Merge branch 'master' into fix/trace-diagnostics-to-stderr

Drarig29 · Drarig29 · commit 2d6217b58028 · 2026-06-26T14:29:48.000+02:00
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -652,10 +652,21 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      # setup-alpine downloads apk.static with a single 10s-timeout curl, and the gitlab mirror
+      # is unreliable from CI runners. Pre-fetch it with retries into the path setup-alpine
+      # caches ($RUNNER_TEMP/apk); the action then skips its own flaky download.
+      - name: Pre-fetch x86_64 apk.static (work around flaky gitlab mirror)
+        run: |
+          mkdir -p "$RUNNER_TEMP"
+          curl -4 -fsSL --retry 5 --retry-all-errors --retry-delay 5 --connect-timeout 30 --max-time 180 \
+            -o "$RUNNER_TEMP/apk" \
+            https://gitlab.alpinelinux.org/api/v4/projects/5/packages/generic/v2.14.10/x86_64/apk.static
+          echo "34bb1a96f0258982377a289392d4ea9f3f4b767a4bb5806b1b87179b79ad8a1c  $RUNNER_TEMP/apk" | sha256sum -c
       - name: Setup Alpine
         uses: jirutka/setup-alpine@ae3b3ddba35054804fc4a3507b519fa7e8152050 # v1.4.1
         with:
           shell-name: alpine.sh
+          apk-tools-url: https://gitlab.alpinelinux.org/api/v4/projects/5/packages/generic/v2.14.10/x86_64/apk.static#!sha256!34bb1a96f0258982377a289392d4ea9f3f4b767a4bb5806b1b87179b79ad8a1c
       - name: Install project dependencies (root)
         run: |
           apk add npm git
@@ -695,7 +706,7 @@ jobs:
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       # setup-alpine downloads apk.static with a single 10s-timeout curl, and the gitlab mirror
-      # is unreliable from arm64 runners. Pre-fetch it with retries into the path setup-alpine
+      # is unreliable from CI runners. Pre-fetch it with retries into the path setup-alpine
       # caches ($RUNNER_TEMP/apk); the action then skips its own flaky download.
       - name: Pre-fetch aarch64 apk.static (work around flaky gitlab mirror)
         run: |
diff --git a/packages/base/package.json b/packages/base/package.json
@@ -145,7 +145,7 @@
     "terminal-link": "^2.1.1",
     "tiny-async-pool": "^2.1.0",
     "typanion": "^3.14.0",
-    "undici": "^7.24.6",
+    "undici": "^7.28.0",
     "upath": "^2.0.1"
   },
   "devDependencies": {
diff --git a/packages/base/src/commands/trace/README.md b/packages/base/src/commands/trace/README.md
@@ -5,7 +5,7 @@ Trace a command with a custom span and report it to Datadog.
 ## Usage
 
 ```bash
-datadog-ci trace [--name <name>] [--tags] [--measures] [--no-fail] [--dry-run] -- <command>
+datadog-ci trace [--name <name>] [--tags] [--measures] [--no-fail] [--no-capture] [--dry-run] -- <command>
 ```
 
 For example:
@@ -21,6 +21,7 @@ datadog-ci trace --name "Say Hello" -- echo "Hello World"
 - `--measures` is an array of key-value pairs with the format `key:value`. These measures are added to the custom span.
     The `value` must be a number.
 - `--no-fail` (default: `false`) will prevent the trace command from failing even when not run in a supported CI Provider. In this case, the command will be launched and nothing will be reported to Datadog.
+- `--no-capture` (default: `false`) reports only the executable name instead of the full command line, so potentially sensitive arguments (tokens, secrets, etc.) are not sent to Datadog. The command is still launched with all of its arguments; only the reported span is trimmed. When `--name` is not provided, the span name also defaults to the executable name.
 - `--dry-run` (default: `false`) runs the command without sending the custom span. All other checks are performed.
 
 #### Environment variables
diff --git a/packages/base/src/commands/trace/__tests__/trace.test.ts b/packages/base/src/commands/trace/__tests__/trace.test.ts
@@ -70,5 +70,43 @@ describe('trace', () => {
     })
   })
 
+  describe('no-capture', () => {
+    // Runs `trace` (in --dry-run) with a full command line including arguments, and returns the
+    // custom span payload that would have been reported (emitted to stdout by --dry-run).
+    const runWithCommand = async (extraArgs: string[], command: string[]) => {
+      const cli = new Cli()
+      cli.register(TraceCommand)
+
+      process.env = {...getEnvVarPlaceholders(), CIRCLECI: 'true'}
+      const context = createMockContext({env: process.env})
+      context.stderr = new PassThrough()
+      const code = await cli.run(['trace', '--dry-run', ...extraArgs, '--', ...command], context)
+
+      const stdout = context.stdout.toString()
+      const match = stdout.match(/Reporting custom span: (\{.*\})/)
+      const payload = match ? JSON.parse(match[1]) : undefined
+
+      return {code, payload}
+    }
+
+    test('captures the full command line by default', async () => {
+      const {payload} = await runWithCommand([], ['echo', '--token', 'secret'])
+      expect(payload.command).toBe('echo --token secret')
+      expect(payload.name).toBe('echo --token secret')
+    })
+
+    test('reports only the executable name with --no-capture', async () => {
+      const {payload} = await runWithCommand(['--no-capture'], ['echo', '--token', 'secret'])
+      expect(payload.command).toBe('echo')
+      expect(payload.name).toBe('echo')
+    })
+
+    test('still honors an explicit --name with --no-capture', async () => {
+      const {payload} = await runWithCommand(['--no-capture', '--name', 'Deploy'], ['echo', '--token', 'secret'])
+      expect(payload.command).toBe('echo')
+      expect(payload.name).toBe('Deploy')
+    })
+  })
+
   makeCIProviderTests(runCLI, [])
 })
diff --git a/packages/base/src/commands/trace/trace.ts b/packages/base/src/commands/trace/trace.ts
@@ -31,12 +31,17 @@ export class TraceCommand extends CustomSpanCommand {
         'Trace a command and report to the datadoghq.eu site',
         'DD_SITE=datadoghq.eu datadog-ci trace -- echo "Hello World"',
       ],
+      [
+        'Trace a command without capturing its arguments (e.g. when they contain secrets)',
+        'datadog-ci trace --no-capture -- ./deploy.sh --token "$SECRET"',
+      ],
     ],
   })
 
   private command = Option.Rest({required: 1})
   private name = Option.String('--name')
   private noFail = Option.Boolean('--no-fail')
+  private noCapture = Option.Boolean('--no-capture')
 
   public async execute() {
     this.tryEnableFips()
@@ -77,7 +82,10 @@ export class TraceCommand extends CustomSpanCommand {
     const stderr: string = await stderrCatcher
     const endTime = new Date()
     const exitCode: number = status ?? this.signalToNumber(signal) ?? BAD_COMMAND_EXIT_CODE
-    const commandStr = this.command.join(' ')
+    // With `--no-capture`, only report the executable name so that potentially sensitive
+    // arguments (tokens, secrets, etc.) are not sent to Datadog. The child still runs with
+    // the full argument list above; only what we report is trimmed.
+    const commandStr = this.noCapture ? command : this.command.join(' ')
 
     const res = await this.executeReportCustomSpan(id, startTime, endTime, {
       command: commandStr,
diff --git a/yarn.lock b/yarn.lock
@@ -1438,7 +1438,7 @@ __metadata:
     terminal-link: "npm:^2.1.1"
     tiny-async-pool: "npm:^2.1.0"
     typanion: "npm:^3.14.0"
-    undici: "npm:^7.24.6"
+    undici: "npm:^7.28.0"
     upath: "npm:^2.0.1"
   peerDependencies:
     "@datadog/datadog-ci-plugin-aas": "workspace:*"
@@ -5429,9 +5429,9 @@ __metadata:
   linkType: hard
 
 "basic-ftp@npm:^5.0.2":
-  version: 5.2.0
-  resolution: "basic-ftp@npm:5.2.0"
-  checksum: 10/f5a15d789aa98859af4da9e976154b2aeae19052e1762dc68d259d2bce631dafa40c667aa06d7346cd630aa6f9cc9a26f515b468e0bd24243fbae2149c7d01ad
+  version: 5.3.1
+  resolution: "basic-ftp@npm:5.3.1"
+  checksum: 10/9232ee155114efafadf5adee86a6750208653a9071e53e9803dceac61a66b3ba3974771ff2490ff28f1a118fdfb806ffcc488f64609e61a9cedb52480b312843
   languageName: node
   linkType: hard
 
@@ -7345,9 +7345,9 @@ __metadata:
   linkType: hard
 
 "flatted@npm:^3.2.9":
-  version: 3.3.1
-  resolution: "flatted@npm:3.3.1"
-  checksum: 10/7b8376061d5be6e0d3658bbab8bde587647f68797cf6bfeae9dea0e5137d9f27547ab92aaff3512dd9d1299086a6d61be98e9d48a56d17531b634f77faadbc49
+  version: 3.4.2
+  resolution: "flatted@npm:3.4.2"
+  checksum: 10/a9e78fe5c2c1fcd98209a015ccee3a6caa953e01729778e83c1fe92e68601a63e1e69cd4e573010ca99eaf585a581b80ccf1018b99283e6cbc2117bcba1e030f
   languageName: node
   linkType: hard
 
@@ -11817,10 +11817,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"undici@npm:^7.24.6":
-  version: 7.25.0
-  resolution: "undici@npm:7.25.0"
-  checksum: 10/038d3568c72bb976e3cc389284f7f1cc64cd70d578300e4676a449fbcb624a35fe99ac127b5f3729f18b8246d6c090444ab61b1b67736bb88f52a3e913d76bf8
+"undici@npm:^7.28.0":
+  version: 7.28.0
+  resolution: "undici@npm:7.28.0"
+  checksum: 10/154423b280d623278a61decb437f8a7e581fb18b8c95556ef956b32a58cd668eadbb812d28e20678cb2dc545a566f35a3afc0962307ca801da30f4741117986d
   languageName: node
   linkType: hard
 
