[ACIX-1440] Only sign and notarize packages on nightly - #49282
Closed
aiuto wants to merge 76 commits into
Closed
Conversation
aiuto
added
changelog/no-changelog
github-actions
Bot
added
the
short review
Contributor
Gitlab CI Configuration ChangesModified Jobs.agent_dmg .agent_dmg:
after_script:
- sudo umount /Volumes/Agent || true
artifacts:
expire_in: 2 weeks
paths:
- omnibus/pkg/*.dmg
- omnibus/pkg/version-manifest.json
before_script:
- sudo umount /Volumes/Agent || true
- rm -rf "$OMNIBUS_GIT_CACHE_DIR" || true
cache:
- key:
files:
- omnibus/Gemfile
- release.json
prefix: omnibus-deps-$CI_JOB_IMAGE-$CI_JOB_NAME-$OMNIBUS_RUBY_VERSION
paths:
- omnibus/vendor/bundle
id_tokens:
BUILDBARN_ID_TOKEN:
aud: buildbarn.us1.ddbuild.io
CI_IDENTITIES_GITLAB_ID_TOKEN:
aud: ci-identities
needs:
- go_mod_tidy_check
rules:
- - if: $CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH =~ /^[0-9]+\.[0-9]+\.x$/
? ^^ ^
+ - if: $CI_COMMIT_BRANCH == "nightly" || $CI_COMMIT_BRANCH =~ /^[0-9]+\.[0-9]+\.x$/
? ^ ^^^^^
variables:
SIGN: true
- if: $CI_COMMIT_TAG =~ /^[0-9]+\.[0-9]+\.[0-9]+(-rc\.[0-9]+)?$/
variables:
SIGN: true
- if: $CI_COMMIT_BRANCH =~ /notarization/
variables:
SIGN: true
- if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
when: never
- changes:
compare_to: $COMPARE_TO_BRANCH
paths:
- comp/core/gui/impl/systray/**/*
- '**/*.m'
- if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
when: never
- changes:
compare_to: $COMPARE_TO_BRANCH
paths:
- omnibus/**/*
- .gitlab-ci.yml
- release.json
- .gitlab/build/package_build/**/*
- changes:
compare_to: $COMPARE_TO_BRANCH
paths:
- '*.bazel*'
- deps/**/*
- bazel/**/*
- if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
when: never
- if: $CI_COMMIT_BRANCH == "main" || $DEPLOY_AGENT == "true" || $RUN_ALL_BUILDS
== "true" || $DDR_WORKFLOW_ID != null
- changes:
compare_to: $COMPARE_TO_BRANCH
paths:
- omnibus/**/*
- pkg/config/config_template.yaml
- pkg/config/system-probe_template.yaml
- if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
when: never
- allow_failure: true
when: manual
script:
- set -eo pipefail
- export VAULT_ADDR=https://vault.us1.ddbuild.io
- vault login -method=aws -no-print
- "if [ -z \"$TMPDIR\" ]; then\n echo \"TMPDIR must be set\" >& 2\n exit 1\nfi\n"
- export DDA_DIR="$TMPDIR/dda-${CI_JOB_ID}"
- export PATH="$DDA_DIR:$PATH"
- export DDA_NO_DYNAMIC_DEPS=1
- "# Perform installation only if the directory does not exist\nif [ ! -d \"$DDA_DIR\"\
\ ]; then\n robust_curl=\"curl -fsSL --retry 4\" # recommended flags + resist\
\ transient errors like `Connection reset by peer`\n # Get the commit from the\
\ build image variable in the format `vPIPELINE_ID-COMMIT`\n export BUILDIMAGES_COMMIT=\"\
${CI_IMAGE_LINUX#*-}\"\n export DDA_VERSION=\"$($robust_curl https://raw.githubusercontent.com/DataDog/datadog-agent-buildimages/${BUILDIMAGES_COMMIT}/dda.env\
\ | awk -F= '/^DDA_VERSION=/ {print $2}')\"\n # Detect architecture and download\
\ appropriate binary\n if [ \"$(uname -m)\" = \"arm64\" ]; then\n dda_target_triple=\"\
aarch64-apple-darwin\"\n else\n dda_target_triple=\"x86_64-apple-darwin\"\n\
\ fi\n $robust_curl -o dda.tar.gz https://github.com/DataDog/datadog-agent-dev/releases/download/${DDA_VERSION}/dda-${dda_target_triple}.tar.gz\n\
\ tar -xzf dda.tar.gz\n mkdir -p \"$DDA_DIR\"\n sudo mv dda $DDA_DIR\n rm\
\ -f dda.tar.gz\n dda self dep sync -f legacy-tasks\n dda self pip install awscli==1.29.45\n\
fi\n"
- echo Setting up Go
- mkdir -p ~/go
- export GO_VERSION="$(cat .go-version)"
- eval "$(gimme $GO_VERSION)"
- export PATH="$PATH:$GOROOT/bin"
- echo Go version should be $GO_VERSION
- go version
- dda inv check-go-version
- DD_API_KEY="$("$CI_PROJECT_DIR"/tools/ci/fetch_secret.sh "$AGENT_API_KEY_ORG2"
token)" || exit $?; export DD_API_KEY
- DD_APP_KEY="$("$CI_PROJECT_DIR"/tools/ci/fetch_secret.sh "$AGENT_APP_KEY_ORG2"
token)" || exit $?; export DD_APP_KEY
- 'AWS_TOKEN="$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds:
21600")"
RUNNER_ID="$(curl -s http://169.254.169.254/latest/meta-data/instance-id -H "X-aws-ec2-metadata-token:
$AWS_TOKEN" || hostname)"
datadog-ci tag --level job --tags macos_runner:"$RUNNER_ID"
echo "Reported runner ID to Datadog: $RUNNER_ID"
'
- "if [ \"$CI_COMMIT_BRANCH\" = \"main\" ] || [[ \"$CI_COMMIT_BRANCH\" =~ ^[0-9]+\\\
.[0-9]+\\.(x|[0-9]+)$ ]]; then\n dda inv -- -e macos.report-versions -l all ||\
\ true\nfi\n"
- "if [ \"$((RANDOM%20))\" -eq 0 ]; then\n echo Trying to remove inactive versions\n\
\ dda inv -- -e macos.remove-inactive-versions -l python -t \"$PYTHON_VERSION\"\
\ || true\n dda inv -- -e macos.remove-inactive-versions -l go -t \"$(cat .go-version)\"\
\ || true\nfi\n"
- 'export TMPDIR=/tmp/gitlabci
NEWTMPDIR="$RUNNER_TEMP_PROJECT_DIR/gitlabci"
sudo rm -fr "$(realpath $TMPDIR)" "$NEWTMPDIR"
mkdir "$NEWTMPDIR"
sudo ln -fs "$NEWTMPDIR" $TMPDIR
echo "Temporary folder created, TMPDIR=$TMPDIR -> $NEWTMPDIR"
'
- sudo bash -c "rm -rf /var/cache/omnibus/src/*" || true
- pushd omnibus && bundle config set --local path 'vendor/bundle' && popd
- 'export GOMODCACHE=~/gomodcache
mkdir -p $GOMODCACHE
'
- bash .gitlab/build/package_build/build_agent_dmg.sh
- $S3_CP_CMD $OMNIBUS_PACKAGE_DIR/version-manifest.json $S3_SBOM_STORAGE_URI/$CI_JOB_NAME/version-manifest.json
stage: package_build
timeout: 2h
variables:
AWS_SHARED_CREDENTIALS_FILE: ${CI_PROJECT_DIR}/.aws/credentials-by-job-id/${CI_JOB_ID}
BAZELISK_HOME: $XDG_CACHE_HOME/bazelisk
INTEGRATION_WHEELS_CACHE_BUCKET: dd-agent-omnibus
INTEGRATION_WHEELS_SKIP_CACHE_UPLOAD: true
KEYCHAIN_NAME: build.keychain
NOTARIZATION_ATTEMPTS: 3
NOTARIZATION_TIMEOUT: 15m
NOTARIZATION_WAIT_TIME: 15s
S3_OMNIBUS_CACHE_BUCKET: dd-ci-datadog-agent-omnibus-cache-build-stable
XDG_CACHE_HOME: $RUNNER_TEMP_PROJECT_DIRagent_dmg-arm64-a7 agent_dmg-arm64-a7:
after_script:
- sudo umount /Volumes/Agent || true
artifacts:
expire_in: 2 weeks
paths:
- omnibus/pkg/*.dmg
- omnibus/pkg/version-manifest.json
before_script:
- sudo umount /Volumes/Agent || true
- rm -rf "$OMNIBUS_GIT_CACHE_DIR" || true
cache:
- key:
files:
- omnibus/Gemfile
- release.json
prefix: omnibus-deps-$CI_JOB_IMAGE-$CI_JOB_NAME-$OMNIBUS_RUBY_VERSION
paths:
- omnibus/vendor/bundle
id_tokens:
BUILDBARN_ID_TOKEN:
aud: buildbarn.us1.ddbuild.io
CI_IDENTITIES_GITLAB_ID_TOKEN:
aud: ci-identities
needs:
- go_mod_tidy_check
rules:
- - if: $CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH =~ /^[0-9]+\.[0-9]+\.x$/
? ^^ ^
+ - if: $CI_COMMIT_BRANCH == "nightly" || $CI_COMMIT_BRANCH =~ /^[0-9]+\.[0-9]+\.x$/
? ^ ^^^^^
variables:
SIGN: true
- if: $CI_COMMIT_TAG =~ /^[0-9]+\.[0-9]+\.[0-9]+(-rc\.[0-9]+)?$/
variables:
SIGN: true
- if: $CI_COMMIT_BRANCH =~ /notarization/
variables:
SIGN: true
- if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
when: never
- changes:
compare_to: $COMPARE_TO_BRANCH
paths:
- comp/core/gui/impl/systray/**/*
- '**/*.m'
- if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
when: never
- changes:
compare_to: $COMPARE_TO_BRANCH
paths:
- omnibus/**/*
- .gitlab-ci.yml
- release.json
- .gitlab/build/package_build/**/*
- changes:
compare_to: $COMPARE_TO_BRANCH
paths:
- '*.bazel*'
- deps/**/*
- bazel/**/*
- if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
when: never
- if: $CI_COMMIT_BRANCH == "main" || $DEPLOY_AGENT == "true" || $RUN_ALL_BUILDS
== "true" || $DDR_WORKFLOW_ID != null
- changes:
compare_to: $COMPARE_TO_BRANCH
paths:
- omnibus/**/*
- pkg/config/config_template.yaml
- pkg/config/system-probe_template.yaml
- if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
when: never
- allow_failure: true
when: manual
script:
- set -eo pipefail
- export VAULT_ADDR=https://vault.us1.ddbuild.io
- vault login -method=aws -no-print
- "if [ -z \"$TMPDIR\" ]; then\n echo \"TMPDIR must be set\" >& 2\n exit 1\nfi\n"
- export DDA_DIR="$TMPDIR/dda-${CI_JOB_ID}"
- export PATH="$DDA_DIR:$PATH"
- export DDA_NO_DYNAMIC_DEPS=1
- "# Perform installation only if the directory does not exist\nif [ ! -d \"$DDA_DIR\"\
\ ]; then\n robust_curl=\"curl -fsSL --retry 4\" # recommended flags + resist\
\ transient errors like `Connection reset by peer`\n # Get the commit from the\
\ build image variable in the format `vPIPELINE_ID-COMMIT`\n export BUILDIMAGES_COMMIT=\"\
${CI_IMAGE_LINUX#*-}\"\n export DDA_VERSION=\"$($robust_curl https://raw.githubusercontent.com/DataDog/datadog-agent-buildimages/${BUILDIMAGES_COMMIT}/dda.env\
\ | awk -F= '/^DDA_VERSION=/ {print $2}')\"\n # Detect architecture and download\
\ appropriate binary\n if [ \"$(uname -m)\" = \"arm64\" ]; then\n dda_target_triple=\"\
aarch64-apple-darwin\"\n else\n dda_target_triple=\"x86_64-apple-darwin\"\n\
\ fi\n $robust_curl -o dda.tar.gz https://github.com/DataDog/datadog-agent-dev/releases/download/${DDA_VERSION}/dda-${dda_target_triple}.tar.gz\n\
\ tar -xzf dda.tar.gz\n mkdir -p \"$DDA_DIR\"\n sudo mv dda $DDA_DIR\n rm\
\ -f dda.tar.gz\n dda self dep sync -f legacy-tasks\n dda self pip install awscli==1.29.45\n\
fi\n"
- echo Setting up Go
- mkdir -p ~/go
- export GO_VERSION="$(cat .go-version)"
- eval "$(gimme $GO_VERSION)"
- export PATH="$PATH:$GOROOT/bin"
- echo Go version should be $GO_VERSION
- go version
- dda inv check-go-version
- DD_API_KEY="$("$CI_PROJECT_DIR"/tools/ci/fetch_secret.sh "$AGENT_API_KEY_ORG2"
token)" || exit $?; export DD_API_KEY
- DD_APP_KEY="$("$CI_PROJECT_DIR"/tools/ci/fetch_secret.sh "$AGENT_APP_KEY_ORG2"
token)" || exit $?; export DD_APP_KEY
- 'AWS_TOKEN="$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds:
21600")"
RUNNER_ID="$(curl -s http://169.254.169.254/latest/meta-data/instance-id -H "X-aws-ec2-metadata-token:
$AWS_TOKEN" || hostname)"
datadog-ci tag --level job --tags macos_runner:"$RUNNER_ID"
echo "Reported runner ID to Datadog: $RUNNER_ID"
'
- "if [ \"$CI_COMMIT_BRANCH\" = \"main\" ] || [[ \"$CI_COMMIT_BRANCH\" =~ ^[0-9]+\\\
.[0-9]+\\.(x|[0-9]+)$ ]]; then\n dda inv -- -e macos.report-versions -l all ||\
\ true\nfi\n"
- "if [ \"$((RANDOM%20))\" -eq 0 ]; then\n echo Trying to remove inactive versions\n\
\ dda inv -- -e macos.remove-inactive-versions -l python -t \"$PYTHON_VERSION\"\
\ || true\n dda inv -- -e macos.remove-inactive-versions -l go -t \"$(cat .go-version)\"\
\ || true\nfi\n"
- 'export TMPDIR=/tmp/gitlabci
NEWTMPDIR="$RUNNER_TEMP_PROJECT_DIR/gitlabci"
sudo rm -fr "$(realpath $TMPDIR)" "$NEWTMPDIR"
mkdir "$NEWTMPDIR"
sudo ln -fs "$NEWTMPDIR" $TMPDIR
echo "Temporary folder created, TMPDIR=$TMPDIR -> $NEWTMPDIR"
'
- sudo bash -c "rm -rf /var/cache/omnibus/src/*" || true
- pushd omnibus && bundle config set --local path 'vendor/bundle' && popd
- 'export GOMODCACHE=~/gomodcache
mkdir -p $GOMODCACHE
'
- bash .gitlab/build/package_build/build_agent_dmg.sh
- $S3_CP_CMD $OMNIBUS_PACKAGE_DIR/version-manifest.json $S3_SBOM_STORAGE_URI/$CI_JOB_NAME/version-manifest.json
stage: package_build
tags:
- macos:sonoma-arm64
- specific:true
timeout: 2h
variables:
AWS_SHARED_CREDENTIALS_FILE: ${CI_PROJECT_DIR}/.aws/credentials-by-job-id/${CI_JOB_ID}
BAZELISK_HOME: $XDG_CACHE_HOME/bazelisk
INTEGRATION_WHEELS_CACHE_BUCKET: dd-agent-omnibus
INTEGRATION_WHEELS_SKIP_CACHE_UPLOAD: true
KEYCHAIN_NAME: build.keychain
NOTARIZATION_ATTEMPTS: 3
NOTARIZATION_TIMEOUT: 15m
NOTARIZATION_WAIT_TIME: 15s
S3_OMNIBUS_CACHE_BUCKET: dd-ci-datadog-agent-omnibus-cache-build-stable
XDG_CACHE_HOME: $RUNNER_TEMP_PROJECT_DIRagent_dmg-x64-a7 agent_dmg-x64-a7:
after_script:
- sudo umount /Volumes/Agent || true
artifacts:
expire_in: 2 weeks
paths:
- omnibus/pkg/*.dmg
- omnibus/pkg/version-manifest.json
before_script:
- sudo umount /Volumes/Agent || true
- rm -rf "$OMNIBUS_GIT_CACHE_DIR" || true
cache:
- key:
files:
- omnibus/Gemfile
- release.json
prefix: omnibus-deps-$CI_JOB_IMAGE-$CI_JOB_NAME-$OMNIBUS_RUBY_VERSION
paths:
- omnibus/vendor/bundle
id_tokens:
BUILDBARN_ID_TOKEN:
aud: buildbarn.us1.ddbuild.io
CI_IDENTITIES_GITLAB_ID_TOKEN:
aud: ci-identities
needs:
- go_mod_tidy_check
rules:
- - if: $CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH =~ /^[0-9]+\.[0-9]+\.x$/
? ^^ ^
+ - if: $CI_COMMIT_BRANCH == "nightly" || $CI_COMMIT_BRANCH =~ /^[0-9]+\.[0-9]+\.x$/
? ^ ^^^^^
variables:
SIGN: true
- if: $CI_COMMIT_TAG =~ /^[0-9]+\.[0-9]+\.[0-9]+(-rc\.[0-9]+)?$/
variables:
SIGN: true
- if: $CI_COMMIT_BRANCH =~ /notarization/
variables:
SIGN: true
- if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
when: never
- changes:
compare_to: $COMPARE_TO_BRANCH
paths:
- comp/core/gui/impl/systray/**/*
- '**/*.m'
- if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
when: never
- changes:
compare_to: $COMPARE_TO_BRANCH
paths:
- omnibus/**/*
- .gitlab-ci.yml
- release.json
- .gitlab/build/package_build/**/*
- changes:
compare_to: $COMPARE_TO_BRANCH
paths:
- '*.bazel*'
- deps/**/*
- bazel/**/*
- if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
when: never
- if: $CI_COMMIT_BRANCH == "main" || $DEPLOY_AGENT == "true" || $RUN_ALL_BUILDS
== "true" || $DDR_WORKFLOW_ID != null
- changes:
compare_to: $COMPARE_TO_BRANCH
paths:
- omnibus/**/*
- pkg/config/config_template.yaml
- pkg/config/system-probe_template.yaml
- if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
when: never
- allow_failure: true
when: manual
script:
- set -eo pipefail
- export VAULT_ADDR=https://vault.us1.ddbuild.io
- vault login -method=aws -no-print
- "if [ -z \"$TMPDIR\" ]; then\n echo \"TMPDIR must be set\" >& 2\n exit 1\nfi\n"
- export DDA_DIR="$TMPDIR/dda-${CI_JOB_ID}"
- export PATH="$DDA_DIR:$PATH"
- export DDA_NO_DYNAMIC_DEPS=1
- "# Perform installation only if the directory does not exist\nif [ ! -d \"$DDA_DIR\"\
\ ]; then\n robust_curl=\"curl -fsSL --retry 4\" # recommended flags + resist\
\ transient errors like `Connection reset by peer`\n # Get the commit from the\
\ build image variable in the format `vPIPELINE_ID-COMMIT`\n export BUILDIMAGES_COMMIT=\"\
${CI_IMAGE_LINUX#*-}\"\n export DDA_VERSION=\"$($robust_curl https://raw.githubusercontent.com/DataDog/datadog-agent-buildimages/${BUILDIMAGES_COMMIT}/dda.env\
\ | awk -F= '/^DDA_VERSION=/ {print $2}')\"\n # Detect architecture and download\
\ appropriate binary\n if [ \"$(uname -m)\" = \"arm64\" ]; then\n dda_target_triple=\"\
aarch64-apple-darwin\"\n else\n dda_target_triple=\"x86_64-apple-darwin\"\n\
\ fi\n $robust_curl -o dda.tar.gz https://github.com/DataDog/datadog-agent-dev/releases/download/${DDA_VERSION}/dda-${dda_target_triple}.tar.gz\n\
\ tar -xzf dda.tar.gz\n mkdir -p \"$DDA_DIR\"\n sudo mv dda $DDA_DIR\n rm\
\ -f dda.tar.gz\n dda self dep sync -f legacy-tasks\n dda self pip install awscli==1.29.45\n\
fi\n"
- echo Setting up Go
- mkdir -p ~/go
- export GO_VERSION="$(cat .go-version)"
- eval "$(gimme $GO_VERSION)"
- export PATH="$PATH:$GOROOT/bin"
- echo Go version should be $GO_VERSION
- go version
- dda inv check-go-version
- DD_API_KEY="$("$CI_PROJECT_DIR"/tools/ci/fetch_secret.sh "$AGENT_API_KEY_ORG2"
token)" || exit $?; export DD_API_KEY
- DD_APP_KEY="$("$CI_PROJECT_DIR"/tools/ci/fetch_secret.sh "$AGENT_APP_KEY_ORG2"
token)" || exit $?; export DD_APP_KEY
- 'AWS_TOKEN="$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds:
21600")"
RUNNER_ID="$(curl -s http://169.254.169.254/latest/meta-data/instance-id -H "X-aws-ec2-metadata-token:
$AWS_TOKEN" || hostname)"
datadog-ci tag --level job --tags macos_runner:"$RUNNER_ID"
echo "Reported runner ID to Datadog: $RUNNER_ID"
'
- "if [ \"$CI_COMMIT_BRANCH\" = \"main\" ] || [[ \"$CI_COMMIT_BRANCH\" =~ ^[0-9]+\\\
.[0-9]+\\.(x|[0-9]+)$ ]]; then\n dda inv -- -e macos.report-versions -l all ||\
\ true\nfi\n"
- "if [ \"$((RANDOM%20))\" -eq 0 ]; then\n echo Trying to remove inactive versions\n\
\ dda inv -- -e macos.remove-inactive-versions -l python -t \"$PYTHON_VERSION\"\
\ || true\n dda inv -- -e macos.remove-inactive-versions -l go -t \"$(cat .go-version)\"\
\ || true\nfi\n"
- 'export TMPDIR=/tmp/gitlabci
NEWTMPDIR="$RUNNER_TEMP_PROJECT_DIR/gitlabci"
sudo rm -fr "$(realpath $TMPDIR)" "$NEWTMPDIR"
mkdir "$NEWTMPDIR"
sudo ln -fs "$NEWTMPDIR" $TMPDIR
echo "Temporary folder created, TMPDIR=$TMPDIR -> $NEWTMPDIR"
'
- sudo bash -c "rm -rf /var/cache/omnibus/src/*" || true
- pushd omnibus && bundle config set --local path 'vendor/bundle' && popd
- 'export GOMODCACHE=~/gomodcache
mkdir -p $GOMODCACHE
'
- bash .gitlab/build/package_build/build_agent_dmg.sh
- $S3_CP_CMD $OMNIBUS_PACKAGE_DIR/version-manifest.json $S3_SBOM_STORAGE_URI/$CI_JOB_NAME/version-manifest.json
stage: package_build
tags:
- macos:sonoma-amd64
- specific:true
timeout: 2h
variables:
AWS_SHARED_CREDENTIALS_FILE: ${CI_PROJECT_DIR}/.aws/credentials-by-job-id/${CI_JOB_ID}
BAZELISK_HOME: $XDG_CACHE_HOME/bazelisk
INTEGRATION_WHEELS_CACHE_BUCKET: dd-agent-omnibus
INTEGRATION_WHEELS_SKIP_CACHE_UPLOAD: true
KEYCHAIN_NAME: build.keychain
NOTARIZATION_ATTEMPTS: 3
NOTARIZATION_TIMEOUT: 15m
NOTARIZATION_WAIT_TIME: 15s
S3_OMNIBUS_CACHE_BUCKET: dd-ci-datadog-agent-omnibus-cache-build-stable
XDG_CACHE_HOME: $RUNNER_TEMP_PROJECT_DIRChanges Summary
ℹ️ Diff available in the job log. |
Contributor
Files inventory check summaryFile checks results against ancestor 73c6aece: Results for datadog-agent_7.81.0~devel.git.140.d904db0.pipeline.113840174-1_amd64.deb:No change detected |
aiuto
marked this pull request as ready for review
April 13, 2026 19:29
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8e85c0ad55
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| needs: ["go_mod_tidy_check"] | ||
| rules: | ||
| - if: $CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH =~ /^[0-9]+\.[0-9]+\.x$/ | ||
| - if: $CI_COMMIT_BRANCH == "nightly" || $CI_COMMIT_BRANCH =~ /^[0-9]+\.[0-9]+\.x$/ |
There was a problem hiding this comment.
This rule switches signing to CI_COMMIT_BRANCH == "nightly", but in this repo nightly runs are scheduled on main and identified via BUCKET_BRANCH (see .gitlab-ci.yml .if_scheduled_main at lines 441-443 and .on_deploy_nightly_repo_branch at 591-595). In that common nightly context, this condition is false, so SIGN=true is never set and DMG signing/notarization is skipped entirely until release branches.
Useful? React with 👍 / 👎.
Contributor
There was a problem hiding this comment.
@codex is right.
I see the intent to limit Apple notarization to nightly builds, which makes sense from a cost/perf perspective. That said, since this has already been scoped down to only main and release branches through #45439, we’ve already moved away from Continuous Integration.
At this point, I think it’s important we stop reducing coverage further, otherwise we risk missing issues earlier in the development cycle. Keeping notarization on main at least gives us a reasonable (frequent enough) safety net before releases.
Instead please consider the following effort on optimization:
Collaborator
Author
There was a problem hiding this comment.
I have been discussing this with Florent and the devx team.
We have all agreed this is sufficient.
It will both save CI time and reduce the number of fully signed images that we should never ship to customers.
Contributor
There was a problem hiding this comment.
-
I think on-call engineers should be consulted when the safety net has weakened to the point where all changes made throughout the day get integrated at once, because that makes it harder to narrow down the source of any regression.
-
@codex is still right on the P1 issue it flagged.
There was a problem hiding this comment.
To use Codex here, create a Codex account and connect to github.
Collaborator
Author
There was a problem hiding this comment.
Let's discuss this off line.
github-actions
Bot
added
medium review
aiuto
marked this pull request as draft
May 8, 2026 02:28
Contributor
|
This pull request has been automatically marked as stale because it has not had activity in the past 15 days. It will be closed in 30 days if no further activity occurs. If this pull request is still relevant, adding a comment or pushing new commits will keep it open. Also, you can always reopen the pull request if you missed the window. Thank you for your contributions! |
Contributor
|
This pull request was automatically closed because it has been stale for 15 days with no activity. If this pull request is still relevant, please reopen it or create a new pull request with updated information. Thanks! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Stops code signing on main, and moves it only to nightly.
Motivation
Get back ~7 minutes of wait time on the post merge finalization of every commit.
Discussion with delivery team indicates that doing this on nightly is sufficient to keep them alert for potential problems.
Describe how you validated your changes
If basic CI passes we merge this.
If some time (a week? until next release candidate freeze?) goes by without anyone finding a problem, we don't roll back. We also take a look at time for macos dmg jobs over the week to verify a measureable decrease.