Skip to content

Commit fb31324

Browse files
sarahchen6sarahchen6
authored
Add GHA workflow to create a release branch and pin system tests (#9782)
* Add GHA workflow to create a release branch and pin system tests commit sha after minor release * Update policy name in workflow * Clean workflow and script
1 parent e0bca5e commit fb31324

File tree

4 files changed

+147
-1
lines changed

4 files changed

+147
-1
lines changed

‎.github/chainguard/self.update-system-tests.push.sts.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
issuer: https://token.actions.githubusercontent.com
2+
3+
subject: repo:DataDog/dd-trace-java:ref:refs/(heads/master|tags/v[0-9]+.[0-9]+.0)
4+
5+
claim_pattern:
6+
event_name: (push|workflow_dispatch)
7+
ref: refs/(heads/master|tags/v[0-9]+\.[0-9]+\.0)
8+
ref_protected: "true"
9+
job_workflow_ref: DataDog/dd-trace-java/\.github/workflows/create-release-branch\.yaml@refs/heads/master
10+
11+
permissions:
12+
contents: write

‎.github/workflows/create-release-branch.yaml‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
name: Create Release Branch and Pin System-Tests
2+
3+
on:
4+
push:
5+
tags:
6+
- 'v[0-9]+.[0-9]+.0' # Trigger on minor release tags (e.g. v1.54.0)
7+
workflow_dispatch:
8+
inputs:
9+
tag:
10+
description: 'The minor release tag (e.g. v1.54.0)'
11+
required: true
12+
type: string
13+
14+
jobs:
15+
create-release-branch:
16+
runs-on: ubuntu-latest
17+
permissions:
18+
contents: read
19+
id-token: write # Required for OIDC token federation
20+
steps:
21+
- uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
22+
id: octo-sts
23+
with:
24+
scope: DataDog/dd-trace-java
25+
policy: self.update-system-tests.push
26+
27+
- name: Determine tag
28+
id: determine-tag
29+
run: |
30+
if [ -n "${{ github.event.inputs.tag }}" ]; then
31+
TAG=${{ github.event.inputs.tag }}
32+
else
33+
TAG=${GITHUB_REF#refs/tags/}
34+
fi
35+
if ! [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.0$ ]]; then
36+
echo "Error: Tag $TAG is not in the expected format: vX.Y.0"
37+
exit 1
38+
fi
39+
echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
40+
41+
- name: Define branch name from tag
42+
id: define-branch
43+
run: |
44+
TAG=${{ steps.determine-tag.outputs.tag }}
45+
BRANCH="release/${TAG%.0}.x"
46+
echo "branch=${BRANCH}" >> "$GITHUB_OUTPUT"
47+
48+
- name: Checkout dd-trace-java
49+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # 5.0.0
50+
51+
- name: Check if branch already exists
52+
id: check-branch
53+
run: |
54+
BRANCH=${{ steps.define-branch.outputs.branch }}
55+
if git ls-remote --heads origin "$BRANCH" | grep -q "$BRANCH"; then
56+
echo "creating_new_branch=false" >> "$GITHUB_OUTPUT"
57+
echo "Branch $BRANCH already exists - skipping following steps"
58+
else
59+
echo "creating_new_branch=true" >> "$GITHUB_OUTPUT"
60+
echo "Branch $BRANCH does not exist - proceeding with following steps"
61+
fi
62+
63+
- name: Update system-tests references to latest commit SHA on main
64+
if: steps.check-branch.outputs.creating_new_branch == 'true'
65+
run: BRANCH=main ./tooling/update_system_test_reference.sh
66+
67+
- name: Commit changes
68+
if: steps.check-branch.outputs.creating_new_branch == 'true'
69+
id: create-commit
70+
run: |
71+
git config user.name "github-actions[bot]"
72+
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
73+
git commit -m "chore: Pin system-tests for release branch" .github/workflows/run-system-tests.yaml
74+
echo "commit=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
75+
76+
- name: Push changes
77+
if: steps.check-branch.outputs.creating_new_branch == 'true'
78+
uses: DataDog/commit-headless@5a0f3876e0fbdd3a86b3e008acf4ec562db59eee # action/v2.0.1
79+
with:
80+
token: "${{ steps.octo-sts.outputs.token }}"
81+
branch: "${{ steps.define-branch.outputs.branch }}"
82+
branch-from: "${{ github.sha }}"
83+
command: push
84+
commits: "${{ steps.create-commit.outputs.commit }}"

‎.github/workflows/run-system-tests.yaml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,14 +60,17 @@ jobs:
6060
main:
6161
needs:
6262
- build
63-
uses: DataDog/system-tests/.github/workflows/system-tests.yml@main
63+
# If you change the following comment, update the pattern in the update_system_test_reference.sh script to match.
64+
uses: DataDog/system-tests/.github/workflows/system-tests.yml@main # system tests are pinned for releases only
6465
secrets: inherit
6566
permissions:
6667
contents: read
6768
id-token: write
6869
packages: write
6970
with:
7071
library: java
72+
# If you change the following comment, update the pattern in the update_system_test_reference.sh script to match.
73+
ref: main # system tests are pinned for releases only
7174
binaries_artifact: binaries
7275
desired_execution_time: 900 # 15 minutes
7376
scenarios_groups: tracer-release

‎tooling/update_system_test_reference.sh‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
# This script updates the system-tests reference in run-system-tests.yaml.
5+
# The reference will be updated with the latest commit SHA of the given branch (or `main` if not set) of https://github.com/DataDog/system-tests.
6+
# Usage: BRANCH=<branch-name> tooling/update_system_test_reference.sh
7+
8+
# Set BRANCH to main if not set
9+
if [ -z "${BRANCH:-}" ]; then
10+
BRANCH="main"
11+
echo "BRANCH is not set. Defaulting to 'main'."
12+
fi
13+
14+
TARGET=".github/workflows/run-system-tests.yaml" # target file to update
15+
PATTERN_1='(\s*system-tests\.yml@)(\S+)(\s+# system tests.*)' # pattern to update the "system-tests.yml@" reference
16+
PATTERN_2='(\s*ref: )(\S+)(\s+# system tests.*)' # pattern to update the "ref:" reference
17+
18+
echo "Fetching latest commit SHA for system-tests branch: $BRANCH"
19+
REF=$(git ls-remote https://github.com/DataDog/system-tests "refs/heads/$BRANCH" | cut -f 1)
20+
if [ -z "$REF" ]; then
21+
echo "Error: Failed to fetch commit SHA for branch $BRANCH"
22+
exit 1
23+
fi
24+
echo "Fetched SHA: $REF"
25+
26+
if [ ! -f "$TARGET" ]; then
27+
echo "Error: Target file $TARGET does not exist"
28+
exit 1
29+
fi
30+
31+
# Save the substitution results to a temporary file first
32+
TEMP_FILE=$(mktemp)
33+
34+
# Update the "system-tests.yml@" reference
35+
echo "Updating 'system-tests.yml@' reference..."
36+
perl -pe "s/$PATTERN_1/\${1}$REF\${3}/g" "$TARGET" > "$TEMP_FILE"
37+
cp "$TEMP_FILE" "$TARGET"
38+
39+
# Update the "ref:" reference
40+
echo "Updating 'ref:' reference..."
41+
perl -pe "s/$PATTERN_2/\${1}$REF\${3}/g" "$TARGET" > "$TEMP_FILE"
42+
cp "$TEMP_FILE" "$TARGET"
43+
44+
# Clean up temporary file
45+
rm -f "$TEMP_FILE"
46+
47+
echo "Done updating system-tests references to $REF"

0 commit comments

Comments
 (0)