From 2b545d85a3895d90ac0e332855445c0bff18d7df Mon Sep 17 00:00:00 2001 From: iunanua Date: Tue, 7 Jul 2026 17:19:54 +0200 Subject: [PATCH 1/4] Exclude release-proposal wfs from green_ci and exclude benchmars on release* branches --- .github/workflows/release-proposal-dispatch.yml | 8 ++++++++ .github/workflows/release-proposal-test.yml | 8 ++++++++ .gitlab/benchmarks.yml | 2 ++ 3 files changed, 18 insertions(+) diff --git a/.github/workflows/release-proposal-dispatch.yml b/.github/workflows/release-proposal-dispatch.yml index f3f691a8c9..3b9c8c7bd9 100644 --- a/.github/workflows/release-proposal-dispatch.yml +++ b/.github/workflows/release-proposal-dispatch.yml @@ -45,6 +45,14 @@ jobs: crates_branch: ${{ steps.normalize.outputs.crates_branch }} count: ${{ steps.normalize.outputs.count }} steps: + - name: Exclude from Green CI + env: + DATADOG_SITE: datadoghq.com + DATADOG_API_KEY: ${{ secrets.DATADOG_API_KEY }} + run: | + npm install -g @datadog/datadog-ci + datadog-ci tag --level pipeline --tags green_ci.excluded:true + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2 - name: Normalize and validate crate list id: normalize diff --git a/.github/workflows/release-proposal-test.yml b/.github/workflows/release-proposal-test.yml index 3a40016246..d9301067dd 100644 --- a/.github/workflows/release-proposal-test.yml +++ b/.github/workflows/release-proposal-test.yml @@ -16,6 +16,14 @@ jobs: outputs: upload_artifact: ${{ steps.package-crates.outputs.upload_artifact }} steps: + - name: Exclude from Green CI + env: + DATADOG_SITE: datadoghq.com + DATADOG_API_KEY: ${{ secrets.DATADOG_API_KEY }} + run: | + npm install -g @datadog/datadog-ci + datadog-ci tag --level pipeline --tags green_ci.excluded:true + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2 with: fetch-depth: 0 diff --git a/.gitlab/benchmarks.yml b/.gitlab/benchmarks.yml index 19975eda7e..db54e1b7ed 100644 --- a/.gitlab/benchmarks.yml +++ b/.gitlab/benchmarks.yml @@ -12,6 +12,8 @@ benchmarks: # Don't run on merge-queue working branches - if: '$CI_COMMIT_BRANCH =~ /^mq-working-branch-/' when: never + - if: '$CI_COMMIT_BRANCH =~ /^release([-\/]|$)/' + when: never - if: $CI_COMMIT_BRANCH == "main" interruptible: false - interruptible: true From 844f4276a6b8e8aeb03cf3fc639dece70e00ca02 Mon Sep 17 00:00:00 2001 From: iunanua Date: Wed, 8 Jul 2026 09:56:48 +0200 Subject: [PATCH 2/4] ci(release): install datadog-ci via pinned checksummed binary Replace `npm install -g @datadog/datadog-ci` in the Green CI exclusion steps with a download of the pinned v5.21.0 release binary verified against its SHA-256 checksum, matching the pattern in test.yml. This avoids running unpinned third-party npm install lifecycle hooks with the DATADOG_API_KEY secret in their environment. Co-Authored-By: Claude Opus 4.8 (1M context) --- .../workflows/release-proposal-dispatch.yml | 21 +++++++++++++++++-- .github/workflows/release-proposal-test.yml | 21 +++++++++++++++++-- 2 files changed, 38 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release-proposal-dispatch.yml b/.github/workflows/release-proposal-dispatch.yml index 3b9c8c7bd9..e9e66af4c4 100644 --- a/.github/workflows/release-proposal-dispatch.yml +++ b/.github/workflows/release-proposal-dispatch.yml @@ -50,8 +50,25 @@ jobs: DATADOG_SITE: datadoghq.com DATADOG_API_KEY: ${{ secrets.DATADOG_API_KEY }} run: | - npm install -g @datadog/datadog-ci - datadog-ci tag --level pipeline --tags green_ci.excluded:true + # Download the pinned, checksum-verified datadog-ci binary instead of + # `npm install -g`, so no third-party install-time code runs with the + # Datadog API key in its environment. + URL="https://github.com/DataDog/datadog-ci/releases/download/v5.21.0/datadog-ci_linux-x64" + OUTPUT="datadog-ci" + EXPECTED_CHECKSUM="be4a6473fc451fec967ff277df3856060814b9a54d707d055a9c1542ae2869f0" + + echo "Downloading datadog-ci from $URL" + curl -L --fail --retry 3 -o "$OUTPUT" "$URL" + chmod +x "$OUTPUT" + + ACTUAL_CHECKSUM=$(sha256sum "$OUTPUT" | cut -d' ' -f1) + if [ "$ACTUAL_CHECKSUM" != "$EXPECTED_CHECKSUM" ]; then + echo "Checksum verification failed! expected=$EXPECTED_CHECKSUM actual=$ACTUAL_CHECKSUM" + exit 1 + fi + echo "Checksum verification passed" + + ./"$OUTPUT" tag --level pipeline --tags green_ci.excluded:true - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2 - name: Normalize and validate crate list diff --git a/.github/workflows/release-proposal-test.yml b/.github/workflows/release-proposal-test.yml index d9301067dd..d3c090d6eb 100644 --- a/.github/workflows/release-proposal-test.yml +++ b/.github/workflows/release-proposal-test.yml @@ -21,8 +21,25 @@ jobs: DATADOG_SITE: datadoghq.com DATADOG_API_KEY: ${{ secrets.DATADOG_API_KEY }} run: | - npm install -g @datadog/datadog-ci - datadog-ci tag --level pipeline --tags green_ci.excluded:true + # Download the pinned, checksum-verified datadog-ci binary instead of + # `npm install -g`, so no third-party install-time code runs with the + # Datadog API key in its environment. + URL="https://github.com/DataDog/datadog-ci/releases/download/v5.21.0/datadog-ci_linux-x64" + OUTPUT="datadog-ci" + EXPECTED_CHECKSUM="be4a6473fc451fec967ff277df3856060814b9a54d707d055a9c1542ae2869f0" + + echo "Downloading datadog-ci from $URL" + curl -L --fail --retry 3 -o "$OUTPUT" "$URL" + chmod +x "$OUTPUT" + + ACTUAL_CHECKSUM=$(sha256sum "$OUTPUT" | cut -d' ' -f1) + if [ "$ACTUAL_CHECKSUM" != "$EXPECTED_CHECKSUM" ]; then + echo "Checksum verification failed! expected=$EXPECTED_CHECKSUM actual=$ACTUAL_CHECKSUM" + exit 1 + fi + echo "Checksum verification passed" + + ./"$OUTPUT" tag --level pipeline --tags green_ci.excluded:true - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2 with: From 2b61aa95b1affbd2cfaf89e74e364d6ee41b528f Mon Sep 17 00:00:00 2001 From: iunanua Date: Wed, 8 Jul 2026 10:13:26 +0200 Subject: [PATCH 3/4] exclude release-proposal, release-testing, etc --- .gitlab/benchmarks.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.gitlab/benchmarks.yml b/.gitlab/benchmarks.yml index c9a2312842..364b4dec3c 100644 --- a/.gitlab/benchmarks.yml +++ b/.gitlab/benchmarks.yml @@ -10,9 +10,9 @@ variables: .benchmark_run_rules: &benchmark_run_rules - if: '$CI_COMMIT_BRANCH =~ /^mq-working-branch-/' when: never - - if: '$CI_COMMIT_BRANCH =~ /^(release|hotfix)\//' + - if: '$CI_COMMIT_BRANCH =~ /^(release|hotfix)[-\/]/' when: never - - if: '$CI_EXTERNAL_PULL_REQUEST_SOURCE_BRANCH_NAME =~ /^(release|hotfix)\//' + - if: '$CI_EXTERNAL_PULL_REQUEST_SOURCE_BRANCH_NAME =~ /^(release|hotfix)[-\/]/' when: never - if: '$CI_COMMIT_BRANCH == "main"' interruptible: false From 0bdafcf054cb3ef66645c5ad20afcc02e97ffa51 Mon Sep 17 00:00:00 2001 From: iunanua Date: Thu, 16 Jul 2026 16:01:50 +0200 Subject: [PATCH 4/4] ci(release): extract Exclude from Green CI step into a shared script The identical datadog-ci download + pipeline tagging step was duplicated in release-proposal-test.yml and release-proposal-dispatch.yml. Move it into scripts/exclude-from-green-ci.sh and call it from both. The step now runs after checkout (so the script is on disk) instead of before. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/CODEOWNERS | 1 + .../workflows/release-proposal-dispatch.yml | 24 ++------------ .github/workflows/release-proposal-test.yml | 32 ++++--------------- scripts/exclude-from-green-ci.sh | 29 +++++++++++++++++ 4 files changed, 40 insertions(+), 46 deletions(-) create mode 100755 scripts/exclude-from-green-ci.sh diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 7d901c41d5..b5c0ee3b5d 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -81,6 +81,7 @@ scripts/check_crypto_providers.sh @DataDog/libdatadog-core scripts/commits-since-release.sh @DataDog/libdatadog-core scripts/create-release.sh @DataDog/apm-common-components-core scripts/crates-to-package.sh @DataDog/libdatadog-core +scripts/exclude-from-green-ci.sh @DataDog/libdatadog-core scripts/major-bumps-level.sh @DataDog/libdatadog-core scripts/publication-order.sh @DataDog/libdatadog-core scripts/reformat_copyright.sh @DataDog/libdatadog-core diff --git a/.github/workflows/release-proposal-dispatch.yml b/.github/workflows/release-proposal-dispatch.yml index e9e66af4c4..ce454a86c7 100644 --- a/.github/workflows/release-proposal-dispatch.yml +++ b/.github/workflows/release-proposal-dispatch.yml @@ -45,32 +45,14 @@ jobs: crates_branch: ${{ steps.normalize.outputs.crates_branch }} count: ${{ steps.normalize.outputs.count }} steps: + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2 + - name: Exclude from Green CI env: DATADOG_SITE: datadoghq.com DATADOG_API_KEY: ${{ secrets.DATADOG_API_KEY }} - run: | - # Download the pinned, checksum-verified datadog-ci binary instead of - # `npm install -g`, so no third-party install-time code runs with the - # Datadog API key in its environment. - URL="https://github.com/DataDog/datadog-ci/releases/download/v5.21.0/datadog-ci_linux-x64" - OUTPUT="datadog-ci" - EXPECTED_CHECKSUM="be4a6473fc451fec967ff277df3856060814b9a54d707d055a9c1542ae2869f0" - - echo "Downloading datadog-ci from $URL" - curl -L --fail --retry 3 -o "$OUTPUT" "$URL" - chmod +x "$OUTPUT" - - ACTUAL_CHECKSUM=$(sha256sum "$OUTPUT" | cut -d' ' -f1) - if [ "$ACTUAL_CHECKSUM" != "$EXPECTED_CHECKSUM" ]; then - echo "Checksum verification failed! expected=$EXPECTED_CHECKSUM actual=$ACTUAL_CHECKSUM" - exit 1 - fi - echo "Checksum verification passed" - - ./"$OUTPUT" tag --level pipeline --tags green_ci.excluded:true + run: ./scripts/exclude-from-green-ci.sh - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2 - name: Normalize and validate crate list id: normalize env: diff --git a/.github/workflows/release-proposal-test.yml b/.github/workflows/release-proposal-test.yml index d3c090d6eb..43499795c6 100644 --- a/.github/workflows/release-proposal-test.yml +++ b/.github/workflows/release-proposal-test.yml @@ -16,36 +16,18 @@ jobs: outputs: upload_artifact: ${{ steps.package-crates.outputs.upload_artifact }} steps: - - name: Exclude from Green CI - env: - DATADOG_SITE: datadoghq.com - DATADOG_API_KEY: ${{ secrets.DATADOG_API_KEY }} - run: | - # Download the pinned, checksum-verified datadog-ci binary instead of - # `npm install -g`, so no third-party install-time code runs with the - # Datadog API key in its environment. - URL="https://github.com/DataDog/datadog-ci/releases/download/v5.21.0/datadog-ci_linux-x64" - OUTPUT="datadog-ci" - EXPECTED_CHECKSUM="be4a6473fc451fec967ff277df3856060814b9a54d707d055a9c1542ae2869f0" - - echo "Downloading datadog-ci from $URL" - curl -L --fail --retry 3 -o "$OUTPUT" "$URL" - chmod +x "$OUTPUT" - - ACTUAL_CHECKSUM=$(sha256sum "$OUTPUT" | cut -d' ' -f1) - if [ "$ACTUAL_CHECKSUM" != "$EXPECTED_CHECKSUM" ]; then - echo "Checksum verification failed! expected=$EXPECTED_CHECKSUM actual=$ACTUAL_CHECKSUM" - exit 1 - fi - echo "Checksum verification passed" - - ./"$OUTPUT" tag --level pipeline --tags green_ci.excluded:true - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2 with: fetch-depth: 0 # Checkout PR head (not the synthetic merge commit) so version comparison matches the proposal branch. ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }} + + - name: Exclude from Green CI + env: + DATADOG_SITE: datadoghq.com + DATADOG_API_KEY: ${{ secrets.DATADOG_API_KEY }} + run: ./scripts/exclude-from-green-ci.sh + - uses: dtolnay/rust-toolchain@stable with: toolchain: 1.92.0 diff --git a/scripts/exclude-from-green-ci.sh b/scripts/exclude-from-green-ci.sh new file mode 100755 index 0000000000..1dc2ef68a8 --- /dev/null +++ b/scripts/exclude-from-green-ci.sh @@ -0,0 +1,29 @@ +#!/usr/bin/env bash +# Copyright 2021-Present Datadog, Inc. https://www.datadoghq.com/ +# SPDX-License-Identifier: Apache-2.0 +# +# Tags the current CI pipeline as excluded from Green CI (green_ci.excluded:true). +# +# Downloads the pinned, checksum-verified datadog-ci binary instead of `npm install -g`, +# so no third-party install-time code runs with the Datadog API key in its environment. +# +# Requires DATADOG_SITE and DATADOG_API_KEY in the environment. + +set -euo pipefail + +URL="https://github.com/DataDog/datadog-ci/releases/download/v5.21.0/datadog-ci_linux-x64" +OUTPUT="datadog-ci" +EXPECTED_CHECKSUM="be4a6473fc451fec967ff277df3856060814b9a54d707d055a9c1542ae2869f0" + +echo "Downloading datadog-ci from $URL" +curl -L --fail --retry 3 -o "$OUTPUT" "$URL" +chmod +x "$OUTPUT" + +ACTUAL_CHECKSUM=$(sha256sum "$OUTPUT" | cut -d' ' -f1) +if [ "$ACTUAL_CHECKSUM" != "$EXPECTED_CHECKSUM" ]; then + echo "Checksum verification failed! expected=$EXPECTED_CHECKSUM actual=$ACTUAL_CHECKSUM" + exit 1 +fi +echo "Checksum verification passed" + +./"$OUTPUT" tag --level pipeline --tags green_ci.excluded:true