Sourced from DataDog/datadog-static-analyzer-github-action's releases.

v3.0.0

This is a major release that converts the action from a container action to a composite action.

In practice, this will reduce the time the action takes to initialize from over 1 minute to under 10 seconds.

Upgrading from v2

TL;DR unless you are self-hosting runners, upgrading from v2 will work without issue.

GitHub-hosted Runners

If you're using Github's runners, you can upgrade without issue.

Side Effects

Note that with the move away from containerization, there are some net-new side effects to using the action that persist to following steps. These are not expected to cause behavior regressions but are listed below for transparency:

• $HOME/.local/bin/ will be created and added to $GITHUB_PATH
  • The datadog-static-analyzer binary will be written here
  • The datadog-ci binary might be written here
• git config --global --add safe.directory "$GITHUB_WORKSPACE" will be run
• git config --unset extensions.worktreeConfig might be run
• A temporary dir (mktemp -d) containing datadog-ci (semver ^4) might be written to $GITHUB_PATH

Self-hosted Runners

If you are using self-hosted runners you might need additional configuration, depending on your setup (firewalls, etc).

Net-new network calls

• npm view @datadog/datadog-ci is used
• GET https://github.com/DataDog/datadog-static-analyzer/releases/latest/download/*
• GET https://github.com/DataDog/datadog-ci/releases/download/*/*

Net-new required binaries in $PATH

• bash
• git
• curl (additionally, CA certificates)
• node
• npm
• unzip

The same "Side Effects" from the section above apply.

• 8340f18 Merge pull request #55 from DataDog/jf/K9VULN-10939
• 54d9d85 Add platform test
• b7fe6fb Implement as a composite action
• See full diff in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)