Skip to content

Commit 1d33895

Browse files
mccullsmcculls
authored
Merge branch 'master' into mcculls/remove-trie-resources-from-agent-jar
2 parents c171427 + fb31324 commit 1d33895

7 files changed

Lines changed: 281 additions & 7 deletions

File tree

‎.github/chainguard/self.update-system-tests.push.sts.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
issuer: https://token.actions.githubusercontent.com
2+
3+
subject: repo:DataDog/dd-trace-java:ref:refs/(heads/master|tags/v[0-9]+.[0-9]+.0)
4+
5+
claim_pattern:
6+
event_name: (push|workflow_dispatch)
7+
ref: refs/(heads/master|tags/v[0-9]+\.[0-9]+\.0)
8+
ref_protected: "true"
9+
job_workflow_ref: DataDog/dd-trace-java/\.github/workflows/create-release-branch\.yaml@refs/heads/master
10+
11+
permissions:
12+
contents: write

‎.github/workflows/create-release-branch.yaml‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
name: Create Release Branch and Pin System-Tests
2+
3+
on:
4+
push:
5+
tags:
6+
- 'v[0-9]+.[0-9]+.0' # Trigger on minor release tags (e.g. v1.54.0)
7+
workflow_dispatch:
8+
inputs:
9+
tag:
10+
description: 'The minor release tag (e.g. v1.54.0)'
11+
required: true
12+
type: string
13+
14+
jobs:
15+
create-release-branch:
16+
runs-on: ubuntu-latest
17+
permissions:
18+
contents: read
19+
id-token: write # Required for OIDC token federation
20+
steps:
21+
- uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
22+
id: octo-sts
23+
with:
24+
scope: DataDog/dd-trace-java
25+
policy: self.update-system-tests.push
26+
27+
- name: Determine tag
28+
id: determine-tag
29+
run: |
30+
if [ -n "${{ github.event.inputs.tag }}" ]; then
31+
TAG=${{ github.event.inputs.tag }}
32+
else
33+
TAG=${GITHUB_REF#refs/tags/}
34+
fi
35+
if ! [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.0$ ]]; then
36+
echo "Error: Tag $TAG is not in the expected format: vX.Y.0"
37+
exit 1
38+
fi
39+
echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
40+
41+
- name: Define branch name from tag
42+
id: define-branch
43+
run: |
44+
TAG=${{ steps.determine-tag.outputs.tag }}
45+
BRANCH="release/${TAG%.0}.x"
46+
echo "branch=${BRANCH}" >> "$GITHUB_OUTPUT"
47+
48+
- name: Checkout dd-trace-java
49+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # 5.0.0
50+
51+
- name: Check if branch already exists
52+
id: check-branch
53+
run: |
54+
BRANCH=${{ steps.define-branch.outputs.branch }}
55+
if git ls-remote --heads origin "$BRANCH" | grep -q "$BRANCH"; then
56+
echo "creating_new_branch=false" >> "$GITHUB_OUTPUT"
57+
echo "Branch $BRANCH already exists - skipping following steps"
58+
else
59+
echo "creating_new_branch=true" >> "$GITHUB_OUTPUT"
60+
echo "Branch $BRANCH does not exist - proceeding with following steps"
61+
fi
62+
63+
- name: Update system-tests references to latest commit SHA on main
64+
if: steps.check-branch.outputs.creating_new_branch == 'true'
65+
run: BRANCH=main ./tooling/update_system_test_reference.sh
66+
67+
- name: Commit changes
68+
if: steps.check-branch.outputs.creating_new_branch == 'true'
69+
id: create-commit
70+
run: |
71+
git config user.name "github-actions[bot]"
72+
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
73+
git commit -m "chore: Pin system-tests for release branch" .github/workflows/run-system-tests.yaml
74+
echo "commit=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
75+
76+
- name: Push changes
77+
if: steps.check-branch.outputs.creating_new_branch == 'true'
78+
uses: DataDog/commit-headless@5a0f3876e0fbdd3a86b3e008acf4ec562db59eee # action/v2.0.1
79+
with:
80+
token: "${{ steps.octo-sts.outputs.token }}"
81+
branch: "${{ steps.define-branch.outputs.branch }}"
82+
branch-from: "${{ github.sha }}"
83+
command: push
84+
commits: "${{ steps.create-commit.outputs.commit }}"

‎.github/workflows/run-system-tests.yaml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,14 +60,17 @@ jobs:
6060
main:
6161
needs:
6262
- build
63-
uses: DataDog/system-tests/.github/workflows/system-tests.yml@main
63+
# If you change the following comment, update the pattern in the update_system_test_reference.sh script to match.
64+
uses: DataDog/system-tests/.github/workflows/system-tests.yml@main # system tests are pinned for releases only
6465
secrets: inherit
6566
permissions:
6667
contents: read
6768
id-token: write
6869
packages: write
6970
with:
7071
library: java
72+
# If you change the following comment, update the pattern in the update_system_test_reference.sh script to match.
73+
ref: main # system tests are pinned for releases only
7174
binaries_artifact: binaries
7275
desired_execution_time: 900 # 15 minutes
7376
scenarios_groups: tracer-release

‎.gitlab/ci-visibility-tests.yml‎

Lines changed: 60 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,64 @@
1+
check-ci-visibility-label:
2+
stage: publish
3+
image: registry.ddbuild.io/images/dd-octo-sts-ci-base:2025.06-1
4+
tags: [ "arch:amd64" ]
5+
needs: [ publish-artifacts-to-s3 ]
6+
id_tokens:
7+
DDOCTOSTS_ID_TOKEN:
8+
aud: dd-octo-sts
9+
rules:
10+
- if: '$POPULATE_CACHE'
11+
when: never
12+
- if: '$CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH !~ /^(master|release\/)/'
13+
when: on_success
14+
- when: never
15+
before_script:
16+
- dd-octo-sts version
17+
- dd-octo-sts debug --scope DataDog/dd-trace-java --policy self.gitlab.github-access.read
18+
- dd-octo-sts token --scope DataDog/dd-trace-java --policy self.gitlab.github-access.read > github-token.txt
19+
- gh auth login --with-token < github-token.txt
20+
script:
21+
- |
22+
# Source utility functions
23+
source .gitlab/ci_visibility_utils.sh
24+
25+
# Get PR number
26+
if ! PR_NUMBER=$(get_pr_number "${CI_COMMIT_BRANCH}"); then
27+
echo "No open PR found for branch ${CI_COMMIT_BRANCH}"
28+
exit 1
29+
fi
30+
31+
echo "Found PR #${PR_NUMBER}"
32+
33+
# Check if PR has the CI visibility label
34+
if pr_has_label "$PR_NUMBER" "comp: ci visibility"; then
35+
echo "PR_NUMBER=${PR_NUMBER}" > pr.env
36+
echo "PR #${PR_NUMBER} detected as CI Visibility PR"
37+
exit 0
38+
else
39+
echo "PR #${PR_NUMBER} not a CI Visibility PR, ignoring trigger"
40+
exit 1
41+
fi
42+
after_script:
43+
- dd-octo-sts revoke -t $(cat github-token.txt) || true
44+
artifacts:
45+
reports:
46+
dotenv: pr.env
47+
allow_failure: true
48+
retry:
49+
max: 2
50+
when: always
51+
152
run-ci-visibility-test-environment:
253
stage: ci-visibility-tests
3-
when: manual
4-
needs: []
54+
needs:
55+
- job: check-ci-visibility-label
56+
artifacts: true
57+
rules:
58+
- if: '$POPULATE_CACHE'
59+
when: never
60+
- if: '$CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH !~ /^(master|release\/)/'
61+
when: on_success
562
trigger:
663
project: DataDog/apm-reliability/test-environment
764
branch: main
@@ -17,3 +74,4 @@ run-ci-visibility-test-environment:
1774
UPSTREAM_COMMIT_SHORT_SHA: $CI_COMMIT_SHORT_SHA
1875
TRACER_LANG: java
1976
JAVA_TRACER_REF_TO_TEST: $CI_COMMIT_BRANCH
77+
JAVA_TRACER_PR_TO_TEST: $PR_NUMBER

‎.gitlab/ci_visibility_utils.sh‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
#!/usr/bin/env bash
2+
3+
function get_pr_number() {
4+
local branch=$1
5+
6+
if [ -z "$branch" ]; then
7+
echo "Error: Branch name is required" >&2
8+
return 1
9+
fi
10+
11+
local pr_number
12+
pr_number=$(gh pr list --repo DataDog/dd-trace-java --head "$branch" --state open --json number --jq '.[0].number')
13+
14+
if [ -z "$pr_number" ]; then
15+
echo "Error: No open PR found for branch $branch" >&2
16+
return 1
17+
fi
18+
19+
echo "$pr_number"
20+
return 0
21+
}
22+
23+
function get_pr_labels() {
24+
local pr_number=$1
25+
26+
if [ -z "$pr_number" ]; then
27+
echo "Error: PR number is required" >&2
28+
return 1
29+
fi
30+
31+
local labels
32+
labels=$(gh pr view "$pr_number" --repo DataDog/dd-trace-java --json labels --jq '.labels[].name')
33+
34+
if [ -z "$labels" ]; then
35+
echo "Warning: No labels found for PR #$pr_number" >&2
36+
return 1
37+
fi
38+
39+
echo "$labels"
40+
return 0
41+
}
42+
43+
function pr_has_label() {
44+
local pr_number=$1
45+
local target_label=$2
46+
47+
if [ -z "$pr_number" ] || [ -z "$target_label" ]; then
48+
echo "Error: PR number and label are required" >&2
49+
return 1
50+
fi
51+
52+
local labels
53+
if ! labels=$(get_pr_labels "$pr_number"); then
54+
return 1
55+
fi
56+
57+
if echo "$labels" | grep -q "$target_label"; then
58+
return 0
59+
else
60+
return 1
61+
fi
62+
}

‎dd-java-agent/agent-bootstrap/src/main/java/datadog/trace/bootstrap/Agent.java‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -184,6 +184,14 @@ public boolean isEnabledByDefault() {
184184
private static boolean distributedDebuggerEnabled = false;
185185
private static boolean agentlessLogSubmissionEnabled = false;
186186

187+
private static void safelySetContextClassLoader(ClassLoader classLoader) {
188+
try {
189+
// this method call can cause a SecurityException if a security manager is installed.
190+
Thread.currentThread().setContextClassLoader(classLoader);
191+
} catch (final Throwable ignored) {
192+
}
193+
}
194+
187195
/**
188196
* Starts the agent; returns a boolean indicating if Agent started successfully
189197
*
@@ -924,7 +932,7 @@ private static synchronized void startJmxFetch() {
924932
} catch (final Throwable ex) {
925933
log.error("Throwable thrown while starting JmxFetch", ex);
926934
} finally {
927-
Thread.currentThread().setContextClassLoader(contextLoader);
935+
safelySetContextClassLoader(contextLoader);
928936
}
929937
}
930938

@@ -1305,7 +1313,7 @@ private static boolean startProfilingAgent(
13051313
} catch (final Throwable ex) {
13061314
log.error(SEND_TELEMETRY, "Throwable thrown while starting profiling agent", ex);
13071315
} finally {
1308-
Thread.currentThread().setContextClassLoader(contextLoader);
1316+
safelySetContextClassLoader(contextLoader);
13091317
}
13101318
StaticEventLogger.end("ProfilingAgent");
13111319
}
@@ -1349,7 +1357,7 @@ private static void shutdownProfilingAgent(final boolean sync) {
13491357
} catch (final Throwable ex) {
13501358
log.error("Throwable thrown while shutting down profiling agent", ex);
13511359
} finally {
1352-
Thread.currentThread().setContextClassLoader(contextLoader);
1360+
safelySetContextClassLoader(contextLoader);
13531361
}
13541362
}
13551363

@@ -1383,7 +1391,7 @@ private static synchronized void startDebuggerAgent(
13831391
} catch (final Throwable ex) {
13841392
log.error("Throwable thrown while starting debugger agent", ex);
13851393
} finally {
1386-
Thread.currentThread().setContextClassLoader(contextLoader);
1394+
safelySetContextClassLoader(contextLoader);
13871395
}
13881396

13891397
StaticEventLogger.end("Debugger");

‎tooling/update_system_test_reference.sh‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
# This script updates the system-tests reference in run-system-tests.yaml.
5+
# The reference will be updated with the latest commit SHA of the given branch (or `main` if not set) of https://github.com/DataDog/system-tests.
6+
# Usage: BRANCH=<branch-name> tooling/update_system_test_reference.sh
7+
8+
# Set BRANCH to main if not set
9+
if [ -z "${BRANCH:-}" ]; then
10+
BRANCH="main"
11+
echo "BRANCH is not set. Defaulting to 'main'."
12+
fi
13+
14+
TARGET=".github/workflows/run-system-tests.yaml" # target file to update
15+
PATTERN_1='(\s*system-tests\.yml@)(\S+)(\s+# system tests.*)' # pattern to update the "system-tests.yml@" reference
16+
PATTERN_2='(\s*ref: )(\S+)(\s+# system tests.*)' # pattern to update the "ref:" reference
17+
18+
echo "Fetching latest commit SHA for system-tests branch: $BRANCH"
19+
REF=$(git ls-remote https://github.com/DataDog/system-tests "refs/heads/$BRANCH" | cut -f 1)
20+
if [ -z "$REF" ]; then
21+
echo "Error: Failed to fetch commit SHA for branch $BRANCH"
22+
exit 1
23+
fi
24+
echo "Fetched SHA: $REF"
25+
26+
if [ ! -f "$TARGET" ]; then
27+
echo "Error: Target file $TARGET does not exist"
28+
exit 1
29+
fi
30+
31+
# Save the substitution results to a temporary file first
32+
TEMP_FILE=$(mktemp)
33+
34+
# Update the "system-tests.yml@" reference
35+
echo "Updating 'system-tests.yml@' reference..."
36+
perl -pe "s/$PATTERN_1/\${1}$REF\${3}/g" "$TARGET" > "$TEMP_FILE"
37+
cp "$TEMP_FILE" "$TARGET"
38+
39+
# Update the "ref:" reference
40+
echo "Updating 'ref:' reference..."
41+
perl -pe "s/$PATTERN_2/\${1}$REF\${3}/g" "$TARGET" > "$TEMP_FILE"
42+
cp "$TEMP_FILE" "$TARGET"
43+
44+
# Clean up temporary file
45+
rm -f "$TEMP_FILE"
46+
47+
echo "Done updating system-tests references to $REF"

0 commit comments

Comments
 (0)