From f6825cd772d866c2004ec7f1292c492888a50843 Mon Sep 17 00:00:00 2001 From: Brian Marks Date: Wed, 26 Aug 2026 18:27:21 -0400 Subject: [PATCH 1/4] ci: reuse system-tests runner image --- .gitlab-ci.yml | 4 +-- .gitlab/generate-package.php | 56 ++++++++++++++++-------------------- 2 files changed, 26 insertions(+), 34 deletions(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 6a570f099af..47d110b1f2d 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -143,6 +143,8 @@ merge-gate: package-trigger: stage: build needs: [ "generate-templates" ] + inherit: + variables: false trigger: include: - artifact: .gitlab/package-gen.yml @@ -153,8 +155,6 @@ package-trigger: pipeline_variables: true variables: PARENT_PIPELINE_ID: $CI_PIPELINE_ID - GIT_SUBMODULE_STRATEGY: recursive - GIT_SUBMODULE_PATHS: libdatadog tests/FeatureFlags/ffe-system-test-data appsec/third_party/cpp-base64 appsec/third_party/libddwaf appsec/third_party/libddwaf-rust appsec/third_party/msgpack-c NIGHTLY_BUILD: $NIGHTLY_BUILD # Runs after the full CI completes. Triggered in two situations: diff --git a/.gitlab/generate-package.php b/.gitlab/generate-package.php index a952d859afa..f09b57d80a5 100644 --- a/.gitlab/generate-package.php +++ b/.gitlab/generate-package.php @@ -119,6 +119,10 @@ function appsec_image_from_tag_mapping(string $tag): string variables: FF_ENABLE_BASH_EXIT_CODE_CHECK: "true" FF_USE_NEW_BASH_EVAL_STRATEGY: "true" + GIT_SUBMODULE_STRATEGY: recursive + GIT_SUBMODULE_PATHS: libdatadog tests/FeatureFlags/ffe-system-test-data appsec/third_party/cpp-base64 appsec/third_party/libddwaf appsec/third_party/libddwaf-rust appsec/third_party/msgpack-c + RELIABILITY_ENV_BRANCH: "master" + SYSTEM_TESTS_LIBRARY: php CARGO_HOME: "${CI_PROJECT_DIR}/.cache/cargo" # One pipeline injection package size ratchet @@ -1263,18 +1267,17 @@ function appsec_image_from_tag_mapping(string $tag): string .system_tests: stage: verify - image: registry.ddbuild.io/images/mirror/python:3.12-slim-bullseye + image: registry.ddbuild.io/system-tests/ci-runner:75a57a4b6391 tags: [ "docker-in-docker:amd64" ] variables: + GIT_SUBMODULE_STRATEGY: none TEST_LIBRARY: php KUBERNETES_CPU_REQUEST: 8 PYTEST_XDIST_AUTO_NUM_WORKERS: 8 KUBERNETES_MEMORY_REQUEST: 3Gi KUBERNETES_MEMORY_LIMIT: 4Gi RUST_BACKTRACE: 1 - BUILD_SH_ARGS: php - PIP_CACHE_DIR: $CI_PROJECT_DIR/.cache/pip - APT_CACHE: $CI_PROJECT_DIR/.cache/apt + BUILD_SH_ARGS: "-i weblog php" DOCKER_DEFAULT_PLATFORM: linux/amd64 # TODO DD_API_KEY; SYSTEM_TESTS_AWS_ACCESS_KEY_ID; SYSTEM_TESTS_AWS_SECRET_ACCESS_KEY needs: @@ -1286,34 +1289,23 @@ function appsec_image_from_tag_mapping(string $tag): string artifacts: true before_script: - | - # Setup cache dirs - mkdir -p $PIP_CACHE_DIR - mkdir -p $APT_CACHE/lists - mkdir -p $APT_CACHE/archives - chown -R $(id -u):$(id -g) $CI_PROJECT_DIR/.cache - - # Install system dependencies - apt-get update -o dir::state::lists="$APT_CACHE/lists" - apt-get install -y --no-install-recommends -o dir::state::lists="$APT_CACHE/lists" -o dir::cache::archives="$APT_CACHE/archives" ca-certificates curl git build-essential - mkdir -p /etc/apt/keyrings - curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc - echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" > /etc/apt/sources.list.d/docker.list - apt-get update -o dir::state::lists="$APT_CACHE/lists" - apt-get install -y --no-install-recommends -o dir::state::lists="$APT_CACHE/lists" -o dir::cache::archives="$APT_CACHE/archives" docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin - - # Install Python dependencies - pip install -U pip virtualenv + set -e + readonly PINNED_SYSTEM_TESTS_COMMIT=f16fe9ed13a45ca4b2bbb9bc55c643347b6c611f + printf '%s' "$PINNED_SYSTEM_TESTS_COMMIT" | grep -Eq '^[0-9a-f]{40}$' + git init -q system-tests + git -C system-tests fetch --quiet --depth 1 https://github.com/DataDog/system-tests.git "$PINNED_SYSTEM_TESTS_COMMIT" + git -C system-tests checkout --quiet --detach "$PINNED_SYSTEM_TESTS_COMMIT" + test "$(git -C system-tests rev-parse HEAD)" = "$PINNED_SYSTEM_TESTS_COMMIT" + test "$(git -C system-tests rev-parse --is-shallow-repository)" = "true" + - CI_IMAGE="$CI_JOB_IMAGE" python3 system-tests/utils/ci/gitlab/build_ci_image.py --check-only - /tmp/vault kv get --format=json "kv/k8s/gitlab-runner/dd-trace-php/datadoghq-api-key" 2>/dev/null | python3 -c "import sys,json;print(json.load(sys.stdin)['data']['data']['key'])" > /tmp/.dd-api-key 2>/dev/null || true - - git clone https://github.com/DataDog/system-tests.git - mv packages/{datadog-setup.php,dd-library-php-*x86_64-linux-gnu.tar.gz} system-tests/binaries - cd system-tests - - ./build.sh $BUILD_SH_ARGS - cache: - - key: v0-$CI_JOB_NAME_SLUG-cache - when: always - paths: - - .cache/ + - ln -sf /system-tests/venv venv + - source venv/bin/activate + - export PYTHONPATH="$CI_PROJECT_DIR/system-tests" + - if [ -n "$BUILD_SH_ARGS" ]; then ./build.sh $BUILD_SH_ARGS; fi after_script: - DATADOG_API_KEY=$(cat /tmp/.dd-api-key 2>/dev/null) || true - mkdir -p artifacts && for f in system-tests/logs*/reportJunit.xml; do dir=$(basename $(dirname "$f")); cp "$f" "artifacts/reportJunit_${dir}.xml" 2>/dev/null || true; done @@ -1346,14 +1338,14 @@ function appsec_image_from_tag_mapping(string $tag): string "System Tests: [php-fpm-8.5, default]": extends: .system_tests variables: - BUILD_SH_ARGS: -w php-fpm-8.5 php + BUILD_SH_ARGS: "-i weblog -w php-fpm-8.5 php" script: - ./run.sh "System Tests: [php-fpm-8.5]": extends: .system_tests variables: - BUILD_SH_ARGS: -w php-fpm-8.5 php + BUILD_SH_ARGS: "-i weblog -w php-fpm-8.5 php" parallel: matrix: - TESTSUITE: @@ -1386,7 +1378,7 @@ function appsec_image_from_tag_mapping(string $tag): string extends: .system_tests timeout: 4h variables: - BUILD_SH_ARGS: -w php + BUILD_SH_ARGS: "-i weblog -w php" # Expand the DinD loopback volume to avoid running out of disk space. # See https://datadoghq.atlassian.net/wiki/spaces/K8S/pages/2874901299/How+to+use+Micro+VMs#DinD-in-CI DOCKER_LOOPBACK_SIZE: 50G @@ -1407,7 +1399,7 @@ function appsec_image_from_tag_mapping(string $tag): string "System Tests: [parametric]": extends: .system_tests variables: - BUILD_SH_ARGS: "-i runner" + BUILD_SH_ARGS: "" script: - ./run.sh PARAMETRIC From 35d20a6585c3efa21dd95c263888821780ec5b82 Mon Sep 17 00:00:00 2001 From: Brian Marks Date: Thu, 27 Aug 2026 09:00:41 -0400 Subject: [PATCH 2/4] ci: follow system-tests main per pipeline --- .gitlab-ci.yml | 1 + .gitlab/generate-package.php | 21 ++++-- .gitlab/test_system_tests_ci_contract.php | 92 +++++++++++++++++++++++ 3 files changed, 109 insertions(+), 5 deletions(-) create mode 100644 .gitlab/test_system_tests_ci_contract.php diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 47d110b1f2d..bf1db405b23 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -53,6 +53,7 @@ generate-templates: printf 'LIBDATADOG_OVERRIDE_SHA=%s\nLIBDATADOG_FEEDBACK_RUN=true\n' "$LIBDATADOG_SHA" >> libdatadog.env fi - php ./.gitlab/generate-package.php | tee .gitlab/package-gen.yml + - php ./.gitlab/test_system_tests_ci_contract.php - php ./.gitlab/generate-tracer.php | tee .gitlab/tracer-gen.yml - php ./.gitlab/generate-appsec.php | tee .gitlab/appsec-gen.yml - php ./.gitlab/generate-profiler.php | tee .gitlab/profiler-gen.yml diff --git a/.gitlab/generate-package.php b/.gitlab/generate-package.php index f09b57d80a5..2c30826e534 100644 --- a/.gitlab/generate-package.php +++ b/.gitlab/generate-package.php @@ -180,6 +180,13 @@ function appsec_image_from_tag_mapping(string $tag): string tags: [ "arch:amd64" ] script: - ./.gitlab/append-build-id.sh + - | + SYSTEM_TESTS_SHA=$(git ls-remote https://github.com/DataDog/system-tests.git refs/heads/main | awk 'NR == 1 { print $1 }') + if ! printf '%s\n' "$SYSTEM_TESTS_SHA" | grep -Eq '^[0-9a-f]{40}$'; then + echo "Failed to resolve a valid system-tests commit: $SYSTEM_TESTS_SHA" + exit 1 + fi + printf 'SYSTEM_TESTS_SHA=%s\n' "$SYSTEM_TESTS_SHA" > system-tests.env # Upgrading composer - composer self-update --no-interaction # Installing dependencies with composer @@ -194,6 +201,8 @@ function appsec_image_from_tag_mapping(string $tag): string paths: - VERSION - ./src/bridge/_generated*.php + reports: + dotenv: system-tests.env diff --git a/.gitlab/test_system_tests_ci_contract.php b/.gitlab/test_system_tests_ci_contract.php new file mode 100644 index 00000000000..48a93ecd63c --- /dev/null +++ b/.gitlab/test_system_tests_ci_contract.php @@ -0,0 +1,92 @@ + system-tests.env", + 'system-tests dotenv creation' +); +require_contains( + $prepare_code, + " reports:\n" . + " dotenv: system-tests.env", + 'system-tests dotenv artifact report' +); + +$system_tests = generated_definition($configuration, '.system_tests'); +require_contains( + $system_tests, + " - job: \"prepare code\"\n" . + " artifacts: true", + 'system-tests revision artifact dependency' +); +require_contains( + $system_tests, + "if ! printf '%s\\n' \"\${SYSTEM_TESTS_SHA:-}\" | grep -Eq '^[0-9a-f]{40}\$'; then", + 'resolved revision validation' +); +require_contains( + $system_tests, + 'git -C system-tests fetch --quiet --depth 1 https://github.com/DataDog/system-tests.git "$SYSTEM_TESTS_SHA"', + 'exact shallow system-tests fetch' +); +require_contains( + $system_tests, + 'git -C system-tests checkout --quiet --detach "$SYSTEM_TESTS_SHA"', + 'detached system-tests checkout' +); +require_contains( + $system_tests, + 'test "$(git -C system-tests rev-parse HEAD)" = "$SYSTEM_TESTS_SHA"', + 'checked-out system-tests revision verification' +); +require_contains( + $system_tests, + 'CI_IMAGE="$CI_JOB_IMAGE" python3 system-tests/utils/ci/gitlab/build_ci_image.py --check-only', + 'runner image compatibility check' +); + +echo "Generated system-tests CI contract: OK\n"; From b77247b8d2d31bc0b14730e0c7d646e8a3ef695c Mon Sep 17 00:00:00 2001 From: Brian Marks Date: Thu, 27 Aug 2026 09:26:58 -0400 Subject: [PATCH 3/4] Delete .gitlab/test_system_tests_ci_contract.php --- .gitlab/test_system_tests_ci_contract.php | 92 ----------------------- 1 file changed, 92 deletions(-) delete mode 100644 .gitlab/test_system_tests_ci_contract.php diff --git a/.gitlab/test_system_tests_ci_contract.php b/.gitlab/test_system_tests_ci_contract.php deleted file mode 100644 index 48a93ecd63c..00000000000 --- a/.gitlab/test_system_tests_ci_contract.php +++ /dev/null @@ -1,92 +0,0 @@ - system-tests.env", - 'system-tests dotenv creation' -); -require_contains( - $prepare_code, - " reports:\n" . - " dotenv: system-tests.env", - 'system-tests dotenv artifact report' -); - -$system_tests = generated_definition($configuration, '.system_tests'); -require_contains( - $system_tests, - " - job: \"prepare code\"\n" . - " artifacts: true", - 'system-tests revision artifact dependency' -); -require_contains( - $system_tests, - "if ! printf '%s\\n' \"\${SYSTEM_TESTS_SHA:-}\" | grep -Eq '^[0-9a-f]{40}\$'; then", - 'resolved revision validation' -); -require_contains( - $system_tests, - 'git -C system-tests fetch --quiet --depth 1 https://github.com/DataDog/system-tests.git "$SYSTEM_TESTS_SHA"', - 'exact shallow system-tests fetch' -); -require_contains( - $system_tests, - 'git -C system-tests checkout --quiet --detach "$SYSTEM_TESTS_SHA"', - 'detached system-tests checkout' -); -require_contains( - $system_tests, - 'test "$(git -C system-tests rev-parse HEAD)" = "$SYSTEM_TESTS_SHA"', - 'checked-out system-tests revision verification' -); -require_contains( - $system_tests, - 'CI_IMAGE="$CI_JOB_IMAGE" python3 system-tests/utils/ci/gitlab/build_ci_image.py --check-only', - 'runner image compatibility check' -); - -echo "Generated system-tests CI contract: OK\n"; From d7b47e678ccae893b05315ed040ca65a42d6bc50 Mon Sep 17 00:00:00 2001 From: Brian Marks Date: Thu, 27 Aug 2026 09:27:38 -0400 Subject: [PATCH 4/4] Remove system tests CI contract execution --- .gitlab-ci.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index bf1db405b23..47d110b1f2d 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -53,7 +53,6 @@ generate-templates: printf 'LIBDATADOG_OVERRIDE_SHA=%s\nLIBDATADOG_FEEDBACK_RUN=true\n' "$LIBDATADOG_SHA" >> libdatadog.env fi - php ./.gitlab/generate-package.php | tee .gitlab/package-gen.yml - - php ./.gitlab/test_system_tests_ci_contract.php - php ./.gitlab/generate-tracer.php | tee .gitlab/tracer-gen.yml - php ./.gitlab/generate-appsec.php | tee .gitlab/appsec-gen.yml - php ./.gitlab/generate-profiler.php | tee .gitlab/profiler-gen.yml