Skip to content

Create datadog-synthetics.yml #144

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
danialzivehdadr wants to merge 3 commits into from
Closed

Create datadog-synthetics.yml #144

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2415b28
Create datadog-synthetics.yml
danialzivehdadr Jun 19, 2026
b95cb02
Create ファイルを取得
danialzivehdadr Jun 24, 2026
92c1ade
Create dimension
danialzivehdadr Jun 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 38 additions & 0 deletions .github/workflows/datadog-synthetics.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
# This workflow will trigger Datadog Synthetic tests within your Datadog organisation
# For more information on running Synthetic tests within your GitHub workflows see: https://docs.datadoghq.com/synthetics/cicd_integrations/github_actions/

# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

# To get started:

# 1. Add your Datadog API (DD_API_KEY) and Application Key (DD_APP_KEY) as secrets to your GitHub repository. For more information, see: https://docs.datadoghq.com/account_management/api-app-keys/.
# 2. Start using the action within your workflow

name: Run Datadog Synthetic tests

on:
push:
branches: [ "main" ]
pull_request:
branches: [ "main" ]

jobs:
build:
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v4

@coderabbitai coderabbitai Bot Jun 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

添加 persist-credentials: false 来禁用 Git 凭证持久化。

默认情况下，actions/checkout 会将 GITHUB_TOKEN 作为 Git 凭证保留在运行器中。虽然此工作流不会将代码推送回仓库，但禁用凭证持久化是一个安全最佳实践，可以降低意外泄露的风险。

🧰 Tools
🪛 zizmor (1.25.2)

[warning] 27-30: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 27-27: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/datadog-synthetics.yml at line 27, The actions/checkout@v4
step is missing the persist-credentials configuration which is a security best
practice. Add the with clause to the actions/checkout@v4 step and set
persist-credentials to false to disable Git credential persistence in the
runner, preventing accidental leakage of the GITHUB_TOKEN even though this
workflow does not push code back to the repository.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

将 actions/checkout 操作固定到特定的提交哈希值。

当前配置使用版本标签 v4，而非提交哈希值。GitHub 的版本标签可以被重新标记，存在供应链安全风险。为确保安全性，应将其锁定到特定的提交 SHA。建议参照 Datadog 操作的做法，使用完整的提交哈希值。

🔐 建议的修复方案 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@b4ffde65f46336ab88eb53b808aeb3b2f405076e # v4.1.1
+      with:
+        persist-credentials: false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- uses: actions/checkout@v4
steps:
- uses: actions/checkout@b4ffde65f46336ab88eb53b808aeb3b2f405076e # v4.1.1
with:
persist-credentials: false
🧰 Tools
🪛 zizmor (1.25.2)

[warning] 27-30: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 27-27: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/datadog-synthetics.yml at line 27, The actions/checkout
action is currently pinned to version tag v4 instead of a specific commit hash,
which poses a supply chain security risk since version tags can be re-tagged.
Replace the version tag reference in the actions/checkout@v4 line with the full
commit SHA hash that corresponds to the v4 release. This ensures the workflow
uses an immutable reference to a specific commit rather than a mutable version
tag.


# Run Synthetic tests within your GitHub workflow.
# For additional configuration options visit the action within the marketplace: https://github.com/marketplace/actions/datadog-synthetics-ci
- name: Run Datadog Synthetic tests
uses: DataDog/synthetics-ci-github-action@87b505388a22005bb8013481e3f73a367b9a53eb # v1.4.0
with:
api_key: ${{secrets.DD_API_KEY}}
app_key: ${{secrets.DD_APP_KEY}}
test_search_query: 'tag:e2e-tests' #Modify this tag to suit your tagging strategy


33 changes: 33 additions & 0 deletions dimension
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
s => {
# "dimensionHeaders": [
# {
# "name": "sessionDefaultChannelGroup"
# }
# ],
# "metricHeaders": [
# {
# "name": "sessions",
# "type": "TYPE_INTEGER"
# }
# ],
# "rows": [
# {
# "dimensionValues": [
# {
# "value": "Organic Search"
# }
# ],
# "metricValues": [
# {
# "value": "200"
# }
# ]
# }
# ],
# "rowCount": 1,
# "metadata": {
# "currencyCode": "JPY",
# "timeZone": "Asia/Tokyo"
# },
# "kind": "analyticsData#runReport"
#}
38 changes: 38 additions & 0 deletions ファイルを取得
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
# ファイルを取得
+get_file_1:
action>: GetFile
display_name>: 'ファイルを取得'
provider: local
filename: rc_36b0011677688bf489d7
private: false
meta:
display:
filename:
label: 'sample-card.png'
icon: text
type: chip
action:
disabled: false
# Document Forceでドキュメントを解析
+d_f_analyze_document_1:
action>: DFAnalyzeDocument
display_name>: 'Document Forceでドキュメントを解析'
provider_id: documentforce_03f3151d6f9accddcffa
endpoint: 'https://app.aipuncher.com/api/v2/analyse/****************'

@coderabbitai coderabbitai Bot Jun 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

不要把解析 endpoint 直接写进仓库。

Line 21 将外部解析地址硬编码在流程里，环境切换、密钥轮换和最小暴露都很难做；如果这个路径本身携带项目级路由 key，泄露面会更大。这里应改成从 secret 或环境变量注入。

🔧 建议修改 
-  endpoint: 'https://app.aipuncher.com/api/v2/analyse/****************'
+  endpoint: '${{ secrets.DOCUMENTFORCE_ANALYZE_ENDPOINT }}'
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
endpoint: 'https://app.aipuncher.com/api/v2/analyse/****************'
endpoint: '${{ secrets.DOCUMENTFORCE_ANALYZE_ENDPOINT }}'
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ファイルを取得` at line 21, 该处把外部解析 endpoint 直接硬编码进了流程配置，需要改为通过环境变量或 secret
注入。请在相关配置/初始化位置（包含 endpoint 的对象或常量）移除固定 URL，并改成从配置读取，确保项目级路由 key
不再出现在仓库中且便于环境切换与轮换。

file: +get_file_1
tags:
AUTORO DevOps:
- '開発テストタグ'
wait_for_result: false
Comment on lines +17 to +26

@coderabbitai coderabbitai Bot Jun 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Locate the workflow file and inspect surrounding context around the referenced lines.
git ls-files | rg -n 'ファイルを取得|get_file|analyse|AnalyzeDocument|DFAnalyzeDocument' || true

Repository: react-component/footer

Length of output: 160

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Locate the workflow file and inspect surrounding context around the referenced lines.
git ls-files | rg -n 'ファイルを取得|get_file|analyse|AnalyzeDocument|DFAnalyzeDocument' || true

Repository: react-component/footer

Length of output: 160

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Search for the workflow and key identifiers.
git ls-files | sed 's#^#./#' | while read -r f; do
  case "$f" in
    *.yml|*.yaml|*.json|*.jsonnet|*.toml|*.tf|*.txt|*.md)
      if rg -n -H --no-heading 'wait_for_result|DFAnalyzeDocument|document_id|analyse|Document Force|ファイルを取得' "$f" >/tmp/match.$$ 2>/dev/null; then
        echo "==> $f"
        cat /tmp/match.$$
      fi
      ;;
  esac
done
rm -f /tmp/match.$$

Repository: react-component/footer

Length of output: 160

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Find any tracked files that mention the key identifiers or the Japanese title.
git ls-files -z | python3 - <<'PY'
import sys, subprocess, os, re, pathlib

files = sys.stdin.buffer.read().split(b'\0')
patterns = [b'wait_for_result', b'DFAnalyzeDocument', b'document_id', b'Document Force', 'ファイルを取得'.encode('utf-8'), b'analyse']
for fb in files:
    if not fb:
        continue
    f = fb.decode('utf-8', errors='surrogateescape')
    try:
        data = pathlib.Path(f).read_text(encoding='utf-8', errors='ignore')
    except Exception:
        continue
    if any(p.decode('utf-8', errors='ignore') in data for p in patterns):
        print(f)
PY

Repository: react-component/footer

Length of output: 164

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Find any tracked files that mention the key identifiers or the Japanese title.
git ls-files -z | python3 - <<'PY'
import sys, pathlib

files = sys.stdin.buffer.read().split(b'\0')
patterns = [
    'wait_for_result',
    'DFAnalyzeDocument',
    'document_id',
    'Document Force',
    'ファイルを取得',
    'analyse',
]
for fb in files:
    if not fb:
        continue
    f = fb.decode('utf-8', errors='surrogateescape')
    try:
        data = pathlib.Path(f).read_text(encoding='utf-8', errors='ignore')
    except Exception:
        continue
    if any(p in data for p in patterns):
        print(f)
PY

Repository: react-component/footer

Length of output: 164

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect tracked file names and look for the likely workflow file.
printf 'Top-level tracked files:\n'
git ls-files | sed -n '1,200p'

printf '\nCandidates containing the Japanese title:\n'
git ls-files | rg 'ファイルを取得|analyse|document|workflow|yaml|yml|json$'

Repository: react-component/footer

Length of output: 1070

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
import os, sys, pathlib, subprocess

# Find the tracked file whose basename is the Japanese title.
target = None
for f in subprocess.check_output(['git', 'ls-files', '-z']).split(b'\0'):
    if not f:
        continue
    name = f.decode('utf-8', errors='surrogateescape')
    if os.path.basename(name) == 'ファイルを取得':
        target = name
        break

print(target or 'NOT_FOUND')
if target:
    print('\n--- file with line numbers ---')
    with open(target, encoding='utf-8', errors='replace') as fh:
        for i, line in enumerate(fh, 1):
            if 1 <= i <= 80:
                print(f'{i:4d}: {line.rstrip()}')
PY

Repository: react-component/footer

Length of output: 1260

补上解析结果判定

wait_for_result: false 让这一步只拿到 document_id 就结束了，当前文件里也没有基于 document_id 的轮询或失败分支。若解析是异步的，这里不会把“解析成功”纳入工作流结果。要么改为等待结果，要么补上后续的轮询/失败处理。

🔧 最小修正示例 
-  wait_for_result: false
+  wait_for_result: true
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
+d_f_analyze_document_1:
action>: DFAnalyzeDocument
display_name>: 'Document Forceでドキュメントを解析'
provider_id: documentforce_03f3151d6f9accddcffa
endpoint: 'https://app.aipuncher.com/api/v2/analyse/****************'
file: +get_file_1
tags:
AUTORO DevOps:
- '開発テストタグ'
wait_for_result: false
d_f_analyze_document_1:
action>: DFAnalyzeDocument
display_name>: 'Document Forceでドキュメントを解析'
provider_id: documentforce_03f3151d6f9accddcffa
endpoint: 'https://app.aipuncher.com/api/v2/analyse/****************'
file: +get_file_1
tags:
AUTORO DevOps:
- '開発テストタグ'
wait_for_result: true
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ファイルを取得` around lines 17 - 26, `d_f_analyze_document_1` currently ends with
`wait_for_result: false`, so the workflow only gets a `document_id` and never
verifies the analysis outcome. Update this step to either wait for the
`DFAnalyzeDocument` result directly, or add a follow-up polling/branching path
keyed on `document_id` that handles success and failure before the workflow
completes. Make sure the final result of the flow reflects the document analysis
status, not just submission.

private: false
meta:
display:
provider_id:
type: chip
label: 'Documentforce (AUTORO連携用)'
icon: documentforce
action:
disabled: false
# {
# "document_id": 1027
# }