Thanks to visit codestin.com
Credit goes to github.com

Skip to content

chore: reduce "Upload tests to datadog" times in CI #17668

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
May 5, 2025
+41 −2
Merged

chore: reduce "Upload tests to datadog" times in CI #17668

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 41 additions & 2 deletions .github/actions/upload-datadog/action.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,8 @@ runs:
steps:
- shell: bash
run: |
set -e

owner=${{ github.repository_owner }}
echo "owner: $owner"
if [[ $owner != "coder" ]]; then
Expand All @@ -21,8 +23,45 @@ runs:
echo "No API key provided, skipping..."
exit 0
fi
npm install -g @datadog/[email protected]
datadog-ci junit upload --service coder ./gotests.xml \

BINARY_VERSION="v2.48.0"
BINARY_HASH_WINDOWS="b7bebb8212403fddb1563bae84ce5e69a70dac11e35eb07a00c9ef7ac9ed65ea"
BINARY_HASH_MACOS="e87c808638fddb21a87a5c4584b68ba802965eb0a593d43959c81f67246bd9eb"
BINARY_HASH_LINUX="5e700c465728fff8313e77c2d5ba1ce19a736168735137e1ddc7c6346ed48208"

TMP_DIR=$(mktemp -d)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could this go in runner temp instead so it hits the ramdisk? The perf savings are probably miniscule but might as well

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The perf savings are probably miniscule

Indeed, I don't think it's worth optimizing further if the entire step already takes only 3 seconds


if [[ "${{ runner.os }}" == "Windows" ]]; then
BINARY_PATH="${TMP_DIR}/datadog-ci.exe"
BINARY_URL="https://github.com/DataDog/datadog-ci/releases/download/${BINARY_VERSION}/datadog-ci_win-x64"
elif [[ "${{ runner.os }}" == "macOS" ]]; then
BINARY_PATH="${TMP_DIR}/datadog-ci"
BINARY_URL="https://github.com/DataDog/datadog-ci/releases/download/${BINARY_VERSION}/datadog-ci_darwin-arm64"
elif [[ "${{ runner.os }}" == "Linux" ]]; then
BINARY_PATH="${TMP_DIR}/datadog-ci"
BINARY_URL="https://github.com/DataDog/datadog-ci/releases/download/${BINARY_VERSION}/datadog-ci_linux-x64"
else
echo "Unsupported OS: ${{ runner.os }}"
exit 1
fi

echo "Downloading DataDog CI binary version ${BINARY_VERSION} for ${{ runner.os }}..."
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Needs SHA256 validation

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Which will be hard now that the version is an input...

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll remove the input then

Copy link
Member

@matifali matifali May 5, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why would it need SHA256 validation? We are downloading from the official repo, and also, the CLI only works if the correct token is available? Also, the test logs are all public; there is no sensitive data. Or. is it, and I am missing something?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It mitigates supply-chain attacks. If somebody took over Datadog's repo, they'd be able to swap the release files for a malicious payload. AFAIK, release artifacts are mutable.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@deansheather I added hash verification

curl -sSL "$BINARY_URL" -o "$BINARY_PATH"

if [[ "${{ runner.os }}" == "Windows" ]]; then
echo "$BINARY_HASH_WINDOWS $BINARY_PATH" | sha256sum --check
elif [[ "${{ runner.os }}" == "macOS" ]]; then
echo "$BINARY_HASH_MACOS $BINARY_PATH" | shasum -a 256 --check
elif [[ "${{ runner.os }}" == "Linux" ]]; then
echo "$BINARY_HASH_LINUX $BINARY_PATH" | sha256sum --check
fi

# Make binary executable (not needed for Windows)
if [[ "${{ runner.os }}" != "Windows" ]]; then
chmod +x "$BINARY_PATH"
fi

"$BINARY_PATH" junit upload --service coder ./gotests.xml \
--tags os:${{runner.os}} --tags runner_name:${{runner.name}}
env:
DATADOG_API_KEY: ${{ inputs.api-key }}
Loading