Skip to content

Commit ffe3efc

Browse files
jandro996jandro996
authored
Merge branch 'master' into alejandro.gonzalez/Optimize-IAST-Vulnerability-Detection
2 parents e0cc794 + 848b075 commit ffe3efc

239 files changed

Lines changed: 2050 additions & 1118 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/README.md‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -85,13 +85,6 @@ _Action:_
8585

8686
_Recovery:_ Check at the milestone for the related issues and update them manually.
8787

88-
### prune-github-container-registry [🔗](prune-github-container-registry.yaml)
89-
90-
_Trigger:_ Every day or manually.
91-
92-
_Action:_ Clean up old lib-injection OCI images from GitHub Container Registry.
93-
94-
_Recovery:_ Manually trigger the action again.
9588

9689
### prune-old-pull-requests [🔗](prune-old-pull-requests.yaml)
9790

‎.github/workflows/prune-github-container-registry.yaml‎

Lines changed: 0 additions & 25 deletions
This file was deleted.

‎.gitlab-ci.yml‎

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,13 @@ default:
119119
- .gitlab/cgroup-info.sh
120120
- gitlab_section_end "cgroup-info"
121121

122+
.gitlab_base_ref_params: &gitlab_base_ref_params
123+
- |
124+
if [[ ! $CI_COMMIT_BRANCH =~ ^(master|release/.*)$ ]]; then
125+
export GIT_BASE_REF=$(.gitlab/find-gh-base-ref.sh)
126+
export GRADLE_PARAMS="$GRADLE_PARAMS -PgitBaseRef=origin/$GIT_BASE_REF"
127+
fi
128+
122129
.gradle_build: &gradle_build
123130
image: ghcr.io/datadog/dd-trace-java-docker-build:${BUILDER_IMAGE_VERSION_PREFIX}base
124131
stage: build
@@ -223,7 +230,8 @@ build_tests:
223230
MAVEN_OPTS: "-Xms64M -Xmx512M -Dorg.slf4j.simpleLogger.defaultLogLevel=debug" # FIXME: Build :smokeTest build fails unless mvn debug logging is on
224231

225232
script:
226-
- ./gradlew clean $GRADLE_TARGET -PskipTests $GRADLE_ARGS
233+
- *gitlab_base_ref_params
234+
- ./gradlew clean $GRADLE_TARGET $GRADLE_PARAMS -PskipTests $GRADLE_ARGS
227235

228236
populate_dep_cache:
229237
extends: build_tests
@@ -327,7 +335,8 @@ test_published_artifacts:
327335
variables:
328336
CACHE_TYPE: lib
329337
script:
330-
- ./gradlew $GRADLE_TARGET -PskipTests -PrunBuildSrcTests -PskipSpotless -PtaskPartitionCount=$NORMALIZED_NODE_TOTAL -PtaskPartition=$NORMALIZED_NODE_INDEX $GRADLE_ARGS
338+
- *gitlab_base_ref_params
339+
- ./gradlew $GRADLE_TARGET $GRADLE_PARAMS -PskipTests -PrunBuildSrcTests -PskipSpotless -PtaskPartitionCount=$NORMALIZED_NODE_TOTAL -PtaskPartition=$NORMALIZED_NODE_INDEX $GRADLE_ARGS
331340
after_script:
332341
- *cgroup_info
333342
- source .gitlab/gitlab-utils.sh
@@ -460,6 +469,7 @@ muzzle-dep-report:
460469
- if: $CI_COMMIT_BRANCH == "master"
461470
when: on_success
462471
script:
472+
- *gitlab_base_ref_params
463473
- >
464474
if [ "$PROFILE_TESTS" == "true" ] && [ "$testJvm" != "ibm8" ] && [ "$testJvm" != "oracle8" ];
465475
then
@@ -506,7 +516,7 @@ muzzle-dep-report:
506516
CI_USE_TEST_AGENT: "true"
507517
CI_AGENT_HOST: local-agent
508518
services:
509-
- name: ghcr.io/datadog/dd-apm-test-agent/ddapm-test-agent:v1.11.0
519+
- name: ghcr.io/datadog/dd-apm-test-agent/ddapm-test-agent:v1.24.1
510520
alias: local-agent
511521
variables:
512522
LOG_LEVEL: "DEBUG"
@@ -729,6 +739,7 @@ deploy_to_di_backend:manual:
729739
UPSTREAM_COMMIT_AUTHOR: $CI_COMMIT_AUTHOR
730740
UPSTREAM_COMMIT_SHORT_SHA: $CI_COMMIT_SHORT_SHA
731741

742+
# If the deploy_to_sonatype job is re-run, re-trigger the deploy_artifacts_to_github job as well so that the artifacts match.
732743
deploy_to_sonatype:
733744
extends: .gradle_build
734745
stage: publish
@@ -746,8 +757,8 @@ deploy_to_sonatype:
746757
- when: manual
747758
allow_failure: true
748759
script:
749-
- export SONATYPE_USERNAME=$(aws ssm get-parameter --region us-east-1 --name ci.dd-trace-java.sonatype_username --with-decryption --query "Parameter.Value" --out text)
750-
- export SONATYPE_PASSWORD=$(aws ssm get-parameter --region us-east-1 --name ci.dd-trace-java.sonatype_password --with-decryption --query "Parameter.Value" --out text)
760+
- export SONATYPE_USERNAME=$(aws ssm get-parameter --region us-east-1 --name ci.dd-trace-java.central_username --with-decryption --query "Parameter.Value" --out text)
761+
- export SONATYPE_PASSWORD=$(aws ssm get-parameter --region us-east-1 --name ci.dd-trace-java.central_password --with-decryption --query "Parameter.Value" --out text)
751762
- export GPG_PRIVATE_KEY=$(aws ssm get-parameter --region us-east-1 --name ci.dd-trace-java.signing.gpg_private_key --with-decryption --query "Parameter.Value" --out text)
752763
- export GPG_PASSWORD=$(aws ssm get-parameter --region us-east-1 --name ci.dd-trace-java.signing.gpg_passphrase --with-decryption --query "Parameter.Value" --out text)
753764
- ./gradlew -PbuildInfo.build.number=$CI_JOB_ID publishToSonatype closeSonatypeStagingRepository -PskipTests $GRADLE_ARGS
@@ -765,7 +776,7 @@ deploy_artifacts_to_github:
765776
when: never
766777
- if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+$/'
767778
when: on_success
768-
# Requires the deploy_to_sonatype job to have run first the UP-TO-DATE gradle check across jobs is broken
779+
# Requires the deploy_to_sonatype job to have run first (the UP-TO-DATE gradle check across jobs is broken)
769780
# This will deploy the artifacts built from the publishToSonatype task to the GitHub release
770781
needs:
771782
- job: deploy_to_sonatype

‎.gitlab/benchmarks.yml‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,6 @@
2727
UPSTREAM_BRANCH: $CI_COMMIT_REF_NAME # The branch or tag name for which project is built.
2828
UPSTREAM_COMMIT_SHA: $CI_COMMIT_SHA # The commit revision the project is built for.
2929

30-
KUBERNETES_SERVICE_ACCOUNT_OVERWRITE: dd-trace-java
31-
FF_USE_LEGACY_KUBERNETES_EXECUTION_STRATEGY: "true"
32-
3330
benchmarks-startup:
3431
extends: .benchmarks
3532
script:
@@ -56,6 +53,7 @@ benchmarks-dacapo:
5653

5754
benchmarks-post-results:
5855
extends: .benchmarks
56+
tags: ["arch:amd64"]
5957
script:
6058
- !reference [ .benchmarks, script ]
6159
- ./steps/upload-results-to-s3.sh

‎.gitlab/find-gh-base-ref.sh‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
#!/usr/bin/env bash
2+
# Determines the base branch for the current PR (if we are running in a PR).
3+
set -euo pipefail
4+
5+
# Happy path: if we're just one commit away from master, base ref is master.
6+
if [[ $(git log --pretty=oneline origin/master..HEAD | wc -l) -eq 1 ]]; then
7+
echo "We are just one commit away from master, base ref is master" >&2
8+
echo "master"
9+
exit 0
10+
fi
11+
12+
# In GitLab: we have no reference to the base branch or even the PR number.
13+
# We have to find it from the current branch name, which is defined in
14+
# CI_COMMIT_REF_NAME.
15+
if [[ -z "${CI_COMMIT_REF_NAME}" ]]; then
16+
echo "CI_COMMIT_REF_NAME is not set, not running in GitLab CI?" >&2
17+
exit 1
18+
fi
19+
20+
if [[ -z "${GITHUB_TOKEN:-}" ]]; then
21+
echo "GITHUB_TOKEN is not set, fetching from AWS SSM" >&2
22+
if ! command -v aws >/dev/null 2>&1; then
23+
echo "aws is not installed, please install it" >&2
24+
exit 1
25+
fi
26+
GITHUB_TOKEN=$(aws ssm get-parameter --name "ci.$CI_PROJECT_NAME.gh_release_token" --with-decryption --query "Parameter.Value" --output text)
27+
if [[ -z "${GITHUB_TOKEN}" ]]; then
28+
echo "Failed to fetch GITHUB_TOKEN from AWS SSM" >&2
29+
exit 1
30+
fi
31+
export GITHUB_TOKEN
32+
fi
33+
34+
if ! command -v curl >/dev/null 2>&1; then
35+
echo "curl is not installed, please install it" >&2
36+
exit 1
37+
fi
38+
39+
if ! command -v jq >/dev/null 2>&1; then
40+
echo "jq is not installed, please install it" >&2
41+
exit 1
42+
fi
43+
44+
while true; do
45+
set +e
46+
PR_DATA=$(curl \
47+
-XGET \
48+
--silent \
49+
--include \
50+
--fail-with-body \
51+
-H 'Accept: application/vnd.github+json' \
52+
-H "Authorization: Bearer ${GITHUB_TOKEN}" \
53+
-H "X-GitHub-Api-Version: 2022-11-28" \
54+
"https://api.github.com/repos/datadog/dd-trace-java/pulls?head=DataDog:${CI_COMMIT_REF_NAME}&sort=updated&direction=desc")
55+
exit_code=$?
56+
set -e
57+
if [[ ${exit_code} -eq 0 ]]; then
58+
PR_NUMBER=$(echo "$PR_DATA" | sed '1,/^[[:space:]]*$/d' | jq -r '.[].number')
59+
PR_BASE_REF=$(echo "$PR_DATA" | sed '1,/^[[:space:]]*$/d' | jq -r '.[].base.ref')
60+
echo "PR is https://github.com/datadog/dd-trace-java/pull/${PR_NUMBER} and base ref is ${PR_BASE_REF}">&2
61+
echo "${PR_BASE_REF}"
62+
exit 0
63+
fi
64+
if echo "$PR_DATA" | grep -q "^x-ratelimit-reset:"; then
65+
reset_timestamp=$(echo -n "$PR_DATA" | grep "^x-ratelimit-reset:" | sed -e 's/^x-ratelimit-reset: //' -e 's/\r//')
66+
now=$(date +%s)
67+
sleep_time=$((reset_timestamp - now + 1))
68+
echo "GitHub rate limit exceeded, sleeping for ${sleep_time} seconds" >&2
69+
sleep "${sleep_time}"
70+
continue
71+
fi
72+
echo -e "GitHub request failed for an unknown reason:\n$(echo "$PR_DATA" | sed '/^$/q')" >&2
73+
echo "Assuming base ref is master" >&2
74+
echo "master"
75+
exit 0
76+
done

‎.gitlab/macrobenchmarks.yml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,6 @@
2222
- platform/artifacts/
2323
expire_in: 3 months
2424
variables:
25-
FF_USE_LEGACY_KUBERNETES_EXECUTION_STRATEGY: "true"
26-
2725
K6_OPTIONS_WARMUP_RATE: 2000
2826
K6_OPTIONS_WARMUP_DURATION: 5m
2927
K6_OPTIONS_WARMUP_GRACEFUL_STOP: 10s

‎benchmark/README.MD‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,19 +4,19 @@ This directory contains different types of benchmarks.
44

55
## Running Benchmarks via Docker
66

7-
Docker allows the execution of benchmarks without needing to install and configure your development environment. For example, package installation and installation of sirun is performed automatically.
7+
Docker allows the execution of benchmarks without needing to install and configure your development environment. For example, package installation and installation of sirun are performed automatically.
88

9-
In order to run benchmarks using Docker, issue the following command from the benchmark folder of the project:
9+
In order to run benchmarks using Docker, issue the following command from the `benchmark/` folder of this project:
1010

1111
```sh
1212
./run.sh
1313
```
1414

15-
Once it finishes, the reports will be available in the reports folder.
15+
If you run into storage errors (e.g. running out of disk space), try removing all unused Docker containers, networks, and images with `docker system prune -af` before running the script again. Once finished, the reports will be available in the `benchmark/reports/` folder. Note that the script can take ~40 minutes to run.
1616

1717
### Running specific benchmarks
1818

19-
If you want to run only a specific category of benchmarks you can do it via arguments:
19+
If you want to run only a specific category of benchmarks, you can do so via arguments:
2020

2121
1. Run startup benchmarks
2222
```sh

‎build.gradle‎

Lines changed: 18 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -13,18 +13,18 @@ buildscript {
1313
}
1414

1515
plugins {
16-
id "datadog.gradle-debug"
17-
id "datadog.dependency-locking"
16+
id 'datadog.gradle-debug'
17+
id 'datadog.dependency-locking'
1818

19-
id "com.diffplug.spotless" version "6.13.0"
19+
id 'com.diffplug.spotless' version '6.13.0'
2020
id 'com.github.spotbugs' version '5.0.14'
21-
id "de.thetaphi.forbiddenapis" version "3.8"
21+
id 'de.thetaphi.forbiddenapis' version '3.8'
2222

2323
id 'pl.allegro.tech.build.axion-release' version '1.14.4'
24-
id 'io.github.gradle-nexus.publish-plugin' version '1.3.0'
24+
id 'io.github.gradle-nexus.publish-plugin' version '2.0.0'
2525

26-
id "com.gradleup.shadow" version "8.3.6" apply false
27-
id "me.champeau.jmh" version "0.7.0" apply false
26+
id 'com.gradleup.shadow' version '8.3.6' apply false
27+
id 'me.champeau.jmh' version '0.7.0' apply false
2828
id 'org.gradle.playframework' version '0.13' apply false
2929
id 'info.solidsoft.pitest' version '1.9.11' apply false
3030
}
@@ -35,13 +35,17 @@ def isCI = System.getenv("CI") != null
3535

3636
apply from: "$rootDir/gradle/repositories.gradle"
3737
apply from: "$rootDir/gradle/scm.gradle"
38+
3839
spotless {
3940
// only resolve the spotless dependencies once in the build
4041
predeclareDeps()
4142
}
43+
4244
spotlessPredeclare {
4345
// these need to align with the types and versions in gradle/spotless.gradle
4446
java {
47+
removeUnusedImports()
48+
4549
// This is the last Google Java Format version that supports Java 8
4650
googleJavaFormat('1.7')
4751
}
@@ -88,7 +92,7 @@ nexusPublishing {
8892
def forceLocal = project.hasProperty('forceLocal') && forceLocal
8993
if (forceLocal && !isCI) {
9094
local {
91-
// For testing use with https://hub.docker.com/r/sonatype/nexus
95+
// For testing, use with https://hub.docker.com/r/sonatype/nexus
9296
// docker run --rm -d -p 8081:8081 --name nexus sonatype/nexus:oss
9397
// ./gradlew publishToLocal
9498
// Doesn't work for testing releases though... (due to staging)
@@ -99,7 +103,13 @@ nexusPublishing {
99103
allowInsecureProtocol = true
100104
}
101105
} else {
106+
// see https://github.com/gradle-nexus/publish-plugin#publishing-to-maven-central-via-sonatype-central
107+
// For official documentation:
108+
// staging repo publishing https://central.sonatype.org/publish/publish-portal-ossrh-staging-api/#configuration
109+
// snapshot publishing https://central.sonatype.org/publish/publish-portal-snapshots/#publishing-via-other-methods
102110
sonatype {
111+
nexusUrl.set(uri("https://ossrh-staging-api.central.sonatype.com/service/local/"))
112+
snapshotRepositoryUrl.set(uri("https://central.sonatype.com/repository/maven-snapshots/"))
103113
username = System.getenv("SONATYPE_USERNAME")
104114
password = System.getenv("SONATYPE_PASSWORD")
105115
}

‎buildSrc/src/test/groovy/CallSiteInstrumentationPluginTest.groovy‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ class CallSiteInstrumentationPluginTest extends Specification {
1010
plugins {
1111
id 'java'
1212
id 'call-site-instrumentation'
13-
id("com.diffplug.spotless") version "6.13.0"
13+
id 'com.diffplug.spotless' version '6.13.0'
1414
}
1515
1616
sourceCompatibility = JavaVersion.VERSION_1_8

‎dd-java-agent/agent-bootstrap/build.gradle‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
// The shadowJar of this project will be injected into the JVM's bootstrap classloader
22
plugins {
3-
id "com.gradleup.shadow"
3+
id 'com.gradleup.shadow'
44
id 'me.champeau.jmh'
55
}
66

0 commit comments

Comments
 (0)