fix(deps): vuln minor upgrades — 4 packages (minor: 3 · patch: 1) [examples/single_service/src/go-project/go.mod] #888

Workflow file for this run

	# Unless explicitly stated otherwise all files in this repository are licensed under
	# the Apache 2.0 License.
	#
	# This product includes software developed at Datadog
	# (https://www.datadoghq.com/) Copyright 2025-Present Datadog, Inc.

	name: CI

	on:
	pull_request:
	push:
	branches:
	- main
	- "feature/**"

	permissions:
	contents: read

	env:
	# Keep the host Go toolchain aligned with the public WORKSPACE Go fixture and
	# the current default tracer pin exercised by that fixture.
	GO_VERSION: "1.25.0"
	PYTHON_VERSION: "3.11"
	BAZELISK_VERSION: "1.28.1"
	BAZELISK_SHA256_LINUX_AMD64: "22e7d3a188699982f661cf4687137ee52d1f24fec1ec893d91a6c4d791a75de8"
	BUILDIFIER_VERSION: "8.2.1"
	BUILDIFIER_SHA256_LINUX_AMD64: "6ceb7b0ab7cf66fceccc56a027d21d9cc557a7f34af37d2101edb56b92fcfa1a"

	concurrency:
	# Keep one active run per workflow/ref to avoid wasting CI minutes when
	# multiple commits are pushed quickly to the same branch.
	group: ci-${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	# Keep the workflow itself running on every PR update so required checks still
	# report a concrete result. Heavy jobs can then opt out cleanly on docs-only
	# changes instead of leaving branch protection checks stuck in a pending state.
	changes:
	timeout-minutes: 5
	runs-on: ubuntu-latest
	outputs:
	docs_only: ${{ steps.classify.outputs.docs_only }}
	rules_go_integration_matrix: ${{ steps.rules_go_matrix.outputs.integration_matrix }}
	rules_go_upstreams: ${{ steps.rules_go_matrix.outputs.upstreams }}
	run_full_ci: ${{ steps.classify.outputs.run_full_ci }}
	steps:
	- name: Checkout
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	with:
	fetch-depth: 0

	- name: Set up Python
	uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
	with:
	python-version: ${{ env.PYTHON_VERSION }}

	- name: Classify changed files
	id: classify
	shell: bash
	env:
	EVENT_NAME: ${{ github.event_name }}
	PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
	PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
	PUSH_BEFORE_SHA: ${{ github.event.before }}
	PUSH_AFTER_SHA: ${{ github.sha }}
	run: \|
	set -euo pipefail

	case "${EVENT_NAME}" in
	pull_request)
	base_sha="${PR_BASE_SHA}"
	head_sha="${PR_HEAD_SHA}"
	;;
	push)
	base_sha="${PUSH_BEFORE_SHA}"
	head_sha="${PUSH_AFTER_SHA}"
	;;
	*)
	base_sha=""
	head_sha=""
	;;
	esac

	while IFS= read -r line; do
	echo "${line}" >> "${GITHUB_OUTPUT}"
	done < <(./tools/dev/classify_ci_changes.sh "${base_sha}" "${head_sha}")

	- name: Generate rules_go CI matrices
	id: rules_go_matrix
	shell: bash
	run: \|
	python3 tools/dev/materialize_rules_go_fork.py list-upstreams \|
	python3 -c 'import json, sys; upstreams = [line.strip() for line in sys.stdin if line.strip()]; assert upstreams, "no rules_go upstreams found"; print("upstreams=" + json.dumps(upstreams, separators=(",", ":"))); print("integration_matrix=" + json.dumps({"upstream": upstreams, "module_system": ["workspace", "bzlmod"]}, separators=(",", ":")))' \
	>> "${GITHUB_OUTPUT}"

	bazel-tests:
	needs: changes
	if: ${{ needs.changes.outputs.run_full_ci == 'true' }}
	timeout-minutes: 45
	strategy:
	fail-fast: false
	matrix:
	os: [macos-latest, windows-latest]
	runs-on: ${{ matrix.os }}
	steps:
	- name: Checkout
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

	- name: Set up Go
	uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
	with:
	go-version: ${{ env.GO_VERSION }}

	- name: Set up Python
	uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
	with:
	python-version: ${{ env.PYTHON_VERSION }}

	# Fresh-run policy: keep this lane intentionally cacheless so every CI run
	# re-evaluates repository rules from scratch.
	# Guardrail: do not add Bazel cache steps (actions/cache, disk cache,
	# remote cache) here without explicit maintainer approval.
	- name: Run Bazel tests
	timeout-minutes: 25
	shell: bash
	run: ./bazelw test //tools/... --test_output=errors

	- name: Build examples
	timeout-minutes: 20
	shell: bash
	run: \|
	if [[ "${{ runner.os }}" == "Windows" ]]; then
	# Ubuntu and macOS build the full example matrix, including Go.
	# Keep Windows coverage on the non-Go examples until the vendored
	# rules_go Orchestrion stdlib action is stable there.
	./bazelw --output_user_root=C:/b build \
	-- \
	//examples/... \
	-//examples/single_service/src/go-project/... \
	-//examples/multi_service/src/go-project/...
	else
	./bazelw build //examples/...
	fi

	- name: Test examples
	timeout-minutes: 20
	shell: bash
	# --enable_runfiles is required on Windows so the dd_topt_java_test
	# example can resolve -javaagent via $(rootpath); no-op on Linux/macOS.
	run: \|
	if [[ "${{ runner.os }}" == "Windows" ]]; then
	./bazelw --output_user_root=C:/b test \
	--enable_runfiles \
	--test_output=errors \
	-- \
	//examples/... \
	-//examples/single_service/src/go-project/... \
	-//examples/multi_service/src/go-project/...
	else
	./bazelw test //examples/... --test_output=errors
	fi

	- name: Exercise single-service runtests script (dry-run)
	shell: bash
	# Keep CI deterministic and secret-free: this validates script wiring
	# and command construction without requiring live Datadog credentials.
	run: RUNTESTS_DRY_RUN=1 bash ./examples/single_service/runtests.sh

	- name: Exercise multi-service runtests script (dry-run)
	shell: bash
	# Keep CI deterministic and secret-free: this validates script wiring
	# and command construction without requiring live Datadog credentials.
	run: RUNTESTS_DRY_RUN=1 bash ./examples/multi_service/runtests.sh

	- name: Exercise example PowerShell runtests scripts (dry-run)
	if: runner.os == 'Windows'
	shell: pwsh
	run: \|
	$env:RUNTESTS_DRY_RUN = "1"
	foreach ($script in @(
	"./examples/single_service/runtests.ps1",
	"./examples/multi_service/runtests.ps1"
	)) {
	& $script
	if ($LASTEXITCODE -ne 0) {
	exit $LASTEXITCODE
	}
	}

	- name: Ensure jq is available (Windows)
	if: runner.os == 'Windows'
	shell: pwsh
	run: \|
	if (Get-Command jq -ErrorAction SilentlyContinue) {
	jq --version
	exit 0
	}
	choco install jq --no-progress -y
	jq --version

	# Runs the same integration harness on Windows.
	- name: Run mock server integration tests (Windows)
	if: runner.os == 'Windows'
	timeout-minutes: 15
	shell: pwsh
	run: ./tools/tests/integration/run_mock_server_tests.ps1

	- name: Validate enabled manifest sync and runtime paths (Windows)
	if: runner.os == 'Windows'
	timeout-minutes: 10
	shell: pwsh
	run: python tools/tests/integration/run_manifest_sync_tests.py --mode windows-enabled-smoke

	bazel-tests-ubuntu-main:
	needs: changes
	if: ${{ needs.changes.outputs.run_full_ci == 'true' }}
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

	- name: Set up Go
	uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
	with:
	go-version: ${{ env.GO_VERSION }}

	- name: Set up Python
	uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
	with:
	python-version: ${{ env.PYTHON_VERSION }}

	# Fresh-run policy: keep this lane intentionally cacheless so every CI run
	# re-evaluates repository rules from scratch.
	# Guardrail: do not add Bazel cache steps (actions/cache, disk cache,
	# remote cache) here without explicit maintainer approval.
	- name: Run Bazel tests
	shell: bash
	run: ./bazelw test //tools/... --test_output=errors

	- name: Run Bazel tests (go companion module)
	shell: bash
	run: \|
	(
	cd modules/go &&
	../../bazelw test //... \
	--override_module=datadog-rules-test-optimization=../..
	)

	- name: Run Bazel tests (python companion module)
	shell: bash
	run: \|
	(
	cd modules/python &&
	../../bazelw test //... \
	--override_module=datadog-rules-test-optimization=../..
	)

	- name: Run Bazel tests (java companion module)
	shell: bash
	run: \|
	(
	cd modules/java &&
	../../bazelw test //... \
	--override_module=datadog-rules-test-optimization=../..
	)

	- name: Run Bazel tests (nodejs companion module)
	shell: bash
	run: \|
	(
	cd modules/nodejs &&
	../../bazelw test //... \
	--override_module=datadog-rules-test-optimization=../..
	)

	- name: Run Bazel tests (dotnet companion module)
	shell: bash
	run: \|
	(
	cd modules/dotnet &&
	../../bazelw test //... \
	--override_module=datadog-rules-test-optimization=../..
	)

	- name: Run Bazel tests (ruby companion module)
	shell: bash
	run: \|
	(
	cd modules/ruby &&
	../../bazelw test //... \
	--override_module=datadog-rules-test-optimization=../..
	)

	- name: Build examples
	shell: bash
	run: ./bazelw build //examples/...

	- name: Test examples
	shell: bash
	run: ./bazelw test //examples/... --test_output=errors

	- name: Exercise single-service runtests script (dry-run)
	shell: bash
	run: RUNTESTS_DRY_RUN=1 bash ./examples/single_service/runtests.sh

	- name: Exercise multi-service runtests script (dry-run)
	shell: bash
	run: RUNTESTS_DRY_RUN=1 bash ./examples/multi_service/runtests.sh

	bazel-tests-ubuntu-mock-server:
	needs: changes
	if: ${{ needs.changes.outputs.run_full_ci == 'true' }}
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

	- name: Set up Go
	uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
	with:
	go-version: ${{ env.GO_VERSION }}

	- name: Set up Python
	uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
	with:
	python-version: ${{ env.PYTHON_VERSION }}

	# The harness owns isolated output bases, so it does not benefit from the
	# Bazel state created by the main Ubuntu lane.
	- name: Run mock server integration tests
	shell: bash
	run: ./tools/tests/integration/run_mock_server_tests.sh

	- name: Run manifest sync and cache isolation integration
	shell: bash
	run: python3 tools/tests/integration/run_manifest_sync_tests.py --mode full

	bazel-tests-ubuntu:
	name: bazel-tests (ubuntu-latest)
	needs:
	- changes
	- bazel-tests-ubuntu-main
	- bazel-tests-ubuntu-mock-server
	if: ${{ always() }}
	runs-on: ubuntu-latest
	steps:
	- name: Require successful Ubuntu Bazel test shards
	shell: bash
	env:
	CHANGES_RESULT: ${{ needs.changes.result }}
	MAIN_RESULT: ${{ needs.bazel-tests-ubuntu-main.result }}
	MOCK_SERVER_RESULT: ${{ needs.bazel-tests-ubuntu-mock-server.result }}
	RUN_FULL_CI: ${{ needs.changes.outputs.run_full_ci }}
	run: \|
	if [[ "${CHANGES_RESULT}" != "success" ]]; then
	echo "Change classification did not succeed: ${CHANGES_RESULT}" >&2
	exit 1
	fi

	if [[ "${RUN_FULL_CI}" != "true" ]]; then
	echo "Ubuntu Bazel tests are not required for this change."
	exit 0
	fi

	if [[ "${MAIN_RESULT}" != "success" ]]; then
	echo "The main Ubuntu Bazel test shard did not succeed: ${MAIN_RESULT}" >&2
	exit 1
	fi

	if [[ "${MOCK_SERVER_RESULT}" != "success" ]]; then
	echo "The Ubuntu mock-server shard did not succeed: ${MOCK_SERVER_RESULT}" >&2
	exit 1
	fi

	rules-go-variant-smoke-shard:
	name: rules-go-variant-smoke-shard (${{ matrix.upstream }})
	needs: changes
	if: ${{ needs.changes.outputs.run_full_ci == 'true' }}
	strategy:
	fail-fast: false
	max-parallel: 4
	matrix:
	upstream: ${{ fromJSON(needs.changes.outputs.rules_go_upstreams) }}
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	with:
	# The variant verifier and smoke harness inspect the vendored fork
	# contract directly, so keep the checkout complete for maintainer
	# diagnostics instead of relying on a shallow history.
	fetch-depth: 0

	- name: Set up Python
	uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
	with:
	python-version: ${{ env.PYTHON_VERSION }}

	- name: Set up Go
	uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
	with:
	go-version: ${{ env.GO_VERSION }}

	- name: Install Bazelisk
	shell: bash
	run: \|
	GO111MODULE=on go install github.com/bazelbuild/bazelisk@v1.28.1
	echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"

	- name: Run vendored rules_go smoke coverage
	shell: bash
	env:
	RULES_GO_UPSTREAM: ${{ matrix.upstream }}
	RULES_GO_VARIANT: base
	run: ./tools/dev/run_rules_go_variant_smoke.sh

	rules-go-variant-smoke:
	needs:
	- changes
	- rules-go-variant-smoke-shard
	if: ${{ always() }}
	runs-on: ubuntu-latest
	steps:
	- name: Require successful rules_go variant smoke shards
	shell: bash
	env:
	CHANGES_RESULT: ${{ needs.changes.result }}
	RUN_FULL_CI: ${{ needs.changes.outputs.run_full_ci }}
	SHARD_RESULT: ${{ needs.rules-go-variant-smoke-shard.result }}
	run: \|
	if [[ "${CHANGES_RESULT}" != "success" ]]; then
	echo "Change classification did not succeed: ${CHANGES_RESULT}" >&2
	exit 1
	fi

	if [[ "${RUN_FULL_CI}" != "true" ]]; then
	echo "rules_go variant smoke coverage is not required for this change."
	exit 0
	fi

	if [[ "${SHARD_RESULT}" != "success" ]]; then
	echo "One or more rules_go variant smoke shards did not succeed: ${SHARD_RESULT}" >&2
	exit 1
	fi

	workspace-compat-shard:
	name: workspace-compat-shard (${{ matrix.upstream }}, ${{ matrix.module_system }})
	needs: changes
	if: ${{ needs.changes.outputs.run_full_ci == 'true' }}
	strategy:
	fail-fast: false
	max-parallel: 4
	matrix: ${{ fromJSON(needs.changes.outputs.rules_go_integration_matrix) }}
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

	- name: Set up Python
	uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
	with:
	python-version: ${{ env.PYTHON_VERSION }}

	- name: Set up Go
	uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
	with:
	go-version: ${{ env.GO_VERSION }}

	- name: Install Bazelisk
	shell: bash
	run: \|
	GO111MODULE=on go install github.com/bazelbuild/bazelisk@v1.28.1
	echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"

	- name: Validate general Go companion consumer path
	shell: bash
	env:
	MODULE_SYSTEM: ${{ matrix.module_system }}
	ORCHESTRION_MODE: general
	RULES_GO_UPSTREAM: ${{ matrix.upstream }}
	RULES_GO_VARIANT: base
	USE_BAZEL_VERSION: "8.4.1"
	run: \|
	case "${MODULE_SYSTEM}" in
	workspace)
	./tools/tests/integration/run_workspace_go_integration.sh
	;;
	bzlmod)
	./tools/tests/integration/run_bzlmod_go_integration.sh
	;;
	*)
	echo "Unsupported module system: ${MODULE_SYSTEM}" >&2
	exit 1
	;;
	esac

	- name: Validate Test Optimization Go companion consumer path
	shell: bash
	env:
	MODULE_SYSTEM: ${{ matrix.module_system }}
	ORCHESTRION_MODE: test_optimization
	RULES_GO_UPSTREAM: ${{ matrix.upstream }}
	RULES_GO_VARIANT: base
	USE_BAZEL_VERSION: "8.4.1"
	run: \|
	case "${MODULE_SYSTEM}" in
	workspace)
	./tools/tests/integration/run_workspace_go_integration.sh
	;;
	bzlmod)
	./tools/tests/integration/run_bzlmod_go_integration.sh
	;;
	*)
	echo "Unsupported module system: ${MODULE_SYSTEM}" >&2
	exit 1
	;;
	esac

	workspace-compat:
	needs:
	- changes
	- workspace-compat-shard
	if: ${{ always() }}
	runs-on: ubuntu-latest
	steps:
	- name: Require successful workspace compatibility shards
	shell: bash
	env:
	CHANGES_RESULT: ${{ needs.changes.result }}
	RUN_FULL_CI: ${{ needs.changes.outputs.run_full_ci }}
	SHARD_RESULT: ${{ needs.workspace-compat-shard.result }}
	run: \|
	if [[ "${CHANGES_RESULT}" != "success" ]]; then
	echo "Change classification did not succeed: ${CHANGES_RESULT}" >&2
	exit 1
	fi

	if [[ "${RUN_FULL_CI}" != "true" ]]; then
	echo "Workspace compatibility coverage is not required for this change."
	exit 0
	fi

	if [[ "${SHARD_RESULT}" != "success" ]]; then
	echo "One or more workspace compatibility shards did not succeed: ${SHARD_RESULT}" >&2
	exit 1
	fi

	go-bootstrap-no-host-shard:
	name: go-bootstrap-no-host-shard (${{ matrix.upstream }}, ${{ matrix.module_system }})
	needs: changes
	if: ${{ needs.changes.outputs.run_full_ci == 'true' }}
	strategy:
	fail-fast: false
	max-parallel: 4
	matrix: ${{ fromJSON(needs.changes.outputs.rules_go_integration_matrix) }}
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

	- name: Set up Python
	uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
	with:
	python-version: ${{ env.PYTHON_VERSION }}

	# Do not use setup-go or `go install` in this lane. The consumer path must
	# obtain its Go SDK from Bazel, while a sentinel shadows any Go binary
	# already present in the hosted-runner image.
	- name: Install Bazelisk without Go
	shell: bash
	run: \|
	set -euo pipefail
	bin_dir="${RUNNER_TEMP}/bazelisk-bin"
	bazelisk_path="${bin_dir}/bazelisk"
	mkdir -p "${bin_dir}"
	curl --fail --location --silent --show-error \
	--retry 3 \
	--output "${bazelisk_path}" \
	"https://github.com/bazelbuild/bazelisk/releases/download/v${BAZELISK_VERSION}/bazelisk-linux-amd64"
	printf '%s %s\n' "${BAZELISK_SHA256_LINUX_AMD64}" "${bazelisk_path}" \|
	sha256sum --check
	chmod +x "${bazelisk_path}"
	echo "${bin_dir}" >> "${GITHUB_PATH}"

	- name: Validate cold config transition without host Go
	shell: bash
	env:
	CONFIG_TRANSITION_ONLY: "1"
	EXPECTED_ORCHESTRION_CACHE_PHASE: extensions.bootstrap_cache_miss
	FORBID_HOST_GO: "1"
	MODULE_SYSTEM: ${{ matrix.module_system }}
	ORCHESTRION_MODE: test_optimization
	RULES_GO_UPSTREAM: ${{ matrix.upstream }}
	RULES_GO_VARIANT: base
	USE_BAZEL_VERSION: "8.4.1"
	XDG_CACHE_HOME: ${{ runner.temp }}/rto-no-host-go-cache/${{ matrix.upstream }}/${{ matrix.module_system }}
	run: \|
	set -euo pipefail
	if [[ -e "${XDG_CACHE_HOME}" ]]; then
	echo "Cold bootstrap cache path already exists: ${XDG_CACHE_HOME}" >&2
	exit 1
	fi
	mkdir -p "${XDG_CACHE_HOME}"
	case "${MODULE_SYSTEM}" in
	workspace)
	./tools/tests/integration/run_workspace_go_integration.sh
	;;
	bzlmod)
	./tools/tests/integration/run_bzlmod_go_integration.sh
	;;
	*)
	echo "Unsupported module system: ${MODULE_SYSTEM}" >&2
	exit 1
	;;
	esac

	- name: Validate warm cache restoration without host Go
	shell: bash
	env:
	CONFIG_TRANSITION_ONLY: "1"
	EXPECTED_ORCHESTRION_CACHE_PHASE: extensions.bootstrap_cache_hit
	FORBID_HOST_GO: "1"
	MODULE_SYSTEM: ${{ matrix.module_system }}
	ORCHESTRION_MODE: test_optimization
	RULES_GO_UPSTREAM: ${{ matrix.upstream }}
	RULES_GO_VARIANT: base
	USE_BAZEL_VERSION: "8.4.1"
	XDG_CACHE_HOME: ${{ runner.temp }}/rto-no-host-go-cache/${{ matrix.upstream }}/${{ matrix.module_system }}
	run: \|
	set -euo pipefail
	case "${MODULE_SYSTEM}" in
	workspace)
	./tools/tests/integration/run_workspace_go_integration.sh
	;;
	bzlmod)
	./tools/tests/integration/run_bzlmod_go_integration.sh
	;;
	*)
	echo "Unsupported module system: ${MODULE_SYSTEM}" >&2
	exit 1
	;;
	esac

	go-bootstrap-no-host:
	needs:
	- changes
	- go-bootstrap-no-host-shard
	if: ${{ always() }}
	runs-on: ubuntu-latest
	steps:
	- name: Require successful no-host-Go bootstrap shards
	shell: bash
	env:
	CHANGES_RESULT: ${{ needs.changes.result }}
	RUN_FULL_CI: ${{ needs.changes.outputs.run_full_ci }}
	SHARD_RESULT: ${{ needs.go-bootstrap-no-host-shard.result }}
	run: \|
	if [[ "${CHANGES_RESULT}" != "success" ]]; then
	echo "Change classification did not succeed: ${CHANGES_RESULT}" >&2
	exit 1
	fi

	if [[ "${RUN_FULL_CI}" != "true" ]]; then
	echo "No-host-Go bootstrap coverage is not required for this change."
	exit 0
	fi

	if [[ "${SHARD_RESULT}" != "success" ]]; then
	echo "One or more no-host-Go bootstrap shards did not succeed: ${SHARD_RESULT}" >&2
	exit 1
	fi

	windows-go-bootstrap-shard:
	name: windows-go-bootstrap-shard (${{ matrix.upstream }}, ${{ matrix.module_system }})
	needs: changes
	if: ${{ needs.changes.outputs.run_full_ci == 'true' }}
	strategy:
	fail-fast: false
	max-parallel: 4
	matrix: ${{ fromJSON(needs.changes.outputs.rules_go_integration_matrix) }}
	runs-on: windows-latest
	steps:
	- name: Checkout
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

	- name: Set up Python
	uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
	with:
	python-version: ${{ env.PYTHON_VERSION }}

	- name: Set up Go
	uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
	with:
	go-version: ${{ env.GO_VERSION }}

	- name: Install Bazelisk
	shell: bash
	run: \|
	GO111MODULE=on go install github.com/bazelbuild/bazelisk@v1.28.1
	echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"

	- name: Validate disabled-to-enabled bootstrap transition
	shell: bash
	env:
	BAZEL_VERSION: "8.4.1"
	MODULE_SYSTEM: ${{ matrix.module_system }}
	ORCHESTRION_MODE: test_optimization
	RULES_GO_UPSTREAM: ${{ matrix.upstream }}
	RULES_GO_VARIANT: base
	WINDOWS_CONFIG_TRANSITION_ONLY: "1"
	run: \|
	case "${MODULE_SYSTEM}" in
	workspace)
	./tools/tests/integration/run_workspace_go_integration.sh
	;;
	bzlmod)
	./tools/tests/integration/run_bzlmod_go_integration.sh
	;;
	*)
	echo "Unsupported module system: ${MODULE_SYSTEM}" >&2
	exit 1
	;;
	esac

	# Keep one consolidated result while the expensive work runs in parallel.
	windows-go-bootstrap-smoke:
	needs:
	- changes
	- windows-go-bootstrap-shard
	if: ${{ always() }}
	runs-on: ubuntu-latest
	steps:
	- name: Require successful Windows bootstrap shards
	shell: bash
	env:
	CHANGES_RESULT: ${{ needs.changes.result }}
	RUN_FULL_CI: ${{ needs.changes.outputs.run_full_ci }}
	SHARD_RESULT: ${{ needs.windows-go-bootstrap-shard.result }}
	run: \|
	if [[ "${CHANGES_RESULT}" != "success" ]]; then
	echo "Change classification did not succeed: ${CHANGES_RESULT}" >&2
	exit 1
	fi

	if [[ "${RUN_FULL_CI}" != "true" ]]; then
	echo "Windows Go bootstrap smoke is not required for this change."
	exit 0
	fi

	if [[ "${SHARD_RESULT}" != "success" ]]; then
	echo "One or more Windows Go bootstrap shards did not succeed: ${SHARD_RESULT}" >&2
	exit 1
	fi

	coverage-tools:
	needs: changes
	if: ${{ needs.changes.outputs.run_full_ci == 'true' }}
	timeout-minutes: 15
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

	- name: Set up Python
	uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
	with:
	python-version: ${{ env.PYTHON_VERSION }}

	- name: Install Python tooling dependencies
	shell: bash
	run: python3 -m pip install --require-hashes -r tools/requirements.txt

	- name: Verify Python tooling tests through Bazel
	shell: bash
	run: ./bazelw test //tools/tests/python:python_tools_test

	- name: Enforce minimum tools coverage signal
	shell: bash
	env:
	TOOLS_COVERAGE_MIN: "40.0"
	run: \|
	# Coverage is collected via Python's trace module for file-level signal,
	# while the Bazel step above keeps runtime wiring parity verified.
	TOOLS_COVERAGE_MIN="$TOOLS_COVERAGE_MIN" python3 - <<'PY'
	import os
	import pathlib
	import runpy
	import sys
	import trace

	repo_root = pathlib.Path.cwd()
	min_raw = os.environ.get("TOOLS_COVERAGE_MIN")
	if min_raw is None or min_raw.strip() == "":
	print("error: TOOLS_COVERAGE_MIN must be provided")
	sys.exit(2)
	min_pct = float(min_raw)
	targets = [
	repo_root / "tools/core/validate_payload_schema.py",
	repo_root / "tools/core/schemas/sync_agentless_schema.py",
	repo_root / "tools/dev/check_module_versions.py",
	repo_root / "tools/dev/lint_uploader_templates.py",
	]

	tracer = trace.Trace(count=True, trace=False)
	exit_code = 0
	try:
	tracer.runctx(
	'runpy.run_path("tools/tests/python/test_python_tools.py", run_name="__main__")',
	{"runpy": runpy},
	{},
	)
	except SystemExit as exc:
	code = exc.code
	if code is None:
	exit_code = 0
	elif isinstance(code, int):
	exit_code = code
	else:
	print(code)
	exit_code = 1

	if exit_code != 0:
	sys.exit(exit_code)

	counts = tracer.results().counts
	lines_found = 0
	lines_hit = 0

	for target in targets:
	target_path = target.resolve()
	source_lines = target_path.read_text(encoding="utf-8").splitlines()
	executable_lines = [
	idx
	for idx, line in enumerate(source_lines, start=1)
	if line.strip() and not line.lstrip().startswith("#")
	]
	hit_lines = set()
	for (filename, lineno), count in counts.items():
	if count <= 0:
	continue
	try:
	if pathlib.Path(filename).resolve() == target_path:
	hit_lines.add(lineno)
	except OSError:
	continue
	found = len(executable_lines)
	hit = len([ln for ln in executable_lines if ln in hit_lines])
	lines_found += found
	lines_hit += hit
	print(f"tools coverage file: {target_path} -> {hit}/{found} lines hit")

	if lines_found <= 0:
	print("error: tools coverage probe found zero executable lines")
	sys.exit(1)

	pct = (lines_hit / lines_found) * 100.0
	print(f"tools coverage total: {lines_hit}/{lines_found} lines hit ({pct:.2f}%)")
	if pct < min_pct:
	print(
	f"error: tools coverage {pct:.2f}% is below minimum {min_pct:.2f}%"
	)
	sys.exit(1)
	PY

	shared-validation:
	needs: changes
	uses: ./.github/workflows/shared-validation.yml
	with:
	docs_only: ${{ needs.changes.outputs.docs_only == 'true' }}
	python_version: "3.11"
	run_buildifier: true
	verify_bazelrc_sync: true
	run_gofmt: true
	run_powershell_lint: true
	run_schema_validation: true
	run_fixture_json_validation: true
	run_schema_parser_parity: true
	run_rules_go_fork_drift: true

	# Policy: keep the hermetic lane Linux-only for now.
	# Rationale: sandbox/network-blocking semantics are most reliable on Linux;
	# macOS/Windows are still covered by the standard test+integration matrix.
	bazel-tests-hermetic:
	needs: changes
	if: ${{ needs.changes.outputs.run_full_ci == 'true' }}
	timeout-minutes: 45
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

	- name: Run Bazel tests (hermetic lane)
	timeout-minutes: 25
	shell: bash
	run: \|
	./bazelw test //tools/... \
	--spawn_strategy=sandboxed \
	--strategy=TestRunner=sandboxed \
	--incompatible_strict_action_env \
	--sandbox_default_allow_network=false \
	--modify_execution_info=TestRunner=+block-network \
	--test_env=TZ=UTC \
	--test_env=LANG=C \
	--test_env=LC_ALL=C \
	--enable_runfiles

	- name: Run Bazel tests (go companion hermetic lane)
	timeout-minutes: 10
	shell: bash
	run: \|
	(
	cd modules/go &&
	../../bazelw test //... \
	--override_module=datadog-rules-test-optimization=../.. \
	--spawn_strategy=sandboxed \
	--strategy=TestRunner=sandboxed \
	--incompatible_strict_action_env \
	--sandbox_default_allow_network=false \
	--modify_execution_info=TestRunner=+block-network \
	--test_env=TZ=UTC \
	--test_env=LANG=C \
	--test_env=LC_ALL=C \
	--enable_runfiles
	)

	- name: Run Bazel tests (python companion hermetic lane)
	timeout-minutes: 10
	shell: bash
	run: \|
	(
	cd modules/python &&
	../../bazelw test //... \
	--override_module=datadog-rules-test-optimization=../.. \
	--spawn_strategy=sandboxed \
	--strategy=TestRunner=sandboxed \
	--incompatible_strict_action_env \
	--sandbox_default_allow_network=false \
	--modify_execution_info=TestRunner=+block-network \
	--test_env=TZ=UTC \
	--test_env=LANG=C \
	--test_env=LC_ALL=C \
	--enable_runfiles
	)

	- name: Run Bazel tests (java companion hermetic lane)
	timeout-minutes: 10
	shell: bash
	run: \|
	(
	cd modules/java &&
	../../bazelw test //... \
	--override_module=datadog-rules-test-optimization=../.. \
	--spawn_strategy=sandboxed \
	--strategy=TestRunner=sandboxed \
	--incompatible_strict_action_env \
	--sandbox_default_allow_network=false \
	--modify_execution_info=TestRunner=+block-network \
	--test_env=TZ=UTC \
	--test_env=LANG=C \
	--test_env=LC_ALL=C \
	--enable_runfiles
	)

	- name: Run Bazel tests (nodejs companion hermetic lane)
	timeout-minutes: 10
	shell: bash
	run: \|
	(
	cd modules/nodejs &&
	../../bazelw test //... \
	--override_module=datadog-rules-test-optimization=../.. \
	--spawn_strategy=sandboxed \
	--strategy=TestRunner=sandboxed \
	--incompatible_strict_action_env \
	--sandbox_default_allow_network=false \
	--modify_execution_info=TestRunner=+block-network \
	--test_env=TZ=UTC \
	--test_env=LANG=C \
	--test_env=LC_ALL=C \
	--enable_runfiles
	)

	- name: Run Bazel tests (dotnet companion hermetic lane)
	timeout-minutes: 10
	shell: bash
	run: \|
	(
	cd modules/dotnet &&
	../../bazelw test //... \
	--override_module=datadog-rules-test-optimization=../.. \
	--spawn_strategy=sandboxed \
	--strategy=TestRunner=sandboxed \
	--incompatible_strict_action_env \
	--sandbox_default_allow_network=false \
	--modify_execution_info=TestRunner=+block-network \
	--test_env=TZ=UTC \
	--test_env=LANG=C \
	--test_env=LC_ALL=C \
	--enable_runfiles
	)

	- name: Run Bazel tests (ruby companion hermetic lane)
	timeout-minutes: 10
	shell: bash
	run: \|
	(
	cd modules/ruby &&
	../../bazelw test //... \
	--override_module=datadog-rules-test-optimization=../.. \
	--spawn_strategy=sandboxed \
	--strategy=TestRunner=sandboxed \
	--incompatible_strict_action_env \
	--sandbox_default_allow_network=false \
	--modify_execution_info=TestRunner=+block-network \
	--test_env=TZ=UTC \
	--test_env=LANG=C \
	--test_env=LC_ALL=C \
	--enable_runfiles
	)

Navigation Menu

Uh oh!

fix(deps): vuln minor upgrades — 4 packages (minor: 3 · patch: 1) [examples/single_service/src/go-project/go.mod] #888

Workflow file

fix(deps): vuln minor upgrades — 4 packages (minor: 3 · patch: 1) [examples/single_service/src/go-project/go.mod] #888

Uh oh!

Workflow file for this run