Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add more YAML verification #5151

Merged
merged 11 commits into from
Jan 28, 2025
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/actions/install/action.yml
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
name: Install dependencies
description: Install dependencies
runs:
using: composite
steps: # retry in case of server error from registry
Expand Down
3 changes: 2 additions & 1 deletion .github/actions/node/14/action.yml
Original file line number Diff line number Diff line change
@@ -1,7 +1,8 @@
name: Node 14
description: Install Node 14
runs:
using: composite
steps:
- uses: actions/setup-node@v3
- uses: actions/setup-node@v4
with:
node-version: '14'
3 changes: 2 additions & 1 deletion .github/actions/node/16/action.yml
Original file line number Diff line number Diff line change
@@ -1,7 +1,8 @@
name: Node 16
description: Install Node 16
runs:
using: composite
steps:
- uses: actions/setup-node@v3
- uses: actions/setup-node@v4
with:
node-version: '16'
3 changes: 2 additions & 1 deletion .github/actions/node/18/action.yml
Original file line number Diff line number Diff line change
@@ -1,7 +1,8 @@
name: Node 18
description: Install Node 18
runs:
using: composite
steps:
- uses: actions/setup-node@v3
- uses: actions/setup-node@v4
with:
node-version: '18'
3 changes: 2 additions & 1 deletion .github/actions/node/20/action.yml
Original file line number Diff line number Diff line change
@@ -1,7 +1,8 @@
name: Node 20
description: Install Node 20
runs:
using: composite
steps:
- uses: actions/setup-node@v3
- uses: actions/setup-node@v4
with:
node-version: '20'
3 changes: 2 additions & 1 deletion .github/actions/node/latest/action.yml
Original file line number Diff line number Diff line change
@@ -1,7 +1,8 @@
name: Node Latest
description: Install the latest Node.js version
runs:
using: composite
steps:
- uses: actions/setup-node@v3
- uses: actions/setup-node@v4
with:
node-version: '22' # Update this line to the latest Node.js version
3 changes: 2 additions & 1 deletion .github/actions/node/oldest/action.yml
Original file line number Diff line number Diff line change
@@ -1,7 +1,8 @@
name: Node 18
description: Install Oldest Supported Node.js version
runs:
using: composite
steps:
- uses: actions/setup-node@v3
- uses: actions/setup-node@v4
with:
node-version: '18'
3 changes: 2 additions & 1 deletion .github/actions/node/setup/action.yml
Original file line number Diff line number Diff line change
@@ -1,8 +1,9 @@
name: Node Setup
description: Install Node.js
runs:
using: composite
steps:
- uses: actions/setup-node@v3
- uses: actions/setup-node@v4
with:
cache: yarn
node-version: '18'
5 changes: 3 additions & 2 deletions .github/actions/plugins/test-and-upstream/action.yml
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
name: Plugin Tests
name: Plugin and Upstream Tests
description: Run plugin tests and upstream test suite
runs:
using: composite
steps:
Expand All @@ -15,7 +16,7 @@ runs:
shell: bash
- run: yarn test:plugins:upstream
shell: bash
- uses: codecov/codecov-action@v3
- uses: codecov/codecov-action@v5
- if: always()
uses: ./.github/actions/testagent/logs
with:
Expand Down
3 changes: 2 additions & 1 deletion .github/actions/plugins/test/action.yml
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
name: Plugin Tests
description: Run plugin tests
runs:
using: composite
steps:
Expand All @@ -11,7 +12,7 @@ runs:
- uses: ./.github/actions/node/latest
- run: yarn test:plugins:ci
shell: bash
- uses: codecov/codecov-action@v3
- uses: codecov/codecov-action@v5
- if: always()
uses: ./.github/actions/testagent/logs
with:
Expand Down
3 changes: 2 additions & 1 deletion .github/actions/plugins/upstream/action.yml
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
name: Plugin Upstream Tests
description: Run upstream test suite
runs:
using: composite
steps:
Expand All @@ -11,7 +12,7 @@ runs:
- uses: ./.github/actions/node/latest
- run: yarn test:plugins:upstream
shell: bash
- uses: codecov/codecov-action@v3
- uses: codecov/codecov-action@v5
- if: always()
uses: ./.github/actions/testagent/logs
with:
Expand Down
42 changes: 42 additions & 0 deletions .github/workflows/actionlint.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
name: Actionlint

on:
pull_request:
push:
branches: [master]
schedule:
- cron: "0 4 * * *"

jobs:
actionlint:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 Code Vulnerability

Workflow depends on a GitHub actions pinned by tag (...read more)

View in Datadog  Leave us feedback  Documentation

- uses: ./.github/actions/node/setup
# NOTE: Ok this next bit seems unnecessary, right? The problem is that
# this repo is currently incompatible with npm, at least with the
# devDependencies. While this is intended to be corrected, it hasn't yet,
# so the easiest thing to do here is just use a fresh package.json. This
# is needed because actionlint runs an `npm install` at the beginning.
- name: Clear package.json
run: |
rm package.json
npm init -y
- name: actionlint
id: actionlint
uses: raven-actions/actionlint@v2

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 Code Vulnerability

Workflow depends on a GitHub actions pinned by tag (...read more)

View in Datadog  Leave us feedback  Documentation

with:
matcher: true
fail-on-error: true
shellcheck: false # TODO should we enable this?
- name: actionlint Summary
if: ${{ steps.actionlint.outputs.exit-code != 0 }}
run: |
echo "Used actionlint version ${{ steps.actionlint.outputs.version-semver }}"
echo "Used actionlint release ${{ steps.actionlint.outputs.version-tag }}"
echo "actionlint ended with ${{ steps.actionlint.outputs.exit-code }} exit code"
echo "actionlint ended because '${{ steps.actionlint.outputs.exit-message }}'"
echo "actionlint found ${{ steps.actionlint.outputs.total-errors }} errors"
echo "actionlint checked ${{ steps.actionlint.outputs.total-files }} files"
echo "actionlint cache used: ${{ steps.actionlint.outputs.cache-hit }}"
exit ${{ steps.actionlint.outputs.exit-code }}
2 changes: 2 additions & 0 deletions .github/workflows/all-green.yml
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@ on:
push:
branches:
- master
schedule:
- cron: "0 4 * * *"

jobs:

Expand Down
36 changes: 18 additions & 18 deletions .github/workflows/appsec.yml
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ jobs:
- uses: ./.github/actions/node/setup
- uses: ./.github/actions/install
- run: yarn test:appsec:ci
- uses: codecov/codecov-action@v3
- uses: codecov/codecov-action@v5

ubuntu:
runs-on: ubuntu-latest
Expand All @@ -33,18 +33,18 @@ jobs:
- run: yarn test:appsec:ci
- uses: ./.github/actions/node/latest
- run: yarn test:appsec:ci
- uses: codecov/codecov-action@v3
- uses: codecov/codecov-action@v5

windows:
runs-on: windows-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v3
- uses: actions/setup-node@v4
with:
node-version: '18'
- uses: ./.github/actions/install
- run: yarn test:appsec:ci
- uses: codecov/codecov-action@v3
- uses: codecov/codecov-action@v5

ldapjs:
runs-on: ubuntu-latest
Expand All @@ -69,7 +69,7 @@ jobs:
- run: yarn test:appsec:plugins:ci
- uses: ./.github/actions/node/latest
- run: yarn test:appsec:plugins:ci
- uses: codecov/codecov-action@v3
- uses: codecov/codecov-action@v5

postgres:
runs-on: ubuntu-latest
Expand All @@ -94,7 +94,7 @@ jobs:
- run: yarn test:appsec:plugins:ci
- uses: ./.github/actions/node/20
- run: yarn test:appsec:plugins:ci
- uses: codecov/codecov-action@v3
- uses: codecov/codecov-action@v5

mysql:
runs-on: ubuntu-latest
Expand All @@ -117,7 +117,7 @@ jobs:
- run: yarn test:appsec:plugins:ci
- uses: ./.github/actions/node/20
- run: yarn test:appsec:plugins:ci
- uses: codecov/codecov-action@v3
- uses: codecov/codecov-action@v5

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 Code Vulnerability

Workflow depends on a GitHub actions pinned by tag (...read more)

View in Datadog  Leave us feedback  Documentation


express:
runs-on: ubuntu-latest
Expand All @@ -131,7 +131,7 @@ jobs:
- run: yarn test:appsec:plugins:ci
- uses: ./.github/actions/node/latest
- run: yarn test:appsec:plugins:ci
- uses: codecov/codecov-action@v3
- uses: codecov/codecov-action@v5

graphql:
runs-on: ubuntu-latest
Expand All @@ -145,7 +145,7 @@ jobs:
- run: yarn test:appsec:plugins:ci
- uses: ./.github/actions/node/latest
- run: yarn test:appsec:plugins:ci
- uses: codecov/codecov-action@v3
- uses: codecov/codecov-action@v5

mongodb-core:
runs-on: ubuntu-latest
Expand All @@ -165,7 +165,7 @@ jobs:
- run: yarn test:appsec:plugins:ci
- uses: ./.github/actions/node/latest
- run: yarn test:appsec:plugins:ci
- uses: codecov/codecov-action@v3
- uses: codecov/codecov-action@v5
bengl marked this conversation as resolved.
Show resolved Hide resolved

mongoose:
runs-on: ubuntu-latest
Expand All @@ -185,7 +185,7 @@ jobs:
- run: yarn test:appsec:plugins:ci
- uses: ./.github/actions/node/latest
- run: yarn test:appsec:plugins:ci
- uses: codecov/codecov-action@v3
- uses: codecov/codecov-action@v5

sourcing:
runs-on: ubuntu-latest
Expand All @@ -201,7 +201,7 @@ jobs:
- run: yarn test:appsec:plugins:ci
- uses: ./.github/actions/node/latest
- run: yarn test:appsec:plugins:ci
- uses: codecov/codecov-action@v3
- uses: codecov/codecov-action@v5
bengl marked this conversation as resolved.
Show resolved Hide resolved

next:
strategy:
Expand Down Expand Up @@ -235,7 +235,7 @@ jobs:
steps:
- uses: actions/checkout@v4
- uses: ./.github/actions/testagent/start
- uses: actions/setup-node@v3
- uses: actions/setup-node@v4

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 Code Vulnerability

Workflow depends on a GitHub actions pinned by tag (...read more)

View in Datadog  Leave us feedback  Documentation

with:
cache: yarn
node-version: ${{ matrix.version }}
Expand All @@ -245,7 +245,7 @@ jobs:
uses: ./.github/actions/testagent/logs
with:
suffix: appsec-${{ github.job }}-${{ matrix.version }}-${{ matrix.range_clean }}
- uses: codecov/codecov-action@v3
- uses: codecov/codecov-action@v5

lodash:
runs-on: ubuntu-latest
Expand All @@ -259,7 +259,7 @@ jobs:
- run: yarn test:appsec:plugins:ci
- uses: ./.github/actions/node/latest
- run: yarn test:appsec:plugins:ci
- uses: codecov/codecov-action@v3
- uses: codecov/codecov-action@v5

integration:
runs-on: ubuntu-latest
Expand All @@ -283,7 +283,7 @@ jobs:
- run: yarn test:appsec:plugins:ci
- uses: ./.github/actions/node/latest
- run: yarn test:appsec:plugins:ci
- uses: codecov/codecov-action@v3
- uses: codecov/codecov-action@v5

template:
runs-on: ubuntu-latest
Expand All @@ -297,7 +297,7 @@ jobs:
- run: yarn test:appsec:plugins:ci
- uses: ./.github/actions/node/latest
- run: yarn test:appsec:plugins:ci
- uses: codecov/codecov-action@v3
- uses: codecov/codecov-action@v5

node-serialize:
runs-on: ubuntu-latest
Expand All @@ -311,4 +311,4 @@ jobs:
- run: yarn test:appsec:plugins:ci
- uses: ./.github/actions/node/latest
- run: yarn test:appsec:plugins:ci
- uses: codecov/codecov-action@v3
- uses: codecov/codecov-action@v5

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 Code Vulnerability

Workflow depends on a GitHub actions pinned by tag (...read more)

View in Datadog  Leave us feedback  Documentation

6 changes: 3 additions & 3 deletions .github/workflows/codeql-analysis.yml
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ jobs:

# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
uses: github/codeql-action/init@v2
uses: github/codeql-action/init@v3
bengl marked this conversation as resolved.
Show resolved Hide resolved
with:
languages: ${{ matrix.language }}
config-file: .github/codeql_config.yml
Expand All @@ -48,7 +48,7 @@ jobs:
# queries: ./path/to/local/query, your-org/your-repo/queries@main

- name: Autobuild
uses: github/codeql-action/autobuild@v2
uses: github/codeql-action/autobuild@v3
bengl marked this conversation as resolved.
Show resolved Hide resolved

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v2
uses: github/codeql-action/analyze@v3
bengl marked this conversation as resolved.
Show resolved Hide resolved
2 changes: 1 addition & 1 deletion .github/workflows/core.yml
Original file line number Diff line number Diff line change
Expand Up @@ -22,4 +22,4 @@ jobs:
- run: yarn test:shimmer:ci
- uses: ./.github/actions/node/latest
- run: yarn test:shimmer:ci
- uses: codecov/codecov-action@v3
- uses: codecov/codecov-action@v5
bengl marked this conversation as resolved.
Show resolved Hide resolved
4 changes: 3 additions & 1 deletion .github/workflows/datadog-static-analysis.yml
Original file line number Diff line number Diff line change
Expand Up @@ -4,14 +4,16 @@ on:
pull_request:
push:
branches: [master]
schedule:
- cron: "0 4 * * *"

jobs:
static-analysis:
runs-on: ubuntu-latest
name: Datadog Static Analyzer
steps:
- name: Checkout
uses: actions/checkout@v3
uses: actions/checkout@v4

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 Code Vulnerability

Workflow depends on a GitHub actions pinned by tag (...read more)

View in Datadog  Leave us feedback  Documentation

- name: Check code meets quality and security standards
id: datadog-static-analysis
uses: DataDog/datadog-static-analyzer-github-action@v1
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/debugger.yml
Original file line number Diff line number Diff line change
Expand Up @@ -32,4 +32,4 @@ jobs:
uses: ./.github/actions/testagent/logs
with:
suffix: debugger
- uses: codecov/codecov-action@v3
- uses: codecov/codecov-action@v5

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 Code Vulnerability

Workflow depends on a GitHub actions pinned by tag (...read more)

View in Datadog  Leave us feedback  Documentation

Loading
Loading