STAC-25142 Add GitHub Actions lint + unit-test workflow (agent CI migration phase 1)#444
Open
LouisParkin wants to merge 1 commit into
Open
STAC-25142 Add GitHub Actions lint + unit-test workflow (agent CI migration phase 1)#444LouisParkin wants to merge 1 commit into
LouisParkin wants to merge 1 commit into
Conversation
…ration phase 1) Ports filename_linting + unbranded/branded unit_tests from .gitlab-ci-agent.yml to GitHub Actions, tracking the active stackstate-7.78.2 pipeline. - filename-linting on `docker` (cheap gate; only needs `git ls-files`). - unbranded/branded unit tests on `xlarge` inside the datadog_build image (tag 7af9194f), pulled via the read-only quay proxy. - 7.78.2 deltas vs 7.71.2: `--major-version` dropped from agent.build/inv test (removed upstream in DD 7.78), and branded runs scripts/verify_branding_literals.sh after fix_branding.sh. Test-execution policy (architect directive — minimize redundant runs): each suite runs once. filename-lint on every PR; the two heavy ~2h suites on pull_request, deduped via concurrency cancel-in-progress. They move to merge_group (run once at land) at phase 6; master/version-branch pushes then build+publish without re-running tests. Security: minimal contents: read, SHA-pinned checkout, persist-credentials false, no PATs, registry-proxy secret only via container.credentials, fork PRs skipped. Zizmor clean; actionlint clean apart from self-hosted labels. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
LouisParkin
force-pushed
the
STAC-25142-agent-lint-unit
branch
from
3cd1a54 to
7308812
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Phase 1 of the
stackstate-agentGitLab → GitHub CI migration (STAC-25142): ports the lint + unit-test jobs from.gitlab-ci-agent.ymlto a GitHub Actions workflow,.github/workflows/lint-and-unit-tests.yml.filename-lintingdockerfilename_linting— cheap gate; only needsgit ls-files, so the GitLab job'sinv deps/go work vendorboilerplate is droppedunbranded-unit-testsxlargeunbranded_unit_tests— fullinv agent.build --race+inv test, DataDog brandingbranded-unit-testsxlargebranded_unit_tests— same +./fix_branding.sh, StackState brandingAll three run inside
container: <proxy>/quay/stackstate/datadog_build_linux_x64:0cd01a13— the sameBUILD_IMAGEthe GitLab pipeline uses (produced bydatadog-agent-buildimages, pulled via the read-only quay proxy). No new runner class is needed:xlarge(6 CPU / 40Gi, DinD) maps to GitLabsts-k8s-xl-runner.Test-execution policy (architect directive — minimize redundant runs)
Each suite runs once on the path to master:
filename-lintingon every PR (fast).pull_request, deduped viaconcurrency: cancel-in-progress.merge_group(run once at land) and drop frompull_request; master/version-branch pushes then build + publish without re-running tests.Open question raised for architects (biggest compute lever, tracked in the migration scope doc): unbranded and branded are nearly the same ~2h job twice — do we need both on every path, or branded-as-gate + unbranded on the queue only?
Prerequisite for green checks
This is a public repo, so the read-only registry-proxy credentials must be available to it for the
container:image pull:vars.REGISTRY_HOST,vars.REGISTRY_USER,secrets.REGISTRY_PASSWORD. If the first run fails on the image pull, these need scoping to this repo (org secret scope, or a repo-level read robot as done fordatadog-agent-buildimages). Org secrets are never exposed to fork PRs, so fork PRs skip these jobs by design.Security
contents: readonly, SHA-pinnedactions/checkout,persist-credentials: false, no PATs, registry secret only viacontainer.credentials. Zizmor: clean. actionlint: clean apart from expected self-hosted-runner label warnings (docker,xlarge).Validation
container:-on-xlarge(manual DinD) path for the first time — that's the main thing this PR validates.Jira: https://stackstate.atlassian.net/browse/STAC-25142
🤖 Generated with Claude Code