Merge branch 'tonycthsu/karafka-community-support' into karafka-tracing

Author: TonyCTHsu

.circleci/config.yml

@@ -0,0 +1,52 @@
+name: 'Prepare bundle cache'
+
+description: 'Sets up bundle cache for GitHub Actions'
+
+outputs:
+  cache-key:
+    description: 'Cache key for the bundle'
+    value: ${{ steps.restore-cache.outputs.cache-primary-key }}
+  lockfile:
+    description: 'Lockfile name'
+    value: ${{ steps.lockfile.outputs.lockfile }}
+
+runs:
+  using: "composite"
+  steps:
+    - id: ruby-alias
+      shell: bash
+      run: |
+        engine=$(ruby -e "puts RUBY_ENGINE")
+        alias=$(ruby -e "puts RUBY_ENGINE_VERSION.split('.').take(2).join")
+
+        echo "ruby-alias=$engine-$alias" >> "$GITHUB_OUTPUT"
+    - name: Generate lockfile
+      id: lockfile
+      shell: bash
+      env:
+        LOCKFILE: lockfile-${{ steps.ruby-alias.outputs.ruby-alias }}
+      run: |
+        bundle lock
+        echo "lockfile=$LOCKFILE" >> "$GITHUB_OUTPUT"
+    - name: Upload lockfile
+      uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+      with:
+        name: ${{ steps.lockfile.outputs.lockfile }}
+        path: "*.lock"
+    - name: Restore cache
+      uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+      id: restore-cache
+      with:
+        key: bundle-${{ runner.os }}-${{ runner.arch }}-${{ steps.ruby-alias.outputs.ruby-alias }}-${{ hashFiles('*.lock') }}
+        path: "/usr/local/bundle"
+    - if: steps.restore-cache.outputs.cache-hit != 'true'
+      shell: bash
+      run: bundle install
+    - if: steps.restore-cache.outputs.cache-hit != 'true'
+      name: Save cache
+      uses: actions/cache/save@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+      with:
+        key: "${{ steps.restore-cache.outputs.cache-primary-key }}"
+        path: "/usr/local/bundle"
+    - run: bundle check
+      shell: bash

.circleci/images/primary/README.md

@@ -1,10 +1,10 @@
-name: 'Restore Bundle from cache'
+name: 'Restore bundle cache'
 
 # TODO: Improve description
-description: 'Restore the bundle from cache'
+description: 'Restores bundle cache for GitHub Actions'
 
 inputs:
-  lockfile-name:
+  lockfile:
     description: 'Name of the lockfile artifact to download'
     required: true
   cache-key:
@@ -17,7 +17,7 @@ runs:
   - name: Download lockfile
     uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
     with:
-      name: ${{ inputs.lockfile-name }}
+      name: ${{ inputs.lockfile }}
 
   - name: Restore cache
     uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0

.circleci/images/primary/binary_version

@@ -3,69 +3,69 @@
 
 core:
 - changed-files:
-  - any-glob-to-any-file: [ 'lib/datadog/core/**' ]
+  - any-glob-to-any-file: ['lib/datadog/core/**']
 
 # Only documentation changes
 docs:
 - changed-files:
-  - all-globs-to-all-files: [ '**/*.md' ]
+  - all-globs-to-all-files: ['**/*.md']
 
 # Only test changes
 dev/testing:
 - changed-files:
-  - all-globs-to-all-files: [ '{spec/**,integration/**,benchmarks/**}' ]
+  - all-globs-to-all-files: ['{spec/**,integration/**,benchmarks/**}']
 
 # Changes to Profiling
 profiling:
 - changed-files:
-  - any-glob-to-any-file: [ '{lib/datadog/profiling/**,ext/datadog_profiling_native_extension/**}' ]
+  - any-glob-to-any-file: ['{lib/datadog/profiling/**,ext/datadog_profiling_native_extension/**}']
 
 # Changes to CI-App
 ci-app:
 - changed-files:
-  - any-glob-to-any-file: [ 'lib/datadog/ci/**' ]
+  - any-glob-to-any-file: ['lib/datadog/ci/**']
 
 # Changes to ASM
 appsec:
 - changed-files:
-  - any-glob-to-any-file: [ 'lib/datadog/appsec/**' ]
+  - any-glob-to-any-file: ['lib/datadog/appsec/**']
 
 # Changes to Tracing
 tracing:
 - changed-files:
-  - any-glob-to-any-file: [ 'lib/datadog/tracing/**' ]
+  - any-glob-to-any-file: ['lib/datadog/tracing/**']
 
 # Changes to Tracing integrations
 integrations:
 - changed-files:
-  - any-glob-to-any-file: [ '{lib/datadog/tracing/contrib/**,lib/datadog/appsec/contrib/**}' ]
+  - any-glob-to-any-file: ['{lib/datadog/tracing/contrib/**,lib/datadog/appsec/contrib/**}']
 
 # Only repository GitHub changes
 dev/github:
 - changed-files:
-  - all-globs-to-all-files: [ '.github/**' ]
+  - all-globs-to-all-files: ['.github/**']
 
 # Only repository CI changes
 dev/ci:
 - changed-files:
-  - all-globs-to-all-files: [ '{.circleci/**,.gitlab-ci.yml}' ]
+  - all-globs-to-all-files: ['{.circleci/**,.gitlab-ci.yml}']
 
 # Version bump pull request
 release:
 - changed-files:
-  - all-globs-to-all-files: [ '{CHANGELOG.md,lib/datadog/version.rb}' ]
+  - all-globs-to-all-files: ['{CHANGELOG.md,lib/datadog/version.rb}']
 
 # Changes to OpenTelemetry
 otel:
 - changed-files:
-  - any-glob-to-any-file: [ 'lib/datadog/opentelemetry/**' ]
+  - any-glob-to-any-file: ['lib/datadog/opentelemetry/**']
 
 # Changes to Single Step Instrumentation
 single-step:
 - changed-files:
-  - any-glob-to-any-file: [ 'lib-injection/**' ]
+  - any-glob-to-any-file: ['lib-injection/**']
 
 # Changes to Debugging
 debugging:
 - changed-files:
-  - any-glob-to-any-file: [ 'lib/datadog/debugging/**' ]
+  - any-glob-to-any-file: ['lib/datadog/debugging/**']

.github/actions/bundle-cache/action.yml

@@ -1,6 +1,6 @@
 name: Unit Test Template
 
-on:
+on: # yamllint disable-line rule:truthy
   workflow_call:
     inputs:
       # TODO: Provides concurrency control for each ruby version
@@ -28,36 +28,19 @@ jobs:
     outputs:
       batches: "${{ steps.set-batches.outputs.batches }}"
       misc: "${{ steps.set-batches.outputs.misc }}"
-      cache-key: "${{ steps.restore-cache.outputs.cache-primary-key }}"
-      lockfile: "${{ steps.lockfile.outputs.lockfile }}"
+      cache-key: "${{ steps.bundle-cache.outputs.cache-key }}"
+      lockfile: "${{ steps.bundle-cache.outputs.lockfile }}"
     container:
       image: ghcr.io/datadog/images-rb/engines/${{ inputs.engine }}:${{ inputs.version }}
     steps:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-    - name: Generate lockfile
-      id: lockfile
-      run: |
-        bundle lock
-        echo "lockfile=lockfile-${{ inputs.alias }}-${{ github.run_id }}" >> $GITHUB_OUTPUT
-    - name: Upload lockfile
-      uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
-      with:
-        name: ${{ steps.lockfile.outputs.lockfile }}
-        path: "*.lock"
-    - name: Restore cache
-      uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
-      id: restore-cache
       with:
-        key: bundle-${{ runner.os }}-${{ runner.arch }}-${{ inputs.alias }}-${{ hashFiles('*.lock') }}
-        path: "/usr/local/bundle"
-    - if: steps.restore-cache.outputs.cache-hit != 'true'
-      run: bundle install
-    - if: steps.restore-cache.outputs.cache-hit != 'true'
-      name: Save cache
-      uses: actions/cache/save@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
-      with:
-        key: "${{ steps.restore-cache.outputs.cache-primary-key }}"
-        path: "/usr/local/bundle"
+        persist-credentials: false
+
+    - name: Prepare bundle cache
+      id: bundle-cache
+      uses: ./.github/actions/bundle-cache
+
     - id: set-batches
       name: Distribute tasks into batches
       run: |
@@ -68,8 +51,8 @@ jobs:
         batches_data=$(echo "$data" | ruby -rjson -e 'puts JSON.parse(STDIN.read)["batches"].to_json')
         misc_data=$(echo "$data" | ruby -rjson -e 'puts JSON.parse(STDIN.read)["misc"].to_json')
 
-        echo "batches=$batches_data" >> $GITHUB_OUTPUT
-        echo "misc=$misc_data" >> $GITHUB_OUTPUT
+        echo "batches=$batches_data" >> "$GITHUB_OUTPUT"
+        echo "misc=$misc_data" >> "$GITHUB_OUTPUT"
     - name: Generate batch summary
       run: bundle exec rake github:generate_batch_summary
       env:
@@ -148,10 +131,12 @@ jobs:
         image: ghcr.io/datadog/images-rb/services/redis:6.2
     steps:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        persist-credentials: false
     - name: Restore bundle cache
       uses: ./.github/actions/bundle-restore
       with:
-        lockfile-name: ${{ needs.batch.outputs.lockfile }}
+        lockfile: ${{ needs.batch.outputs.lockfile }}
         cache-key: ${{ needs.batch.outputs.cache-key }}
     - name: Build & Test
       uses: ./.github/actions/build-test
@@ -221,10 +206,12 @@ jobs:
         image: ghcr.io/datadog/images-rb/services/starburstdata/presto:332-e.9
     steps:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        persist-credentials: false
     - name: Restore bundle cache
       uses: ./.github/actions/bundle-restore
       with:
-        lockfile-name: ${{ needs.batch.outputs.lockfile }}
+        lockfile: ${{ needs.batch.outputs.lockfile }}
         cache-key: ${{ needs.batch.outputs.cache-key }}
     - name: Build & Test
       uses: ./.github/actions/build-test

.github/actions/bundle-restore/action.yml

@@ -1,5 +1,6 @@
 name: Add milestone to merged pull requests
-on:
+
+on: # yamllint disable-line rule:truthy
   pull_request:
     types: [closed]
 
@@ -16,13 +17,15 @@ jobs:
         # Checks out the branch that the pull request is merged into
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
+          persist-credentials: false
           ref: ${{ github.event.pull_request.base.ref }}
 
       - name: Get major version from gemspec
         # Parse the gemspec and return the major version
         id: version
         run: |
-          echo "::set-output name=version::$(find . -name *.gemspec | ruby -ne 'puts Gem::Specification.load($_.chomp).version.to_s.split(".").first')"
+          VERSION=$(ruby -e "puts Gem::Specification.load(Dir.glob('*.gemspec').first).version.to_s.split('.').first")
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
       - name: Get project milestones
         id: milestones

.github/labeler.yml

@@ -1,6 +1,6 @@
 name: Build gem
 
-on:
+on: # yamllint disable-line rule:truthy
   workflow_dispatch:
     inputs:
       push:
@@ -10,10 +10,13 @@ on:
         default: true
   push:
     branches:
-    - master
+      - master
   pull_request:
     branches:
-    - master
+      - master
+
+# Default permissions for all jobs
+permissions: {}
 
 env:
   GEM_HOST: 'https://rubygems.pkg.github.com/DataDog'
@@ -31,32 +34,29 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - uses: ruby/setup-ruby@8388f20e6a9c43cd241131b678469a9f89579f37 # v1.216.0
         with:
           ruby-version: '3.2'
           bundler-cache: true # runs 'bundle install' and caches installed gems automatically
       - name: Patch version
         if: ${{ matrix.type != 'final' }}
+        env:
+          GHA_RUN_ID: ${{ github.run_id }}
+          GIT_REF: ${{ github.ref }}
+          GIT_SHA: ${{ github.sha }}
         run: |
-          # Obtain context information
-          gha_run_id='${{ github.run_id }}'
-          git_ref='${{ github.ref }}'
-          git_sha='${{ github.sha }}'
-
-          # Output info for CI debug
-          echo gha_run_id="${gha_run_id}"
-          echo git_ref="${git_ref}"
-          echo git_sha="${git_sha}"
+          .gitlab/patch_gem_version.sh gha "$GHA_RUN_ID" "$GIT_REF" "$GIT_SHA";
 
-          .gitlab/patch_gem_version.sh gha $gha_run_id $git_ref $git_sha;
       - name: Patch gem host
         if: ${{ matrix.type != 'final' }}
         run: |
           # Patch in GEM_HOST
           sed datadog.gemspec -i -e "s,^\([\t ]*spec\.metadata\['allowed_push_host'\]\) *= *,\1 = \'${GEM_HOST}\' # ,"
 
           # Test result
-          cat datadog.gemspec | grep -e allowed_push_host
+          grep -e allowed_push_host datadog.gemspec
       - name: Build gem
         run: bundle exec rake build
       - name: List gem