fix: publish-before-populate data race in compliance reportCheckEvents (#54661)

<!--Please give us some feedback on your experience writing this PR ! https://app.datadoghq.com/forms/43db4c02-6837-400c-8083-692e141b1b88 !-->

### What does this PR do?
Fixes a data race in `pkg/compliance`'s `reportCheckEvents()`: it mutated `event.Container.Image*` and `event.K8SManaged` after `updateEvent()` had already published the event into `a.statuses`, where the expvar/status endpoint reads it without a lock. Reorders those mutations to happen before publish, and makes `updateEvent()`/`getChecksStatus()` store/return copies so nothing outside the lock can mutate what a concurrent reader sees.

### Motivation
Found via a race-detector-enabled build in staging, which reported isolated `WARNING: DATA RACE` occurrences in system-probe whenever the status endpoint was scraped while a compliance check event was being reported.

### Describe how you validated your changes
Added `TestReportCheckEventsConcurrentStatusRead`, which races `reportCheckEvents()` against concurrent reads of the checks status. Confirmed it fails under `-race` before this fix and passes cleanly after; full `pkg/compliance` suite (137 tests) also passes under `-race`.

### Additional Notes
No behavior change — events are published fully-formed instead of partially, same final content.

Co-authored-by: pierre.gimalac <pierre.gimalac@datadoghq.com>

Author: pgimalac

pkg/compliance/BUILD.bazel

@@ -191,6 +191,7 @@ go_library(
 dd_agent_go_test(
     name = "compliance_test",
     srcs = [
+        "agent_race_test.go",
         "agent_test.go",
         "cri_test.go",
         "k8s_reflectors_test.go",
@@ -213,10 +214,17 @@ dd_agent_go_test(
         ],
     ],
     deps = [
+        "//comp/core/config",
+        "//comp/core/log/mock",
         "//comp/core/secrets/noop-impl",
+        "//comp/core/workloadmeta/def",
+        "//comp/core/workloadmeta/impl",
+        "//comp/def",
         "//comp/logs-library/client",
         "//comp/logs/agent/config",
         "//comp/serializer/logscompression/fx-mock",
+        "//pkg/logs/message",
+        "//pkg/logs/sources",
         "@com_github_stretchr_testify//assert",
         "@com_github_stretchr_testify//require",
         "@io_k8s_api//rbac/v1:rbac",

pkg/compliance/agent.go

@@ -575,18 +575,21 @@ func (a *Agent) reportCheckEvents(eventsTTL time.Duration, events ...*CheckEvent
 	eventsExpireAt := time.Now().Add(2 * eventsTTL).Truncate(1 * time.Second)
 	for _, event := range events {
 		event.ExpireAt = &eventsExpireAt
+		// Mutate event fully before updateEvent() publishes it into a.statuses.
+		if event.Result != CheckSkipped {
+			if a.wmeta != nil && event.Container != nil {
+				if ctnr, _ := a.wmeta.GetContainer(event.Container.ContainerID); ctnr != nil {
+					event.Container.ImageID = ctnr.Image.ID
+					event.Container.ImageName = ctnr.Image.Name
+					event.Container.ImageTag = ctnr.Image.Tag
+				}
+			}
+			event.K8SManaged = a.k8sManaged
+		}
 		a.updateEvent(event)
 		if event.Result == CheckSkipped {
 			continue
 		}
-		if a.wmeta != nil && event.Container != nil {
-			if ctnr, _ := a.wmeta.GetContainer(event.Container.ContainerID); ctnr != nil {
-				event.Container.ImageID = ctnr.Image.ID
-				event.Container.ImageName = ctnr.Image.Name
-				event.Container.ImageTag = ctnr.Image.Tag
-			}
-		}
-		event.K8SManaged = a.k8sManaged
 		a.opts.Reporter.ReportEvent(event)
 	}
 }
@@ -613,7 +616,9 @@ func (a *Agent) getChecksStatus() []*CheckStatus {
 	defer a.statusesMu.RUnlock()
 	statuses := make([]*CheckStatus, 0, len(a.statuses))
 	for _, status := range a.statuses {
-		statuses = append(statuses, status)
+		// Copy under the lock: callers marshal the result without holding it.
+		statusCopy := *status
+		statuses = append(statuses, &statusCopy)
 	}
 	return statuses
 }
@@ -657,7 +662,9 @@ func (a *Agent) updateEvent(event *CheckEvent) {
 	if !ok || status == nil {
 		log.Errorf("check for rule=%s was not registered in checks monitor statuses", event.RuleID)
 	} else {
-		status.LastEvent = event
+		// Publish a copy: callers must not be able to mutate it afterwards.
+		eventCopy := *event
+		status.LastEvent = &eventCopy
 	}
 }
 

pkg/compliance/agent_race_test.go

@@ -0,0 +1,97 @@
+// Unless explicitly stated otherwise all files in this repository are licensed
+// under the Apache License Version 2.0.
+// This product includes software developed at Datadog (https://www.datadoghq.com/).
+// Copyright 2016-present Datadog, Inc.
+
+package compliance
+
+import (
+	"expvar"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/DataDog/datadog-agent/comp/core/config"
+	logmock "github.com/DataDog/datadog-agent/comp/core/log/mock"
+	workloadmeta "github.com/DataDog/datadog-agent/comp/core/workloadmeta/def"
+	workloadmetaimpl "github.com/DataDog/datadog-agent/comp/core/workloadmeta/impl"
+	compdef "github.com/DataDog/datadog-agent/comp/def"
+	logsconfig "github.com/DataDog/datadog-agent/comp/logs/agent/config"
+	"github.com/DataDog/datadog-agent/pkg/logs/message"
+	"github.com/DataDog/datadog-agent/pkg/logs/sources"
+)
+
+// TestReportCheckEventsConcurrentStatusRead races reportCheckEvents() against
+// concurrent status reads, mirroring the expvar/status endpoint. Run with -race.
+func TestReportCheckEventsConcurrentStatusRead(t *testing.T) {
+	const containerID = "abc123"
+
+	wmetaMock := workloadmetaimpl.NewWorkloadMetaMock(workloadmetaimpl.Dependencies{
+		Lc:     compdef.NewTestLifecycle(t),
+		Log:    logmock.New(t),
+		Config: config.NewMock(t),
+		Params: workloadmeta.NewParams(),
+	})
+	wmetaMock.Set(&workloadmeta.Container{
+		EntityID: workloadmeta.EntityID{Kind: workloadmeta.KindContainer, ID: containerID},
+		Image: workloadmeta.ContainerImage{
+			ID:   "sha256:deadbeef",
+			Name: "redis",
+			Tag:  "latest",
+		},
+	})
+
+	// LogReporter is built directly (same package) with a drained, buffered
+	// channel instead of a real network pipeline, so ReportEvent never blocks.
+	logChan := make(chan *message.Message, 100)
+	go func() {
+		for msg := range logChan {
+			_ = msg
+		}
+	}()
+	reporter := &LogReporter{
+		hostname:  "test-host",
+		logSource: sources.NewLogSource("test", &logsconfig.LogsConfig{Type: "test", Source: "test"}),
+		logChan:   logChan,
+		endpoints: &logsconfig.Endpoints{},
+	}
+
+	managedEnv := "test-managed-env"
+	a := &Agent{
+		wmeta: wmetaMock,
+		opts:  AgentOptions{Reporter: reporter},
+		statuses: map[string]*CheckStatus{
+			"rule-1": {RuleID: "rule-1"},
+		},
+		k8sManaged: &managedEnv,
+	}
+
+	statusFn := expvar.Func(func() interface{} { return a.getChecksStatus() })
+
+	stop := make(chan struct{})
+	var wg sync.WaitGroup
+	wg.Go(func() {
+		for {
+			select {
+			case <-stop:
+				return
+			default:
+				_ = statusFn.String()
+			}
+		}
+	})
+
+	for i := 0; i < 2000; i++ {
+		event := &CheckEvent{
+			RuleID: "rule-1",
+			Result: CheckPassed,
+			Container: &CheckContainerMeta{
+				ContainerID: containerID,
+			},
+		}
+		a.reportCheckEvents(time.Minute, event)
+	}
+
+	close(stop)
+	wg.Wait()
+}