Skip to content

Fix exception-threshold-bump when restoring lost headroom - #54615

Merged
gh-worker-dd-mergequeue-cf854d[bot] merged 1 commit into
mainfrom
regis.desgroppes/restore-static-quality-gates-headroom
Aug 10, 2026
Merged

Fix exception-threshold-bump when restoring lost headroom#54615
gh-worker-dd-mergequeue-cf854d[bot] merged 1 commit into
mainfrom
regis.desgroppes/restore-static-quality-gates-headroom

Conversation

@rdesgroppes

@rdesgroppes rdesgroppes commented Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

What does this PR do?

Fix fetch_main_headroom() in tasks/static_quality_gates/metrics.py: widen its lookback from 1 day to 7 so it doesn't miss main's last report over a weekend, and floor the computed headroom at BUFFER_SIZE instead of 0 when main is already over its own limit.

Motivation

agent_rpm_arm64/agent_suse_arm64 exceeded their 735.07 MiB limit on main, driven mainly by #54204's Rust data-security check (+3.49 MiB).
Restoring headroom via quality-gates.exception-threshold-bump should have been a one-line fix, but the script failed to produce a usable threshold, for two reasons:

  1. its 1-day lookback missed main's last report across the weekend gap between Friday's merges and the incident, since main only reports this metric when a commit lands,
  2. it sets the new limit to the PR's own reported size plus main's headroom, so whenever main's headroom was at or below 0 (as it was here) the new limit collapsed to just the PR's own size: a threshold still below main's actual usage, one that would not even have unblocked main.

Describe how you validated your changes

Added test_headroom_floored_when_main_over_its_own_limit (renamed from the now-inverted test_headroom_never_negative) asserting the floor applies when main is over budget.

Reran quality-gates.exception-threshold-bump twice independently: both runs produced identical thresholds, confirming the fix is deterministic.

@rdesgroppes rdesgroppes added changelog/no-changelog No changelog entry needed qa/no-code-change No code change in Agent code requiring validation labels Aug 10, 2026
@dd-octo-sts

dd-octo-sts Bot commented Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Files inventory check summary

File checks results against ancestor e98625f8:

Results for datadog-agent_7.84.0~devel.git.36.843f65f.pipeline.129910554-1_amd64.deb:

No change detected

Results for datadog-iot-agent_7.84.0~devel.git.36.843f65f.pipeline.129910554-1_amd64.deb:

No change detected

@dd-octo-sts

dd-octo-sts Bot commented Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Static quality checks

✅ Please find below the results from static quality gates
Comparison made with ancestor e98625f
📊 Static Quality Gates Dashboard
🔗 SQG Job

32 successful checks with minimal change (< 2 KiB)
Quality gate Current Size
✅ agent_deb_amd64 759.551 MiB
✅ agent_deb_amd64_fips 712.889 MiB
✅ agent_heroku_amd64 312.284 MiB
✅ agent_rpm_amd64 759.535 MiB
✅ agent_rpm_amd64_fips 712.873 MiB
✅ agent_rpm_arm64 735.491 MiB
✅ agent_rpm_arm64_fips 692.104 MiB
✅ agent_suse_amd64 759.535 MiB
✅ agent_suse_amd64_fips 712.873 MiB
✅ agent_suse_arm64 735.491 MiB
✅ agent_suse_arm64_fips 692.104 MiB
✅ docker_agent_amd64 818.162 MiB
✅ docker_agent_arm64 819.163 MiB
✅ docker_agent_jmx_amd64 1009.060 MiB
✅ docker_agent_jmx_arm64 998.713 MiB
✅ docker_cluster_agent_amd64 210.227 MiB
✅ docker_cluster_agent_arm64 223.267 MiB
✅ docker_cws_instrumentation_amd64 7.439 MiB
✅ docker_cws_instrumentation_arm64 6.877 MiB
✅ docker_dogstatsd_amd64 39.479 MiB
✅ docker_dogstatsd_arm64 37.560 MiB
✅ docker_host_profiler_amd64 305.801 MiB
✅ docker_host_profiler_arm64 317.116 MiB
✅ dogstatsd_deb_amd64 30.220 MiB
✅ dogstatsd_deb_arm64 28.243 MiB
✅ dogstatsd_rpm_amd64 30.220 MiB
✅ dogstatsd_suse_amd64 30.220 MiB
✅ iot_agent_deb_amd64 46.431 MiB
✅ iot_agent_deb_arm64 43.103 MiB
✅ iot_agent_deb_armhf 43.883 MiB
✅ iot_agent_rpm_amd64 46.432 MiB
✅ iot_agent_suse_amd64 46.431 MiB

@rdesgroppes
rdesgroppes force-pushed the regis.desgroppes/restore-static-quality-gates-headroom branch from 694a22e to 7ac4fbd Compare August 10, 2026 09:46
@dd-octo-sts dd-octo-sts Bot added internal Identify a non-fork PR team/agent-build labels Aug 10, 2026
@github-actions github-actions Bot added the short review PR is simple enough to be reviewed quickly label Aug 10, 2026
@rdesgroppes
rdesgroppes force-pushed the regis.desgroppes/restore-static-quality-gates-headroom branch from 7ac4fbd to dee19d1 Compare August 10, 2026 09:49
@rdesgroppes
rdesgroppes marked this pull request as ready for review August 10, 2026 09:49
@rdesgroppes
rdesgroppes requested a review from a team as a code owner August 10, 2026 09:49
@rdesgroppes
Fix exception-threshold-bump's headroom calculation
843f65f 
### What does this PR do?
Fix `fetch_main_headroom()` in tasks/static_quality_gates/metrics.py:
widen its lookback from 1 day to 7 so it doesn't miss `main`'s last
report over a weekend, and floor the computed headroom at `BUFFER_SIZE`
instead of 0 when main is already over its own limit.

### Motivation
`agent_rpm_arm64`/`agent_suse_arm64` exceeded their 735.07 MiB limit on
`main`, driven mainly by #54204's Rust data-security check (+3.49 MiB).
Restoring headroom via `quality-gates.exception-threshold-bump` should
have been a one-line fix, but the script failed to produce a usable
threshold, for two reasons.

Its 1-day lookback missed `main`'s last report across the weekend gap
between Friday's merges and the incident, since main only reports this
metric when a commit lands.

And it sets the new limit to the PR's own reported size plus main's
headroom, so whenever main's headroom was at or below 0 (as it was here)
the new limit collapsed to just the PR's own size: a threshold still
below main's actual usage, one that would not even have unblocked
`main`.

### Describe how you validated your changes
Added `test_headroom_floored_when_main_over_its_own_limit` (renamed from
the now-inverted `test_headroom_never_negative`) asserting the floor
applies when main is over budget.

Reran `quality-gates.exception-threshold-bump` twice independently: both
runs produced identical thresholds, confirming the fix is deterministic.
@rdesgroppes
rdesgroppes force-pushed the regis.desgroppes/restore-static-quality-gates-headroom branch from dee19d1 to 843f65f Compare August 10, 2026 10:41
@cit-pr-commenter-54b7da

cit-pr-commenter-54b7da Bot commented Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Regression Detector

Regression Detector Results

Metrics dashboard
Target profiles
Run ID: 572dd0cd-a3ec-4e6b-9a49-85ccdc17697c

Baseline: 0a076ce
Comparison: 1d86ce7
Diff

Optimization Goals: ✅ No significant changes detected

Fine details of change detection per experiment

perf experiment goal Δ mean % Δ mean % CI trials links
➖ quality_gate_logs % cpu utilization +1.67 [+0.82, +2.51] 1 Logs bounds checks dashboard
➖ quality_gate_idle memory utilization +0.12 [+0.07, +0.16] 1 Logs bounds checks dashboard
➖ quality_gate_security_mean_fs_load memory utilization +0.07 [+0.04, +0.11] 1 Logs bounds checks dashboard
➖ quality_gate_metrics_logs memory utilization +0.03 [-0.22, +0.27] 1 Logs bounds checks dashboard
➖ quality_gate_security_no_fs_load memory utilization -0.03 [-0.12, +0.07] 1 Logs bounds checks dashboard
➖ quality_gate_private_action_runner memory utilization -0.10 [-0.22, +0.02] 1 Logs bounds checks dashboard
➖ quality_gate_idle_all_features memory utilization -0.22 [-0.26, -0.18] 1 Logs bounds checks dashboard
➖ quality_gate_security_idle memory utilization -0.25 [-0.31, -0.19] 1 Logs bounds checks dashboard

Bounds Checks: ✅ Passed

perf experiment bounds_check_name replicates_passed observed_value links
✅ quality_gate_idle intake_connections 10/10 3 ≤ 4 bounds checks dashboard
✅ quality_gate_idle memory_usage 10/10 149.10MiB ≤ 154MiB bounds checks dashboard
✅ quality_gate_idle total_bytes_received 10/10 734.02KiB ≤ 819.20KiB bounds checks dashboard
✅ quality_gate_idle_all_features intake_connections 10/10 3 ≤ 4 bounds checks dashboard
✅ quality_gate_idle_all_features memory_usage 10/10 488.95MiB ≤ 512MiB bounds checks dashboard
✅ quality_gate_idle_all_features total_bytes_received 10/10 1.12MiB ≤ 1.25MiB bounds checks dashboard
✅ quality_gate_logs intake_connections 10/10 17 ≤ 40 bounds checks dashboard
✅ quality_gate_logs memory_usage 10/10 185.14MiB ≤ 195MiB bounds checks dashboard
✅ quality_gate_logs missed_bytes 10/10 0B = 0B bounds checks dashboard
✅ quality_gate_logs total_bytes_received 10/10 264.14MiB ≤ 292MiB bounds checks dashboard
✅ quality_gate_metrics_logs cpu_usage 10/10 367.03 ≤ 2000 bounds checks dashboard
✅ quality_gate_metrics_logs intake_connections 10/10 19 ≤ 40 bounds checks dashboard
✅ quality_gate_metrics_logs memory_usage 10/10 381.77MiB ≤ 430MiB bounds checks dashboard
✅ quality_gate_metrics_logs missed_bytes 10/10 0B = 0B bounds checks dashboard
✅ quality_gate_metrics_logs total_bytes_received 10/10 0.94GiB ≤ 1.04GiB bounds checks dashboard
✅ quality_gate_private_action_runner memory_usage 10/10 71.83MiB ≤ 75MiB bounds checks dashboard
✅ quality_gate_security_idle cpu_usage 10/10 28.41 ≤ 100 bounds checks dashboard
✅ quality_gate_security_idle memory_usage 10/10 300.85MiB ≤ 330MiB bounds checks dashboard
✅ quality_gate_security_mean_fs_load cpu_usage 10/10 57.81 ≤ 200 bounds checks dashboard
✅ quality_gate_security_mean_fs_load memory_usage 10/10 280.41MiB ≤ 310MiB bounds checks dashboard
✅ quality_gate_security_no_fs_load cpu_usage 10/10 26.04 ≤ 100 bounds checks dashboard
✅ quality_gate_security_no_fs_load memory_usage 10/10 286.73MiB ≤ 320MiB bounds checks dashboard

Explanation

Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%

Performance changes are noted in the perf column of each table:

  • ✅ = significantly better comparison variant performance
  • ❌ = significantly worse comparison variant performance
  • ➖ = no significant change in performance

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".

For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:

  1. Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.

  2. Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.

  3. Its configuration does not mark it "erratic".

Replicate Execution Details

We run multiple replicates for each experiment/variant. However, we allow replicates to be automatically retried if there are any failures, up to 8 times, at which point the replicate is marked dead and we are unable to run analysis for the entire experiment. We call each of these attempts at running replicates a replicate execution. This section lists all replicate executions that failed due to the target crashing or being oom killed.

Note: In the below tables we bucket failures by experiment, variant, and failure type. For each of these buckets we list out the replicate indexes that failed with an annotation signifying how many times said replicate failed with the given failure mode. In the below example the baseline variant of the experiment named experiment_with_failures had two replicates that failed by oom kills. Replicate 0, which failed 8 executions, and replicate 1 which failed 6 executions, all with the same failure mode.

Experiment Variant Replicates Failure Logs Debug Dashboard
experiment_with_failures baseline 0 (x8) 1 (x6) Oom killed Debug Dashboard

The debug dashboard links will take you to a debugging dashboard specifically designed to investigate replicate execution failures.

❌ Retried Profiling Replicate Execution Failures (ddprof)

Note: Profiling replicas may still be executing. See the debug dashboard for up to date status.

Experiment Variant Replicates Failure Debug Dashboard
quality_gate_idle comparison 10 Oom killed Debug Dashboard
quality_gate_idle_all_features baseline 10 Oom killed Debug Dashboard
quality_gate_idle_all_features comparison 10 Oom killed Debug Dashboard
quality_gate_logs comparison 10 Oom killed Debug Dashboard
quality_gate_metrics_logs baseline 10 Oom killed Debug Dashboard
quality_gate_metrics_logs comparison 10 Oom killed Debug Dashboard
quality_gate_security_idle baseline 10 Crashed (exit code: 134) Debug Dashboard
quality_gate_security_idle comparison 10 Oom killed Debug Dashboard
quality_gate_security_mean_fs_load baseline 10 Crashed (exit code: 134) Debug Dashboard
quality_gate_security_no_fs_load comparison 10 Oom killed Debug Dashboard

CI Pass/Fail Decision

✅ Passed. All Quality Gates passed.

  • quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
  • quality_gate_security_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_security_idle, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_security_mean_fs_load, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_security_mean_fs_load, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_idle_all_features, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
  • quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_private_action_runner, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_idle, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
  • quality_gate_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_security_no_fs_load, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_security_no_fs_load, bounds check memory_usage: 10/10 replicas passed. Gate passed.

@rdesgroppes rdesgroppes changed the title Fix exception-threshold-bump and restore lost headroom Fix exception-threshold-bump Aug 10, 2026
@rdesgroppes rdesgroppes changed the title Fix exception-threshold-bump Fix exception-threshold-bump when restoring lost headroom Aug 10, 2026
@rdesgroppes rdesgroppes mentioned this pull request Aug 10, 2026
Merged
rdesgroppes added a commit that referenced this pull request Aug 10, 2026
@rdesgroppes @claude
Restore static quality gates headroom for #54400
d08da9c 
### What does this PR do?
Bump `agent_rpm_arm64`/`agent_suse_arm64`'s `max_on_disk_size` using
`quality-gates.exception-threshold-bump`'s fix from #54615: the only
two gates PR #54400 is actually short on headroom for.

Also align each RPM/SUSE twin gate pair's `max_on_wire_size` up to the
higher of the two (`agent_rpm_amd64_fips`, `agent_rpm_arm64_fips`,
`agent_suse_arm64`, `iot_agent_suse_amd64`): RPM and SUSE packages are
the same format, so a twin pair drifting apart is noise, not signal.

### Motivation
PR #54400 (an incident fix) is blocked by these two gates, both at
zero margin on `main` after #54204's Rust data-security check. A
rebase alone left it short by 34 KiB.

### Describe how you validated your changes
Confirmed against PR #54400's live metrics: it currently fails only
`agent_rpm_arm64`/`agent_suse_arm64` on-disk, by 34.26 KiB; against
these new thresholds, none of its 33 gates fail.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@gh-worker-dd-mergequeue-cf854d
gh-worker-dd-mergequeue-cf854d Bot merged commit 1d86ce7 into main Aug 10, 2026
249 checks passed
@gh-worker-dd-mergequeue-cf854d
gh-worker-dd-mergequeue-cf854d Bot deleted the regis.desgroppes/restore-static-quality-gates-headroom branch August 10, 2026 14:17
@github-actions github-actions Bot added this to the 7.84.0 milestone Aug 10, 2026
github-actions Bot pushed a commit that referenced this pull request Aug 10, 2026
@gh-worker-dd-mergequeue-cf854d
Fix exception-threshold-bump when restoring lost headroom (#54615)
62f4c91 
### What does this PR do?
Fix `fetch_main_headroom()` in tasks/static_quality_gates/metrics.py: widen its lookback from 1 day to 7 so it doesn't miss `main`'s last report over a weekend, and floor the computed headroom at `BUFFER_SIZE` instead of 0 when main is already over its own limit.

### Motivation
`agent_rpm_arm64`/`agent_suse_arm64` exceeded their 735.07 MiB limit on `main`, driven mainly by #54204's Rust data-security check (+3.49 MiB).
Restoring headroom via `quality-gates.exception-threshold-bump` should have been a one-line fix, but the script failed to produce a usable threshold, for two reasons:
1. its 1-day lookback missed `main`'s last report across the weekend gap between Friday's merges and the incident, since main only reports this metric when a commit lands,
2. it sets the new limit to the PR's own reported size plus main's headroom, so whenever main's headroom was at or below 0 (as it was here) the new limit collapsed to just the PR's own size: a threshold still below main's actual usage, one that would not even have unblocked `main`.

### Describe how you validated your changes
Added `test_headroom_floored_when_main_over_its_own_limit` (renamed from the now-inverted `test_headroom_never_negative`) asserting the floor applies when main is over budget.

Reran `quality-gates.exception-threshold-bump` twice independently: both runs produced identical thresholds, confirming the fix is deterministic.

Co-authored-by: regis.desgroppes <regis.desgroppes@datadoghq.com> 1d86ce7
gh-worker-dd-mergequeue-cf854d Bot pushed a commit that referenced this pull request Aug 10, 2026
@rdesgroppes
Restore static quality gates headroom for #54400 (#54637)
6e8afe6 
### What does this PR do?
Bump `agent_rpm_arm64`/`agent_suse_arm64`'s `max_on_disk_size` using `quality-gates.exception-threshold-bump`'s fix from #54615: the only two gates PR #54400 is actually short on headroom for.

Also align each RPM/SUSE twin gate pair's `max_on_wire_size` up to the higher of the two (`agent_rpm_amd64_fips`, `agent_rpm_arm64_fips`, `agent_suse_arm64`, `iot_agent_suse_amd64`): RPM and SUSE packages are the same format, so a twin pair drifting apart is noise, not signal.

### Motivation
#54400 (an incident fix) is blocked by these two gates, both at zero margin on `main` after #54204's Rust data-security check.
A rebase alone left it short by 34 KiB.

### Describe how you validated your changes
Confirmed against #54400's live metrics: it currently fails only `agent_rpm_arm64`/`agent_suse_arm64` on-disk, by 34.26 KiB.
Against these new thresholds, none of its 33 gates fail.

Co-authored-by: regis.desgroppes <regis.desgroppes@datadoghq.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@JSGette JSGette JSGette approved these changes

Assignees

No one assigned

Labels

changelog/no-changelog No changelog entry needed internal Identify a non-fork PR qa/no-code-change No code change in Agent code requiring validation short review PR is simple enough to be reviewed quickly team/agent-build

Projects

None yet

Milestone

7.84.0

Development

Successfully merging this pull request may close these issues.

2 participants

@rdesgroppes @JSGette