw test //... \
              --override_module=datadog-rules-test-optimization=../..
          )

      - name: Build and test examples
        shell: bash
        run: |
          ./bazelw build //examples/...
          ./bazelw test //examples/...

      - name: Run mock server integration tests
        timeout-minutes: 20
        shell: bash
        run: ./tools/tests/integration/run_mock_server_tests.sh

      - name: Release checklist reminder
        shell: bash
        run: |
          echo "Release validation completed."
          echo "Before publishing, follow CONTRIBUTING.md release runbook steps."

  release-hermetic:
    timeout-minutes: 45
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Run Bazel tests (hermetic lane)
        timeout-minutes: 25
        shell: bash
        run: |
          ./bazelw test //tools/... \
          --spawn_strategy=sandboxed \
          --strategy=TestRunner=sandboxed \
          --incompatible_strict_action_env \
          --sandbox_default_allow_network=false \
          --modify_execution_info=TestRunner=+block-network \
          --test_env=TZ=UTC \
          --test_env=LANG=C \
          --test_env=LC_ALL=C \
          --enable_runfiles

      - name: Run Bazel tests (go companion hermetic lane)
        timeout-minutes: 10
        shell: bash
        run: |
          (
            cd modules/go &&
            ../../bazelw test //... \
              --override_module=datadog-rules-test-optimization=../.. \
              --spawn_strategy=sandboxed \
              --strategy=TestRunner=sandboxed \
              --incompatible_strict_action_env \
              --sandbox_default_allow_network=false \
              --modify_execution_info=TestRunner=+block-network \
              --test_env=TZ=UTC \
              --test_env=LANG=C \
              --test_env=LC_ALL=C \
              --enable_runfiles
          )

      - name: Run Bazel tests (python companion hermetic lane)
        timeout-minutes: 10
        shell: bash
        run: |
          (
            cd modules/python &&
            ../../bazelw test //... \
              --override_module=datadog-rules-test-optimization=../.. \
              --spawn_strategy=sandboxed \
              --strategy=TestRunner=sandboxed \
              --incompatible_strict_action_env \
              --sandbox_default_allow_network=false \
              --modify_execution_info=TestRunner=+block-network \
              --test_env=TZ=UTC \
              --test_env=LANG=C \
              --test_env=LC_ALL=C \
              --enable_runfiles
          )

      - name: Run Bazel tests (java companion hermetic lane)
        timeout-minutes: 10
        shell: bash
        run: |
          (
            cd modules/java &&
            ../../bazelw test //... \
              --override_module=datadog-rules-test-optimization=../.. \
              --spawn_strategy=sandboxed \
              --strategy=TestRunner=sandboxed \
              --incompatible_strict_action_env \
              --sandbox_default_allow_network=false \
              --modify_execution_info=TestRunner=+block-network \
              --test_env=TZ=UTC \
              --test_env=LANG=C \
              --test_env=LC_ALL=C \
              --enable_runfiles
          )

      - name: Run Bazel tests (nodejs companion hermetic lane)
        timeout-minutes: 10
        shell: bash
        run: |
          (
            cd modules/nodejs &&
            ../../bazelw test //... \
              --override_module=datadog-rules-test-optimization=../.. \
              --spawn_strategy=sandboxed \
              --strategy=TestRunner=sandboxed \
              --incompatible_strict_action_env \
              --sandbox_default_allow_network=false \
              --modify_execution_info=TestRunner=+block-network \
              --test_env=TZ=UTC \
              --test_env=LANG=C \
              --test_env=LC_ALL=C \
              --enable_runfiles
          )

      - name: Run Bazel tests (dotnet companion hermetic lane)
        timeout-minutes: 10
        shell: bash
        run: |
          (
            cd modules/dotnet &&
            ../../bazelw test //... \
              --override_module=datadog-rules-test-optimization=../.. \
              --spawn_strategy=sandboxed \
              --strategy=TestRunner=sandboxed \
              --incompatible_strict_action_env \
              --sandbox_default_allow_network=false \
              --modify_execution_info=TestRunner=+block-network \
              --test_env=TZ=UTC \
              --test_env=LANG=C \
              --test_env=LC_ALL=C \
              --enable_runfiles
          )

      - name: Run Bazel tests (ruby companion hermetic lane)
        timeout-minutes: 10
        shell: bash
        run: |
          (
            cd modules/ruby &&
            ../../bazelw test //... \
              --override_module=datadog-rules-test-optimization=../.. \
              --spawn_strategy=sandboxed \
              --strategy=TestRunner=sandboxed \
              --incompatible_strict_action_env \
              --sandbox_default_allow_network=false \
              --modify_execution_info=TestRunner=+block-network \
              --test_env=TZ=UTC \
              --test_env=LANG=C \
              --test_env=LC_ALL=C \
              --enable_runfiles
          )

  release-shared-validation:
    uses: ./.github/workflows/shared-validation.yml
    with:
      python_version: "3.11"
      run_buildifier: false
      verify_bazelrc_sync: false
      run_gofmt: true
      run_powershell_lint: true
      run_schema_validation: true
      run_fixture_json_validation: false
      run_schema_parser_parity: true
      run_rules_go_fork_drift: true

  release-docs-links:
    timeout-minutes: 10
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Install lychee CLI
        shell: bash
        run: |
          set -euo pipefail
          version="0.23.0"
          archive="lychee-x86_64-unknown-linux-gnu.tar.gz"
          url="https://github.com/lycheeverse/lychee/releases/download/lychee-v${version}/${archive}"
          sha256="1fcb6ccf10d04c22b8c5873c5b9cb7be32ee7423e12169d6f1a79a6f1962ef81"

          curl -fsSL "$url" -o "/tmp/${archive}"
          echo "${sha256}  /tmp/${archive}" | sha256sum --check
          mkdir -p "$RUNNER_TEMP/lychee-bin"
          tar -xzf "/tmp/${archive}" -C "$RUNNER_TEMP/lychee-bin"
          echo "$RUNNER_TEMP/lychee-bin" >> "$GITHUB_PATH"
          "$RUNNER_TEMP/lychee-bin/lychee" --version

      - name: Check markdown links
        shell: bash
        run: |
          set -euo pipefail
          shopt -s globstar nullglob
          files=(
            README.md
            CONTRIBUTING.md
            AGENTS.md
            CHANGELOG.md
            SECURITY.md
            docs/**/*.md
            examples/**/*.md
          )
          # lychee replaces the default success-code set when --accept is present.
          lychee \
            --no-progress \
            --verbose \
            --accept '200..=299,429' \
            --max-retries 2 \
            --retry-wait-time 2 \
            "${files[@]}"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  release-platform-smoke:
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        os: [macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: Ensure jq is available (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          if (Get-Command jq -ErrorAction SilentlyContinue) {
            jq --version
            exit 0
          }
          choco install jq --no-progress -y
          jq --version

      - name: Run mock server integration tests (macOS)
        if: runner.os == 'macOS'
        shell: bash
        run: ./tools/tests/integration/run_mock_server_tests.sh

      - name: Run mock server integration tests (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: ./tools/tests/integration/run_mock_server_tests.ps1