ci: exclude release-proposal wfs from green_ci and exclude benchmarks on release* branches - #2206
Conversation
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2b545d85a3
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
🎉 All green!🧪 All tests passed 🎯 Code Coverage (details) 🔗 Commit SHA: 0bdafcf | Docs | Datadog PR Page | Give us feedback! |
Artifact Size Benchmark Reportaarch64-alpine-linux-musl
aarch64-unknown-linux-gnu
libdatadog-x64-windows
libdatadog-x86-windows
x86_64-alpine-linux-musl
x86_64-unknown-linux-gnu
|
Replace `npm install -g @datadog/datadog-ci` in the Green CI exclusion steps with a download of the pinned v5.21.0 release binary verified against its SHA-256 checksum, matching the pattern in test.yml. This avoids running unpinned third-party npm install lifecycle hooks with the DATADOG_API_KEY secret in their environment. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
| # Download the pinned, checksum-verified datadog-ci binary instead of | ||
| # `npm install -g`, so no third-party install-time code runs with the | ||
| # Datadog API key in its environment. | ||
| URL="https://github.com/DataDog/datadog-ci/releases/download/v5.21.0/datadog-ci_linux-x64" | ||
| OUTPUT="datadog-ci" | ||
| EXPECTED_CHECKSUM="be4a6473fc451fec967ff277df3856060814b9a54d707d055a9c1542ae2869f0" | ||
|
|
||
| echo "Downloading datadog-ci from $URL" | ||
| curl -L --fail --retry 3 -o "$OUTPUT" "$URL" | ||
| chmod +x "$OUTPUT" | ||
|
|
||
| ACTUAL_CHECKSUM=$(sha256sum "$OUTPUT" | cut -d' ' -f1) | ||
| if [ "$ACTUAL_CHECKSUM" != "$EXPECTED_CHECKSUM" ]; then | ||
| echo "Checksum verification failed! expected=$EXPECTED_CHECKSUM actual=$ACTUAL_CHECKSUM" | ||
| exit 1 | ||
| fi | ||
| echo "Checksum verification passed" | ||
|
|
||
| ./"$OUTPUT" tag --level pipeline --tags green_ci.excluded:true |
There was a problem hiding this comment.
Since this code is run in two workflows, Wouldn't it be better to put this code in scripts and run it from the workflow?
cdd6207 to
3ec993c
Compare
The identical datadog-ci download + pipeline tagging step was duplicated in release-proposal-test.yml and release-proposal-dispatch.yml. Move it into scripts/exclude-from-green-ci.sh and call it from both. The step now runs after checkout (so the script is on disk) instead of before. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
3ec993c to
0bdafcf
Compare
|
/merge |
|
View all feedbacks in Devflow UI.
This pull request is not mergeable according to GitHub. Common reasons include pending required checks, missing approvals, or merge conflicts — but it could also be blocked by other repository rules or settings.
The expected merge time in
|
BenchmarksComparisonBenchmark execution time: 2026-07-16 14:39:37 Comparing candidate commit 0bdafcf in PR branch Found 10 performance improvements and 18 performance regressions! Performance is the same for 120 metrics, 0 unstable metrics.
|
|
/merge |
|
View all feedbacks in Devflow UI.
PR already in the queue with status waiting |
95d0c13
into
main
What does this PR do?
release-proposal-dispatch.ymlandrelease-proposal-test.ymlrelease,release-proposal,release-*branches