check.yml

name: Static Analysis
on:
  push:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    name: build
    runs-on: ubuntu-24.04
    container: ghcr.io/datadog/images-rb/engines/ruby:3.3
    steps:
      - uses: actions/checkout@v4
      - run: bundle lock
      - uses: actions/upload-artifact@v4
        id: lockfile
        with:
          name: 'check-lockfile-${{ github.sha }}-${{ github.run_id }}'
          path: '*.lock'
          if-no-files-found: error

  rubocop:
    name: rubocop/lint
    runs-on: ubuntu-24.04
    needs: ['build']
    container: ghcr.io/datadog/images-rb/engines/ruby:3.3
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
      - run: bundle install
      - run: bundle exec rake rubocop

  standard:
    name: standard/lint
    runs-on: ubuntu-24.04
    needs: ['build']
    container: ghcr.io/datadog/images-rb/engines/ruby:3.3
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
      - name: Install dependencies
        run: bundle install
      - run: bundle exec rake standard

  steep:
    name: steep/typecheck
    runs-on: ubuntu-24.04
    needs: ['build']
    container: ghcr.io/datadog/images-rb/engines/ruby:3.3
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
      - name: Install dependencies
        run: bundle install
      - name: Check for stale signature files
        run: bundle exec rake rbs:stale
      - name: Check for missing signature files
        run: bundle exec rake rbs:missing
      - name: Check types
        run: bundle exec rake steep:check
      - name: Record stats
        run: bundle exec rake steep:stats[md] >> $GITHUB_STEP_SUMMARY

  # Dogfooding Datadog SBOM Analysis
  dd-software-composition-analysis:
    name: dd/sca
    runs-on: ubuntu-24.04
    needs: ['build']
    container: ghcr.io/datadog/images-rb/engines/ruby:3.3
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - uses: actions/download-artifact@v4 # requires the lockfile
      - uses: DataDog/datadog-sca-github-action@main
        with:
          dd_api_key: ${{ secrets.DD_API_KEY }}
          dd_app_key: ${{ secrets.DD_APP_KEY }}
          dd_site: datadoghq.com

  # Dogfooding Datadog Static Analysis
  dd-static-analysis:
    name: dd/static-analysis
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
      - uses: DataDog/datadog-static-analyzer-github-action@v1
        with:
          dd_api_key: ${{ secrets.DD_API_KEY }}
          dd_app_key: ${{ secrets.DD_APP_KEY }}
          dd_site: datadoghq.com
          cpu_count: 2

  semgrep:
    name: semgrep/ci
    runs-on: ubuntu-24.04
    container: semgrep/semgrep # PENDING: Possible to be rate limited.
    steps:
      - uses: actions/checkout@v4
      - run: |
          semgrep ci \
          --include=bin/* \
          --include=ext/* \
          --include=lib/* \
          --exclude-rule=ruby.lang.security.model-attributes-attr-accessible.model-attributes-attr-accessible
        env:
          SEMGREP_RULES: p/default

  static-analysis:
    needs:
      - 'steep'
      - 'rubocop'
      - 'standard'
      - 'semgrep'
      - 'dd-software-composition-analysis'
      - 'dd-static-analysis'
    runs-on: ubuntu-24.04
    steps:
      - run: echo "Done"