ci: Run Datadog SCA in CI

[harmonherring-pro]

What does this PR do?

Adds a new Gitlab CI job that dogfoods the Datadog SCA product

Motivation

@DataDog/software-integrity-and-trust partners with @DataDog/static-analysis to dogfood their SCA product and secure Datadog's supply chain.

Reviewer's Checklist

• Changed code has unit tests for its functionality at or near 100% coverage.
• System-Tests covering this feature have been added and enabled with the va.b.c-dev version tag.
• There is a benchmark for any new code, or changes to existing code.
• If this interacts with the agent in a new way, a system test has been added.
• Add an appropriate team label so this PR gets put in the right place for the release notes.
• Non-trivial go.mod changes, e.g. adding new modules, are reviewed by @DataDog/dd-trace-go-guild.

[pr-commenter]

Benchmarks

Benchmark execution time: 2024-03-28 21:04:16

Comparing candidate commit f92faae in PR branch harmon.herring/sint-1892-deploy-sca with baseline commit aaf8af5 in branch main.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 44 metrics, 0 unstable metrics.

[Julio-Guerra]

Cool to see this initiative poping here ;-)

Is the docker image publicly accessible? If so, I suggest we do a github workflow instead, as this is our main CI tool.
(You could even provide a simple reusable github workflow or action to hide all these details).

[juli1]

Cool to see this initiative poping here ;-)

Is the docker image publicly accessible? If so, I suggest we do a github workflow instead, as this is our main CI tool. (You could even provide a simple reusable github workflow or action to hide all these details).

It's not. If you want to use a GitHub action, you can use the SCA GitHub action.

[Julio-Guerra]

Cool to see this initiative poping here ;-)
Is the docker image publicly accessible? If so, I suggest we do a github workflow instead, as this is our main CI tool. (You could even provide a simple reusable github workflow or action to hide all these details).

It's not. If you want to use a GitHub action, you can use the SCA GitHub action.

So why not integrate this here? We are an open-source library, so the more open we are, the better ;-)
So far GitLab is used only for the benchmark platform which relies on gitlab runners maintained by the related backend team, everything else we have and rely on ourselves runs on GitHub Workflow.

Still open to starting your early integration this way.

[darccio]

I was planning to apply this at some point. Thanks for taking the lead, @harmonherring-pro! As @Julio-Guerra stated, I think too that we should go with the SCA GitHub Action.

If you don't mind, I can take care of this and convert the GitLab YAML to its GitHub equivalent in this same PR. WDYT?

[harmonherring-pro]

I was planning to apply this at some point. Thanks for taking the lead, @harmonherring-pro! As @Julio-Guerra stated, I think too that we should go with the SCA GitHub Action.

If you don't mind, I can take care of this and convert the GitLab YAML to its GitHub equivalent in this same PR. WDYT?

Thanks for pinging me! I was wrapped up in some other work for a few days and didn't realize the activity this PR had 😅 that sounds good to me, let me know if you need anything from me!

[juliendoutre]

Looks good to me! Approving just in case, but feel free to go with the github actions integration if you want to.

[juliendoutre]

Could you set the service to dd-trace-go please?

[github-actions]

This PR is stale because it has been open 20 days with no activity. Remove stale label or comment or this will be closed in 10 days.