sync experiment

.github/workflows/backport.yml

@@ -1,26 +1,55 @@
-name: Backport PR creator
+name: Backport PR Creator
 on:
-  pull_request_target:
+  pull_request:
     types:
       - closed
       - labeled
 
 jobs:
   main:
-    if: github.repository == 'grafana/pyroscope'
+    # We don't run the backporting for PRs from forks because those can't access "pyroscope-development-app" secrets in vault.
+    # We don't use GitHub actions app (secrets.GITHUB_TOKEN) because PRs created by the bot don't trigger CI.
+    # Also only run if the PR is merged, as an extra safe-guard.
+    if: ${{ ! github.event.pull_request.head.repo.fork && github.event.pull_request.merged == true }}
+
     runs-on: ubuntu-latest
+    permissions:
+      contents: "read"
+      id-token: "write"
+      pull-requests: "write"
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          repository: grafana/grafana-github-actions
+          repository: "grafana/grafana-github-actions"
+          persist-credentials: false
           path: ./actions
+          ref: 066cbcd084b61558d99d13c76f835c49e31b4670
+
       - name: Install Actions
         run: npm install --production --prefix ./actions
+
+      - id: get-secrets
+        uses: grafana/shared-workflows/actions/get-vault-secrets@28361cdb22223e5f1e34358c86c20908e7248760
+        with:
+          repo_secrets: |
+            GITHUB_APP_ID=pyroscope-development-app:app-id
+            GITHUB_APP_PRIVATE_KEY=pyroscope-development-app:private-key
+
+      - name: Generate token
+        id: app-token
+        uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
+        with:
+          app-id: ${{ env.GITHUB_APP_ID }}
+          private-key: ${{ env.GITHUB_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: |
+            pyroscope
+
       - name: Run backport
         uses: ./actions/backport
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
           labelsToAdd: backport
           # The provided token needs read permissions for organization members if you want to remove the default reviewers.
           removeDefaultReviewers: false

.github/workflows/ci.yml

@@ -0,0 +1,183 @@
+name: ci
+on:
+  push:
+    branches:
+      - main
+
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  # Cancel any running workflow for the same branch when new commits are pushed.
+  # We group both by ref_name (available when CI is triggered by a push to a branch/tag)
+  # and head_ref (available when CI is triggered by a PR).
+  group: "${{ github.ref_name }}-${{ github.head_ref }}"
+  cancel-in-progress: true
+
+jobs:
+  format:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
+      - name: Install Go
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+        with:
+          go-version: 1.23.11
+      - name: Format
+        run: make fmt check/unstaged-changes
+  check-generated:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
+      - name: Install Go
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+        with:
+          go-version: 1.23.11
+      - name: Check generated files
+        run: make generate check/unstaged-changes
+  test:
+    strategy:
+      matrix:
+        include:
+          - arch: amd64
+            runner: ubuntu-24.04
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
+      - name: Install Go
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+        with:
+          go-version: 1.23.11
+      - name: Go Mod
+        run: make check/go/mod
+      - name: Test
+        run: make go/test
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
+      - name: Install Go
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+        with:
+          go-version: 1.23.11
+      - name: Run linter
+        run: make lint
+      - name: Check helm manifests
+        run: make helm/check check/unstaged-changes
+
+  test-docs:
+    runs-on: ubuntu-latest
+    steps:
+      - name: "Check out code"
+        uses: "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683" # v4
+        with:
+          persist-credentials: false
+      - name: "Test docs"
+        run: make docs/test
+
+  build-image:
+    if: github.event_name != 'push'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
+      - name: Set up go
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+        with:
+          go-version: 1.23.11
+      - uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3
+        with:
+          node-version: 20
+          cache: yarn
+      - name: Build image Pyroscope
+        run: make docker-image/pyroscope/build-multiarch "BUILDX_ARGS=--cache-from=type=gha --cache-to=type=gha"
+
+  build-push:
+    if: github.event_name == 'push' && github.repository == 'grafana/pyroscope'
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
+    outputs:
+      image: ${{ steps.push-metadata.outputs.image }}
+      image-digest: ${{ steps.push-metadata.outputs.image-digest }}
+      image-tag: ${{ steps.push-metadata.outputs.image-tag }}
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
+      - name: Set up go
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+        with:
+          go-version: 1.23.11
+      # login to docker hub
+      - id: get-secrets
+        uses: grafana/shared-workflows/actions/get-vault-secrets@28361cdb22223e5f1e34358c86c20908e7248760
+        with:
+          common_secrets: |
+            DOCKERHUB_USERNAME=dockerhub:username
+            DOCKERHUB_PASSWORD=dockerhub:password
+      - uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2
+        name: Login to Docker Hub
+        with:
+          username: ${{ env.DOCKERHUB_USERNAME }}
+          password: ${{ env.DOCKERHUB_PASSWORD }}
+      - name: Pyroscope Build & push multi-arch image
+        id: build-push
+        run: |
+          make docker-image/pyroscope/push-multiarch "BUILDX_ARGS=--cache-from=type=gha --cache-to=type=gha"
+      - name: Get image, image tag and image digest
+        id: push-metadata
+        run: |
+          image=$(cat ./.docker-image-name-pyroscope)
+          echo "image=${image}" >> "$GITHUB_OUTPUT"
+          echo "image-tag=${image#*:}" >> "$GITHUB_OUTPUT"
+          echo "image-digest=$(cat ./.docker-image-digest-pyroscope)" >> "$GITHUB_OUTPUT"
+
+  deploy-dev:
+    permissions:
+      contents: read
+      id-token: write
+    if: github.event_name == 'push' && github.repository == 'grafana/pyroscope' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    needs: [build-push]
+    steps:
+    - id: "submit-argowfs-deployment"
+      name: "Submit Argo Workflows deployment"
+      uses: grafana/shared-workflows/actions/trigger-argo-workflow@af9b0c52635d39023136fb9312a354f91d9b2bfd
+      with:
+        namespace: "phlare-cd"
+        workflow_template: "deploy-pyroscope-dev"
+        parameters: |
+          dockertag=${{ needs.build-push.outputs.image-tag }}
+          commit=${{ github.sha }}
+    - name: Print URI
+      run: |
+        echo "URI: ${{ steps.submit-argowfs-deployment.outputs.uri }}"

.github/workflows/e2e.yaml

@@ -4,73 +4,88 @@ on:
     branches:
       - main
   pull_request:
-
 concurrency:
   # Cancel any running workflow for the same branch when new commits are pushed.
   # We group both by ref_name (available when CI is triggered by a push to a branch/tag)
   # and head_ref (available when CI is triggered by a PR).
   group: "e2e-${{ github.ref_name }}-${{ github.head_ref }}"
   cancel-in-progress: true
-
+permissions:
+  contents: read
+env:
+  LANG: en_US.UTF-8
+  LC_ALL: en_US.UTF-8
 jobs:
   regular-path:
-    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - arch: amd64
+            runner: ubuntu-24.04
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
-      - uses: actions/setup-node@v3
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: 'false'
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: lts/hydrogen
+          node-version: 20
           cache: yarn
       - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
         with:
-          go-version: "1.22.11"
+          go-version: "1.23.11"
           cache: true
-      - run: yarn --frozen-lockfile
+      - name: Install node-canvas
+        run: sudo apt-get update && sudo apt-get install build-essential libcairo2-dev libpango1.0-dev libjpeg-dev libgif-dev librsvg2-dev
       - run: make build
       - name: Cypress run
-        uses: cypress-io/github-action@v5
+        uses: cypress-io/github-action@b8ba51a856ba5f4c15cf39007636d4ab04f23e3c # v6.10.2
         with:
           wait-on: http://localhost:4040/ready
           start: make run
           config-file: cypress/ci.ts
         env:
           ELECTRON_ENABLE_LOGGING: 1
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: always()
         with:
           name: regular-path-cypress-screenshots
           path: cypress/screenshots
-
   base-path:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
-      - uses: actions/setup-node@v3
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: 'false'
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: lts/hydrogen
+          node-version: 20
           cache: yarn
       - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
         with:
-          go-version: "1.22.11"
+          go-version: "1.23.11"
           cache: true
-      - run: yarn --frozen-lockfile
+      - name: Install node-canvas
+        run: sudo apt-get update && sudo apt-get install build-essential libcairo2-dev libpango1.0-dev libjpeg-dev libgif-dev librsvg2-dev
       - run: make build
       - name: run nginx with /foobar/
         run: docker compose -f scripts/base-url/docker-compose.yaml up -d
       - name: Cypress run
-        uses: cypress-io/github-action@v5
+        uses: cypress-io/github-action@b8ba51a856ba5f4c15cf39007636d4ab04f23e3c # v6.10.2
         with:
           wait-on: http://localhost:8080/foobar/ready
           start: |
             make run PARAMS=-api.base-url=/foobar/
           config-file: cypress/ci-base-path.ts
         env:
           ELECTRON_ENABLE_LOGGING: 1
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: always()
         with:
           name: base-path-cypress-screenshots