Sign macos DMG only on nightly instead of main - #54797
Open
aiuto wants to merge 17 commits into
Open
Conversation
aiuto
added
changelog/no-changelog
github-actions
Bot
added
the
short review
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Contributor
Gitlab CI Configuration ChangesModified Jobs.agent_dmg .agent_dmg:
after_script:
- sudo umount /Volumes/Agent || true
artifacts:
expire_in: 2 weeks
paths:
- omnibus/pkg/*.dmg
- omnibus/pkg/version-manifest.json
before_script:
- sudo umount /Volumes/Agent || true
cache:
- key:
files:
- omnibus/Gemfile
- release.json
prefix: omnibus-deps-$CI_JOB_IMAGE-$CI_JOB_NAME-$OMNIBUS_RUBY_VERSION
paths:
- omnibus/vendor/bundle
id_tokens:
BUILDBARN_ID_TOKEN:
aud: buildbarn.us1.ddbuild.io
CI_IDENTITIES_GITLAB_ID_TOKEN:
aud: ci-identities
needs:
- go_mod_tidy_check
rules:
+ - if: ($CI_COMMIT_BRANCH == "main" && ($BUCKET_BRANCH == "nightly" || $BUCKET_BRANCH
- - if: $CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH =~ /^[0-9]+\.[0-9]+\.x$/
? - --- ^^^^^^^^^^^^^^^^^ ^^ ^
+ == "oldnightly")) || $CI_COMMIT_BRANCH =~ /^[0-9]+\.[0-9]+\.x$/
? ^ ^^^^ ^^^^^ ++
variables:
SIGN: true
- if: $CI_COMMIT_TAG =~ /^[0-9]+\.[0-9]+\.[0-9]+(-rc\.[0-9]+)?$/
variables:
SIGN: true
- if: $CI_COMMIT_BRANCH =~ /notarization/
variables:
SIGN: true
- if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
when: never
- changes:
compare_to: $COMPARE_TO_BRANCH
paths:
- comp/core/gui/impl/systray/**/*
- '**/*.m'
- if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
when: never
- changes:
compare_to: $COMPARE_TO_BRANCH
paths:
- omnibus/**/*
- .gitlab-ci.yml
- release.json
- .gitlab/build/package_build/**/*
- changes:
compare_to: $COMPARE_TO_BRANCH
paths:
- '**/*.bazel*'
- deps/**/*
- bazel/**/*
- tasks/build_tags.bzl
- if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
when: never
- if: $CI_COMMIT_BRANCH == "main" || $DEPLOY_AGENT == "true" || $RUN_ALL_BUILDS
== "true" || $DDR_WORKFLOW_ID != null
- changes:
compare_to: $COMPARE_TO_BRANCH
paths:
- omnibus/**/*
- if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
when: never
- allow_failure: true
when: manual
script:
- set -eo pipefail
- "if [ -z \"$TMPDIR\" ]; then\n echo \"TMPDIR must be set\" >& 2\n exit 1\nfi\n"
- export DDA_DIR="$TMPDIR/dda-${CI_JOB_ID}"
- export PATH="$DDA_DIR:$PATH"
- export DDA_NO_DYNAMIC_DEPS=1
- "# Perform installation only if the directory does not exist\nif [ ! -d \"$DDA_DIR\"\
\ ]; then\n robust_curl=\"curl -fsSL --retry 4\" # recommended flags + resist\
\ transient errors like `Connection reset by peer`\n # Get the commit from the\
\ build image variable in the format `vPIPELINE_ID-COMMIT`\n export BUILDIMAGES_COMMIT=\"\
${CI_IMAGE_LINUX#*-}\"\n export DDA_VERSION=\"$($robust_curl https://raw.githubusercontent.com/DataDog/datadog-agent-buildimages/${BUILDIMAGES_COMMIT}/dda.env\
\ | awk -F= '/^DDA_VERSION=/ {print $2}')\"\n # Detect architecture and download\
\ appropriate binary\n if [ \"$(uname -m)\" = \"arm64\" ]; then\n dda_target_triple=\"\
aarch64-apple-darwin\"\n else\n dda_target_triple=\"x86_64-apple-darwin\"\n\
\ fi\n $robust_curl -o dda.tar.gz https://github.com/DataDog/datadog-agent-dev/releases/download/${DDA_VERSION}/dda-${dda_target_triple}.tar.gz\n\
\ tar -xzf dda.tar.gz\n mkdir -p \"$DDA_DIR\"\n sudo mv dda $DDA_DIR\n rm\
\ -f dda.tar.gz\n # Explicitly bootstrap dda's managed environment. The stable\
\ mirror\n # (UV_DEFAULT_INDEX) lags new dda releases by a publish waiting period,\
\ so\n # let this install also resolve dda from the testing index already present\n\
\ # in UV_INDEX. Scoped to the bootstrap only.\n UV_INDEX_STRATEGY=unsafe-best-match\
\ dda self restore\n dda self dep sync -f legacy-tasks\n dda self pip install\
\ awscli==1.29.45\nfi\n"
- echo Setting up Go
- mkdir -p ~/go
- export GO_VERSION="$(cat .go-version)"
- eval "$(gimme $GO_VERSION)"
- export PATH="$PATH:$GOROOT/bin"
- echo Go version should be $GO_VERSION
- go version
- dda inv check-go-version
- DD_API_KEY="$("$CI_PROJECT_DIR"/tools/ci/fetch_secret.sh "$AGENT_API_KEY_ORG2"
token)" || exit $?; export DD_API_KEY
- DD_APP_KEY="$("$CI_PROJECT_DIR"/tools/ci/fetch_secret.sh "$AGENT_APP_KEY_ORG2"
token)" || exit $?; export DD_APP_KEY
- 'AWS_TOKEN="$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds:
21600")"
RUNNER_ID="$(curl -s http://169.254.169.254/latest/meta-data/instance-id -H "X-aws-ec2-metadata-token:
$AWS_TOKEN" || hostname)"
datadog-ci tag --level job --tags macos_runner:"$RUNNER_ID"
echo "Reported runner ID to Datadog: $RUNNER_ID"
'
- "if [ \"$CI_COMMIT_BRANCH\" = \"main\" ] || [[ \"$CI_COMMIT_BRANCH\" =~ ^[0-9]+\\\
.[0-9]+\\.(x|[0-9]+)$ ]]; then\n dda inv -- -e macos.report-versions -l all ||\
\ true\nfi\n"
- "if [ \"$((RANDOM%20))\" -eq 0 ]; then\n echo Trying to remove inactive versions\n\
\ dda inv -- -e macos.remove-inactive-versions -l python -t \"$PYTHON_VERSION\"\
\ || true\n dda inv -- -e macos.remove-inactive-versions -l go -t \"$(cat .go-version)\"\
\ || true\nfi\n"
- 'export TMPDIR=/tmp/gitlabci
NEWTMPDIR="$RUNNER_TEMP_PROJECT_DIR/gitlabci"
sudo rm -fr "$(realpath $TMPDIR)" "$NEWTMPDIR"
mkdir "$NEWTMPDIR"
sudo ln -fs "$NEWTMPDIR" $TMPDIR
echo "Temporary folder created, TMPDIR=$TMPDIR -> $NEWTMPDIR"
'
- sudo bash -c "rm -rf /var/cache/omnibus/src/*" || true
- pushd omnibus && bundle config set --local path 'vendor/bundle' && popd
- 'export GOPATH="$(go env GOPATH)"
export GOMODCACHE="$GOPATH/pkg/mod"
mkdir -p "$GOMODCACHE"
'
- . tools/ci/sanitize-goproxy.sh
- ci-identities-gitlab-job-client assume-role
- bash .gitlab/build/package_build/build_agent_dmg.sh
- $S3_CP_CMD $OMNIBUS_PACKAGE_DIR/version-manifest.json $S3_SBOM_STORAGE_URI/$CI_JOB_NAME/version-manifest.json
stage: package_build
timeout: 2h
variables:
AWS_SHARED_CREDENTIALS_FILE: ${CI_PROJECT_DIR}/.aws/credentials-by-job-id/${CI_JOB_ID}
BAZELISK_HOME: $XDG_CACHE_HOME/bazelisk
KEYCHAIN_NAME: build.keychain
NOTARIZATION_ATTEMPTS: 3
NOTARIZATION_TIMEOUT: 15m
NOTARIZATION_WAIT_TIME: 15s
S3_OMNIBUS_CACHE_BUCKET: dd-ci-datadog-agent-omnibus-cache-build-stable
XDG_CACHE_HOME: $RUNNER_TEMP_PROJECT_DIRagent_dmg-arm64-a7 agent_dmg-arm64-a7:
after_script:
- sudo umount /Volumes/Agent || true
artifacts:
expire_in: 2 weeks
paths:
- omnibus/pkg/*.dmg
- omnibus/pkg/version-manifest.json
before_script:
- sudo umount /Volumes/Agent || true
cache:
- key:
files:
- omnibus/Gemfile
- release.json
prefix: omnibus-deps-$CI_JOB_IMAGE-$CI_JOB_NAME-$OMNIBUS_RUBY_VERSION
paths:
- omnibus/vendor/bundle
id_tokens:
BUILDBARN_ID_TOKEN:
aud: buildbarn.us1.ddbuild.io
CI_IDENTITIES_GITLAB_ID_TOKEN:
aud: ci-identities
needs:
- go_mod_tidy_check
rules:
+ - if: ($CI_COMMIT_BRANCH == "main" && ($BUCKET_BRANCH == "nightly" || $BUCKET_BRANCH
- - if: $CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH =~ /^[0-9]+\.[0-9]+\.x$/
? - --- ^^^^^^^^^^^^^^^^^ ^^ ^
+ == "oldnightly")) || $CI_COMMIT_BRANCH =~ /^[0-9]+\.[0-9]+\.x$/
? ^ ^^^^ ^^^^^ ++
variables:
SIGN: true
- if: $CI_COMMIT_TAG =~ /^[0-9]+\.[0-9]+\.[0-9]+(-rc\.[0-9]+)?$/
variables:
SIGN: true
- if: $CI_COMMIT_BRANCH =~ /notarization/
variables:
SIGN: true
- if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
when: never
- changes:
compare_to: $COMPARE_TO_BRANCH
paths:
- comp/core/gui/impl/systray/**/*
- '**/*.m'
- if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
when: never
- changes:
compare_to: $COMPARE_TO_BRANCH
paths:
- omnibus/**/*
- .gitlab-ci.yml
- release.json
- .gitlab/build/package_build/**/*
- changes:
compare_to: $COMPARE_TO_BRANCH
paths:
- '**/*.bazel*'
- deps/**/*
- bazel/**/*
- tasks/build_tags.bzl
- if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
when: never
- if: $CI_COMMIT_BRANCH == "main" || $DEPLOY_AGENT == "true" || $RUN_ALL_BUILDS
== "true" || $DDR_WORKFLOW_ID != null
- changes:
compare_to: $COMPARE_TO_BRANCH
paths:
- omnibus/**/*
- if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
when: never
- allow_failure: true
when: manual
script:
- set -eo pipefail
- "if [ -z \"$TMPDIR\" ]; then\n echo \"TMPDIR must be set\" >& 2\n exit 1\nfi\n"
- export DDA_DIR="$TMPDIR/dda-${CI_JOB_ID}"
- export PATH="$DDA_DIR:$PATH"
- export DDA_NO_DYNAMIC_DEPS=1
- "# Perform installation only if the directory does not exist\nif [ ! -d \"$DDA_DIR\"\
\ ]; then\n robust_curl=\"curl -fsSL --retry 4\" # recommended flags + resist\
\ transient errors like `Connection reset by peer`\n # Get the commit from the\
\ build image variable in the format `vPIPELINE_ID-COMMIT`\n export BUILDIMAGES_COMMIT=\"\
${CI_IMAGE_LINUX#*-}\"\n export DDA_VERSION=\"$($robust_curl https://raw.githubusercontent.com/DataDog/datadog-agent-buildimages/${BUILDIMAGES_COMMIT}/dda.env\
\ | awk -F= '/^DDA_VERSION=/ {print $2}')\"\n # Detect architecture and download\
\ appropriate binary\n if [ \"$(uname -m)\" = \"arm64\" ]; then\n dda_target_triple=\"\
aarch64-apple-darwin\"\n else\n dda_target_triple=\"x86_64-apple-darwin\"\n\
\ fi\n $robust_curl -o dda.tar.gz https://github.com/DataDog/datadog-agent-dev/releases/download/${DDA_VERSION}/dda-${dda_target_triple}.tar.gz\n\
\ tar -xzf dda.tar.gz\n mkdir -p \"$DDA_DIR\"\n sudo mv dda $DDA_DIR\n rm\
\ -f dda.tar.gz\n # Explicitly bootstrap dda's managed environment. The stable\
\ mirror\n # (UV_DEFAULT_INDEX) lags new dda releases by a publish waiting period,\
\ so\n # let this install also resolve dda from the testing index already present\n\
\ # in UV_INDEX. Scoped to the bootstrap only.\n UV_INDEX_STRATEGY=unsafe-best-match\
\ dda self restore\n dda self dep sync -f legacy-tasks\n dda self pip install\
\ awscli==1.29.45\nfi\n"
- echo Setting up Go
- mkdir -p ~/go
- export GO_VERSION="$(cat .go-version)"
- eval "$(gimme $GO_VERSION)"
- export PATH="$PATH:$GOROOT/bin"
- echo Go version should be $GO_VERSION
- go version
- dda inv check-go-version
- DD_API_KEY="$("$CI_PROJECT_DIR"/tools/ci/fetch_secret.sh "$AGENT_API_KEY_ORG2"
token)" || exit $?; export DD_API_KEY
- DD_APP_KEY="$("$CI_PROJECT_DIR"/tools/ci/fetch_secret.sh "$AGENT_APP_KEY_ORG2"
token)" || exit $?; export DD_APP_KEY
- 'AWS_TOKEN="$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds:
21600")"
RUNNER_ID="$(curl -s http://169.254.169.254/latest/meta-data/instance-id -H "X-aws-ec2-metadata-token:
$AWS_TOKEN" || hostname)"
datadog-ci tag --level job --tags macos_runner:"$RUNNER_ID"
echo "Reported runner ID to Datadog: $RUNNER_ID"
'
- "if [ \"$CI_COMMIT_BRANCH\" = \"main\" ] || [[ \"$CI_COMMIT_BRANCH\" =~ ^[0-9]+\\\
.[0-9]+\\.(x|[0-9]+)$ ]]; then\n dda inv -- -e macos.report-versions -l all ||\
\ true\nfi\n"
- "if [ \"$((RANDOM%20))\" -eq 0 ]; then\n echo Trying to remove inactive versions\n\
\ dda inv -- -e macos.remove-inactive-versions -l python -t \"$PYTHON_VERSION\"\
\ || true\n dda inv -- -e macos.remove-inactive-versions -l go -t \"$(cat .go-version)\"\
\ || true\nfi\n"
- 'export TMPDIR=/tmp/gitlabci
NEWTMPDIR="$RUNNER_TEMP_PROJECT_DIR/gitlabci"
sudo rm -fr "$(realpath $TMPDIR)" "$NEWTMPDIR"
mkdir "$NEWTMPDIR"
sudo ln -fs "$NEWTMPDIR" $TMPDIR
echo "Temporary folder created, TMPDIR=$TMPDIR -> $NEWTMPDIR"
'
- sudo bash -c "rm -rf /var/cache/omnibus/src/*" || true
- pushd omnibus && bundle config set --local path 'vendor/bundle' && popd
- 'export GOPATH="$(go env GOPATH)"
export GOMODCACHE="$GOPATH/pkg/mod"
mkdir -p "$GOMODCACHE"
'
- . tools/ci/sanitize-goproxy.sh
- ci-identities-gitlab-job-client assume-role
- bash .gitlab/build/package_build/build_agent_dmg.sh
- $S3_CP_CMD $OMNIBUS_PACKAGE_DIR/version-manifest.json $S3_SBOM_STORAGE_URI/$CI_JOB_NAME/version-manifest.json
stage: package_build
tags:
- macos:sonoma-arm64
- specific:true
timeout: 2h
variables:
AWS_SHARED_CREDENTIALS_FILE: ${CI_PROJECT_DIR}/.aws/credentials-by-job-id/${CI_JOB_ID}
BAZELISK_HOME: $XDG_CACHE_HOME/bazelisk
KEYCHAIN_NAME: build.keychain
NOTARIZATION_ATTEMPTS: 3
NOTARIZATION_TIMEOUT: 15m
NOTARIZATION_WAIT_TIME: 15s
S3_OMNIBUS_CACHE_BUCKET: dd-ci-datadog-agent-omnibus-cache-build-stable
XDG_CACHE_HOME: $RUNNER_TEMP_PROJECT_DIRagent_dmg-x64-a7 agent_dmg-x64-a7:
after_script:
- sudo umount /Volumes/Agent || true
artifacts:
expire_in: 2 weeks
paths:
- omnibus/pkg/*.dmg
- omnibus/pkg/version-manifest.json
before_script:
- sudo umount /Volumes/Agent || true
cache:
- key:
files:
- omnibus/Gemfile
- release.json
prefix: omnibus-deps-$CI_JOB_IMAGE-$CI_JOB_NAME-$OMNIBUS_RUBY_VERSION
paths:
- omnibus/vendor/bundle
id_tokens:
BUILDBARN_ID_TOKEN:
aud: buildbarn.us1.ddbuild.io
CI_IDENTITIES_GITLAB_ID_TOKEN:
aud: ci-identities
needs:
- go_mod_tidy_check
rules:
+ - if: ($CI_COMMIT_BRANCH == "main" && ($BUCKET_BRANCH == "nightly" || $BUCKET_BRANCH
- - if: $CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH =~ /^[0-9]+\.[0-9]+\.x$/
? - --- ^^^^^^^^^^^^^^^^^ ^^ ^
+ == "oldnightly")) || $CI_COMMIT_BRANCH =~ /^[0-9]+\.[0-9]+\.x$/
? ^ ^^^^ ^^^^^ ++
variables:
SIGN: true
- if: $CI_COMMIT_TAG =~ /^[0-9]+\.[0-9]+\.[0-9]+(-rc\.[0-9]+)?$/
variables:
SIGN: true
- if: $CI_COMMIT_BRANCH =~ /notarization/
variables:
SIGN: true
- if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
when: never
- changes:
compare_to: $COMPARE_TO_BRANCH
paths:
- comp/core/gui/impl/systray/**/*
- '**/*.m'
- if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
when: never
- changes:
compare_to: $COMPARE_TO_BRANCH
paths:
- omnibus/**/*
- .gitlab-ci.yml
- release.json
- .gitlab/build/package_build/**/*
- changes:
compare_to: $COMPARE_TO_BRANCH
paths:
- '**/*.bazel*'
- deps/**/*
- bazel/**/*
- tasks/build_tags.bzl
- if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
when: never
- if: $CI_COMMIT_BRANCH == "main" || $DEPLOY_AGENT == "true" || $RUN_ALL_BUILDS
== "true" || $DDR_WORKFLOW_ID != null
- changes:
compare_to: $COMPARE_TO_BRANCH
paths:
- omnibus/**/*
- if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
when: never
- allow_failure: true
when: manual
script:
- set -eo pipefail
- "if [ -z \"$TMPDIR\" ]; then\n echo \"TMPDIR must be set\" >& 2\n exit 1\nfi\n"
- export DDA_DIR="$TMPDIR/dda-${CI_JOB_ID}"
- export PATH="$DDA_DIR:$PATH"
- export DDA_NO_DYNAMIC_DEPS=1
- "# Perform installation only if the directory does not exist\nif [ ! -d \"$DDA_DIR\"\
\ ]; then\n robust_curl=\"curl -fsSL --retry 4\" # recommended flags + resist\
\ transient errors like `Connection reset by peer`\n # Get the commit from the\
\ build image variable in the format `vPIPELINE_ID-COMMIT`\n export BUILDIMAGES_COMMIT=\"\
${CI_IMAGE_LINUX#*-}\"\n export DDA_VERSION=\"$($robust_curl https://raw.githubusercontent.com/DataDog/datadog-agent-buildimages/${BUILDIMAGES_COMMIT}/dda.env\
\ | awk -F= '/^DDA_VERSION=/ {print $2}')\"\n # Detect architecture and download\
\ appropriate binary\n if [ \"$(uname -m)\" = \"arm64\" ]; then\n dda_target_triple=\"\
aarch64-apple-darwin\"\n else\n dda_target_triple=\"x86_64-apple-darwin\"\n\
\ fi\n $robust_curl -o dda.tar.gz https://github.com/DataDog/datadog-agent-dev/releases/download/${DDA_VERSION}/dda-${dda_target_triple}.tar.gz\n\
\ tar -xzf dda.tar.gz\n mkdir -p \"$DDA_DIR\"\n sudo mv dda $DDA_DIR\n rm\
\ -f dda.tar.gz\n # Explicitly bootstrap dda's managed environment. The stable\
\ mirror\n # (UV_DEFAULT_INDEX) lags new dda releases by a publish waiting period,\
\ so\n # let this install also resolve dda from the testing index already present\n\
\ # in UV_INDEX. Scoped to the bootstrap only.\n UV_INDEX_STRATEGY=unsafe-best-match\
\ dda self restore\n dda self dep sync -f legacy-tasks\n dda self pip install\
\ awscli==1.29.45\nfi\n"
- echo Setting up Go
- mkdir -p ~/go
- export GO_VERSION="$(cat .go-version)"
- eval "$(gimme $GO_VERSION)"
- export PATH="$PATH:$GOROOT/bin"
- echo Go version should be $GO_VERSION
- go version
- dda inv check-go-version
- DD_API_KEY="$("$CI_PROJECT_DIR"/tools/ci/fetch_secret.sh "$AGENT_API_KEY_ORG2"
token)" || exit $?; export DD_API_KEY
- DD_APP_KEY="$("$CI_PROJECT_DIR"/tools/ci/fetch_secret.sh "$AGENT_APP_KEY_ORG2"
token)" || exit $?; export DD_APP_KEY
- 'AWS_TOKEN="$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds:
21600")"
RUNNER_ID="$(curl -s http://169.254.169.254/latest/meta-data/instance-id -H "X-aws-ec2-metadata-token:
$AWS_TOKEN" || hostname)"
datadog-ci tag --level job --tags macos_runner:"$RUNNER_ID"
echo "Reported runner ID to Datadog: $RUNNER_ID"
'
- "if [ \"$CI_COMMIT_BRANCH\" = \"main\" ] || [[ \"$CI_COMMIT_BRANCH\" =~ ^[0-9]+\\\
.[0-9]+\\.(x|[0-9]+)$ ]]; then\n dda inv -- -e macos.report-versions -l all ||\
\ true\nfi\n"
- "if [ \"$((RANDOM%20))\" -eq 0 ]; then\n echo Trying to remove inactive versions\n\
\ dda inv -- -e macos.remove-inactive-versions -l python -t \"$PYTHON_VERSION\"\
\ || true\n dda inv -- -e macos.remove-inactive-versions -l go -t \"$(cat .go-version)\"\
\ || true\nfi\n"
- 'export TMPDIR=/tmp/gitlabci
NEWTMPDIR="$RUNNER_TEMP_PROJECT_DIR/gitlabci"
sudo rm -fr "$(realpath $TMPDIR)" "$NEWTMPDIR"
mkdir "$NEWTMPDIR"
sudo ln -fs "$NEWTMPDIR" $TMPDIR
echo "Temporary folder created, TMPDIR=$TMPDIR -> $NEWTMPDIR"
'
- sudo bash -c "rm -rf /var/cache/omnibus/src/*" || true
- pushd omnibus && bundle config set --local path 'vendor/bundle' && popd
- 'export GOPATH="$(go env GOPATH)"
export GOMODCACHE="$GOPATH/pkg/mod"
mkdir -p "$GOMODCACHE"
'
- . tools/ci/sanitize-goproxy.sh
- ci-identities-gitlab-job-client assume-role
- bash .gitlab/build/package_build/build_agent_dmg.sh
- $S3_CP_CMD $OMNIBUS_PACKAGE_DIR/version-manifest.json $S3_SBOM_STORAGE_URI/$CI_JOB_NAME/version-manifest.json
stage: package_build
tags:
- macos:sonoma-amd64
- specific:true
timeout: 2h
variables:
AWS_SHARED_CREDENTIALS_FILE: ${CI_PROJECT_DIR}/.aws/credentials-by-job-id/${CI_JOB_ID}
BAZELISK_HOME: $XDG_CACHE_HOME/bazelisk
KEYCHAIN_NAME: build.keychain
NOTARIZATION_ATTEMPTS: 3
NOTARIZATION_TIMEOUT: 15m
NOTARIZATION_WAIT_TIME: 15s
S3_OMNIBUS_CACHE_BUCKET: dd-ci-datadog-agent-omnibus-cache-build-stable
XDG_CACHE_HOME: $RUNNER_TEMP_PROJECT_DIRChanges Summary
ℹ️ Diff available in the job log. |
Contributor
Files inventory check summaryFile checks results against ancestor bc3f4273: Results for datadog-agent_7.84.0~devel.git.483.770b104.pipeline.133364046-1_amd64.deb:No change detected Results for datadog-iot-agent_7.84.0~devel.git.483.770b104.pipeline.133364046-1_amd64.deb:No change detected |
We should not be creating notarized, installabler packages off of main. That creates artifacts which could appear to be end-user consumable, but are not supported, nor neccessarily validated.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5c0ba608b9
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
jack0x2
approved these changes
Aug 13, 2026
rdesgroppes
reviewed
Aug 13, 2026
rdesgroppes
left a comment
rdesgroppes
left a comment
Contributor
There was a problem hiding this comment.
I must admit that I am dismayed to see #49282 resurface through a different PR, despite earlier objections.
Collaborator
Author
|
I hear your belief that everything should be tested on all pushes to main, but this is not one of those flows that should be. Authorization to publish belongs in the release pipelines. |
aiuto
force-pushed
the
aiuto/no_mac_sign_main
branch
from
August 18, 2026 04:22
5c0ba60 to
947ca8c
Compare
FlorentClarret
approved these changes
Aug 18, 2026
Contributor
@aiuto To clarify my position: notarization originally ran in PR pipelines and could prevent regressions in the signing and notarization process from reaching main. The present PR removes that remaining per-commit validation: a nightly failure may cover an entire day of changes, making the responsible change substantially harder to identify, even with the investigation tooling available to us. I therefore do not think this decision should be made solely by the people responsible for the Agent release process. If the concern is that main produces apparently consumable artifacts, that should be addressed through artifact publication, visibility, retention, or labeling. |
Collaborator
Author
They actually have the biggest part of the choice. Security concerns also add to the choice. That's my wheelhouse. Correctness issues are minimal becuase this code is rarely touched and almost never breaks except for upstream flakes. |
Collaborator
Author
|
/merge |
|
View all feedbacks in Devflow UI.
It will be processed automatically as soon as GitHub reports it as mergeable. View in MergeQueue UI.
devflow unqueued this merge request: It did not become mergeable within the expected time |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Stops doing real signing and notarization of Macos DMG packages on main. Do it on nightly only so we maintain some testing of the process.
Give co-ownership of the artifact build job to the delivery team, as they should be the decision maker w.r.t. code signing.
Motivation
We should not be creating notarized, installable packages off of main. That creates artifacts which could appear to be end-user consumable, but are not supported, nor necessarily validated. Notarization also slightly DOSes Apple.
Ideally we should only do notarization on the release branches for candidate builds. We'll address that once we convert the build to bazel.
Describe how you validated your changes
CI
Additional Notes