fix(ci): pin github actions per commit-sha #25291
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,13 +1,14 @@ | ||
| --- | ||
| # add system-probe label to any changes done in network, security, eventmonitor or ebpf packages | ||
| component/system-probe: | ||
| - changed-files: | ||
| - any-glob-to-any-file: | ||
| - pkg/collector/corechecks/ebpf/** #ebpf-platform (oomkill and tcp_queue_length) | ||
| - pkg/ebpf/** # ebpf-platform (ebpf_manager) | ||
| - pkg/eventmonitor/** # cws (new event monitor component) | ||
| - pkg/network/** # npm and usm | ||
| - pkg/process/monitor/** # usm (process monitor) | ||
| - pkg/security/** # cws | ||
| - pkg/util/kernel/** # ebpf-platform | ||
| - cmd/system-probe/** # ebpf_platform (system-probe executable) | ||
| - tasks/system_probe.py # invoke tasks | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -18,7 +18,7 @@ jobs: | |
| GH_REPO: ${{ github.repository }} | ||
| steps: | ||
| - name: Checkout datadog-agent repository | ||
| uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4 | ||
|
There was a problem hiding this comment. Would it make sense to have a centralized file where these There was a problem hiding this comment. I'll check if we can do this. It could remove some redundancy even if the updates are normally handled automatically by dependabot (so mitigates a little bit the maintenance complexity, wdyt?) There was a problem hiding this comment. Fully agree with Srdjan on this ! There was a problem hiding this comment. I really disagree with the single file approach, we know in advance it will never be maintained and upgrades will never be made. Keeping the format easy for dependabot to do the upgrades on its own should be the main priority IMO. There was a problem hiding this comment. @paulcacheux Hmm - that's a fair point. Any other alternatives to make this both dependabot and human easily digestible/maintainable without using the old tags? I'm afraid with hashes approach, nobody will actually check these in updates and something might slip by. There was a problem hiding this comment. We still have the associated tag in the comment for human-readable format. Would you prefer having a link to the release on the corresponding github repo? There was a problem hiding this comment. @chouetz That may be a good compromise though a link to the repo at that tag release would be better I think since the hash can easily be compared. |
||
|
|
||
| - name: Get repo current milestone | ||
| id: current-milestone | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -26,25 +26,25 @@ jobs: | |
| docker rmi $(docker image ls -aq) >/dev/null 2>&1 | ||
|
|
||
| - name: Checkout datadog-agent repository | ||
| uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4 | ||
|
There was a problem hiding this comment. I would much rather we don't use comments with the version here since it will get out of sync if we merge a dependabot PR updating the sha There was a problem hiding this comment. If I believe this I think it will be synced |
||
| with: | ||
| ref: ${{ inputs.base_branch || 'main' }} | ||
|
|
||
| - name: Checkout btfhub-archive repository | ||
| uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4 | ||
| with: | ||
| repository: DataDog/btfhub-archive | ||
| path: dev/dist/archive | ||
|
|
||
| - name: Install python | ||
| uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0 | ||
| with: | ||
| python-version: '3.9' | ||
| cache: 'pip' | ||
| - run: pip install -r requirements.txt | ||
|
|
||
| - name: Install go | ||
| uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0 | ||
| with: | ||
| go-version-file: '.go-version' | ||
|
|
||
|
|
@@ -61,7 +61,7 @@ jobs: | |
| run: | | ||
| inv -e security-agent.generate-btfhub-constants --archive-path=./dev/dist/archive ${{ inputs.force_refresh && '--force-refresh' || '' }} | ||
|
|
||
| - uses: stefanzweifel/git-auto-commit-action@8621497c8c39c72f3e2a999a26b4ca1b5058a842 # v5.0.1 | ||
| id: commit-creator | ||
| with: | ||
| commit_message: "CWS: sync BTFhub constants" | ||
|
|
@@ -71,7 +71,7 @@ jobs: | |
| skip_checkout: true | ||
|
|
||
| - name: Create Pull Request | ||
| uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 | ||
| if: steps.commit-creator.outputs.changes_detected == 'true' | ||
| with: | ||
| script: | | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
❓ question: Isn't it missing some spaces ?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I used the very same format as in the documentation, and I guess yaml understands both, so I think it's equal