Skip to content

Commit 7308812

Browse files
LouisParkinclaude
LouisParkin
and
claude
committed
STAC-25142 Add GitHub Actions lint + unit-test workflow (agent CI migration phase 1)
Ports filename_linting + unbranded/branded unit_tests from .gitlab-ci-agent.yml to GitHub Actions, tracking the active stackstate-7.78.2 pipeline. - filename-linting on `docker` (cheap gate; only needs `git ls-files`). - unbranded/branded unit tests on `xlarge` inside the datadog_build image (tag 7af9194f), pulled via the read-only quay proxy. - 7.78.2 deltas vs 7.71.2: `--major-version` dropped from agent.build/inv test (removed upstream in DD 7.78), and branded runs scripts/verify_branding_literals.sh after fix_branding.sh. Test-execution policy (architect directive — minimize redundant runs): each suite runs once. filename-lint on every PR; the two heavy ~2h suites on pull_request, deduped via concurrency cancel-in-progress. They move to merge_group (run once at land) at phase 6; master/version-branch pushes then build+publish without re-running tests. Security: minimal contents: read, SHA-pinned checkout, persist-credentials false, no PATs, registry-proxy secret only via container.credentials, fork PRs skipped. Zizmor clean; actionlint clean apart from self-hosted labels. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
1 parent 88a4745 commit 7308812

1 file changed

Lines changed: 156 additions & 0 deletions

File tree

‎.github/workflows/lint-and-unit-tests.yml‎

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
name: Lint and unit tests
2+
3+
# Ported from .gitlab-ci-agent.yml (filename_linting, unbranded_unit_tests,
4+
# branded_unit_tests) as part of the GitLab -> GitHub migration (STAC-25142),
5+
# phase 1: lint + unit tests. Tracks the stackstate-7.78.2 pipeline.
6+
#
7+
# Test-execution policy (architect directive — minimize redundant runs):
8+
# * filename-linting is a cheap gate and runs on every PR.
9+
# * The two unit suites are heavy (each does a full `inv agent.build` + full
10+
# `inv test`, ~2h on an XL runner). They run ONCE per change here, deduped
11+
# via `concurrency: cancel-in-progress`. When the merge queue is enabled
12+
# (phase 6) they move to `merge_group` (run once at land) and drop from
13+
# `pull_request`; master/version-branch pushes then build+publish WITHOUT
14+
# re-running tests. Follow-ups tracked in the migration scope doc:
15+
# - path-filter the heavy suites (skip when no Go/build inputs changed)
16+
# - open question for architects: do we need BOTH unbranded and branded
17+
# on every path, or branded-as-gate + unbranded on the queue only?
18+
#
19+
# Prerequisites for a GREEN run (see scope doc):
20+
# * The GitLab push mirror to this repo must be disabled (done 2026-07-10),
21+
# otherwise a mirror sync overwrites anything pushed to GitHub.
22+
# * This is a PUBLIC repo. The read-only registry-proxy credentials must be
23+
# available to it (org-inherited or provisioned via pulumi-infra):
24+
# vars REGISTRY_HOST, REGISTRY_USER + secret REGISTRY_PASSWORD. Org secrets
25+
# are never exposed to fork PRs, so external-fork PRs skip these jobs.
26+
27+
on:
28+
pull_request:
29+
workflow_dispatch:
30+
31+
permissions:
32+
contents: read
33+
34+
concurrency:
35+
group: ${{ github.workflow }}-${{ github.ref }}
36+
cancel-in-progress: true
37+
38+
env:
39+
# conda env baked into the datadog_build image.
40+
CONDA_ENV: ddpy3
41+
42+
jobs:
43+
filename-linting:
44+
name: Filename linting
45+
# Same-repo PRs only: the registry-proxy secret is not exposed to fork PRs.
46+
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
47+
runs-on: docker
48+
timeout-minutes: 20
49+
container:
50+
# datadog_build image (built by datadog-agent-buildimages), pulled via the
51+
# read-only quay proxy — mirrors BUILD_IMAGE in .gitlab-ci.yml (7.78.2 tag).
52+
image: ${{ vars.REGISTRY_HOST }}/quay/stackstate/datadog_build_linux_x64:7af9194f
53+
credentials:
54+
username: ${{ vars.REGISTRY_USER }}
55+
password: ${{ secrets.REGISTRY_PASSWORD }}
56+
steps:
57+
- name: Check out repository
58+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
59+
with:
60+
persist-credentials: false
61+
62+
- name: inv linter.filenames
63+
run: |
64+
set -eo pipefail
65+
# linter.filenames only shells out to `git ls-files` + path checks, so
66+
# it needs no Go deps/vendoring (the GitLab job carried that as boilerplate).
67+
. /root/miniforge3/etc/profile.d/conda.sh
68+
conda activate "${CONDA_ENV}"
69+
inv -e linter.filenames
70+
71+
unbranded-unit-tests:
72+
name: Unit tests (unbranded / DataDog)
73+
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
74+
runs-on: xlarge
75+
timeout-minutes: 150
76+
container:
77+
image: ${{ vars.REGISTRY_HOST }}/quay/stackstate/datadog_build_linux_x64:7af9194f
78+
credentials:
79+
username: ${{ vars.REGISTRY_USER }}
80+
password: ${{ secrets.REGISTRY_PASSWORD }}
81+
steps:
82+
- name: Check out repository
83+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
84+
with:
85+
persist-credentials: false
86+
87+
- name: Build agent and run unit tests
88+
run: |
89+
set -eo pipefail
90+
export PATH="$PATH:/usr/local/go/bin"
91+
. /root/miniforge3/etc/profile.d/conda.sh
92+
conda activate "${CONDA_ENV}"
93+
go clean -modcache
94+
go work sync
95+
go work vendor
96+
inv -e deps --verbose
97+
# /go/bin is not cached on ephemeral runners; re-run deps to get tool
98+
# binaries (golint, misspell, ...).
99+
inv deps
100+
export AGENT_GITHUB_ORG=DataDog
101+
export GITHUB_ORG=DataDog
102+
export BRANDED=false
103+
export AGENT_REPO_NAME=datadog-agent
104+
inv -e agent.build --race
105+
gofmt -l -w -s ./pkg ./cmd
106+
inv -e rtloader.test
107+
invoke install-tools
108+
# Go 1.25+ no longer ships prebuilt tool binaries; build covdata into
109+
# GOTOOLDIR so `go test -cover` resolves it (golang/go#75031).
110+
go build -o "$(go env GOTOOLDIR)/covdata" cmd/covdata
111+
# Drop build tags for features StackState does not ship in its images.
112+
export STS_UT_BUILD_EXCLUDE="oracle,trivy,trivy_no_javadb,nvml,jetson,bundle_installer,systemd"
113+
inv -e test --coverage --race --profile --cpus 4 --build-exclude="${STS_UT_BUILD_EXCLUDE}" --timeout=600
114+
115+
branded-unit-tests:
116+
name: Unit tests (branded / StackState)
117+
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
118+
runs-on: xlarge
119+
timeout-minutes: 150
120+
container:
121+
image: ${{ vars.REGISTRY_HOST }}/quay/stackstate/datadog_build_linux_x64:7af9194f
122+
credentials:
123+
username: ${{ vars.REGISTRY_USER }}
124+
password: ${{ secrets.REGISTRY_PASSWORD }}
125+
steps:
126+
- name: Check out repository
127+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
128+
with:
129+
persist-credentials: false
130+
131+
- name: Build agent and run unit tests
132+
run: |
133+
set -eo pipefail
134+
export PATH="$PATH:/usr/local/go/bin"
135+
. /root/miniforge3/etc/profile.d/conda.sh
136+
conda activate "${CONDA_ENV}"
137+
go clean -modcache
138+
go work sync
139+
go work vendor
140+
inv -e deps --verbose
141+
inv deps
142+
export AGENT_GITHUB_ORG=DataDog
143+
export GITHUB_ORG=DataDog
144+
export BRANDED=true
145+
export AGENT_REPO_NAME=datadog-agent
146+
export OMNIBUS_FORCE_PACKAGES=true
147+
# Rebrand DataDog -> StackState, then verify no unbranded literals remain.
148+
./fix_branding.sh
149+
./scripts/verify_branding_literals.sh
150+
inv -e agent.build --race
151+
gofmt -l -w -s ./pkg ./cmd
152+
inv -e rtloader.test
153+
invoke install-tools
154+
go build -o "$(go env GOTOOLDIR)/covdata" cmd/covdata
155+
export STS_UT_BUILD_EXCLUDE="oracle,trivy,trivy_no_javadb,nvml,jetson,bundle_installer,systemd"
156+
inv -e test --coverage --race --profile --cpus 4 --build-exclude="${STS_UT_BUILD_EXCLUDE}" --timeout=600

0 commit comments

Comments
 (0)