Changes for NR CSEC module support

.devcontainer/Dockerfile

@@ -1,4 +1,20 @@
-ARG IMAGE=ghcr.io/newrelic-experimental/pyenv-devcontainer:latest
-
 # To target other architectures, change the --platform directive in the Dockerfile.
-FROM --platform=linux/amd64 ${IMAGE}
+ARG IMAGE_TAG=latest
+FROM ghcr.io/newrelic/newrelic-python-agent-ci:${IMAGE_TAG}
+
+# Setup non-root user
+USER root
+ARG UID=1000
+ARG GID=${UID}
+ENV HOME /home/vscode
+RUN mkdir -p ${HOME} && \
+    groupadd --gid ${GID} vscode && \
+    useradd --uid ${UID} --gid ${GID} --home ${HOME} vscode && \
+    chown -R ${UID}:${GID} /home/vscode
+
+# Fix pyenv installation
+RUN echo 'eval "$(pyenv init -)"' >>${HOME}/.bashrc && \
+    chown -R vscode:vscode ${PYENV_ROOT}
+
+# Set user
+USER ${UID}:${GID}

.devcontainer/devcontainer.json

@@ -5,7 +5,7 @@
 		// To target other architectures, change the --platform directive in the Dockerfile.
 		"dockerfile": "Dockerfile",
 		"args": {
-			"IMAGE": "ghcr.io/newrelic-experimental/pyenv-devcontainer:latest"
+			"IMAGE_TAG": "latest"
 		}
 	},
 	"remoteUser": "vscode",

.github/actions/update-rpm-config/action.yml

@@ -0,0 +1,69 @@
+name: "update-rpm-config"
+description: "Set current version of agent in rpm config using API."
+inputs:
+  agent-language:
+    description: "Language agent to configure (eg. python)"
+    required: true
+    default: "python"
+  agent-version:
+    description: "3-4 digit agent version number (eg. 1.2.3) with optional leading v (ignored)"
+    required: true
+  dry-run:
+    description: "Dry Run"
+    required: true
+    default: "false"
+  production-api-key:
+    description: "API key for New Relic Production"
+    required: false
+
+runs:
+  using: "composite"
+  steps:
+    - name: Trim potential leading v from agent version
+      shell: bash
+      run: |
+        AGENT_VERSION=${{ inputs.agent-version }}
+        echo "AGENT_VERSION=${AGENT_VERSION#"v"}" >> $GITHUB_ENV
+
+    - name: Generate Payload
+      shell: bash
+      run: |
+        echo "PAYLOAD='{ \"system_configuration\": { \"key\": \"${{ inputs.agent-language }}_agent_version\", \"value\": \"${{ env.AGENT_VERSION }}\" } }'" >> $GITHUB_ENV
+
+    - name: Generate Content-Type
+      shell: bash
+      run: |
+        echo "CONTENT_TYPE='Content-Type: application/json'" >> $GITHUB_ENV
+
+    - name: Update system configuration page
+      shell: bash
+      if: ${{ inputs.dry-run == 'false' }}
+      run: |
+        curl -X POST 'https://api.newrelic.com/v2/system_configuration.json' \
+        -H "X-Api-Key:${{ inputs.production-api-key }}" -i \
+        -H ${{ env.CONTENT_TYPE }} \
+        -d ${{ env.PAYLOAD }}
+
+    - name: Verify system configuration update
+      shell: bash
+      if: ${{ inputs.dry-run == 'false' }}
+      run: |
+        PROD_VERSION=$(curl -X GET 'https://api.newrelic.com/v2/system_configuration.json' \
+        -H "X-Api-Key:${{ inputs.production-api-key }}" \
+        -H "${{ env.CONTENT_TYPE }}" | jq ".system_configurations | from_entries | .${{inputs.agent-language}}_agent_version")
+
+        if [ "${{ env.AGENT_VERSION }}" != "$PROD_VERSION" ]; then
+            echo "Version mismatch: $PROD_VERSION"
+            exit 1
+        fi
+
+    - name: (dry-run) Update system configuration page
+      shell: bash
+      if: ${{ inputs.dry-run != 'false' }}
+      run: |
+        cat << EOF
+            curl -X POST 'https://api.newrelic.com/v2/system_configuration.json' \
+            -H "X-Api-Key:**REDACTED**" -i \
+            -H ${{ env.CONTENT_TYPE }} \
+            -d ${{ env.PAYLOAD }}
+        EOF

.github/containers/Dockerfile

@@ -0,0 +1,107 @@
+
+# Copyright 2010 New Relic, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+FROM ubuntu:20.04
+
+# Install OS packages
+RUN export DEBIAN_FRONTEND=noninteractive && \
+    apt-get update && \
+    apt-get install -y \
+        bash \
+        build-essential \
+        curl \
+        expat \
+        fish \
+        fontconfig \
+        freetds-common \
+        freetds-dev \
+        gcc \
+        git \
+        libbz2-dev \
+        libcurl4-openssl-dev \
+        libffi-dev \
+        libgmp-dev \
+        libkrb5-dev \
+        liblzma-dev \
+        libmpfr-dev \
+        libncurses-dev \
+        libpq-dev \
+        libreadline-dev \
+        libsqlite3-dev \
+        libssl-dev \
+        locales \
+        make \
+        odbc-postgresql \
+        openssl \
+        python2-dev \
+        python3-dev \
+        python3-pip \
+        sudo \
+        tzdata \
+        unixodbc-dev \
+        unzip \
+        vim \
+        wget \
+        zip \
+        zlib1g \
+        zlib1g-dev \
+        zsh && \
+    rm -rf /var/lib/apt/lists/*
+
+# Build librdkafka from source
+ARG LIBRDKAFKA_VERSION=2.1.1
+RUN cd /tmp && \
+    wget https://github.com/confluentinc/librdkafka/archive/refs/tags/v${LIBRDKAFKA_VERSION}.zip -O ./librdkafka.zip && \
+    unzip ./librdkafka.zip && \
+    rm ./librdkafka.zip && \
+    cd ./librdkafka-${LIBRDKAFKA_VERSION} && \
+    ./configure && \
+    make all install && \
+    cd /tmp && \
+    rm -rf ./librdkafka-${LIBRDKAFKA_VERSION}
+
+# Setup ODBC config
+RUN sed -i 's|Driver=psqlodbca.so|Driver=/usr/lib/x86_64-linux-gnu/odbc/psqlodbca.so|g' /etc/odbcinst.ini && \
+    sed -i 's|Driver=psqlodbcw.so|Driver=/usr/lib/x86_64-linux-gnu/odbc/psqlodbcw.so|g' /etc/odbcinst.ini && \
+    sed -i 's|Setup=libodbcpsqlS.so|Setup=/usr/lib/x86_64-linux-gnu/odbc/libodbcpsqlS.so|g' /etc/odbcinst.ini
+
+# Set the locale
+RUN locale-gen --no-purge en_US.UTF-8
+ENV LANG=en_US.UTF-8 \ LANGUAGE=en_US:en \ LC_ALL=en_US.UTF-8
+ENV TZ="Etc/UTC"
+RUN ln -fs "/usr/share/zoneinfo/${TZ}" /etc/localtime && \
+    dpkg-reconfigure -f noninteractive tzdata
+
+# Use root user
+ENV HOME /root
+WORKDIR "${HOME}"
+
+# Install pyenv
+ENV PYENV_ROOT="/usr/local/pyenv"
+RUN curl https://pyenv.run/ | /bin/bash
+ENV PATH="${PYENV_ROOT}/bin:${PYENV_ROOT}/shims:${PATH}"
+RUN echo 'eval "$(pyenv init -)"' >>${HOME}/.bashrc && \
+    pyenv update
+
+# Install Python
+ARG PYTHON_VERSIONS="3.11 3.10 3.9 3.8 3.7 3.12 2.7 pypy2.7-7.3.12 pypy3.8-7.3.11"
+COPY --chown=1000:1000 --chmod=+x ./install-python.sh /tmp/install-python.sh
+RUN /tmp/install-python.sh && \
+    rm /tmp/install-python.sh
+
+# Install dependencies for main python installation
+COPY ./requirements.txt /tmp/requirements.txt
+RUN pyenv exec pip install --upgrade -r /tmp/requirements.txt && \
+    rm /tmp/requirements.txt

.github/containers/Makefile

@@ -0,0 +1,71 @@
+# Copyright 2010 New Relic, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Override constants
+PLATFORM_OVERRIDE:=
+PYTHON_VERSIONS_OVERRIDE:=
+
+# Computed variables
+IMAGE_NAME:=ghcr.io/newrelic/newrelic-python-agent-ci
+MAKEFILE_DIR:=$(dir $(realpath $(firstword ${MAKEFILE_LIST})))
+REPO_ROOT:=$(realpath ${MAKEFILE_DIR}../../)
+UNAME_P:=$(shell uname -p)
+PLATFORM_AUTOMATIC:=$(if $(findstring arm,${UNAME_P}),linux/arm64,linux/amd64)
+PLATFORM:=$(if ${PLATFORM_OVERRIDE},${PLATFORM_OVERRIDE},${PLATFORM_AUTOMATIC})
+PYTHON_VERSIONS_AUTOMATIC:=3.10 2.7
+PYTHON_VERSIONS:=$(if ${PYTHON_VERSIONS_OVERRIDE},${PYTHON_VERSIONS_OVERRIDE},${PYTHON_VERSIONS_AUTOMATIC})
+
+.PHONY: default
+default: test
+
+.PHONY: build
+build:
+	@docker build ${MAKEFILE_DIR} \
+		--platform=${PLATFORM} \
+		-t ${IMAGE_NAME}:local \
+		--build-arg='PYTHON_VERSIONS=${PYTHON_VERSIONS}'
+
+# Run the local tag as a container.
+.PHONY: run
+run: run.local
+
+# Run a specific tag as a container.
+# Usage: make run.<tag>
+# Defaults to run.local, but can instead be run.latest or any other tag.
+.PHONY: run.%
+run.%:
+# Build image if local was specified, else pull latest
+	@if [[ "$*" = "local" ]]; then cd ${MAKEFILE_DIR} && $(MAKE) build; else docker pull ${IMAGE_NAME}:$*; fi
+	@docker run --rm -it \
+		--platform=${PLATFORM} \
+		--mount type=bind,source="${REPO_ROOT}",target=/home/github/python-agent \
+		--workdir=/home/github/python-agent \
+		--add-host=host.docker.internal:host-gateway \
+		-e NEW_RELIC_HOST="${NEW_RELIC_HOST}" \
+		-e NEW_RELIC_LICENSE_KEY="${NEW_RELIC_LICENSE_KEY}" \
+		-e NEW_RELIC_DEVELOPER_MODE="${NEW_RELIC_DEVELOPER_MODE}" \
+		-e GITHUB_ACTIONS="true" \
+		${IMAGE_NAME}:$* /bin/bash
+
+# Ensure python versions are usable. Cannot be automatically used with PYTHON_VERSIONS_OVERRIDE.
+.PHONY: test
+test: build
+	@docker run --rm \
+		--platform=${PLATFORM} \
+		ghcr.io/newrelic/python-agent-ci:local \
+		/bin/bash -c '\
+			python3.10 --version && \
+			python2.7 --version && \
+			touch tox.ini && tox --version && \
+			echo "Success! Python versions installed."'

.github/containers/install-python.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+# Copyright 2010 New Relic, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -eo pipefail
+
+main() {
+    # Coerce space separated string to array
+    if [[ ${#PYTHON_VERSIONS[@]} -eq 1 ]]; then
+        PYTHON_VERSIONS=($PYTHON_VERSIONS)
+    fi
+
+    if [[ -z "${PYTHON_VERSIONS[@]}" ]]; then
+        echo "No python versions specified. Make sure PYTHON_VERSIONS is set." 1>&2
+        exit 1
+    fi
+
+    # Find all latest pyenv supported versions for requested python versions
+    PYENV_VERSIONS=()
+    for v in "${PYTHON_VERSIONS[@]}"; do
+        LATEST=$(pyenv latest -k "$v" || pyenv latest -k "$v-dev")
+        if [[ -z "$LATEST" ]]; then
+            echo "Latest version could not be found for ${v}." 1>&2
+            exit 1
+        fi
+        PYENV_VERSIONS+=($LATEST)
+    done
+
+    # Install each specific version
+    for v in "${PYENV_VERSIONS[@]}"; do
+        pyenv install "$v" &
+    done
+    wait
+
+    # Set all installed versions as globally accessible
+    pyenv global ${PYENV_VERSIONS[@]}
+}
+
+main

.github/containers/requirements.txt

@@ -0,0 +1,9 @@
+bandit
+black
+flake8
+isort
+pip
+setuptools
+tox
+virtualenv<20.22.0
+wheel