chore(.github/workflowsw): move `main` CI checks to merge queue runs by darccio · Pull Request #3887 · DataDog/dd-trace-go

darccio · 2025-08-18T17:38:22Z

What does this PR do?

Updates workflows so main CI checks happen during a merge queue run. Specifically it marks all workflows that run in push events to main to run on those events on branches starting with mq-working-branch.

Additionally:

Standardises pull_request triggers to explicitly set opened, reopened, and synchronized default states.
Standardises tags-ignore for push triggers to ignore all nested modules' version tags.
Removes merge_group triggers.
Removes synchronized event on pull-request-title-validation.
Updates Go version to the highest supported one on pull-request workflow.
Swaps main-branch-tests with pull-requests, making sure any flakiness is early detected.
main-branch-tests run only high-signal unit-integration-tests with a smaller set.
Fixes indentation on system-tests.
Introduces repository caching to avoid pulling it in matrix-based tests like system-tests, pull-request, or main-branch-tests.

Motivation

Clarify CI usage and ensure that failing CI checks have visibility and impact. Currently we can only see if anything is wrong on main by looking at the CI checks for a commit in GitHub's UI.

Note 1: this PR requires a small change on repository's settings to move the required checks PR Unit and Integration Tests / test-core and PR Unit and Integration Tests / test-contrib to PR Unit and Integration Tests.

Note 2: this PR would cause that no check will run if somebody with admin privileges doesn't use the merge queue. It should be possible to avoid that by setting some kind of break glass job that must run when merging directly from the UI. Merge queue should work by skipping it.

Reviewer's Checklist

Changed code has unit tests for its functionality at or near 100% coverage.
System-Tests covering this feature have been added and enabled with the va.b.c-dev version tag.
There is a benchmark for any new code, or changes to existing code.
If this interacts with the agent in a new way, a system test has been added.
New code is free of linting errors. You can check this by running ./scripts/lint.sh locally.
Add an appropriate team label so this PR gets put in the right place for the release notes.
Non-trivial go.mod changes, e.g. adding new modules, are reviewed by @DataDog/dd-trace-go-guild.

Unsure? Have a question? Request a review!

datadog-datadog-prod-us1 · 2025-08-18T17:46:03Z

✅ Tests

🎉 All green!

❄️ No new flaky tests detected
🧪 All tests passed

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 957c7cf | Docs | Was this helpful? Give us feedback!}

pr-commenter · 2025-08-19T08:17:44Z

Benchmarks

Benchmark execution time: 2025-09-03 14:40:47

Comparing candidate commit 957c7cf in PR branch dario.castane/ktlo/disable-main-branch-ci with baseline commit 1921d92 in branch main.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 24 metrics, 0 unstable metrics.

hannahkm

Looks good, thank you!

kakkoyun

LGTM

darccio · 2025-08-28T09:28:47Z

/merge

dd-devflow-routing-codex · 2025-08-28T09:28:51Z

View all feedbacks in Devflow UI.

2025-08-28 09:28:50 UTC ℹ️ Start processing command /merge

2025-08-28 09:29:01 UTC ℹ️ MergeQueue: waiting for PR to be ready

This merge request is not mergeable yet, because of pending checks/missing approvals. It will be added to the queue as soon as checks pass and/or get approvals.
Note: if you pushed new commits since the last approval, you may need additional approval.
You can remove it from the waiting list with /remove command.

2025-08-28 09:47:52 UTC ⚠️ MergeQueue: This merge request was unqueued

[email protected] unqueued this merge request

RomainMuller · 2025-08-28T09:43:58Z

-      runs-on: ${{ matrix.runs-on }}
-      ref: ${{ inputs.ref || github.ref }}
-    secrets: inherit
+      go-version: "1.25" # Should be the highest supported version of Go


Would be neat if that supported the stable alias?

That introduces the "risk" of having red CI if a new Go release causes the pipeline to fail. I prefer to have control, in the same line of the previous point about stating explicitly configs equivalent to the defaults.

darccio · 2025-08-28T09:47:37Z

/merge -c

dd-devflow-routing-codex · 2025-08-28T09:47:42Z

View all feedbacks in Devflow UI.

2025-08-28 09:47:41 UTC ℹ️ Start processing command /merge -c

eliottness · 2025-09-03T08:24:23Z

-      inputs:
-          ref:
-              description: 'System Tests ref/tag/branch'
-              required: true
-              default: main
-              type: string
+    inputs:
+        ref:
+            description: 'System Tests ref/tag/branch'
+            required: true
+            default: main
+            type: string


Is it just me or I think this part in indented differently ?

It had extra indentation, that's why it was modified.

…e soon-to-be merged PR as they ran on it

…flakiness is more probable while testing the PR

…and Integration Tests

…commit (#3893)

…le validation workflow

…le workflows

darccio · 2025-09-04T06:37:02Z

/merge

dd-devflow-routing-codex · 2025-09-04T06:37:07Z

View all feedbacks in Devflow UI.

2025-09-04 06:37:07 UTC ℹ️ Start processing command /merge

2025-09-04 06:37:12 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in main is approximately 14m (p90).

2025-09-04 06:51:00 UTC ℹ️ MergeQueue: This merge request was merged

…us (#4704) ## Problem The [CodeQL status page](https://github.com/DataDog/dd-trace-go/security/code-scanning/tools/CodeQL/status) shows the last scan date as **2025-09-03**, even though CodeQL runs successfully on every PR and every `mq-working-branch-**` push. This is an **association problem, not an execution problem.** GitHub Code Scanning indexes each SARIF upload by the `ref` the trigger event carried. The default-branch status panel only counts uploads tagged with `refs/heads/main`. CodeQL is running, but every upload it produces is filed under a non-default ref. ### Root cause PR #3887 (2025-09-04, _"move `main` CI checks to merge queue runs"_) restructured the workflow triggers: | Removed | Kept / Added | |---|---| | `push: branches: [main, master]` | `push: branches: [mq-working-branch-**]` | | `pull_request: branches: [main]` | `pull_request:` (no branch filter) | | `merge_group:` | `workflow_call:` (unused — no caller wires CodeQL) | After this change, CodeQL only ever sees refs of the form `refs/pull/<n>/merge` or `refs/heads/mq-working-branch-XXX`. The repository's merge mechanism fast-forwards `main` onto a green staging commit and deletes the staging branch — no `push` event for `refs/heads/main` fires, so CodeQL never runs against the default branch. The SARIF uploaded during the queue run stays tagged with the staging ref even after that exact SHA becomes `HEAD` of `main`. This is asymmetric with GitHub's _native_ merge queue: native queue events arrive on `refs/heads/gh-readonly-queue/main/<sha>` and Code Scanning rolls those uploads up to the default branch on completion. Custom queues built on fast-forward branches get no such roll-up. ### Why it matters - The [security tab](https://github.com/DataDog/dd-trace-go/security/code-scanning/tools/CodeQL/status) shows the configuration as inactive, which trips compliance alarms and looks like a regression to auditors. - New CodeQL findings introduced after 2025-09-03 are recorded against PR / staging refs and never roll up to the canonical `main` view. - Branch-protection rules of the form "CodeQL must be passing on default branch" can mis-report. ## Verification - [x] `git diff` shows exactly one inserted line: ` - main` - [x] `actionlint .github/workflows/codeql-analysis.yml` passes with no errors - [ ] After merge, the Actions tab shows a new "CodeQL" run on `refs/heads/main` - [ ] The [status page](https://github.com/DataDog/dd-trace-go/security/code-scanning/tools/CodeQL/status) shows a timestamp newer than 2025-09-03, still with configuration ID `FZTWS5DIOVRC653POJVWM3DPO5ZS6Y3PMRSXC3BNMFXGC3DZONUXGLTZNVWA` Co-authored-by: darccio <[email protected]>

darccio marked this pull request as ready for review August 18, 2025 17:44

darccio requested review from a team as code owners August 18, 2025 17:44

hannahkm reviewed Aug 18, 2025

View reviewed changes

Comment thread .github/workflows/pull-request.yml Outdated

darccio force-pushed the dario.castane/ktlo/disable-main-branch-ci branch from acd62bd to b742c82 Compare August 19, 2025 08:14

hannahkm approved these changes Aug 19, 2025

View reviewed changes

darccio mentioned this pull request Aug 19, 2025

fix(.github/workflows): reuse cached .git repository for branch HEAD commit #3893

Merged

7 tasks

darccio force-pushed the dario.castane/ktlo/disable-main-branch-ci branch 2 times, most recently from d742705 to 849e00d Compare August 21, 2025 10:07

darccio changed the title ~~chore(ci): move main CI checks to merge queue runs~~ chore(.github/workflowsw): move main CI checks to merge queue runs Aug 21, 2025

darccio force-pushed the dario.castane/ktlo/disable-main-branch-ci branch from 8635ff7 to 58b7fa2 Compare August 22, 2025 10:29

kakkoyun approved these changes Aug 25, 2025

View reviewed changes

darccio force-pushed the dario.castane/ktlo/disable-main-branch-ci branch 3 times, most recently from f9521df to bd8a68a Compare August 28, 2025 08:49

dd-devflow Bot added the mergequeue-status: waiting label Aug 28, 2025

RomainMuller reviewed Aug 28, 2025

View reviewed changes

dd-devflow Bot added mergequeue-status: removed and removed mergequeue-status: waiting labels Aug 28, 2025

darccio requested a review from RomainMuller August 28, 2025 12:59

eliottness requested review from eliottness and removed request for RomainMuller September 3, 2025 08:21

eliottness reviewed Sep 3, 2025

View reviewed changes

eliottness approved these changes Sep 3, 2025

View reviewed changes

darccio added 6 commits September 3, 2025 16:26

chore(ci): ensure merge queue runs the same CI checks when testing th…

3cb86c0

…e soon-to-be merged PR as they ran on it

feat(.github/workflows): swap pull-request and main-branch-tests, so …

4baab01

…flakiness is more probable while testing the PR

hack(.github/workflows): fake the name of the done check for PR Unit …

de74ca2

…and Integration Tests

fix(.github/workflows): reuse cached .git repository for branch HEAD …

966c56a

…commit (#3893)

chore(.github/workflows): add 'synchronize' event to pull request tit…

d70bde3

…le validation workflow

chore(.github/workflows): remove pull request event types from multip…

957c7cf

…le workflows

darccio force-pushed the dario.castane/ktlo/disable-main-branch-ci branch from ba0972d to 957c7cf Compare September 3, 2025 14:27

dd-devflow Bot added mergequeue-status: queued mergequeue-status: in_progress and removed mergequeue-status: removed mergequeue-status: queued labels Sep 4, 2025

dd-mergequeue Bot merged commit d6a972f into main Sep 4, 2025
263 checks passed

dd-devflow Bot added mergequeue-status: done and removed mergequeue-status: in_progress labels Sep 4, 2025

dd-mergequeue Bot deleted the dario.castane/ktlo/disable-main-branch-ci branch September 4, 2025 06:50

kakkoyun mentioned this pull request Apr 29, 2026

ci(codeql): add main to push.branches to unfreeze default-branch status #4704

Merged

4 tasks

Uh oh!

Conversation

darccio commented Aug 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Motivation

Reviewer's Checklist

Uh oh!

datadog-datadog-prod-us1 Bot commented Aug 18, 2025 • edited by datadog-official Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

pr-commenter Bot commented Aug 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchmarks

Uh oh!

hannahkm left a comment

Choose a reason for hiding this comment

Uh oh!

kakkoyun left a comment

Choose a reason for hiding this comment

Uh oh!

darccio commented Aug 28, 2025

Uh oh!

dd-devflow-routing-codex Bot commented Aug 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

RomainMuller Aug 28, 2025

Choose a reason for hiding this comment

Uh oh!

darccio Aug 28, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

darccio commented Aug 28, 2025

Uh oh!

dd-devflow-routing-codex Bot commented Aug 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

eliottness Sep 3, 2025

Choose a reason for hiding this comment

Uh oh!

darccio Sep 3, 2025

Choose a reason for hiding this comment

Uh oh!

darccio commented Sep 4, 2025

Uh oh!

dd-devflow-routing-codex Bot commented Sep 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

darccio commented Aug 18, 2025 •

edited

Loading

datadog-datadog-prod-us1 Bot commented Aug 18, 2025 •

edited by datadog-official Bot

Loading

pr-commenter Bot commented Aug 19, 2025 •

edited

Loading

dd-devflow-routing-codex Bot commented Aug 28, 2025 •

edited

Loading

dd-devflow-routing-codex Bot commented Aug 28, 2025 •

edited

Loading

dd-devflow-routing-codex Bot commented Sep 4, 2025 •

edited

Loading