STAC-25142 Add GitHub Actions lint + unit-test workflow (agent CI migration phase 1) - #444
Open
LouisParkin wants to merge 22 commits into
Open
STAC-25142 Add GitHub Actions lint + unit-test workflow (agent CI migration phase 1)#444LouisParkin wants to merge 22 commits into
LouisParkin wants to merge 22 commits into
Conversation
LouisParkin
force-pushed
the
STAC-25142-agent-lint-unit
branch
from
July 10, 2026 15:22
3cd1a54 to
7308812
Compare
LouisParkin
force-pushed
the
STAC-25142-agent-lint-unit
branch
from
July 27, 2026 09:25
76349d9 to
c2e9da2
Compare
…ration phase 1) Ports filename_linting + unbranded/branded unit_tests from .gitlab-ci-agent.yml to GitHub Actions, tracking the active stackstate-7.78.2 pipeline. - filename-linting on `docker` (cheap gate; only needs `git ls-files`). - unbranded/branded unit tests on `xlarge` inside the datadog_build image (tag 7af9194f), pulled via the read-only quay proxy. - 7.78.2 deltas vs 7.71.2: `--major-version` dropped from agent.build/inv test (removed upstream in DD 7.78), and branded runs scripts/verify_branding_literals.sh after fix_branding.sh. Test-execution policy (architect directive — minimize redundant runs): each suite runs once. filename-lint on every PR; the two heavy ~2h suites on pull_request, deduped via concurrency cancel-in-progress. They move to merge_group (run once at land) at phase 6; master/version-branch pushes then build+publish without re-running tests. Security: minimal contents: read, SHA-pinned checkout, persist-credentials false, no PATs, registry-proxy secret only via container.credentials, fork PRs skipped. Zizmor clean; actionlint clean apart from self-hosted labels. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…; conda needs bash)
…ds the 3.x version tag
…on phase 2) Port build_binaries and build_cluster_agent from .gitlab-ci-agent.yml to .github/workflows/build-binaries.yml: build the branded (StackState) production agent (+ rtloader) and cluster-agent in the datadog_build container on public xlarge runners, once per change (pull_request), deduped via concurrency. Carry over the GitLab pipeline speedups: self-contained jobs with no shared deps prerequisite (the Go module cache is untransportable between jobs and shared vendoring breaks the go.mod<->vendor reconcile), version.txt generated in-job from git, and a runner-local persistent-cache follow-up noted for the real warm-cache win. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…e image Speeds up the migrated stackstate-agent GitHub Actions build/test jobs by replacing each job's cold `go clean -modcache` + `inv deps` (go mod download + tidy) reconcile with a warm GOMODCACHE delivered as a prebuilt CI image, keyed by a content hash of the module graph. Mirrors the StackGraph ci-metadata / build-ci-image pattern. - .github/scripts/agent-godeps-cache-metadata.sh: content-addressed image tag from every go.mod/go.sum + go.work + modules.yml plus the Dockerfile/script themselves, so any graph or mechanism change rotates the tag. - .github/docker/godeps-cache/Dockerfile: FROM datadog_build, bakes external modules into GOMODCACHE via a per-module `go mod download` loop. - .github/workflows/godeps-cache.yml: reusable workflow (tag lookup + build only when missing); pushes to quay.io/stackstate (private), pulled by consumers through the registry.tooling quay proxy with the existing REGISTRY_* creds. - build-binaries.yml / lint-and-unit-tests.yml: add the godeps-cache job, repoint the 4 heavy jobs to the cache image, drop the per-job modcache reset + inv deps (keep `go work sync` / `go work vendor` against the warm cache). Zizmor clean (narrow unpinned-images ignore on the content-addressed container refs, which are effectively digest-pinned but computed per run). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
LouisParkin
force-pushed
the
STAC-25142-agent-lint-unit
branch
from
July 28, 2026 09:40
c2e9da2 to
c07d0c8
Compare
RUN ran under dash so the read -d '' loop never iterated; -mod=mod is rejected in workspace mode.
STAC-25429 Warm the Go module cache with a prebuilt, content-addressed CI image
STAC-25459 Wire inv check-mod-tidy into CI, gated on the godeps cache hash
… STAC-25142-agent-omnibus-deb
STAC-25142 Add omnibus DEB build and container image workflows
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Phase 1 of the
stackstate-agentGitLab → GitHub CI migration (STAC-25142): ports the lint + unit-test jobs from.gitlab-ci-agent.ymlto a GitHub Actions workflow,.github/workflows/lint-and-unit-tests.yml.filename-lintingdockerfilename_linting— cheap gate; only needsgit ls-files, so the GitLab job'sinv deps/go work vendorboilerplate is droppedunbranded-unit-testsxlargeunbranded_unit_tests— fullinv agent.build --race+inv test, DataDog brandingbranded-unit-testsxlargebranded_unit_tests— same +./fix_branding.sh, StackState brandingAll three run inside
container: <proxy>/quay/stackstate/datadog_build_linux_x64:0cd01a13— the sameBUILD_IMAGEthe GitLab pipeline uses (produced bydatadog-agent-buildimages, pulled via the read-only quay proxy). No new runner class is needed:xlarge(6 CPU / 40Gi, DinD) maps to GitLabsts-k8s-xl-runner.Test-execution policy (architect directive — minimize redundant runs)
Each suite runs once on the path to master:
filename-lintingon every PR (fast).pull_request, deduped viaconcurrency: cancel-in-progress.merge_group(run once at land) and drop frompull_request; master/version-branch pushes then build + publish without re-running tests.Open question raised for architects (biggest compute lever, tracked in the migration scope doc): unbranded and branded are nearly the same ~2h job twice — do we need both on every path, or branded-as-gate + unbranded on the queue only?
Prerequisite for green checks
This is a public repo, so the read-only registry-proxy credentials must be available to it for the
container:image pull:vars.REGISTRY_HOST,vars.REGISTRY_USER,secrets.REGISTRY_PASSWORD. If the first run fails on the image pull, these need scoping to this repo (org secret scope, or a repo-level read robot as done fordatadog-agent-buildimages). Org secrets are never exposed to fork PRs, so fork PRs skip these jobs by design.Security
contents: readonly, SHA-pinnedactions/checkout,persist-credentials: false, no PATs, registry secret only viacontainer.credentials. Zizmor: clean. actionlint: clean apart from expected self-hosted-runner label warnings (docker,xlarge).Validation
container:-on-xlarge(manual DinD) path for the first time — that's the main thing this PR validates.Jira: https://stackstate.atlassian.net/browse/STAC-25142
🤖 Generated with Claude Code