chore(.github/workflows): cache datadog-agent image (POC for general Docker images caching)

.github/actions/run-service/action.yml

@@ -0,0 +1,34 @@
+name: Run service
+description: Runs a Docker image from cache
+inputs:
+  repository:
+    required: true
+    description: The repository of the image to warm up
+  tag:
+    required: true
+    description: The tag of the image to warm up (latest tag not supported)
+  flags:
+    required: true
+    description: The flags to pass to the service
+runs:
+  using: "composite"
+  steps:
+    - name: Build cache filename
+      id: build_cache_filename
+      shell: bash
+      run: |
+        cache_filename=$(printf '%s_%s' "${{ inputs.repository }}" "${{ inputs.tag }}" | tr -cs '[:alnum:]_' '_')
+        echo "cache_filename=$cache_filename" >> $GITHUB_OUTPUT
+    - name: Restore image cache
+      uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+      with:
+        path: ${{ steps.build_cache_filename.outputs.cache_filename }}.tar
+        key: ${{ inputs.repository }}:${{ inputs.tag }}
+    - name: Load image
+      shell: bash
+      run: |
+        docker load -i ${{ steps.build_cache_filename.outputs.cache_filename }}.tar
+    - name: Run service
+      shell: bash
+      run: |
+        docker run -d ${{ inputs.flags }} ${{ inputs.repository }}:${{ inputs.tag }}

.github/actions/warm-up-service/action.yml

@@ -0,0 +1,35 @@
+name: Warm up service
+inputs:
+  repository:
+    required: true
+    description: The repository of the image to warm up
+  tag:
+    required: true
+    description: The tag of the image to warm up (latest tag not supported)
+runs:
+  using: "composite"
+  steps:
+    - name: Restore repo cache
+      uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+      with:
+        path: .git
+        key: gitdb-${{ github.repository_id }}-${{ github.sha }}
+    - name: Checkout
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        ref: ${{ github.sha }}
+        clean: false
+    - name: Pull Docker image
+      id: pull_image
+      shell: bash
+      run: |
+        image=${{ inputs.repository }}:${{ inputs.tag }}
+        docker pull $image
+        cache_filename=$(printf '%s_%s' "${{ inputs.repository }}" "${{ inputs.tag }}" | tr -cs '[:alnum:]_' '_')
+        echo "cache_filename=$cache_filename" >> $GITHUB_OUTPUT
+        docker save $image > $cache_filename.tar
+    - name: Cache Docker image
+      uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+      with:
+        path: "${{ steps.pull_image.outputs.cache_filename }}.tar"
+        key: "${{ inputs.repository }}:${{ inputs.tag }}"

.github/workflows/Makefile

@@ -8,4 +8,10 @@ clean:
 	rm -rf test-apps.yml
 
 test-apps.yml: test-apps.cue
-	cat <(echo "# Code generated via \`make test-apps.yml\`; DO NOT EDIT.") <(cue export --out=yaml $<) > $@
+	cat <(echo "# Code generated via \`make test-apps.yml\`; DO NOT EDIT.") <(cue export --out=yaml $<) > $@
+
+unit-integration-tests.yml: unit-integration-tests.cue
+	cat <(echo "# Code generated via \`make unit-integration-tests.yml\`; DO NOT EDIT.") <(cue export services.cue go-versions.cue --out=yaml $<) > $@
+
+pull-request.yml: pull-request.cue
+	cat <(echo "# Code generated via \`make pull-request.yml\`; DO NOT EDIT.") <(cue export services.cue go-versions.cue --out=yaml $<) > $@

.github/workflows/api-check.yml

@@ -2,6 +2,10 @@ name: API Stability Check
 
 on:
   pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
     paths:
       - 'ddtrace/tracer/**'
       - 'scripts/apiextractor/**'

.github/workflows/appsec.yml

@@ -10,19 +10,25 @@ on:
   schedule: # nightly
     - cron: "0 0 * * *"
   pull_request: # on pull requests touching appsec files
+    types:
+      - opened
+      - synchronize
+      - reopened
     paths:
       - '.github/workflows/appsec.yml'
       - 'internal/appsec/**'
       - 'appsec/**'
       - 'contrib/**/appsec.go'
       - '**/go.mod'
-  merge_group:
   push:
-    branches: release-v*
+    branches:
+      - release-v*
     tags-ignore:
       - 'contrib/**'
       - 'instrumentation/**'
-
+      - 'internal/**'
+      - 'orchestrion/**'
+      - 'scripts/**'
 env:
   DD_APPSEC_WAF_TIMEOUT: 1m
   PACKAGES: >-

.github/workflows/codeql-analysis.yml

@@ -8,14 +8,13 @@ on:
         required: true
         type: string
   push:
-    branches: [ main, master ]
-    tags-ignore:
-      - 'contrib/**'
-      - 'instrumentation/**'
+    branches:
+      - mq-working-branch-**
   pull_request:
-    # The branches below must be a subset of the branches above
-    branches: [ main ]
-  merge_group:
+    types:
+      - opened
+      - synchronize
+      - reopened
 
 jobs:
   analyze:

.github/workflows/ecosystems-label-pr.yml

@@ -1,12 +1,12 @@
 name: Label APM Ecosystems Pull Requests
 on:
   pull_request:
-    paths:
-      - "contrib/**"
     types:
       - opened
       - reopened
       - edited
+    paths:
+      - "contrib/**"
 permissions:
   contents: read
   pull-requests: write

.github/workflows/generate.yml

@@ -3,12 +3,13 @@ name: Generate
 on:
   push:
     branches:
-      - main
       - release-*
+      - mq-working-branch-**
   pull_request:
-    branches:
-      - main
-      - release-*
+    types:
+      - opened
+      - synchronize
+      - reopened
   workflow_call:
     inputs:
       go-version:

.github/workflows/go-versions.cue

@@ -0,0 +1,6 @@
+package workflows
+
+_go_versions: [
+	"1.24",
+	"1.25",
+]

.github/workflows/govulncheck.yml

@@ -8,11 +8,14 @@ on:
         type: string
   push:
     branches:
-      - main
       - release-v*
+      - mq-working-branch-**
     tags-ignore:
       - 'contrib/**'
       - 'instrumentation/**'
+      - 'internal/**'
+      - 'orchestrion/**'
+      - 'scripts/**'
   schedule:
     - cron: '00 00 * * *'
   workflow_dispatch:

.github/workflows/main-branch-tests.yml

@@ -1,44 +1,27 @@
 name: Main Branch and Release Tests
 
 on:
-  workflow_call: # allows to reuse this workflow
-    inputs:
-      ref:
-        description: 'The branch to run the workflow on'
-        required: true
-        type: string
   push:
     branches:
-      - main
       - release-v*
+      - mq-working-branch-**
     tags-ignore:
       - 'contrib/**'
       - 'instrumentation/**'
+      - 'internal/**'
+      - 'orchestrion/**'
+      - 'scripts/**'
 
 concurrency:
   group: ${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
   unit-integration-tests:
-    strategy:
-      matrix:
-        go-version: [ "1.25", "1.24" ]
-      fail-fast: false
     uses: ./.github/workflows/unit-integration-tests.yml
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: write
     with:
-      go-version: ${{ matrix.go-version }}
-      ref: ${{ inputs.ref || github.ref }}
-    secrets: inherit
-  multios-unit-tests:
-    strategy:
-      matrix:
-        runs-on: [ macos-latest, windows-latest, ubuntu-latest ]
-        go-version: [ "1.25", "1.24" ]
-      fail-fast: false
-    uses: ./.github/workflows/multios-unit-tests.yml
-    with:
-      go-version: ${{ matrix.go-version }}
-      runs-on: ${{ matrix.runs-on }}
-      ref: ${{ inputs.ref || github.ref }}
-    secrets: inherit
+      go-version: "1.25" # Should be the highest supported version of Go

.github/workflows/multios-unit-tests.yml

@@ -4,13 +4,11 @@ on:
   workflow_dispatch: # manually
     inputs:
       go-version:
+        description: The Go version to use
         required: true
         type: string
       runs-on:
-        required: true
-        type: string
-      ref:
-        description: 'The branch to run the workflow on'
+        description: The OS to run the tests on
         required: true
         type: string
   workflow_call:
@@ -21,10 +19,6 @@ on:
       runs-on:
         required: true
         type: string
-      ref:
-        description: 'The branch to run the workflow on'
-        required: true
-        type: string
 
 env:
   DD_APPSEC_WAF_TIMEOUT: 1m # Increase time WAF time budget to reduce CI flakiness
@@ -50,10 +44,16 @@ jobs:
         shell: pwsh
         run: |
           "normalized_workspace=${{ github.workspace }}" >> $env:GITHUB_ENV
+      - name: Restore repo cache
+        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        with:
+          path: .git
+          key: gitdb-${{ github.repository_id }}-${{ github.sha }}
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v2.7.0
         with:
-          ref: ${{ inputs.ref || github.ref }}
+          ref: ${{ github.sha }}
+          clean: false
       - name: Setup Go and development tools
         uses: ./.github/actions/setup-go
         with:
@@ -63,7 +63,7 @@ jobs:
       - name: Mac OS Coreutils
         if: inputs.runs-on == 'macos-latest'
         run: brew install coreutils
-      - name: "Runner ${{ matrix.runner-index }}: Test Core and Contrib (No Integration Tests)"
+      - name: "Runner: Test Core and Contrib (No Integration Tests)"
         shell: bash
         run: |
           export PATH="${{ github.workspace }}/bin:${PATH}"

.github/workflows/orchestrion.yml

@@ -15,13 +15,19 @@ on:
       DD_API_KEY:
         required: false
   pull_request:
-  merge_group:
+    types:
+      - opened
+      - synchronize
+      - reopened
   push:
     branches:
       - release-v*
     tags-ignore:
       - 'contrib/**'
       - 'instrumentation/**'
+      - 'internal/**'
+      - 'orchestrion/**'
+      - 'scripts/**'
 
 permissions: read-all
 

.github/workflows/parametric-tests.yml

@@ -9,15 +9,19 @@ on:
         type: string
   push:
     branches:
-      - main
       - release-v*
+      - mq-working-branch-**
     tags-ignore:
       - 'contrib/**'
       - 'instrumentation/**'
+      - 'internal/**'
+      - 'orchestrion/**'
+      - 'scripts/**'
   pull_request:
-    branches:
-      - "**"
-  merge_group:
+    types:
+      - opened
+      - synchronize
+      - reopened
   workflow_dispatch:
     inputs:
       ref:

.github/workflows/pull-request-title-validation.yml

@@ -2,7 +2,10 @@ name: Validate PR Title
 
 on:
   pull_request:
-    types: [opened, edited,reopened,synchronize]
+    types:
+      - opened
+      - edited
+      - reopened
 
 jobs:
   check-title: