Skip to content

Commit d7bee55

Browse files
watsonwatson
authored
Revert "chore: vendor on npm prepare instead of committing to git (#7423)" (#7638)
This reverts commit 2608ddb.
1 parent 2608ddb commit d7bee55

131 files changed

Lines changed: 3005 additions & 898 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/dependabot-automation.yml‎

Lines changed: 300 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,28 @@ env:
1212
GROUPS: '["dev-minor-and-patch-dependencies", "gh-actions-packages", "test-versions"]'
1313

1414
jobs:
15+
dependabot:
16+
if: github.event.pull_request.user.login == 'dependabot[bot]'
17+
runs-on: ubuntu-latest
18+
# Keep this job as a stable, always-green check on Dependabot PRs, even when the workflow is
19+
# re-triggered by an automation commit (e.g., vendoring). Sensitive operations (OIDC token mint,
20+
# approving, enabling auto-merge) are delegated to `dependabot-automation` below.
21+
permissions:
22+
contents: read
23+
steps:
24+
- name: Status
25+
run: |
26+
echo "Dependabot PR detected."
27+
if [ "${{ github.actor }}" = "dependabot[bot]" ]; then
28+
echo "Automation steps will run in the 'dependabot-automation' job."
29+
else
30+
echo "Skipping automation: workflow actor is '${{ github.actor }}'."
31+
fi
32+
1533
dependabot-automation:
1634
# Only run automation on the initial Dependabot-triggered run. If an automation commit is pushed
17-
# GitHub re-triggers this workflow with `github.actor == 'dd-octo-sts[bot]'`. We intentionally
18-
# avoid minting tokens / approving / enabling auto-merge on that follow-up run.
35+
# (e.g. vendor output), GitHub re-triggers this workflow with `github.actor == 'dd-octo-sts[bot]'`.
36+
# We intentionally avoid minting tokens / approving / enabling auto-merge on that follow-up run.
1937
if: github.event.pull_request.user.login == 'dependabot[bot]' && github.actor == 'dependabot[bot]'
2038
runs-on: ubuntu-latest
2139
permissions:
@@ -43,3 +61,283 @@ jobs:
4361
env:
4462
PR_URL: ${{ github.event.pull_request.html_url }}
4563
GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
64+
65+
vendor-build:
66+
if: github.event.pull_request.user.login == 'dependabot[bot]'
67+
runs-on: ubuntu-latest
68+
# Security: this job checks out and runs code from the PR (vendoring build),
69+
# so it is intentionally restricted to read-only permissions and produces a
70+
# patch artifact instead of pushing directly.
71+
permissions:
72+
contents: read
73+
pull-requests: read
74+
outputs:
75+
has_changes: ${{ steps.diff.outputs.has_changes }}
76+
is_vendor_group: ${{ steps.ctx.outputs.is_vendor_group }}
77+
steps:
78+
- name: Dependabot metadata
79+
id: metadata
80+
uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # 2.5.0
81+
- name: Compute vendor context
82+
id: ctx
83+
run: |
84+
set -euo pipefail
85+
86+
echo "is_vendor_group=${{ steps.metadata.outputs.directory == '/vendor' }}" >> $GITHUB_OUTPUT
87+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
88+
if: steps.ctx.outputs.is_vendor_group == 'true'
89+
with:
90+
repository: ${{ github.event.pull_request.head.repo.full_name }}
91+
ref: ${{ github.event.pull_request.head.sha }}
92+
fetch-depth: 1
93+
persist-credentials: false
94+
- name: Restore trusted Node setup actions
95+
if: steps.ctx.outputs.is_vendor_group == 'true'
96+
run: |
97+
git fetch --no-tags --depth=1 origin "${{ github.event.pull_request.base.sha }}"
98+
git checkout "${{ github.event.pull_request.base.sha }}" -- .github/actions/node
99+
- name: Restore trusted vendoring scripts
100+
if: steps.ctx.outputs.is_vendor_group == 'true'
101+
run: |
102+
git fetch --no-tags --depth=1 origin "${{ github.event.pull_request.base.sha }}"
103+
git checkout "${{ github.event.pull_request.base.sha }}" -- vendor/rspack.js vendor/rspack.config.js
104+
- uses: ./.github/actions/node/active-lts
105+
if: steps.ctx.outputs.is_vendor_group == 'true'
106+
- name: Install vendoring deps (no lifecycle scripts)
107+
if: steps.ctx.outputs.is_vendor_group == 'true'
108+
run: yarn --ignore-scripts --frozen-lockfile --non-interactive
109+
working-directory: ./vendor
110+
- name: Build vendored bundles (trusted script)
111+
if: steps.ctx.outputs.is_vendor_group == 'true'
112+
run: node ./rspack.js
113+
working-directory: ./vendor
114+
- name: Create patch (restricted paths only)
115+
id: diff
116+
run: |
117+
set -euo pipefail
118+
119+
if [ "${{ steps.ctx.outputs.is_vendor_group }}" != "true" ]; then
120+
echo "has_changes=false" >> $GITHUB_OUTPUT
121+
exit 0
122+
fi
123+
124+
if git diff --quiet; then
125+
echo "has_changes=false" >> $GITHUB_OUTPUT
126+
exit 0
127+
fi
128+
129+
allowed_prefix_1="vendor/dist/"
130+
allowed_file_1="vendor/package.json"
131+
allowed_file_2="vendor/yarn.lock"
132+
133+
bad=0
134+
while IFS= read -r file; do
135+
case "$file" in
136+
"$allowed_file_1" | "$allowed_file_2" | "$allowed_prefix_1"*)
137+
;;
138+
*)
139+
echo "Unexpected changed path: $file"
140+
bad=1
141+
;;
142+
esac
143+
done < <(git diff --name-only)
144+
145+
if [ "$bad" -ne 0 ]; then
146+
echo "Refusing to proceed: unexpected paths changed during vendoring."
147+
exit 1
148+
fi
149+
150+
git diff --binary --no-color > "${RUNNER_TEMP}/vendor.patch"
151+
echo "has_changes=true" >> $GITHUB_OUTPUT
152+
- uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
153+
if: steps.diff.outputs.has_changes == 'true'
154+
with:
155+
name: vendor-patch
156+
path: ${{ runner.temp }}/vendor.patch
157+
if-no-files-found: error
158+
159+
vendor-push:
160+
if: github.event.pull_request.user.login == 'dependabot[bot]' && needs.vendor-build.outputs.is_vendor_group == 'true' && needs.vendor-build.outputs.has_changes == 'true'
161+
runs-on: ubuntu-latest
162+
needs: vendor-build
163+
# Security: this job never runs installs/builds.
164+
# It only applies the vetted patch artifact and writes the update via the GitHub API.
165+
permissions:
166+
id-token: write
167+
steps:
168+
- uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
169+
id: octo-sts
170+
with:
171+
scope: DataDog/dd-trace-js
172+
policy: dependabot-automation
173+
- name: Dependabot metadata
174+
id: metadata
175+
uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # 2.5.0
176+
with:
177+
github-token: "${{ steps.octo-sts.outputs.token }}"
178+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
179+
with:
180+
token: ${{ steps.octo-sts.outputs.token }}
181+
repository: ${{ github.event.pull_request.head.repo.full_name }}
182+
ref: ${{ github.event.pull_request.head.sha }}
183+
persist-credentials: false
184+
- uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
185+
with:
186+
name: vendor-patch
187+
path: ${{ runner.temp }}/vendor-artifact
188+
- name: Apply patch
189+
run: git apply --whitespace=nowarn "${{ runner.temp }}/vendor-artifact/vendor.patch"
190+
- name: Validate changed paths
191+
run: |
192+
set -euo pipefail
193+
194+
allowed_prefix_1="vendor/dist/"
195+
allowed_file_1="vendor/package.json"
196+
allowed_file_2="vendor/yarn.lock"
197+
198+
bad=0
199+
while IFS= read -r file; do
200+
case "$file" in
201+
"$allowed_file_1" | "$allowed_file_2" | "$allowed_prefix_1"*)
202+
;;
203+
*)
204+
echo "Unexpected changed path after applying patch: $file"
205+
bad=1
206+
;;
207+
esac
208+
done < <(git diff --name-only)
209+
210+
if [ "$bad" -ne 0 ]; then
211+
echo "Refusing to proceed: unexpected paths changed."
212+
exit 1
213+
fi
214+
- name: Create verified commit via GitHub API (server-side)
215+
env:
216+
TARGET_BRANCH: ${{ github.event.pull_request.head.ref }}
217+
GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
218+
run: |
219+
set -euo pipefail
220+
221+
repo="${GITHUB_REPOSITORY}"
222+
expected_head_oid="$(git rev-parse HEAD)"
223+
224+
max_files=200
225+
max_total_bytes=$((10 * 1024 * 1024)) # 10 MiB
226+
227+
mapfile -t changes < <(git diff --name-status)
228+
change_count="${#changes[@]}"
229+
if [ "$change_count" -eq 0 ]; then
230+
echo "No changed files detected."
231+
exit 1
232+
fi
233+
if [ "$change_count" -gt "$max_files" ]; then
234+
echo "Too many changed files ($change_count > $max_files)."
235+
exit 1
236+
fi
237+
238+
additions='[]'
239+
deletions='[]'
240+
total_bytes=0
241+
for change in "${changes[@]}"; do
242+
read -r status path path2 <<<"$change"
243+
244+
if [[ "$status" == D ]]; then
245+
deletions="$(jq -c --arg path "$path" '. + [{path: $path}]' <<<"$deletions")"
246+
continue
247+
fi
248+
249+
# Treat renames as delete+add to keep the server-side tree in sync.
250+
if [[ "$status" == R* ]]; then
251+
deletions="$(jq -c --arg path "$path" '. + [{path: $path}]' <<<"$deletions")"
252+
path="$path2"
253+
fi
254+
255+
test -f "$path"
256+
file_bytes="$(stat -c '%s' "$path")"
257+
total_bytes=$((total_bytes + file_bytes))
258+
if [ "$total_bytes" -gt "$max_total_bytes" ]; then
259+
echo "Total changes too large (${total_bytes} bytes)."
260+
exit 1
261+
fi
262+
contents="$(base64 -w 0 "$path")"
263+
additions="$(jq -c --arg path "$path" --arg contents "$contents" '. + [{path: $path, contents: $contents}]' <<<"$additions")"
264+
done
265+
266+
variables="$(jq -c \
267+
--arg repo "$repo" \
268+
--arg branch "$TARGET_BRANCH" \
269+
--arg msg "update vendored dependencies with new versions" \
270+
--arg expected "$expected_head_oid" \
271+
--argjson additions "$additions" \
272+
--argjson deletions "$deletions" \
273+
'{
274+
input: {
275+
branch: { repositoryNameWithOwner: $repo, branchName: $branch },
276+
message: { headline: $msg },
277+
expectedHeadOid: $expected,
278+
fileChanges: { additions: $additions, deletions: $deletions }
279+
}
280+
}'
281+
)"
282+
283+
query='mutation($input: CreateCommitOnBranchInput!) { createCommitOnBranch(input: $input) { commit { oid url } } }'
284+
gh api graphql -f query="$query" -f variables="$variables" -q '.data.createCommitOnBranch.commit.oid' >/dev/null
285+
286+
# If branch protection is configured to dismiss stale approvals when new commits are pushed,
287+
# the vendoring commit will invalidate the earlier approval. Re-approve and (re-)enable
288+
# auto-merge after pushing so Dependabot PRs can still merge automatically.
289+
- name: Approve a PR (after vendoring commit)
290+
if: contains(fromJSON(env.GROUPS), steps.metadata.outputs.dependency-group)
291+
run: gh pr review --approve "$PR_URL"
292+
env:
293+
PR_URL: ${{ github.event.pull_request.html_url }}
294+
GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
295+
- name: Enable auto-merge for Dependabot PRs (after vendoring commit)
296+
if: contains(fromJSON(env.GROUPS), steps.metadata.outputs.dependency-group)
297+
run: gh pr merge --auto --squash "$PR_URL"
298+
env:
299+
PR_URL: ${{ github.event.pull_request.html_url }}
300+
GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
301+
302+
vendor-validate:
303+
# Run validation after the generated vendor patch has been pushed, to ensure the PR contains
304+
# the committed `vendor/dist/*` outputs. This runs inside the same workflow as the push, so it
305+
# doesn't rely on additional workflows being triggered by that push.
306+
if: github.event.pull_request.user.login == 'dependabot[bot]' && needs.vendor-build.outputs.is_vendor_group == 'true' && needs.vendor-build.outputs.has_changes == 'true'
307+
runs-on: ubuntu-latest
308+
needs:
309+
- vendor-build
310+
- vendor-push
311+
permissions:
312+
contents: read
313+
pull-requests: read
314+
steps:
315+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
316+
with:
317+
repository: ${{ github.event.pull_request.head.repo.full_name }}
318+
ref: ${{ github.event.pull_request.head.ref }}
319+
fetch-depth: 1
320+
persist-credentials: false
321+
- name: Restore trusted Node setup actions
322+
run: |
323+
git fetch --no-tags --depth=1 origin "${{ github.event.pull_request.base.sha }}"
324+
git checkout "${{ github.event.pull_request.base.sha }}" -- .github/actions/node
325+
- name: Restore trusted vendoring scripts
326+
run: |
327+
git fetch --no-tags --depth=1 origin "${{ github.event.pull_request.base.sha }}"
328+
git checkout "${{ github.event.pull_request.base.sha }}" -- vendor/rspack.js vendor/rspack.config.js
329+
- uses: ./.github/actions/node/active-lts
330+
# Running `yarn` also automatically runs Rspack as a postinstall script.
331+
- run: yarn --frozen-lockfile
332+
working-directory: vendor
333+
- name: Ensure no untracked outputs
334+
run: |
335+
set -euo pipefail
336+
337+
if [ -n "$(git status --porcelain)" ]; then
338+
echo "Working tree is dirty after vendoring:"
339+
git status --porcelain
340+
exit 1
341+
fi
342+
- name: Diff only expected paths
343+
run: git diff --exit-code -- vendor/dist vendor/package.json vendor/yarn.lock

‎.github/workflows/platform.yml‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -43,8 +43,7 @@ jobs:
4343
steps:
4444
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4545
- uses: ./.github/actions/node/active-lts
46-
- uses: ./.github/actions/install
47-
- run: FILENAME=$(npm pack --silent --pack-destination /tmp) && mv /tmp/$FILENAME /tmp/dd-trace.tgz
46+
- run: FILENAME=$(npm pack --pack-destination /tmp) && mv /tmp/$FILENAME /tmp/dd-trace.tgz
4847
- run: mkdir -p /tmp/app
4948
- run: npm i -g pnpm
5049
if: matrix.manager.name == 'pnpm'
@@ -59,7 +58,7 @@ jobs:
5958
- uses: ./.github/actions/node/active-lts
6059
- uses: ./.github/actions/install
6160
- run: mkdir npm bun
62-
- run: FILENAME=$(npm pack --silent) && tar -zxf $FILENAME -C npm
61+
- run: FILENAME=$(npm pack) && tar -zxf $FILENAME -C npm
6362
- run: ./node_modules/.bin/bun pm pack --gzip-level 0 --filename bun.tgz && tar -zxf bun.tgz -C bun
6463
- run: diff -r npm bun
6564

@@ -447,13 +446,12 @@ jobs:
447446
runs-on: ubuntu-latest
448447
steps:
449448
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
450-
- uses: ./.github/actions/node/active-lts
451-
- uses: ./.github/actions/install
452-
- run: bun add --ignore-scripts mocha@10 # Use older mocha to support old Node.js versions
453-
- run: bun add --ignore-scripts express@4 # Use older express to support old Node.js versions
454449
- uses: ./.github/actions/node
455450
with:
456451
version: ${{ matrix.version }}
452+
- uses: ./.github/actions/install
453+
- run: bun add --ignore-scripts mocha@10 # Use older mocha to support old Node.js versions
454+
- run: bun add --ignore-scripts express@4 # Use older express to support old Node.js versions
457455
- run: node node_modules/.bin/mocha --colors --timeout 30000 integration-tests/init.spec.js
458456
- uses: DataDog/junit-upload-github-action@055560f63c405095e9228ba443eee7987e22bb94 # v2.1.1
459457
if: always() && github.actor != 'dependabot[bot]'

‎.github/workflows/project.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ jobs:
7676
steps:
7777
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
7878
- uses: ./.github/actions/node/latest
79-
- run: FILENAME=$(npm pack --silent --pack-destination /tmp) && mv /tmp/$FILENAME /tmp/dd-trace.tgz
79+
- run: FILENAME=$(npm pack --pack-destination /tmp) && mv /tmp/$FILENAME /tmp/dd-trace.tgz
8080
- run: rm -rf *
8181
- run: tar -zxf /tmp/dd-trace.tgz -C $(pwd) --strip-components=1
8282
- run: yarn --prod --ignore-optional

‎.github/workflows/system-tests.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424
with:
2525
path: dd-trace-js
2626
- name: Pack dd-trace-js
27-
run: mkdir -p ./binaries && echo /binaries/$(npm pack --silent --pack-destination ./binaries ./dd-trace-js) > ./binaries/nodejs-load-from-npm
27+
run: mkdir -p ./binaries && echo /binaries/$(npm pack --pack-destination ./binaries ./dd-trace-js) > ./binaries/nodejs-load-from-npm
2828
- name: Upload artifact
2929
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
3030
with:

‎.github/workflows/update-3rdparty-licenses.yml‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,6 @@ name: Update 3rd-party licenses
33
on:
44
pull_request:
55
paths:
6-
- ".github/vendored-dependencies.csv"
7-
- "vendor/package-lock.json"
86
- "yarn.lock"
97

108
jobs:
@@ -35,8 +33,8 @@ jobs:
3533
- name: Check out dd-license-attribution
3634
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3735
with:
38-
repository: watson/dd-license-attribution
39-
ref: 8ea483b9f735bf8da632c89796789cc2a050a9a6
36+
repository: DataDog/dd-license-attribution
37+
ref: 224a89cb69d3143e8aa4640405037cf9c233ddf5
4038
path: dd-license-attribution
4139

4240
- name: Install dd-license-attribution
@@ -69,7 +67,7 @@ jobs:
6967
--use-mirrors=mirrors.json \
7068
--no-scancode-strategy \
7169
--no-github-sbom-strategy \
72-
--lockfile-subdir vendor \
70+
--yarn-subdir vendor \
7371
"${REPOSITORY_URL}" > LICENSE-3rdparty.csv
7472
7573
- name: Append vendored dependencies from PR

0 commit comments

Comments
 (0)