Skip to content

Bump rshell to v0.0.20#51247

Merged
gh-worker-dd-mergequeue-cf854d[bot] merged 3 commits into
mainfrom
alex/bump-rshell
May 26, 2026
Merged

Bump rshell to v0.0.20#51247
gh-worker-dd-mergequeue-cf854d[bot] merged 3 commits into
mainfrom
alex/bump-rshell

Conversation

@AlexandreYang

@AlexandreYang AlexandreYang commented May 22, 2026

Copy link
Copy Markdown
Member

What does this PR do?

Bumps github.com/DataDog/rshell from v0.0.18 to v0.0.20 and updates the corresponding go.sum entries.

Adds focused runCommand coverage that pins stdout and stderr output-limit sentinels as action-level errors instead of normal RunCommandOutputs, since the output schema has no truncation marker.

Motivation

Pick up the latest rshell release in the Agent dependency set.

Mainly for this security fix: DataDog/rshell#268

Describe how you validated your changes

  • dda inv test --targets=./pkg/privateactionrunner/bundles/remoteaction/rshell --extra-args="-run ^TestRunCommandOutputLimitsReturnActionErrors$ -count=1 -timeout=30s"
  • git diff --check

Additional Notes

The output-limit test documents the intentional integration contract: partial stdout/stderr from rshell output caps is not returned as a normal command result without an explicit truncation field.

@github-actions

Copy link
Copy Markdown
Contributor

@codex review

@dd-octo-sts dd-octo-sts Bot added the internal Identify a non-fork PR label May 22, 2026
@github-actions github-actions Bot added the short review PR is simple enough to be reviewed quickly label May 22, 2026
@datadog-prod-us1-3

datadog-prod-us1-3 Bot commented May 22, 2026

Copy link
Copy Markdown
Contributor

Pipelines

Fix all issues with BitsAI

⚠️ Warnings

🚦 2 Pipeline jobs failed

Slack emoji PR updates | run_slapr   View in Datadog   GitHub Actions

🔄 Retry job. This looks flaky and may succeed on retry. Failed to download action archive from GitHub. Archive not found at URI 'https://codeload.github.com/DataDog/dd-octo-sts-action/tar.gz/96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a'

DataDog/datadog-agent | oracle: [21.3.0-xe]   View in Datadog   GitLab

🛟 This job is unlikely to succeed on retry. Please review your pipeline configuration. Failed to ping oracle instance: ORA-12514: TNS:listener does not currently know of service requested in connect descriptor.

ℹ️ Info

🎯 Code Coverage (details)
Patch Coverage: 100.00%
Overall Coverage: 50.34% (+0.00%)

Useful? React with 👍 / 👎

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 1181fad | Docs | Datadog PR Page | Give us feedback!

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Keep them coming!

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

@AlexandreYang AlexandreYang changed the title [codex] Bump rshell to v0.0.19 Bump rshell to v0.0.19 May 22, 2026
@AlexandreYang
AlexandreYang marked this pull request as ready for review May 22, 2026 18:35
@AlexandreYang AlexandreYang added qa/done QA done before merge and regressions are covered by tests changelog/no-changelog No changelog entry needed labels May 22, 2026

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5c3d339d98

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread go.mod Outdated
@dd-octo-sts

dd-octo-sts Bot commented May 22, 2026

Copy link
Copy Markdown
Contributor

Files inventory check summary

File checks results against ancestor 2af33192:

Results for datadog-agent_7.81.0~devel.git.200.1181fad.pipeline.115110428-1_amd64.deb:

No change detected

@dd-octo-sts

dd-octo-sts Bot commented May 22, 2026

Copy link
Copy Markdown
Contributor

Static quality checks

✅ Please find below the results from static quality gates
Comparison made with ancestor 2af3319
📊 Static Quality Gates Dashboard
🔗 SQG Job

Successful checks

Info

Quality gate Change Size (prev → curr → max)
agent_rpm_arm64 +2.82 KiB (0.00% increase, -0.32% of buffer) 723.641 → 723.644 → 724.500
agent_suse_arm64 +2.82 KiB (0.00% increase, -0.32% of buffer) 723.641 → 723.644 → 724.500
docker_agent_arm64 +2.82 KiB (0.00% increase, -0.18% of buffer) 808.619 → 808.622 → 810.120
docker_agent_jmx_arm64 +2.82 KiB (0.00% increase, -0.19% of buffer) 988.318 → 988.320 → 989.800
28 successful checks with minimal change (< 2 KiB)
Quality gate Current Size
agent_deb_amd64 746.081 MiB
agent_deb_amd64_fips 703.856 MiB
agent_heroku_amd64 310.811 MiB
agent_rpm_amd64 746.065 MiB
agent_rpm_amd64_fips 703.840 MiB
agent_rpm_arm64_fips 684.564 MiB
agent_suse_amd64 746.065 MiB
agent_suse_amd64_fips 703.840 MiB
agent_suse_arm64_fips 684.564 MiB
docker_agent_amd64 806.242 MiB
docker_agent_jmx_amd64 997.162 MiB
docker_cluster_agent_amd64 207.015 MiB
docker_cluster_agent_arm64 220.953 MiB
docker_cws_instrumentation_amd64 7.154 MiB
docker_cws_instrumentation_arm64 6.689 MiB
docker_dogstatsd_amd64 39.503 MiB
docker_dogstatsd_arm64 37.690 MiB
docker_host_profiler_amd64 302.081 MiB
docker_host_profiler_arm64 313.589 MiB
dogstatsd_deb_amd64 30.159 MiB
dogstatsd_deb_arm64 28.284 MiB
dogstatsd_rpm_amd64 30.159 MiB
dogstatsd_suse_amd64 30.159 MiB
iot_agent_deb_amd64 44.594 MiB
iot_agent_deb_arm64 41.551 MiB
iot_agent_deb_armhf 42.259 MiB
iot_agent_rpm_amd64 44.594 MiB
iot_agent_suse_amd64 44.594 MiB

@cit-pr-commenter-54b7da

cit-pr-commenter-54b7da Bot commented May 22, 2026

Copy link
Copy Markdown

Regression Detector

Regression Detector Results

Metrics dashboard
Target profiles
Run ID: 0aaf4794-5eec-4abd-8392-b24cb0fb04bb

Baseline: 5194f96
Comparison: 9101702
Diff

Optimization Goals: ✅ No significant changes detected

Experiments ignored for regressions

Regressions in experiments with settings containing erratic: true are ignored.

perf experiment goal Δ mean % Δ mean % CI trials links
docker_containers_cpu % cpu utilization -1.24 [-4.11, +1.62] 1 Logs

Fine details of change detection per experiment

perf experiment goal Δ mean % Δ mean % CI trials links
tcp_syslog_to_blackhole ingress throughput +0.36 [+0.19, +0.53] 1 Logs
uds_dogstatsd_20mb_12k_contexts_20_senders memory utilization +0.26 [+0.21, +0.30] 1 Logs
quality_gate_idle memory utilization +0.25 [+0.21, +0.30] 1 Logs bounds checks dashboard
ddot_metrics_sum_cumulativetodelta_exporter memory utilization +0.25 [+0.02, +0.49] 1 Logs
otlp_ingest_metrics memory utilization +0.17 [+0.01, +0.32] 1 Logs
ddot_metrics memory utilization +0.13 [-0.06, +0.32] 1 Logs
ddot_metrics_sum_cumulative memory utilization +0.12 [-0.04, +0.28] 1 Logs
quality_gate_logs % cpu utilization +0.03 [-0.97, +1.04] 1 Logs bounds checks dashboard
quality_gate_idle_all_features memory utilization +0.03 [-0.03, +0.09] 1 Logs bounds checks dashboard
file_to_blackhole_500ms_latency egress throughput +0.03 [-0.38, +0.44] 1 Logs
uds_dogstatsd_to_api_v3 ingress throughput +0.02 [-0.19, +0.23] 1 Logs
file_to_blackhole_1000ms_latency egress throughput +0.02 [-0.43, +0.47] 1 Logs
uds_dogstatsd_to_api ingress throughput +0.02 [-0.19, +0.22] 1 Logs
file_to_blackhole_0ms_latency egress throughput -0.01 [-0.51, +0.49] 1 Logs
tcp_dd_logs_filter_exclude ingress throughput -0.02 [-0.12, +0.08] 1 Logs
file_to_blackhole_100ms_latency egress throughput -0.03 [-0.17, +0.10] 1 Logs
ddot_metrics_sum_delta memory utilization -0.04 [-0.23, +0.15] 1 Logs
otlp_ingest_logs memory utilization -0.05 [-0.15, +0.04] 1 Logs
file_tree memory utilization -0.11 [-0.16, -0.06] 1 Logs
docker_containers_memory memory utilization -0.18 [-0.27, -0.08] 1 Logs
ddot_logs memory utilization -0.29 [-0.34, -0.23] 1 Logs
docker_containers_cpu % cpu utilization -1.24 [-4.11, +1.62] 1 Logs
quality_gate_metrics_logs memory utilization -1.74 [-1.98, -1.50] 1 Logs bounds checks dashboard

Bounds Checks: ✅ Passed

perf experiment bounds_check_name replicates_passed observed_value links
docker_containers_cpu simple_check_run 10/10 719 ≥ 26
docker_containers_memory memory_usage 10/10 246.66MiB ≤ 370MiB
docker_containers_memory simple_check_run 10/10 683 ≥ 26
file_to_blackhole_0ms_latency memory_usage 10/10 0.16GiB ≤ 1.20GiB
file_to_blackhole_0ms_latency missed_bytes 10/10 0B = 0B
file_to_blackhole_1000ms_latency memory_usage 10/10 0.20GiB ≤ 1.20GiB
file_to_blackhole_1000ms_latency missed_bytes 10/10 0B = 0B
file_to_blackhole_100ms_latency memory_usage 10/10 0.17GiB ≤ 1.20GiB
file_to_blackhole_100ms_latency missed_bytes 10/10 0B = 0B
file_to_blackhole_500ms_latency memory_usage 10/10 0.18GiB ≤ 1.20GiB
file_to_blackhole_500ms_latency missed_bytes 10/10 0B = 0B
quality_gate_idle intake_connections 10/10 3 ≤ 4 bounds checks dashboard
quality_gate_idle memory_usage 10/10 143.06MiB ≤ 147MiB bounds checks dashboard
quality_gate_idle total_bytes_received 10/10 741.04KiB ≤ 819.20KiB bounds checks dashboard
quality_gate_idle_all_features intake_connections 10/10 2 ≤ 4 bounds checks dashboard
quality_gate_idle_all_features memory_usage 10/10 426.56MiB ≤ 495MiB bounds checks dashboard
quality_gate_idle_all_features total_bytes_received 10/10 1.11MiB ≤ 1.25MiB bounds checks dashboard
quality_gate_logs intake_connections 10/10 3 ≤ 6 bounds checks dashboard
quality_gate_logs memory_usage 10/10 177.23MiB ≤ 195MiB bounds checks dashboard
quality_gate_logs missed_bytes 10/10 0B = 0B bounds checks dashboard
quality_gate_logs total_bytes_received 10/10 264.35MiB ≤ 292MiB bounds checks dashboard
quality_gate_metrics_logs cpu_usage 10/10 350.29 ≤ 2000 bounds checks dashboard
quality_gate_metrics_logs intake_connections 10/10 4 ≤ 6 bounds checks dashboard
quality_gate_metrics_logs memory_usage 10/10 371.39MiB ≤ 430MiB bounds checks dashboard
quality_gate_metrics_logs missed_bytes 10/10 0B = 0B bounds checks dashboard
quality_gate_metrics_logs total_bytes_received 10/10 0.94GiB ≤ 1.04GiB bounds checks dashboard

Explanation

Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%

Performance changes are noted in the perf column of each table:

  • ✅ = significantly better comparison variant performance
  • ❌ = significantly worse comparison variant performance
  • ➖ = no significant change in performance

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".

For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:

  1. Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.

  2. Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.

  3. Its configuration does not mark it "erratic".

CI Pass/Fail Decision

Passed. All Quality Gates passed.

  • quality_gate_idle_all_features, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
  • quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_idle, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
  • quality_gate_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.

@github-actions github-actions Bot added medium review PR review might take time and removed short review PR is simple enough to be reviewed quickly labels May 26, 2026
@AlexandreYang
AlexandreYang requested a review from a team as a code owner May 26, 2026 09:41
@AlexandreYang
AlexandreYang requested review from embeaken and removed request for a team May 26, 2026 09:41
@AlexandreYang AlexandreYang changed the title Bump rshell to v0.0.19 Bump rshell to v0.0.20 May 26, 2026
@AlexandreYang
AlexandreYang removed the request for review from embeaken May 26, 2026 12:32
@AlexandreYang

Copy link
Copy Markdown
Member Author

/merge

@gh-worker-devflow-routing-ef8351

gh-worker-devflow-routing-ef8351 Bot commented May 26, 2026

Copy link
Copy Markdown

View all feedbacks in Devflow UI.

2026-05-26 12:42:18 UTC ℹ️ Start processing command /merge


2026-05-26 12:42:23 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in main is approximately 1h (p90).


2026-05-26 13:24:28 UTC ℹ️ MergeQueue: This merge request was merged

@gh-worker-dd-mergequeue-cf854d
gh-worker-dd-mergequeue-cf854d Bot merged commit 9101702 into main May 26, 2026
247 of 250 checks passed
@gh-worker-dd-mergequeue-cf854d
gh-worker-dd-mergequeue-cf854d Bot deleted the alex/bump-rshell branch May 26, 2026 13:24
@github-actions github-actions Bot added this to the 7.81.0 milestone May 26, 2026
@dd-octo-sts

dd-octo-sts Bot commented May 26, 2026

Copy link
Copy Markdown
Contributor

⚠️ Automatic backport to 7.80.x failed.

This usually happens when the cherry-pick has merge conflicts and needs manual resolution.

To backport manually, run:

git fetch
git worktree add .worktrees/backport-7.80.x 7.80.x
cd .worktrees/backport-7.80.x
git switch --create backport-51247-to-7.80.x
git cherry-pick -x --mainline 1 9101702b630538ecd6db0b949e7d8750d4953ef5
git push --set-upstream origin backport-51247-to-7.80.x

Workflow logs: https://github.com/DataDog/datadog-agent/actions/runs/26451244272

gh-worker-dd-mergequeue-cf854d Bot pushed a commit that referenced this pull request May 26, 2026
Backport of #51247

---

Bumps `github.com/DataDog/rshell` from `v0.0.18` to `v0.0.20` and updates the corresponding `go.sum` entries.

Adds focused `runCommand` coverage that pins stdout and stderr output-limit sentinels as action-level errors instead of normal `RunCommandOutputs`, since the output schema has no truncation marker.

Pick up the latest `rshell` release in the Agent dependency set.

Mainly for this security fix: DataDog/rshell#268

- `dda inv test --targets=./pkg/privateactionrunner/bundles/remoteaction/rshell --extra-args="-run ^TestRunCommandOutputLimitsReturnActionErrors$ -count=1 -timeout=30s"`
- `git diff --check`

The output-limit test documents the intentional integration contract: partial stdout/stderr from rshell output caps is not returned as a normal command result without an explicit truncation field.


(cherry picked from commit 9101702)

### What does this PR do?

### Motivation

### Describe how you validated your changes

### Additional Notes


Co-authored-by: florent.clarret <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

changelog/no-changelog No changelog entry needed internal Identify a non-fork PR medium review PR review might take time qa/done QA done before merge and regressions are covered by tests team/action-platform

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants