Skip to content

Commit dc72586

Browse files
martincostellomartincostello
committed
Merge branch 'main' into gh-5973 
2 parents 8af9406 + fe5e6bc commit dc72586

12 files changed

+335
-270
lines changed

‎.github/dependabot.yml‎

Lines changed: 3 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -1,75 +1,10 @@
1+
# This file is retained solely for automated tooling to see we do automated
2+
# dependency updates as not all such scanners recognize the use of Renovate.
13
version: 2
24
updates:
35
- package-ecosystem: "github-actions"
46
directory: "/"
57
schedule:
6-
interval: "daily"
7-
labels:
8-
- "infra"
9-
- package-ecosystem: "docker"
10-
directory: "/examples/MicroserviceExample/WebApi"
11-
schedule:
12-
interval: "weekly"
13-
day: "wednesday"
14-
labels:
15-
- "infra"
16-
ignore:
17-
- dependency-name: "*"
18-
update-types:
19-
- "version-update:semver-major"
20-
- "version-update:semver-minor"
21-
- package-ecosystem: "docker"
22-
directory: "examples/MicroserviceExample/WorkerService"
23-
schedule:
24-
interval: "weekly"
25-
day: "wednesday"
26-
labels:
27-
- "infra"
28-
ignore:
29-
- dependency-name: "*"
30-
update-types:
31-
- "version-update:semver-major"
32-
- "version-update:semver-minor"
33-
- package-ecosystem: "docker"
34-
directory: "test/OpenTelemetry.Exporter.OpenTelemetryProtocol.Tests/IntegrationTest"
35-
schedule:
36-
interval: "weekly"
37-
day: "wednesday"
38-
labels:
39-
- "infra"
40-
ignore:
41-
- dependency-name: "*"
42-
update-types:
43-
- "version-update:semver-major"
44-
- "version-update:semver-minor"
45-
- package-ecosystem: "docker"
46-
directory: "test/OpenTelemetry.Instrumentation.W3cTraceContext.Tests"
47-
schedule:
48-
interval: "weekly"
49-
day: "wednesday"
50-
labels:
51-
- "infra"
52-
ignore:
53-
- dependency-name: "*"
54-
update-types:
55-
- "version-update:semver-major"
56-
- "version-update:semver-minor"
57-
- package-ecosystem: "dotnet-sdk"
58-
directory: "/"
59-
schedule:
60-
interval: "weekly"
61-
day: "wednesday"
62-
labels:
63-
- "infra"
64-
ignore:
65-
- dependency-name: "*"
66-
update-types:
67-
- "version-update:semver-major"
68-
- "version-update:semver-minor"
69-
- package-ecosystem: "pip"
70-
directory: "test/OpenTelemetry.Instrumentation.W3cTraceContext.Tests"
71-
schedule:
72-
interval: "weekly"
73-
day: "wednesday"
8+
interval: yearly
749
labels:
7510
- "infra"

‎.github/renovate.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
3+
"additionalBranchPrefix": "{{manager}}/",
4+
"automerge": false,
5+
"commitBodyTable": true,
6+
"commitMessageAction": "Bump",
7+
"dependencyDashboard": false,
8+
"extends": [
9+
"config:best-practices",
10+
"customManagers:dockerfileVersions",
11+
"customManagers:githubActionsVersions",
12+
":automergeRequireAllStatusChecks",
13+
":disableRateLimiting",
14+
":enableVulnerabilityAlerts",
15+
":gitSignOff",
16+
":ignoreUnstable"
17+
],
18+
"labels": ["dependencies", "infra"],
19+
"packageRules": [
20+
{
21+
"matchManagers": ["dockerfile"],
22+
"addLabels": ["docker"]
23+
},
24+
{
25+
"matchManagers": ["github-actions"],
26+
"addLabels": ["github_actions"]
27+
},
28+
{
29+
"matchManagers": ["nuget"],
30+
"addLabels": [".NET"]
31+
},
32+
{
33+
"matchManagers": ["pypi"],
34+
"addLabels": ["python"]
35+
},
36+
{
37+
"description": ["Skip pinned NuGet package versions"],
38+
"matchManagers": ["nuget"],
39+
"matchCurrentValue": "^\\[[^,]+,\\)$",
40+
"enabled": false
41+
},
42+
{
43+
"extends": ["monorepo:dotnet"],
44+
"description": ["Disable major version updates for .NET"],
45+
"matchUpdateTypes": ["major"],
46+
"enabled": false
47+
},
48+
{
49+
"matchDepNames": ["xunit"],
50+
"description": ["Disable major version updates for xunit"],
51+
"matchUpdateTypes": ["major"],
52+
"enabled": false
53+
}
54+
],
55+
"schedule": ["* 8-17 * * 3"],
56+
"timezone": "Etc/UTC",
57+
"vulnerabilityAlerts": {
58+
"addLabels": ["security"]
59+
}
60+
}

‎.github/workflows/automation.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,16 @@ on:
55
outputs:
66
enabled:
77
value: ${{ jobs.resolve-automation.outputs.enabled == 'true' }}
8-
token-secret-name:
9-
value: ${{ jobs.resolve-automation.outputs.token-secret-name }}
108
username:
119
value: ${{ vars.AUTOMATION_USERNAME }}
1210
email:
1311
value: ${{ vars.AUTOMATION_EMAIL }}
12+
application-name:
13+
value: ${{ vars.AUTOMATION_APPLICATION_NAME }}
14+
application-username:
15+
value: ${{ vars.AUTOMATION_APPLICATION_USERNAME }}
1416
secrets:
15-
OPENTELEMETRYBOT_GITHUB_TOKEN:
17+
OTELBOT_DOTNET_PRIVATE_KEY:
1618
required: false
1719

1820
permissions:
@@ -25,13 +27,11 @@ jobs:
2527

2628
outputs:
2729
enabled: ${{ steps.evaluate.outputs.enabled }}
28-
token-secret-name: ${{ steps.evaluate.outputs.token-secret-name }}
2930

3031
env:
31-
OPENTELEMETRYBOT_GITHUB_TOKEN_EXISTS: ${{ secrets.OPENTELEMETRYBOT_GITHUB_TOKEN != '' }}
32+
OTELBOT_DOTNET_PRIVATE_KEY_EXISTS: ${{ secrets.OTELBOT_DOTNET_PRIVATE_KEY != '' }}
3233

3334
steps:
3435
- id: evaluate
3536
run: |
36-
echo "enabled=${{ env.OPENTELEMETRYBOT_GITHUB_TOKEN_EXISTS == 'true' }}" >> "$GITHUB_OUTPUT"
37-
echo "token-secret-name=OPENTELEMETRYBOT_GITHUB_TOKEN" >> "$GITHUB_OUTPUT"
37+
echo "enabled=${{ env.OTELBOT_DOTNET_PRIVATE_KEY_EXISTS == 'true' }}" >> "$GITHUB_OUTPUT"

‎.github/workflows/ci.yml‎

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,13 @@ jobs:
1616
lint-misspell-sanitycheck:
1717
uses: ./.github/workflows/sanitycheck.yml
1818

19+
code-ql:
20+
uses: ./.github/workflows/codeql-analysis-steps.yml
21+
permissions:
22+
actions: read
23+
contents: read
24+
security-events: write
25+
1926
detect-changes:
2027
runs-on: windows-latest
2128
outputs:
@@ -175,6 +182,7 @@ jobs:
175182
build-test:
176183
needs: [
177184
detect-changes,
185+
code-ql,
178186
lint-misspell-sanitycheck,
179187
lint-md,
180188
lint-dotnet-format,
@@ -192,5 +200,15 @@ jobs:
192200
if: always() && !cancelled()
193201
runs-on: ubuntu-22.04
194202
steps:
195-
- run: |
196-
if ( ${{ contains(needs.*.result, 'failure') }} == true ); then echo 'build failed'; exit 1; else echo 'build complete'; fi
203+
- name: Report CI status
204+
shell: bash
205+
env:
206+
CI_SUCCESS: ${{ !contains(needs.*.result, 'failure') }}
207+
run: |
208+
if [ "${CI_SUCCESS}" == "true" ]
209+
then
210+
echo 'Build complete'
211+
else
212+
echo 'Build failed'
213+
exit 1
214+
fi

‎.github/workflows/codeql-analysis-steps.yml‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
name: codeql-analysis-steps
2+
3+
on:
4+
workflow_call:
5+
6+
permissions: {}
7+
8+
jobs:
9+
analyze:
10+
permissions:
11+
actions: read # for github/codeql-action/init to get workflow details
12+
contents: read # for actions/checkout to fetch code
13+
security-events: write # for github/codeql-action/analyze to upload SARIF results
14+
runs-on: windows-latest
15+
16+
strategy:
17+
fail-fast: false
18+
matrix:
19+
language: ['actions', 'csharp']
20+
21+
steps:
22+
- name: Configure Pagefile
23+
if: matrix.language == 'csharp'
24+
uses: al-cheb/configure-pagefile-action@a3b6ebd6b634da88790d9c58d4b37a7f4a7b8708 # v1.4
25+
with:
26+
minimum-size: 8GB
27+
maximum-size: 32GB
28+
disk-root: "D:"
29+
30+
- name: Checkout repository
31+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
32+
with:
33+
filter: 'tree:0'
34+
persist-credentials: false
35+
show-progress: false
36+
37+
- name: Initialize CodeQL
38+
uses: github/codeql-action/init@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3
39+
with:
40+
build-mode: none
41+
languages: ${{ matrix.language }}
42+
43+
- name: Perform CodeQL Analysis
44+
uses: github/codeql-action/analyze@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3
45+
with:
46+
category: '/language:${{ matrix.language }}'
47+
48+
results:
49+
if: ${{ !cancelled() }}
50+
needs: [ analyze ]
51+
runs-on: ubuntu-latest
52+
53+
steps:
54+
- name: Report status
55+
shell: bash
56+
env:
57+
SCAN_SUCCESS: ${{ !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled') }}
58+
run: |
59+
if [ "${SCAN_SUCCESS}" == "true" ]
60+
then
61+
echo 'CodeQL analysis successful'
62+
else
63+
echo 'CodeQL analysis failed'
64+
exit 1
65+
fi

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 5 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -1,71 +1,16 @@
11
name: "CodeQL"
22

33
on:
4-
push:
5-
branches: [ 'main' ]
6-
pull_request:
7-
branches: [ 'main' ]
84
schedule:
95
- cron: '0 0 * * *' # once in a day at 00:00
106
workflow_dispatch:
117

128
permissions: {}
139

1410
jobs:
15-
analyze:
11+
code-ql:
12+
uses: ./.github/workflows/codeql-analysis-steps.yml
1613
permissions:
17-
actions: read # for github/codeql-action/init to get workflow details
18-
contents: read # for actions/checkout to fetch code
19-
security-events: write # for github/codeql-action/analyze to upload SARIF results
20-
runs-on: windows-latest
21-
22-
strategy:
23-
fail-fast: false
24-
matrix:
25-
language: ['actions', 'csharp']
26-
27-
steps:
28-
- name: Configure Pagefile
29-
if: matrix.language == 'csharp'
30-
uses: al-cheb/configure-pagefile-action@a3b6ebd6b634da88790d9c58d4b37a7f4a7b8708 # v1.4
31-
with:
32-
minimum-size: 8GB
33-
maximum-size: 32GB
34-
disk-root: "D:"
35-
36-
- name: Checkout repository
37-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
38-
with:
39-
filter: 'tree:0'
40-
persist-credentials: false
41-
show-progress: false
42-
43-
- name: Initialize CodeQL
44-
uses: github/codeql-action/init@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3
45-
with:
46-
build-mode: none
47-
languages: ${{ matrix.language }}
48-
49-
- name: Perform CodeQL Analysis
50-
uses: github/codeql-action/analyze@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3
51-
with:
52-
category: '/language:${{ matrix.language }}'
53-
54-
codeql:
55-
if: ${{ !cancelled() }}
56-
needs: [ analyze ]
57-
runs-on: ubuntu-latest
58-
59-
steps:
60-
- name: Report status
61-
shell: bash
62-
env:
63-
SCAN_SUCCESS: ${{ !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled') }}
64-
run: |
65-
if [ "${SCAN_SUCCESS}" == "true" ]
66-
then
67-
echo 'CodeQL analysis successful'
68-
else
69-
echo 'CodeQL analysis failed'
70-
exit 1
71-
fi
14+
actions: read
15+
contents: read
16+
security-events: write

0 commit comments

Comments
 (0)