shared-validation.yml

# Unless explicitly stated otherwise all files in this repository are licensed under
# the Apache 2.0 License.
#
# This product includes software developed at Datadog
# (https://www.datadoghq.com/) Copyright 2025-Present Datadog, Inc.

name: Shared Validation

on:
  workflow_call:
    inputs:
      # The caller sets this when a change only touches markdown or docs/
      # content, allowing each validation job to skip itself while still
      # surfacing a completed check in GitHub.
      docs_only:
        required: false
        type: boolean
        default: false
      python_version:
        required: false
        type: string
        default: "3.11"
      run_buildifier:
        required: false
        type: boolean
        default: false
      verify_bazelrc_sync:
        required: false
        type: boolean
        default: false
      run_gofmt:
        required: false
        type: boolean
        default: true
      run_powershell_lint:
        required: false
        type: boolean
        default: true
      run_schema_validation:
        required: false
        type: boolean
        default: false
      run_fixture_json_validation:
        required: false
        type: boolean
        default: false
      run_schema_parser_parity:
        required: false
        type: boolean
        default: false
      run_rules_go_fork_drift:
        required: false
        type: boolean
        default: false

permissions:
  contents: read

env:
  BUILDIFIER_VERSION: "8.2.1"
  BUILDIFIER_SHA256_LINUX_AMD64: "6ceb7b0ab7cf66fceccc56a027d21d9cc557a7f34af37d2101edb56b92fcfa1a"

jobs:
  shell-lint:
    if: ${{ !inputs.docs_only }}
    timeout-minutes: 15
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: ${{ inputs.python_version }}

      - name: Install ShellCheck
        shell: bash
        run: |
          sudo apt-get update
          sudo apt-get install -y shellcheck

      - name: Lint repository shell scripts
        shell: bash
        run: |
          shellcheck --severity=error \
            bazelw \
            examples/common/runtests_common.sh \
            examples/single_service/runtests.sh \
            examples/multi_service/runtests.sh \
            tools/tests/integration/*.sh \
            tools/tests/python/run_python_tools_test.sh \
            tools/tests/python/run_bazelw_wrapper_test.sh

      - name: Install Buildifier
        if: ${{ inputs.run_buildifier }}
        shell: bash
        run: |
          curl -sSL -o /tmp/buildifier "https://github.com/bazelbuild/buildtools/releases/download/v${BUILDIFIER_VERSION}/buildifier-linux-amd64"
          echo "${BUILDIFIER_SHA256_LINUX_AMD64}  /tmp/buildifier" | sha256sum -c -
          chmod +x /tmp/buildifier
          sudo mv /tmp/buildifier /usr/local/bin/buildifier

      - name: Check Starlark formatting with Buildifier
        if: ${{ inputs.run_buildifier }}
        shell: bash
        run: |
          mapfile -t starlark_files < <(
            git ls-files -- \
              '*.bzl' 'BUILD' 'BUILD.bazel' 'WORKSPACE' 'MODULE.bazel' \
              ':(exclude)third_party/rgo/**'
          )
          if (( ${#starlark_files[@]} == 0 )); then
            echo "No Starlark files found."
            exit 0
          fi
          buildifier -mode=check "${starlark_files[@]}"

      - name: Lint embedded uploader templates (bash)
        shell: bash
        run: python3 tools/dev/lint_uploader_templates.py --skip-powershell-parse

      - name: Verify example .bazelrc files stay in sync
        if: ${{ inputs.verify_bazelrc_sync }}
        shell: bash
        run: |
          cmp --silent examples/single_service/.bazelrc examples/multi_service/.bazelrc

  gofmt-check:
    if: ${{ !inputs.docs_only && inputs.run_gofmt }}
    timeout-minutes: 10
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Verify Go files are gofmt formatted
        shell: bash
        run: |
          mapfile -t go_files < <(
            git ls-files -- '*.go' ':(exclude)third_party/**'
          )
          if (( ${#go_files[@]} == 0 )); then
            exit 0
          fi
          unformatted="$(gofmt -l "${go_files[@]}")"
          if [[ -n "${unformatted}" ]]; then
            echo "error: gofmt found unformatted files:"
            echo "${unformatted}"
            exit 1
          fi

  schema-validation:
    if: ${{ !inputs.docs_only && inputs.run_schema_validation }}
    timeout-minutes: 15
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: ${{ inputs.python_version }}

      - name: Install Python tooling dependencies
        shell: bash
        run: python3 -m pip install --require-hashes -r tools/requirements.txt

      - name: Verify core/companion module versions are aligned
        shell: bash
        run: python3 tools/dev/check_module_versions.py

      - name: Verify .bazelversion parity
        shell: bash
        run: python3 tools/dev/check_bazelversion_sync.py

      - name: Validate integration fixture and snapshot JSON
        if: ${{ inputs.run_fixture_json_validation }}
        shell: bash
        run: |
          python3 - <<'PY'
          import json
          from pathlib import Path
          files = sorted(Path("tools/tests/integration/fixtures").glob("*.json"))
          files += sorted(Path("tools/tests/integration/snapshots").glob("*.json"))
          for path in files:
            with path.open("r", encoding="utf-8") as handle:
              json.load(handle)
            print(f"valid json: {path}")
          PY

      - name: Verify schema files are in sync
        shell: bash
        run: python3 tools/core/schemas/sync_agentless_schema.py --check

      - name: Verify schema parser parity (PyYAML vs Ruby)
        if: ${{ inputs.run_schema_parser_parity }}
        shell: bash
        run: python3 tools/core/schemas/check_schema_parser_parity.py

  rules-go-fork-drift:
    if: ${{ !inputs.docs_only && inputs.run_rules_go_fork_drift }}
    timeout-minutes: 15
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: ${{ inputs.python_version }}

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: "1.25.0"

      - name: Verify Go toolchain for generated rules_go maps
        shell: bash
        run: |
          go version
          command -v gofmt

      - name: Verify rules_go fork registry and materialized trees
        shell: bash
        run: |
          python3 tools/dev/generate_rules_go_fork_maps.py --check
          RULES_GO_ORCHESTRION_CACHE="${RUNNER_TEMP}/rules_go_orchestrion_cache" \
            python3 tools/dev/materialize_rules_go_fork.py check --all
          python3 tools/dev/verify_rules_go_profiles.py \
            --public-denylist tools/dev/private_leak_public_denylist.txt

      - name: Verify rules_go fork release archive contents
        shell: bash
        run: python3 tools/dev/check_release_archive_contents.py

  powershell-lint:
    if: ${{ !inputs.docs_only && inputs.run_powershell_lint }}
    timeout-minutes: 20
    runs-on: windows-latest
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: ${{ inputs.python_version }}

      - name: Install PSScriptAnalyzer
        shell: pwsh
        run: |
          if (-not (Get-Module -ListAvailable -Name PSScriptAnalyzer)) {
            if (-not (Get-PackageProvider -ListAvailable -Name NuGet -ErrorAction SilentlyContinue)) {
              Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force
            }
            Set-PSRepository -Name PSGallery -InstallationPolicy Trusted
            Install-Module -Name PSScriptAnalyzer -Scope CurrentUser -Force -AllowClobber
          }

      - name: Lint integration PowerShell scripts
        shell: pwsh
        run: |
          $results = Invoke-ScriptAnalyzer -Path "tools/tests/integration/*.ps1" -Severity Error
          if ($results) {
            $results | Format-Table -AutoSize
            throw "PSScriptAnalyzer found lint errors."
          }

      - name: Lint embedded uploader templates (PowerShell lane)
        shell: pwsh
        run: python tools/dev/lint_uploader_templates.py --skip-shellcheck