feat(trace): add --no-capture flag to omit command arguments from reported spans#2380
Merged
Drarig29 merged 2 commits intoJun 26, 2026
Merged
Conversation
…orted spans `datadog-ci trace -- <cmd>` always reports the full command line, including every argument, in the span's `command` field (and uses it as the default `name`). When arguments carry secrets (tokens, passwords, signed URLs), those values are sent to Datadog and surface in the CI Visibility UI. Add `--no-capture` (default: false): when set, only the executable name is reported instead of the full command line. The child process is still launched with all of its arguments — only what we report is trimmed. When `--name` is not provided, the span name also falls back to the executable name so arguments don't leak via the default name; an explicit `--name` is still honored. Co-Authored-By: Claude Opus 4.8 <[email protected]>
janine-c
approved these changes
Jun 25, 2026
Drarig29
changed the title
--no-capture flag to omit command arguments from reported spans
Drarig29
added
the
software-delivery
|
Drarig29
approved these changes
Jun 26, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #2379
What and why?
datadog-ci trace -- <cmd>always reports the full command line, including every argument, in the span'scommandfield (and uses it as the defaultname). When arguments carry secrets (tokens, passwords, signed URLs), those values are sent to Datadog and surface in the CI Visibility UI.How?
Add
--no-capture(default: false): when set, only the executable name is reported instead of the full command line. The child process is still launched with all of its arguments — only what we report is trimmed. When--nameis not provided, the span name also falls back to the executable name so arguments don't leak via the default name; an explicit--nameis still honored.Scope:
--no-captureonly affects the reportedcommand/name. User-supplied--tags,--measures, andDD_TAGSare reported as-is, since the user controls those explicitly.Adds unit tests for all three behaviours (default captures the full line,
--no-capturetrims to the executable,--no-capturestill honors--name) and documents the flag in the command README and--helpexamples.Review checklist