Verify yaml #4639
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -162,3 +162,10 @@ jobs: | |
| - run: yarn type:test | ||
| - run: yarn type:doc | ||
|
|
||
| verify-yaml: | ||
|
There was a problem hiding this comment. I think this (and the name of the script file too) could use a more descriptive name of what it's doing. Something like |
||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
There was a problem hiding this comment. 🟠 Code VulnerabilityWorkflow depends on a GitHub actions pinned by tag (...read more)Pin third party actions by hash, or at least by tag for trusted sourcesWhen using a third party action, one needs to provide its GitHub path ( No pinned git ref means the action will use the latest commit of the default branch each time it runs, eventually running newer versions of the code that were not audited by Datadog. Specifying a git tag is better, but since they are not immutable, using a full length hash is recommended to make sure the action content is actually frozen to some reviewed state. Be careful however, as even pinning an action by hash can be circumvented by attackers still. For instance, if an action relies on a Docker image which is itself not pinned to a digest, it becomes possible to alter its behaviour through the Docker image without actually changing its hash. You can learn more about this kind of attacks in Unpinnable Actions: How Malicious Code Can Sneak into Your GitHub Actions Workflows. Pinning actions by hash is still a good first line of defense against supply chain attacks. Additionally, pinning by hash or tag means the action won’t benefit from newer version updates if any, including eventual security patches. Make sure to regularly check if newer versions for an action you use are available. For actions coming from a very trustworthy source, it can make sense to use a laxer pinning policy to benefit from updates as soon as possible.
There was a problem hiding this comment. Shouldn't There was a problem hiding this comment. Can we just disable this entirely? It just complains about everything, making it effectively useless as it just pollutes PRs with dozens of comments like this constantly everywhere. |
||
| - uses: ./.github/actions/node/setup | ||
| - uses: ./.github/actions/install | ||
| - run: node scripts/verify-ci-config.js | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -72,6 +72,7 @@ dev,sinon,BSD-3-Clause,Copyright 2010-2017 Christian Johansen | |
| dev,sinon-chai,WTFPL and BSD-2-Clause,Copyright 2004 Sam Hocevar 2012–2017 Domenic Denicola | ||
| dev,tap,ISC,Copyright 2011-2022 Isaac Z. Schlueter and Contributors | ||
| dev,tiktoken,MIT,Copyright (c) 2022 OpenAI, Shantanu Jain | ||
| dev,yaml,ISC,Copyright Eemeli Aro <[email protected]> | ||
| file,aws-lambda-nodejs-runtime-interface-client,Apache 2.0,Copyright 2019 Amazon.com Inc. or its affiliates. All Rights Reserved. | ||
| file,profile.proto,Apache license 2.0,Copyright 2016 Google Inc. | ||
| file,is-git-url,MIT,Copyright (c) 2017 Jon Schlinkert. | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -155,6 +155,7 @@ | |
| "sinon": "^16.1.3", | ||
| "sinon-chai": "^3.7.0", | ||
| "tap": "^16.3.7", | ||
| "tiktoken": "^1.0.15", | ||
| "yaml": "^2.5.0" | ||
| } | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,156 @@ | ||
| 'use strict' | ||
| /* eslint-disable no-console */ | ||
|
|
||
| const fs = require('fs') | ||
| const path = require('path') | ||
| const util = require('util') | ||
| const proxyquire = require('proxyquire') | ||
| const yaml = require('yaml') | ||
| const semver = require('semver') | ||
| const { execSync } = require('child_process') | ||
| const Module = require('module') | ||
| if (!Module.isBuiltin) { | ||
| Module.isBuiltin = mod => Module.builtinModules.includes(mod) | ||
| } | ||
|
|
||
| const nodeMajor = Number(process.versions.node.split('.')[0]) | ||
|
|
||
| const names = fs.readdirSync(path.join(__dirname, '..', 'packages', 'datadog-instrumentations', 'src')) | ||
| .filter(file => file.endsWith('.js')) | ||
| .map(file => file.slice(0, -3)) | ||
|
|
||
| const instrumentations = names.reduce((acc, key) => { | ||
| let instrumentations = [] | ||
| const name = key | ||
|
|
||
| try { | ||
| loadInstFile(`${name}/server.js`, instrumentations) | ||
| loadInstFile(`${name}/client.js`, instrumentations) | ||
| } catch (e) { | ||
| loadInstFile(`${name}.js`, instrumentations) | ||
| } | ||
|
|
||
| instrumentations = instrumentations.filter(i => i.versions) | ||
| if (instrumentations.length) { | ||
| acc[key] = instrumentations | ||
| } | ||
|
|
||
| return acc | ||
| }, {}) | ||
|
|
||
| const versions = {} | ||
|
|
||
| function checkYaml (yamlPath) { | ||
| const yamlContent = yaml.parse(fs.readFileSync(yamlPath, 'utf8')) | ||
|
|
||
| const rangesPerPluginFromYaml = {} | ||
| const rangesPerPluginFromInst = {} | ||
| for (const jobName in yamlContent.jobs) { | ||
| const job = yamlContent.jobs[jobName] | ||
| if (!job.env || !job.env.PLUGINS) continue | ||
|
|
||
| const pluginName = job.env.PLUGINS | ||
| if (Module.isBuiltin(pluginName)) continue | ||
| const rangesFromYaml = getRangesFromYaml(job) | ||
| if (rangesFromYaml) { | ||
| if (!rangesPerPluginFromYaml[pluginName]) { | ||
| rangesPerPluginFromYaml[pluginName] = new Set() | ||
| } | ||
| rangesFromYaml.forEach(range => rangesPerPluginFromYaml[pluginName].add(range)) | ||
| const plugin = instrumentations[pluginName] | ||
| const allRangesForPlugin = new Set(plugin.map(x => x.versions).flat()) | ||
| rangesPerPluginFromInst[pluginName] = allRangesForPlugin | ||
| } | ||
| } | ||
| for (const pluginName in rangesPerPluginFromYaml) { | ||
| const yamlRanges = Array.from(rangesPerPluginFromYaml[pluginName]) | ||
| const instRanges = Array.from(rangesPerPluginFromInst[pluginName]) | ||
| const yamlVersions = getMatchingVersions(pluginName, yamlRanges) | ||
| const instVersions = getMatchingVersions(pluginName, instRanges) | ||
| if (!util.isDeepStrictEqual(yamlVersions, instVersions)) { | ||
| const opts = { colors: true } | ||
| const colors = x => util.inspect(x, opts) | ||
| errorMsg(pluginName, 'Mismatch', ` | ||
| Valid version ranges from YAML: ${colors(yamlRanges)} | ||
| Valid version ranges from INST: ${colors(instRanges)} | ||
| ${mismatching(yamlVersions, instVersions)} | ||
| Note that versions may be dependent on Node.js version. This is Node.js v${colors(nodeMajor)} | ||
|
|
||
| > These don't match the same sets of versions in npm. | ||
| > | ||
| > Please check ${yamlPath} and the instrumentations | ||
| > for ${pluginName} to see that the version ranges match.`.trim()) | ||
| } | ||
| } | ||
| } | ||
|
|
||
| function loadInstFile (file, instrumentations) { | ||
| const instrument = { | ||
| addHook (instrumentation) { | ||
| instrumentations.push(instrumentation) | ||
| } | ||
| } | ||
|
|
||
| const instPath = path.join(__dirname, `../packages/datadog-instrumentations/src/${file}`) | ||
|
|
||
| proxyquire.noPreserveCache()(instPath, { | ||
| './helpers/instrument': instrument, | ||
| '../helpers/instrument': instrument | ||
| }) | ||
| } | ||
|
|
||
| function getRangesFromYaml (job) { | ||
| // eslint-disable-next-line no-template-curly-in-string | ||
| if (job.env && job.env.PACKAGE_VERSION_RANGE && job.env.PACKAGE_VERSION_RANGE !== '${{ matrix.range }}') { | ||
| errorMsg(job.env.PLUGINS, 'ERROR in YAML', 'You must use matrix.range instead of env.PACKAGE_VERSION_RANGE') | ||
| process.exitCode = 1 | ||
| } | ||
| if (job.strategy && job.strategy.matrix && job.strategy.matrix.range) { | ||
| const possibilities = [job.strategy.matrix] | ||
| if (job.strategy.matrix.include) { | ||
| possibilities.push(...job.strategy.matrix.include) | ||
| } | ||
| return possibilities.map(possibility => { | ||
| if (possibility.range) { | ||
| return [possibility.range].flat() | ||
| } else { | ||
| return undefined | ||
| } | ||
| }).flat() | ||
| } | ||
|
|
||
| return null | ||
| } | ||
|
|
||
| function getMatchingVersions (name, ranges) { | ||
| if (!versions[name]) { | ||
| versions[name] = JSON.parse(execSync('npm show ' + name + ' versions --json').toString()) | ||
| } | ||
| return versions[name].filter(version => ranges.some(range => semver.satisfies(version, range))) | ||
| } | ||
|
|
||
| checkYaml(path.join(__dirname, '..', '.github', 'workflows', 'plugins.yml')) | ||
| checkYaml(path.join(__dirname, '..', '.github', 'workflows', 'appsec.yml')) | ||
|
|
||
| function mismatching (yamlVersions, instVersions) { | ||
| const yamlSet = new Set(yamlVersions) | ||
| const instSet = new Set(instVersions) | ||
|
|
||
| const onlyInYaml = yamlVersions.filter(v => !instSet.has(v)) | ||
| const onlyInInst = instVersions.filter(v => !yamlSet.has(v)) | ||
|
|
||
| const opts = { colors: true } | ||
| return [ | ||
| `Versions only in YAML: ${util.inspect(onlyInYaml, opts)}`, | ||
| `Versions only in INST: ${util.inspect(onlyInInst, opts)}` | ||
| ].join('\n') | ||
| } | ||
|
|
||
| function errorMsg (pluginName, title, message) { | ||
| console.log('===========================================') | ||
| console.log(title + ' for ' + pluginName) | ||
| console.log('-------------------------------------------') | ||
| console.log(message) | ||
| console.log('\n') | ||
| process.exitCode = 1 | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -5252,6 +5252,11 @@ yaml@^1.10.2: | |
| resolved "https://registry.npmjs.org/yaml/-/yaml-1.10.2.tgz" | ||
| integrity sha512-r3vXyErRCYJ7wg28yvBY5VSoAF8ZvlcW9/BwUzEtUsjvX/DKs24dIkuwjtuprwJJHsbyUbLApepYTR1BN4uHrg== | ||
|
|
||
| yaml@^2.5.0: | ||
| version "2.5.0" | ||
| resolved "https://registry.yarnpkg.com/yaml/-/yaml-2.5.0.tgz#c6165a721cf8000e91c36490a41d7be25176cf5d" | ||
| integrity sha512-2wWLbGbYDiSqqIKoPjar3MPgB94ErzCtrNE1FdqGuaO0pi2JGjmE8aW8TDZwzU7vuxcGRdL/4gPQwQ7hD5AMSw== | ||
|
|
||
| [email protected]: | ||
| version "20.2.4" | ||
| resolved "https://registry.npmjs.org/yargs-parser/-/yargs-parser-20.2.4.tgz" | ||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Seems like node-version is not actually used?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yeah, it's for validation in the script. I'm gonna try to work out a better way of expressing this though.