Merge branch 'elastic:main' into main

.buildkite/hooks/post-checkout

@@ -0,0 +1,53 @@
+#!/bin/bash
+
+set -euo pipefail
+
+checkout_merge() {
+    local target_branch=$1
+    local pr_commit=$2
+    local merge_branch=$3
+
+    if [[ -z "${target_branch}" ]]; then
+        echo "No pull request target branch"
+        exit 1
+    fi
+
+    git fetch -v origin "${target_branch}"
+    git checkout FETCH_HEAD
+    echo "Current branch: $(git rev-parse --abbrev-ref HEAD)"
+
+    # create temporal branch to merge the PR with the target branch
+    git checkout -b ${merge_branch}
+    echo "New branch created: $(git rev-parse --abbrev-ref HEAD)"
+
+    # set author identity so it can be run git merge
+    git config user.name "github-merged-pr-post-checkout"
+    git config user.email "auto-merge@buildkite"
+
+    git merge --no-edit "${BUILDKITE_COMMIT}" || {
+        local merge_result=$?
+        echo "Merge failed: ${merge_result}"
+        git merge --abort
+        exit ${merge_result}
+    }
+}
+
+pull_request="${BUILDKITE_PULL_REQUEST:-false}"
+
+if [[ "${pull_request}" == "false" ]]; then
+    echo "Not a pull request, skipping"
+    exit 0
+fi
+
+TARGET_BRANCH="${BUILDKITE_PULL_REQUEST_BASE_BRANCH:-master}"
+PR_COMMIT="${BUILDKITE_COMMIT}"
+PR_ID=${BUILDKITE_PULL_REQUEST}
+MERGE_BRANCH="pr_merge_${PR_ID}"
+
+checkout_merge "${TARGET_BRANCH}" "${PR_COMMIT}" "${MERGE_BRANCH}"
+
+echo "Commit information"
+git --no-pager log --format=%B -n 1
+
+# Ensure buildkite groups are rendered
+echo ""

.buildkite/hooks/pre-command

@@ -0,0 +1,8 @@
+#!/bin/bash
+
+set -euo pipefail
+
+echo "Golang version:"
+version=$(cat .go-version)
+export SETUP_GOLANG_VERSION="${version}"
+echo "${SETUP_GOLANG_VERSION}"

.buildkite/pipeline.yml

@@ -0,0 +1,37 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/buildkite/pipeline-schema/main/schema.json
+
+# env SETUP_GOLANG_VERSION set up on pre-command hook
+
+steps:
+  - label: ":linux: Test on Go ${SETUP_GOLANG_VERSION}"
+    key: test
+    command:
+      - ".buildkite/scripts/test.sh"
+    agents:
+      image: golang:${SETUP_GOLANG_VERSION}
+      cpu: "8"
+      memory: "4G"
+    artifact_paths:
+      - "build/junit-*.xml"
+
+  - label: ":junit: Junit annotate"
+    plugins:
+      - junit-annotate#v2.4.1:
+          artifacts: "build/junit-*.xml"
+          fail-build-on-error: true
+    agents:
+      provider: "gcp" #junit plugin requires docker
+    depends_on:
+      - step: "test"
+        allow_failure: true
+
+  - label: ":linux: Microbench"
+    key: benchmark
+    command:
+      - ".buildkite/scripts/bench.sh"
+    agents:
+      image: golang:${SETUP_GOLANG_VERSION}
+      cpu: "8"
+      memory: "4G"
+    artifact_paths:
+      - "bench.out"

.buildkite/pull-requests.json

@@ -0,0 +1,20 @@
+{
+    "jobs": [
+        {
+            "enabled": true,
+            "pipelineSlug": "go-libaudit",
+            "allow_org_users": true,
+            "allowed_repo_permissions": ["admin", "write"],
+            "allowed_list": [ ],
+            "set_commit_status": true,
+            "build_on_commit": true,
+            "build_on_comment": true,
+            "trigger_comment_regex": "^(?:(?:buildkite\\W+)?(?:build|test)\\W+(?:this|it))|^/test$",
+            "always_trigger_comment_regex": "^(?:(?:buildkite\\W+)?(?:build|test)\\W+(?:this|it))|^/test$",
+            "skip_ci_labels": [  ],
+            "skip_target_branches": [ ],
+            "skip_ci_on_only_changed": [ ],
+            "always_require_ci_on_changed": [ ]
+        }
+    ]
+}

.ci/bench.sh → .buildkite/scripts/bench.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euxo pipefail
 
-go get -d -t ./...
 go mod download
+go mod verify
 
 go test -count=5 -benchmem -run=XXX -benchtime=100ms -bench='.*' -v $(go list ./... | grep -v /vendor/) | tee bench.out

.buildkite/scripts/test.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+set -euxo pipefail
+
+go install github.com/elastic/go-licenser@latest
+go mod download
+go mod verify
+
+if go mod tidy ; then
+    if [ -z "$(git status --porcelain go.mod go.sum)" ] ; then
+        echo "Go module manifest has not changed."
+    else
+        echo "Go module manifest changed. Run 'go mod tidy'" 1>&2
+        exit 1
+    fi
+fi
+go-licenser -d
+
+if find . -name '*.go' | grep -v vendor | xargs gofmt -s -l | read ; then
+    echo "Code differs from gofmt's style. Run 'gofmt -s -w .'" 1>&2
+    exit 1
+fi
+
+# Run the tests
+go install github.com/jstemmer/go-junit-report@latest
+IS_TEST_FAIL=false
+run_test_prepare_junit() {
+    local temporary_file="build/test-report.out"
+    local junit_output=${1:-test-report.out}
+    local root=${2:-false}
+    local go_env=${3:-''} # e.g. GOARCH=386
+    set +e
+    list="$(go list ./... | grep -v /vendor/)"
+    list_string="${list//$'\n'/ }"
+    if [[ $root == "true" ]]; then
+        ${go_env} go test -v ${list_string} | tee ${temporary_file}
+        [[ $? -gt 0 ]] && IS_TEST_FAIL=true
+    else
+        useradd -m -s /bin/bash testuser
+        su -c "${go_env} go test -v ${list_string}" testuser | tee ${temporary_file}
+        [[ $? -gt 0 ]] && IS_TEST_FAIL=true
+        userdel testuser
+    fi
+    go-junit-report > "${junit_output}" < ${temporary_file}
+    set -e
+}
+
+mkdir -p build
+run_test_prepare_junit "build/junit-noroot.xml" false
+run_test_prepare_junit "build/junit-386-noroot.xml" false "GOARCH=386"
+
+if [[ ${IS_TEST_FAIL} == 'true' ]]; then
+    echo "TESTS FAIL"
+    exit 1
+fi
+
+# Check build
+mkdir -p build/bin
+go build -o build/bin/audit ./cmd/audit/
+go build -o build/bin/auparse ./cmd/auparse/