cws-btfhub-sync.yml

name: "CWS BTFHub constants sync"

on:
  workflow_dispatch:
    inputs:
      base_branch:
        description: 'Base branch to target'
        required: false
        default: 'main'
        type: string
      force_refresh:
        description: 'Force refresh of the constants'
        required: false
        default: 'false'
        type: boolean
  schedule:
    - cron: '30 4 * * 5' # at 4:30 UTC on Friday

permissions: {}

jobs:
  generate:
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
      matrix:
        cone:
          - amzn
          - centos
          - debian
          - fedora
          - ol/7/arm64
          - ol/7/x86_64
          - ol/8/arm64
          - ol/8/x86_64
          - opensuse-leap
          - rhel
          - sles
          - ubuntu/16.04/x86_64
          - ubuntu/18.04/arm64
          - ubuntu/18.04/x86_64
          - ubuntu/20.04/arm64
          - ubuntu/20.04/x86_64
    steps:
      - name: Cleanup runner
        run: |
          sudo rm -rf /usr/local/lib/android >/dev/null 2>&1
          docker rmi $(docker image ls -aq) >/dev/null 2>&1
          sudo rm -rf /usr/share/dotnet
          sudo rm -rf /opt/ghc
          sudo rm -rf "/usr/local/share/boost"
          df -h

      - name: Checkout datadog-agent repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: ${{ inputs.base_branch || 'main' }}
          persist-credentials: false

      - name: Checkout btfhub-archive repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          repository: DataDog/btfhub-archive
          path: dev/dist/archive
          sparse-checkout: ${{ matrix.cone }}
          persist-credentials: false

      - name: Install python
        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
        with:
          python-version: 3.11
          cache: 'pip'
      - run: pip install -r requirements.txt

      - name: Install go
        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version-file: '.go-version'

      - name: Compute name
        id: artifact-name
        run: |
          echo "ARTIFACT_NAME=constants-${{ matrix.cone }}" | tr '/' '-' >> $GITHUB_OUTPUT

      - name: Sync constants
        if: ${{ !inputs.force_refresh }}
        env:
          ARTIFACT_NAME: ${{ steps.artifact-name.outputs.ARTIFACT_NAME }}
        run: |
          inv -e security-agent.generate-btfhub-constants --archive-path=./dev/dist/archive --output-path=./"$ARTIFACT_NAME".json

      - name: Force sync constants
        if: ${{ inputs.force_refresh }}
        env:
          ARTIFACT_NAME: ${{ steps.artifact-name.outputs.ARTIFACT_NAME }}
        run: |
          inv -e security-agent.generate-btfhub-constants --archive-path=./dev/dist/archive --output-path=./"$ARTIFACT_NAME".json --force-refresh

      - name: Upload artifact
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          name: ${{ steps.artifact-name.outputs.ARTIFACT_NAME }}
          path: ./${{ steps.artifact-name.outputs.ARTIFACT_NAME }}.json

  combine:
    needs: generate
    runs-on: ubuntu-22.04
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Checkout datadog-agent repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: ${{ inputs.base_branch || 'main' }}

      - name: Install python
        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
        with:
          python-version: 3.11
          cache: 'pip'
      - run: pip install -r requirements.txt

      - name: Install go
        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version-file: '.go-version'

      - name: Download All Artifacts
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          path: ./dev/dist/constants
          pattern: constants-*
          merge-multiple: true

      - name: Combine constants
        run: |
          inv -e security-agent.combine-btfhub-constants --archive-path=./dev/dist/constants

      - name: Compute branch name
        id: branch-name
        run: |
          echo "BRANCH_NAME=cws/constants-sync-$(date +%s)" >> $GITHUB_OUTPUT

      - uses: stefanzweifel/git-auto-commit-action@8621497c8c39c72f3e2a999a26b4ca1b5058a842 # v5.0.1
        id: commit-creator
        with:
          commit_message: "CWS: sync BTFhub constants"
          branch: ${{ steps.branch-name.outputs.BRANCH_NAME }}
          create_branch: true
          skip_fetch: true
          skip_checkout: true

      - name: Create Pull Request
        env:
          BRANCH_NAME: ${{ steps.branch-name.outputs.BRANCH_NAME }}
          BASE_BRANCH: ${{ inputs.base_branch || 'main' }}
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        if: steps.commit-creator.outputs.changes_detected == 'true'
        with:
          script: |
            const { repo, owner } = context.repo;
            const result = await github.rest.pulls.create({
              title: 'CWS: sync BTFHub constants',
              owner,
              repo,
              head: process.env.BRANCH_NAME,
              base: process.env.BASE_BRANCH,
              body: [
                '### What does this PR do?',
                'This PR syncs the BTFHub constants used by CWS',
                '_This PR was autogenerated_'
              ].join('\n')
            });
            github.rest.issues.update({
              owner,
              repo,
              issue_number: result.data.number,
              milestone: 22, // triage
            });
            github.rest.issues.addLabels({
              owner,
              repo,
              issue_number: result.data.number,
              labels: ['changelog/no-changelog', 'qa/no-code-change', 'team/agent-security']
            });