Skip to content

Skip full git clones on Windows package jobs - #54921

Open
mikesherovdd wants to merge 3 commits into
mainfrom
cursor/windows-package-shallow-clone
Open

Skip full git clones on Windows package jobs#54921
mikesherovdd wants to merge 3 commits into
mainfrom
cursor/windows-package-shallow-clone

Conversation

@mikesherovdd

@mikesherovdd mikesherovdd commented Aug 14, 2026

Copy link
Copy Markdown
Contributor

What does this PR do?

Stop Windows MSI/zip package jobs from doing a full git clone (GIT_DEPTH: 0). They only needed history so get_version() could run git describe --tags inside the build container, which has no AWS credentials.

Instead, download agent-version.cache on the runner host (after assume-role) and fail the job if that copy fails. The file is mounted into the container and xcopied into the buildroot, so get_version() reads the cache and never calls git describe.

Motivation

Full clones of this repo are expensive. These jobs can use the pipeline-default shallow clone once versioning comes from setup_agent_version's S3 cache.

Describe how you validated your changes

  • Confirmed go_deps already needs: setup_agent_version, so the cache object exists before package jobs start.
  • Confirmed the host before_script assume-role still runs (this change is in script, so it is not overwritten).
  • S3 copy uses the same Invoke-Expression + $lastExitCode pattern as .upload_sbom_artifacts_windows, because PowerShell 5 does not fail the job on a native aws.exe error.

Additional Notes

CI-only; no release note.

Made with Cursor

@mikesherovdd @cursoragent
Skip full git clones on Windows package jobs.
db4c825 
Fetch agent-version.cache on the runner host so get_version() does not fall back to git describe inside the build container.

Co-authored-by: Cursor <cursoragent@cursor.com>
@github-actions github-actions Bot added the short review PR is simple enough to be reviewed quickly label Aug 14, 2026
@mikesherovdd
mikesherovdd marked this pull request as ready for review August 14, 2026 17:36
@mikesherovdd
mikesherovdd requested review from a team as code owners August 14, 2026 17:36
@mikesherovdd
mikesherovdd requested a review from mrafi97 August 14, 2026 17:36
@github-actions github-actions Bot deleted a comment from chatgpt-codex-connector Bot Aug 14, 2026
@mikesherovdd mikesherovdd added the qa/no-code-change No code change in Agent code requiring validation label Aug 14, 2026
@dd-octo-sts

dd-octo-sts Bot commented Aug 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Gitlab CI Configuration Changes

Modified Jobs
.windows_main_agent_base 
  .windows_main_agent_base:
    artifacts:
      expire_in: 2 weeks
      paths:
      - omnibus/pkg/pipeline-$CI_PIPELINE_ID
    before_script:
    - C:\ci-identities-gitlab-job-client.exe assume-role
    id_tokens:
      BUILDBARN_ID_TOKEN:
        aud: buildbarn.us1.ddbuild.io
      CI_IDENTITIES_GITLAB_ID_TOKEN:
        aud: ci-identities
    needs:
    - go_deps
    script:
    - $ErrorActionPreference = 'Stop'
+   - Invoke-Expression "$S3_CP_CMD $S3_ARTIFACTS_URI/agent-version.cache ."
+   - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    - . ./tools/ci/sanitize-goproxy.ps1
    - if (Test-Path omnibus\pkg) { remove-item -recurse -force omnibus\pkg }
    - mkdir omnibus\pkg
    - '.\tools\ci\docker-run-with-bazel-cache.ps1 -m 24576M -v "$(Get-Location):c:\mnt"
      -e DDA_FEATURE_FLAGS_CI_SSM_KEY_WINDOWS="${DDA_FEATURE_FLAGS_CI_SSM_KEY_WINDOWS}"
      -e GITLAB_CI -e CI_JOB_ID -e CI_PIPELINE_ID -e CI_PROJECT_NAME -e CI_COMMIT_BRANCH
      -e CI_JOB_NAME_SLUG -e CI_COMMIT_REF_NAME -e OMNIBUS_TARGET -e WINDOWS_BUILDER=true
      -e INTEGRATIONS_CORE_VERSION -e INTEGRATIONS_WHEELS_STORAGE -e WINDOWS_DDNPM_DRIVER
      -e WINDOWS_DDNPM_VERSION -e WINDOWS_DDNPM_SHASUM -e WINDOWS_DDPROCMON_DRIVER -e
      WINDOWS_DDPROCMON_VERSION -e WINDOWS_DDPROCMON_SHASUM -e GOMODCACHE="c:\modcache"
      -e GOPROXY -e GONOSUMDB -e AWS_NETWORKING=true -e SIGN_WINDOWS_DD_WCS=true -e
      WINDOWS_SIGNING_CERT -e WINDOWS_SIGNING_CONFIG -e TARGET_ARCH="$ARCH" -e DEBUG_CUSTOMACTION
      -e BUCKET_BRANCH -e S3_OMNIBUS_CACHE_BUCKET -e S3_OMNIBUS_GIT_CACHE_BUCKET -e
      BUNDLE_MIRROR__RUBYGEMS__ORG -e PIP_INDEX_URL -e AGENT_API_KEY_ORG2 -e OMNIBUS_GIT_CACHE_DIR=${Env:TEMP}/${CI_PIPELINE_ID}/omnibus-git-cache
      -e AGENT_FLAVOR -e OMNIBUS_RUBY_VERSION -e PYTHONUTF8=1 -e E2E_COVERAGE_PIPELINE
      -e DEPLOY_AGENT -e CI_JOB_TOKEN -e CI_IDENTITIES_GITLAB_ID_TOKEN ${WINBUILDIMAGE}
      powershell -C "c:\mnt\tasks\winbuildscripts\Build-AgentPackages.ps1 -BuildOutOfSource
      1 -InstallDeps 1 -CheckGoVersion 1 -BuildUpgrade 1"
  
      '
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    - get-childitem omnibus\pkg\pipeline-$CI_PIPELINE_ID
    - Invoke-Expression "$S3_CP_CMD omnibus\pkg\pipeline-$CI_PIPELINE_ID\version-manifest.json
      $S3_SBOM_STORAGE_URI/$CI_JOB_NAME/version-manifest.json"
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    stage: package_build
    tags:
    - windows-v2:2022
    variables:
      AWS_SHARED_CREDENTIALS_FILE: ${CI_PROJECT_DIR}\.aws\credentials-by-job-id\${CI_JOB_ID}
      BAZELISK_HOME: $XDG_CACHE_HOME/bazelisk
-     GIT_DEPTH: 0
      GIT_STRATEGY: clone
      OMNIBUS_TARGET: main
      WINBUILDIMAGE: registry.ddbuild.io/ci/datadog-agent-buildimages/windows_ltsc2022_${ARCH}${CI_IMAGE_WIN_LTSC2022_X64_SUFFIX}:${CI_IMAGE_WIN_LTSC2022_X64}
      XDG_CACHE_HOME: c:/bzl
.windows_msi_base 
  .windows_msi_base:
    artifacts:
      expire_in: 2 weeks
      paths:
      - omnibus/pkg/pipeline-$CI_PIPELINE_ID
    before_script:
    - C:\ci-identities-gitlab-job-client.exe assume-role
    id_tokens:
      BUILDBARN_ID_TOKEN:
        aud: buildbarn.us1.ddbuild.io
      CI_IDENTITIES_GITLAB_ID_TOKEN:
        aud: ci-identities
    needs:
    - go_deps
    script:
    - $ErrorActionPreference = 'Stop'
+   - Invoke-Expression "$S3_CP_CMD $S3_ARTIFACTS_URI/agent-version.cache ."
+   - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    - . ./tools/ci/sanitize-goproxy.ps1
    - if (Test-Path omnibus\pkg) { remove-item -recurse -force omnibus\pkg }
    - mkdir omnibus\pkg
    - '.\tools\ci\docker-run-with-bazel-cache.ps1 -m 24576M -v "$(Get-Location):c:\mnt"
      -e DDA_FEATURE_FLAGS_CI_SSM_KEY_WINDOWS="${DDA_FEATURE_FLAGS_CI_SSM_KEY_WINDOWS}"
      -e GITLAB_CI -e CI_JOB_ID -e CI_PIPELINE_ID -e CI_PROJECT_NAME -e CI_COMMIT_BRANCH
      -e CI_JOB_NAME_SLUG -e CI_COMMIT_REF_NAME -e OMNIBUS_TARGET -e WINDOWS_BUILDER=true
      -e INTEGRATIONS_CORE_VERSION -e INTEGRATIONS_WHEELS_STORAGE -e WINDOWS_DDNPM_DRIVER
      -e WINDOWS_DDNPM_VERSION -e WINDOWS_DDNPM_SHASUM -e WINDOWS_DDPROCMON_DRIVER -e
      WINDOWS_DDPROCMON_VERSION -e WINDOWS_DDPROCMON_SHASUM -e GOMODCACHE="c:\modcache"
      -e GOPROXY -e GONOSUMDB -e AWS_NETWORKING=true -e SIGN_WINDOWS_DD_WCS=true -e
      WINDOWS_SIGNING_CERT -e WINDOWS_SIGNING_CONFIG -e TARGET_ARCH="$ARCH" -e DEBUG_CUSTOMACTION
      -e BUCKET_BRANCH -e S3_OMNIBUS_CACHE_BUCKET -e S3_OMNIBUS_GIT_CACHE_BUCKET -e
      BUNDLE_MIRROR__RUBYGEMS__ORG -e PIP_INDEX_URL -e AGENT_API_KEY_ORG2 -e OMNIBUS_GIT_CACHE_DIR=${Env:TEMP}/${CI_PIPELINE_ID}/omnibus-git-cache
      -e AGENT_FLAVOR -e OMNIBUS_RUBY_VERSION -e PYTHONUTF8=1 -e E2E_COVERAGE_PIPELINE
      -e DEPLOY_AGENT -e CI_JOB_TOKEN -e CI_IDENTITIES_GITLAB_ID_TOKEN ${WINBUILDIMAGE}
      powershell -C "c:\mnt\tasks\winbuildscripts\Build-AgentPackages.ps1 -BuildOutOfSource
      1 -InstallDeps 1 -CheckGoVersion 1 -BuildUpgrade 1"
  
      '
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    - get-childitem omnibus\pkg\pipeline-$CI_PIPELINE_ID
    - Invoke-Expression "$S3_CP_CMD omnibus\pkg\pipeline-$CI_PIPELINE_ID\version-manifest.json
      $S3_SBOM_STORAGE_URI/$CI_JOB_NAME/version-manifest.json"
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    stage: package_build
    tags:
    - windows-v2:2022
    variables:
      AWS_SHARED_CREDENTIALS_FILE: ${CI_PROJECT_DIR}\.aws\credentials-by-job-id\${CI_JOB_ID}
      BAZELISK_HOME: $XDG_CACHE_HOME/bazelisk
-     GIT_DEPTH: 0
      GIT_STRATEGY: clone
      WINBUILDIMAGE: registry.ddbuild.io/ci/datadog-agent-buildimages/windows_ltsc2022_${ARCH}${CI_IMAGE_WIN_LTSC2022_X64_SUFFIX}:${CI_IMAGE_WIN_LTSC2022_X64}
      XDG_CACHE_HOME: c:/bzl
.windows_zip_base 
  .windows_zip_base:
    artifacts:
      expire_in: 2 weeks
      paths:
      - omnibus/pkg/pipeline-$CI_PIPELINE_ID
    before_script:
    - C:\ci-identities-gitlab-job-client.exe assume-role
    id_tokens:
      CI_IDENTITIES_GITLAB_ID_TOKEN:
        aud: ci-identities
    needs:
    - go_deps
    rules:
    - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
      when: never
    - when: on_success
    script:
    - $ErrorActionPreference = "Stop"
+   - Invoke-Expression "$S3_CP_CMD $S3_ARTIFACTS_URI/agent-version.cache ."
+   - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    - . ./tools/ci/sanitize-goproxy.ps1
    - if (Test-Path omnibus\pkg) { remove-item -recurse -force omnibus\pkg }
    - mkdir omnibus\pkg
    - 'docker run --rm -m 24576M -v "$(Get-Location):c:\mnt" -e CI -e GITLAB_CI -e CI_COMMIT_BRANCH
      -e CI_PIPELINE_ID -e CI_JOB_ID -e CI_PROJECT_NAME -e CI_JOB_NAME_SLUG -e CI_COMMIT_REF_NAME
      -e OMNIBUS_TARGET -e WINDOWS_BUILDER=true -e INTEGRATIONS_CORE_VERSION -e INTEGRATIONS_WHEELS_STORAGE
      -e WINDOWS_DDNPM_DRIVER -e WINDOWS_DDNPM_VERSION -e WINDOWS_DDNPM_SHASUM -e WINDOWS_DDPROCMON_DRIVER
      -e WINDOWS_DDPROCMON_VERSION -e WINDOWS_DDPROCMON_SHASUM -e GOMODCACHE="c:\modcache"
      -e GOPROXY -e GONOSUMDB -e AWS_NETWORKING=true -e SIGN_WINDOWS_DD_WCS=true -e
      WINDOWS_SIGNING_CERT -e WINDOWS_SIGNING_CONFIG -e BUCKET_BRANCH -e S3_OMNIBUS_CACHE_BUCKET
      -e USE_S3_CACHING -e BUNDLE_MIRROR__RUBYGEMS__ORG -e PIP_INDEX_URL -e AGENT_API_KEY_ORG2
      -e CI_IDENTITIES_GITLAB_ID_TOKEN ${WINBUILDIMAGE} powershell -C "c:\mnt\tasks\winbuildscripts\Build-OmnibusTarget.ps1
      -BuildOutOfSource 1 -InstallDeps 1 -CheckGoVersion 1"
  
      '
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    - get-childitem omnibus\pkg\pipeline-$CI_PIPELINE_ID
    - Invoke-Expression "$S3_CP_CMD omnibus\pkg\pipeline-$CI_PIPELINE_ID\version-manifest.json
      $S3_SBOM_STORAGE_URI/$CI_JOB_NAME/version-manifest.json"
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    stage: package_build
    tags:
    - windows-v2:2022
    variables:
      ARCH: x64
      AWS_SHARED_CREDENTIALS_FILE: ${CI_PROJECT_DIR}\.aws\credentials-by-job-id\${CI_JOB_ID}
-     GIT_DEPTH: 0
      GIT_STRATEGY: clone
      WINBUILDIMAGE: registry.ddbuild.io/ci/datadog-agent-buildimages/windows_ltsc2022_${ARCH}${CI_IMAGE_WIN_LTSC2022_X64_SUFFIX}:${CI_IMAGE_WIN_LTSC2022_X64}
.windows_zip_bazel_base 
  .windows_zip_bazel_base:
    artifacts:
      expire_in: 2 weeks
      paths:
      - omnibus/pkg/pipeline-$CI_PIPELINE_ID
    before_script:
    - C:\ci-identities-gitlab-job-client.exe assume-role
    id_tokens:
      BUILDBARN_ID_TOKEN:
        aud: buildbarn.us1.ddbuild.io
      CI_IDENTITIES_GITLAB_ID_TOKEN:
        aud: ci-identities
    needs:
    - go_deps
    rules:
    - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
      when: never
    - when: on_success
    script:
    - $ErrorActionPreference = "Stop"
+   - Invoke-Expression "$S3_CP_CMD $S3_ARTIFACTS_URI/agent-version.cache ."
+   - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    - . ./tools/ci/sanitize-goproxy.ps1
    - if (Test-Path omnibus\pkg) { remove-item -recurse -force omnibus\pkg }
    - mkdir omnibus\pkg
    - '.\tools\ci\docker-run-with-bazel-cache.ps1 -m 24576M -v "$(Get-Location):c:\mnt"
      -e DDA_FEATURE_FLAGS_CI_SSM_KEY_WINDOWS="${DDA_FEATURE_FLAGS_CI_SSM_KEY_WINDOWS}"
      -e GITLAB_CI -e CI_JOB_ID -e CI_PIPELINE_ID -e CI_PROJECT_NAME -e CI_COMMIT_BRANCH
      -e CI_JOB_NAME_SLUG -e CI_COMMIT_REF_NAME -e OMNIBUS_TARGET -e WINDOWS_BUILDER=true
      -e GOMODCACHE="c:\modcache" -e GOPROXY -e GONOSUMDB -e AWS_NETWORKING=true -e
      SIGN_WINDOWS_DD_WCS=true -e WINDOWS_SIGNING_CERT -e WINDOWS_SIGNING_CONFIG -e
      TARGET_ARCH="$ARCH" -e BUCKET_BRANCH -e S3_OMNIBUS_CACHE_BUCKET -e S3_OMNIBUS_GIT_CACHE_BUCKET
      -e BUNDLE_MIRROR__RUBYGEMS__ORG -e PIP_INDEX_URL -e AGENT_API_KEY_ORG2 -e OMNIBUS_GIT_CACHE_DIR=${Env:TEMP}/${CI_PIPELINE_ID}/omnibus-git-cache
      -e AGENT_FLAVOR -e OMNIBUS_RUBY_VERSION -e PYTHONUTF8=1 -e DEPLOY_AGENT -e CI_JOB_TOKEN
      -e CI_IDENTITIES_GITLAB_ID_TOKEN ${WINBUILDIMAGE} powershell -C "c:\mnt\tasks\winbuildscripts\Build-OmnibusTarget.ps1
      -BuildOutOfSource 1 -InstallDeps 1 -CheckGoVersion 1"
  
      '
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    - get-childitem omnibus\pkg\pipeline-$CI_PIPELINE_ID
    - Invoke-Expression "$S3_CP_CMD omnibus\pkg\pipeline-$CI_PIPELINE_ID\version-manifest.json
      $S3_SBOM_STORAGE_URI/$CI_JOB_NAME/version-manifest.json"
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    stage: package_build
    tags:
    - windows-v2:2022
    variables:
      ARCH: x64
      AWS_SHARED_CREDENTIALS_FILE: ${CI_PROJECT_DIR}\.aws\credentials-by-job-id\${CI_JOB_ID}
      BAZELISK_HOME: $XDG_CACHE_HOME/bazelisk
-     GIT_DEPTH: 0
      GIT_STRATEGY: clone
      WINBUILDIMAGE: registry.ddbuild.io/ci/datadog-agent-buildimages/windows_ltsc2022_${ARCH}${CI_IMAGE_WIN_LTSC2022_X64_SUFFIX}:${CI_IMAGE_WIN_LTSC2022_X64}
      XDG_CACHE_HOME: c:/bzl
windows_msi_and_bosh_zip_x64-a7 
  windows_msi_and_bosh_zip_x64-a7:
    artifacts:
      expire_in: 2 weeks
      paths:
      - omnibus/pkg/pipeline-$CI_PIPELINE_ID
    before_script:
    - C:\ci-identities-gitlab-job-client.exe assume-role
    id_tokens:
      BUILDBARN_ID_TOKEN:
        aud: buildbarn.us1.ddbuild.io
      CI_IDENTITIES_GITLAB_ID_TOKEN:
        aud: ci-identities
    needs:
    - go_deps
    rules:
    - when: on_success
    script:
    - $ErrorActionPreference = 'Stop'
+   - Invoke-Expression "$S3_CP_CMD $S3_ARTIFACTS_URI/agent-version.cache ."
+   - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    - . ./tools/ci/sanitize-goproxy.ps1
    - if (Test-Path omnibus\pkg) { remove-item -recurse -force omnibus\pkg }
    - mkdir omnibus\pkg
    - '.\tools\ci\docker-run-with-bazel-cache.ps1 -m 24576M -v "$(Get-Location):c:\mnt"
      -e DDA_FEATURE_FLAGS_CI_SSM_KEY_WINDOWS="${DDA_FEATURE_FLAGS_CI_SSM_KEY_WINDOWS}"
      -e GITLAB_CI -e CI_JOB_ID -e CI_PIPELINE_ID -e CI_PROJECT_NAME -e CI_COMMIT_BRANCH
      -e CI_JOB_NAME_SLUG -e CI_COMMIT_REF_NAME -e OMNIBUS_TARGET -e WINDOWS_BUILDER=true
      -e INTEGRATIONS_CORE_VERSION -e INTEGRATIONS_WHEELS_STORAGE -e WINDOWS_DDNPM_DRIVER
      -e WINDOWS_DDNPM_VERSION -e WINDOWS_DDNPM_SHASUM -e WINDOWS_DDPROCMON_DRIVER -e
      WINDOWS_DDPROCMON_VERSION -e WINDOWS_DDPROCMON_SHASUM -e GOMODCACHE="c:\modcache"
      -e GOPROXY -e GONOSUMDB -e AWS_NETWORKING=true -e SIGN_WINDOWS_DD_WCS=true -e
      WINDOWS_SIGNING_CERT -e WINDOWS_SIGNING_CONFIG -e TARGET_ARCH="$ARCH" -e DEBUG_CUSTOMACTION
      -e BUCKET_BRANCH -e S3_OMNIBUS_CACHE_BUCKET -e S3_OMNIBUS_GIT_CACHE_BUCKET -e
      BUNDLE_MIRROR__RUBYGEMS__ORG -e PIP_INDEX_URL -e AGENT_API_KEY_ORG2 -e OMNIBUS_GIT_CACHE_DIR=${Env:TEMP}/${CI_PIPELINE_ID}/omnibus-git-cache
      -e AGENT_FLAVOR -e OMNIBUS_RUBY_VERSION -e PYTHONUTF8=1 -e E2E_COVERAGE_PIPELINE
      -e DEPLOY_AGENT -e CI_JOB_TOKEN -e CI_IDENTITIES_GITLAB_ID_TOKEN ${WINBUILDIMAGE}
      powershell -C "c:\mnt\tasks\winbuildscripts\Build-AgentPackages.ps1 -BuildOutOfSource
      1 -InstallDeps 1 -CheckGoVersion 1 -BuildUpgrade 1"
  
      '
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    - get-childitem omnibus\pkg\pipeline-$CI_PIPELINE_ID
    - Invoke-Expression "$S3_CP_CMD omnibus\pkg\pipeline-$CI_PIPELINE_ID\version-manifest.json
      $S3_SBOM_STORAGE_URI/$CI_JOB_NAME/version-manifest.json"
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    stage: package_build
    tags:
    - windows-v2:2022
    timeout: 2h
    variables:
      ARCH: x64
      AWS_SHARED_CREDENTIALS_FILE: ${CI_PROJECT_DIR}\.aws\credentials-by-job-id\${CI_JOB_ID}
      BAZELISK_HOME: $XDG_CACHE_HOME/bazelisk
-     GIT_DEPTH: 0
      GIT_STRATEGY: clone
      OMNIBUS_TARGET: main
      WINBUILDIMAGE: registry.ddbuild.io/ci/datadog-agent-buildimages/windows_ltsc2022_${ARCH}${CI_IMAGE_WIN_LTSC2022_X64_SUFFIX}:${CI_IMAGE_WIN_LTSC2022_X64}
      XDG_CACHE_HOME: c:/bzl
windows_msi_and_bosh_zip_x64-a7-fips 
  windows_msi_and_bosh_zip_x64-a7-fips:
    artifacts:
      expire_in: 2 weeks
      paths:
      - omnibus/pkg/pipeline-$CI_PIPELINE_ID
    before_script:
    - C:\ci-identities-gitlab-job-client.exe assume-role
    id_tokens:
      BUILDBARN_ID_TOKEN:
        aud: buildbarn.us1.ddbuild.io
      CI_IDENTITIES_GITLAB_ID_TOKEN:
        aud: ci-identities
    needs:
    - go_deps
    rules:
    - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
      when: never
    - when: on_success
    script:
    - $ErrorActionPreference = 'Stop'
+   - Invoke-Expression "$S3_CP_CMD $S3_ARTIFACTS_URI/agent-version.cache ."
+   - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    - . ./tools/ci/sanitize-goproxy.ps1
    - if (Test-Path omnibus\pkg) { remove-item -recurse -force omnibus\pkg }
    - mkdir omnibus\pkg
    - '.\tools\ci\docker-run-with-bazel-cache.ps1 -m 24576M -v "$(Get-Location):c:\mnt"
      -e DDA_FEATURE_FLAGS_CI_SSM_KEY_WINDOWS="${DDA_FEATURE_FLAGS_CI_SSM_KEY_WINDOWS}"
      -e GITLAB_CI -e CI_JOB_ID -e CI_PIPELINE_ID -e CI_PROJECT_NAME -e CI_COMMIT_BRANCH
      -e CI_JOB_NAME_SLUG -e CI_COMMIT_REF_NAME -e OMNIBUS_TARGET -e WINDOWS_BUILDER=true
      -e INTEGRATIONS_CORE_VERSION -e INTEGRATIONS_WHEELS_STORAGE -e WINDOWS_DDNPM_DRIVER
      -e WINDOWS_DDNPM_VERSION -e WINDOWS_DDNPM_SHASUM -e WINDOWS_DDPROCMON_DRIVER -e
      WINDOWS_DDPROCMON_VERSION -e WINDOWS_DDPROCMON_SHASUM -e GOMODCACHE="c:\modcache"
      -e GOPROXY -e GONOSUMDB -e AWS_NETWORKING=true -e SIGN_WINDOWS_DD_WCS=true -e
      WINDOWS_SIGNING_CERT -e WINDOWS_SIGNING_CONFIG -e TARGET_ARCH="$ARCH" -e DEBUG_CUSTOMACTION
      -e BUCKET_BRANCH -e S3_OMNIBUS_CACHE_BUCKET -e S3_OMNIBUS_GIT_CACHE_BUCKET -e
      BUNDLE_MIRROR__RUBYGEMS__ORG -e PIP_INDEX_URL -e AGENT_API_KEY_ORG2 -e OMNIBUS_GIT_CACHE_DIR=${Env:TEMP}/${CI_PIPELINE_ID}/omnibus-git-cache
      -e AGENT_FLAVOR -e OMNIBUS_RUBY_VERSION -e PYTHONUTF8=1 -e E2E_COVERAGE_PIPELINE
      -e DEPLOY_AGENT -e CI_JOB_TOKEN -e CI_IDENTITIES_GITLAB_ID_TOKEN ${WINBUILDIMAGE}
      powershell -C "c:\mnt\tasks\winbuildscripts\Build-AgentPackages.ps1 -BuildOutOfSource
      1 -InstallDeps 1 -CheckGoVersion 1 -BuildUpgrade 1"
  
      '
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    - get-childitem omnibus\pkg\pipeline-$CI_PIPELINE_ID
    - Invoke-Expression "$S3_CP_CMD omnibus\pkg\pipeline-$CI_PIPELINE_ID\version-manifest.json
      $S3_SBOM_STORAGE_URI/$CI_JOB_NAME/version-manifest.json"
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    stage: package_build
    tags:
    - windows-v2:2022
    timeout: 2h
    variables:
      AGENT_FLAVOR: fips
      ARCH: x64
      AWS_SHARED_CREDENTIALS_FILE: ${CI_PROJECT_DIR}\.aws\credentials-by-job-id\${CI_JOB_ID}
      BAZELISK_HOME: $XDG_CACHE_HOME/bazelisk
-     GIT_DEPTH: 0
      GIT_STRATEGY: clone
      OMNIBUS_TARGET: main
      WINBUILDIMAGE: registry.ddbuild.io/ci/datadog-agent-buildimages/windows_ltsc2022_${ARCH}${CI_IMAGE_WIN_LTSC2022_X64_SUFFIX}:${CI_IMAGE_WIN_LTSC2022_X64}
      XDG_CACHE_HOME: c:/bzl
windows_zip_agent_binaries_x64-a7 
  windows_zip_agent_binaries_x64-a7:
    artifacts:
      expire_in: 2 weeks
      paths:
      - omnibus/pkg/pipeline-$CI_PIPELINE_ID
    before_script:
    - C:\ci-identities-gitlab-job-client.exe assume-role
    id_tokens:
      CI_IDENTITIES_GITLAB_ID_TOKEN:
        aud: ci-identities
    needs:
    - go_deps
    rules:
    - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
      when: never
    - when: on_success
    script:
    - $ErrorActionPreference = "Stop"
+   - Invoke-Expression "$S3_CP_CMD $S3_ARTIFACTS_URI/agent-version.cache ."
+   - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    - . ./tools/ci/sanitize-goproxy.ps1
    - if (Test-Path omnibus\pkg) { remove-item -recurse -force omnibus\pkg }
    - mkdir omnibus\pkg
    - 'docker run --rm -m 24576M -v "$(Get-Location):c:\mnt" -e CI -e GITLAB_CI -e CI_COMMIT_BRANCH
      -e CI_PIPELINE_ID -e CI_JOB_ID -e CI_PROJECT_NAME -e CI_JOB_NAME_SLUG -e CI_COMMIT_REF_NAME
      -e OMNIBUS_TARGET -e WINDOWS_BUILDER=true -e INTEGRATIONS_CORE_VERSION -e INTEGRATIONS_WHEELS_STORAGE
      -e WINDOWS_DDNPM_DRIVER -e WINDOWS_DDNPM_VERSION -e WINDOWS_DDNPM_SHASUM -e WINDOWS_DDPROCMON_DRIVER
      -e WINDOWS_DDPROCMON_VERSION -e WINDOWS_DDPROCMON_SHASUM -e GOMODCACHE="c:\modcache"
      -e GOPROXY -e GONOSUMDB -e AWS_NETWORKING=true -e SIGN_WINDOWS_DD_WCS=true -e
      WINDOWS_SIGNING_CERT -e WINDOWS_SIGNING_CONFIG -e BUCKET_BRANCH -e S3_OMNIBUS_CACHE_BUCKET
      -e USE_S3_CACHING -e BUNDLE_MIRROR__RUBYGEMS__ORG -e PIP_INDEX_URL -e AGENT_API_KEY_ORG2
      -e CI_IDENTITIES_GITLAB_ID_TOKEN ${WINBUILDIMAGE} powershell -C "c:\mnt\tasks\winbuildscripts\Build-OmnibusTarget.ps1
      -BuildOutOfSource 1 -InstallDeps 1 -CheckGoVersion 1"
  
      '
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    - get-childitem omnibus\pkg\pipeline-$CI_PIPELINE_ID
    - Invoke-Expression "$S3_CP_CMD omnibus\pkg\pipeline-$CI_PIPELINE_ID\version-manifest.json
      $S3_SBOM_STORAGE_URI/$CI_JOB_NAME/version-manifest.json"
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    stage: package_build
    tags:
    - windows-v2:2022
    variables:
      ARCH: x64
      AWS_SHARED_CREDENTIALS_FILE: ${CI_PROJECT_DIR}\.aws\credentials-by-job-id\${CI_JOB_ID}
-     GIT_DEPTH: 0
      GIT_STRATEGY: clone
      OMNIBUS_TARGET: agent-binaries
      WINBUILDIMAGE: registry.ddbuild.io/ci/datadog-agent-buildimages/windows_ltsc2022_${ARCH}${CI_IMAGE_WIN_LTSC2022_X64_SUFFIX}:${CI_IMAGE_WIN_LTSC2022_X64}
windows_zip_ddot_x64 
  windows_zip_ddot_x64:
    artifacts:
      expire_in: 2 weeks
      paths:
      - omnibus/pkg/pipeline-$CI_PIPELINE_ID
    before_script:
    - C:\ci-identities-gitlab-job-client.exe assume-role
    id_tokens:
      CI_IDENTITIES_GITLAB_ID_TOKEN:
        aud: ci-identities
    needs:
    - go_deps
    rules:
    - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
      when: never
    - when: on_success
    script:
    - $ErrorActionPreference = "Stop"
+   - Invoke-Expression "$S3_CP_CMD $S3_ARTIFACTS_URI/agent-version.cache ."
+   - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    - . ./tools/ci/sanitize-goproxy.ps1
    - if (Test-Path omnibus\pkg) { remove-item -recurse -force omnibus\pkg }
    - mkdir omnibus\pkg
    - 'docker run --rm -m 24576M -v "$(Get-Location):c:\mnt" -e CI -e GITLAB_CI -e CI_COMMIT_BRANCH
      -e CI_PIPELINE_ID -e CI_JOB_ID -e CI_PROJECT_NAME -e CI_JOB_NAME_SLUG -e CI_COMMIT_REF_NAME
      -e OMNIBUS_TARGET -e WINDOWS_BUILDER=true -e INTEGRATIONS_CORE_VERSION -e INTEGRATIONS_WHEELS_STORAGE
      -e WINDOWS_DDNPM_DRIVER -e WINDOWS_DDNPM_VERSION -e WINDOWS_DDNPM_SHASUM -e WINDOWS_DDPROCMON_DRIVER
      -e WINDOWS_DDPROCMON_VERSION -e WINDOWS_DDPROCMON_SHASUM -e GOMODCACHE="c:\modcache"
      -e GOPROXY -e GONOSUMDB -e AWS_NETWORKING=true -e SIGN_WINDOWS_DD_WCS=true -e
      WINDOWS_SIGNING_CERT -e WINDOWS_SIGNING_CONFIG -e BUCKET_BRANCH -e S3_OMNIBUS_CACHE_BUCKET
      -e USE_S3_CACHING -e BUNDLE_MIRROR__RUBYGEMS__ORG -e PIP_INDEX_URL -e AGENT_API_KEY_ORG2
      -e CI_IDENTITIES_GITLAB_ID_TOKEN ${WINBUILDIMAGE} powershell -C "c:\mnt\tasks\winbuildscripts\Build-OmnibusTarget.ps1
      -BuildOutOfSource 1 -InstallDeps 1 -CheckGoVersion 1"
  
      '
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    - get-childitem omnibus\pkg\pipeline-$CI_PIPELINE_ID
    - Invoke-Expression "$S3_CP_CMD omnibus\pkg\pipeline-$CI_PIPELINE_ID\version-manifest.json
      $S3_SBOM_STORAGE_URI/$CI_JOB_NAME/version-manifest.json"
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    stage: package_build
    tags:
    - windows-v2:2022
    variables:
      ARCH: x64
      AWS_SHARED_CREDENTIALS_FILE: ${CI_PROJECT_DIR}\.aws\credentials-by-job-id\${CI_JOB_ID}
-     GIT_DEPTH: 0
      GIT_STRATEGY: clone
      OMNIBUS_TARGET: ddot
      WINBUILDIMAGE: registry.ddbuild.io/ci/datadog-agent-buildimages/windows_ltsc2022_${ARCH}${CI_IMAGE_WIN_LTSC2022_X64_SUFFIX}:${CI_IMAGE_WIN_LTSC2022_X64}
windows_zip_eudm_x64 
  windows_zip_eudm_x64:
    artifacts:
      expire_in: 2 weeks
      paths:
      - omnibus/pkg/pipeline-$CI_PIPELINE_ID
    before_script:
    - C:\ci-identities-gitlab-job-client.exe assume-role
    id_tokens:
      BUILDBARN_ID_TOKEN:
        aud: buildbarn.us1.ddbuild.io
      CI_IDENTITIES_GITLAB_ID_TOKEN:
        aud: ci-identities
    needs:
    - go_deps
    rules:
    - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
      when: never
    - when: on_success
    script:
    - $ErrorActionPreference = "Stop"
+   - Invoke-Expression "$S3_CP_CMD $S3_ARTIFACTS_URI/agent-version.cache ."
+   - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    - . ./tools/ci/sanitize-goproxy.ps1
    - if (Test-Path omnibus\pkg) { remove-item -recurse -force omnibus\pkg }
    - mkdir omnibus\pkg
    - '.\tools\ci\docker-run-with-bazel-cache.ps1 -m 24576M -v "$(Get-Location):c:\mnt"
      -e DDA_FEATURE_FLAGS_CI_SSM_KEY_WINDOWS="${DDA_FEATURE_FLAGS_CI_SSM_KEY_WINDOWS}"
      -e GITLAB_CI -e CI_JOB_ID -e CI_PIPELINE_ID -e CI_PROJECT_NAME -e CI_COMMIT_BRANCH
      -e CI_JOB_NAME_SLUG -e CI_COMMIT_REF_NAME -e OMNIBUS_TARGET -e WINDOWS_BUILDER=true
      -e GOMODCACHE="c:\modcache" -e GOPROXY -e GONOSUMDB -e AWS_NETWORKING=true -e
      SIGN_WINDOWS_DD_WCS=true -e WINDOWS_SIGNING_CERT -e WINDOWS_SIGNING_CONFIG -e
      TARGET_ARCH="$ARCH" -e BUCKET_BRANCH -e S3_OMNIBUS_CACHE_BUCKET -e S3_OMNIBUS_GIT_CACHE_BUCKET
      -e BUNDLE_MIRROR__RUBYGEMS__ORG -e PIP_INDEX_URL -e AGENT_API_KEY_ORG2 -e OMNIBUS_GIT_CACHE_DIR=${Env:TEMP}/${CI_PIPELINE_ID}/omnibus-git-cache
      -e AGENT_FLAVOR -e OMNIBUS_RUBY_VERSION -e PYTHONUTF8=1 -e DEPLOY_AGENT -e CI_JOB_TOKEN
      -e CI_IDENTITIES_GITLAB_ID_TOKEN ${WINBUILDIMAGE} powershell -C "c:\mnt\tasks\winbuildscripts\Build-OmnibusTarget.ps1
      -BuildOutOfSource 1 -InstallDeps 1 -CheckGoVersion 1"
  
      '
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    - get-childitem omnibus\pkg\pipeline-$CI_PIPELINE_ID
    - Invoke-Expression "$S3_CP_CMD omnibus\pkg\pipeline-$CI_PIPELINE_ID\version-manifest.json
      $S3_SBOM_STORAGE_URI/$CI_JOB_NAME/version-manifest.json"
    - If ($lastExitCode -ne "0") { throw "Previous command returned $lastExitCode" }
    stage: package_build
    tags:
    - windows-v2:2022
    variables:
      ARCH: x64
      AWS_SHARED_CREDENTIALS_FILE: ${CI_PROJECT_DIR}\.aws\credentials-by-job-id\${CI_JOB_ID}
      BAZELISK_HOME: $XDG_CACHE_HOME/bazelisk
-     GIT_DEPTH: 0
      GIT_STRATEGY: clone
      OMNIBUS_TARGET: eudm
      WINBUILDIMAGE: registry.ddbuild.io/ci/datadog-agent-buildimages/windows_ltsc2022_${ARCH}${CI_IMAGE_WIN_LTSC2022_X64_SUFFIX}:${CI_IMAGE_WIN_LTSC2022_X64}
      XDG_CACHE_HOME: c:/bzl

Changes Summary

Removed Modified Added Renamed
0 9 0 0

ℹ️ Diff available in the job log.

@mikesherovdd mikesherovdd added the changelog/no-changelog No changelog entry needed label Aug 14, 2026
@mikesherovdd @cursoragent
Use local agent-version.cache even without CI_PIPELINE_ID.
0146c5a 
Omnibus drops CI_PIPELINE_ID, so Windows resource versioning skipped the cache and ran git describe on a shallow clone.

Co-authored-by: Cursor <cursoragent@cursor.com>
@mikesherovdd
mikesherovdd requested review from a team as code owners August 14, 2026 18:08
@mikesherovdd @cursoragent
Format version_tests.py for ruff.
e90643c 
Co-authored-by: Cursor <cursoragent@cursor.com>
@dd-octo-sts

dd-octo-sts Bot commented Aug 14, 2026

Copy link
Copy Markdown
Contributor

Static quality checks

✅ Please find below the results from static quality gates
Comparison made with ancestor 3b2688f
📊 Static Quality Gates Dashboard
🔗 SQG Job
SOME SIZE DELTAS ARE N/A (ANCESTOR METRICS NOT YET AVAILABLE). RETRY JOB

Successful checks

Info

Quality gate Change Size (prev → curr → max)
✅ agent_deb_amd64 N/A N/A → 759.616 → 764.500
✅ agent_deb_amd64_fips N/A N/A → 712.473 → 715.740
✅ agent_heroku_amd64 N/A N/A → 311.955 → 319.050
✅ agent_msi N/A N/A → 643.578 → 660.960
✅ agent_rpm_amd64 N/A N/A → 759.600 → 764.470
✅ agent_rpm_amd64_fips N/A N/A → 712.457 → 715.740
✅ agent_rpm_arm64 N/A N/A → 735.359 → 736.540
✅ agent_rpm_arm64_fips N/A N/A → 691.546 → 693.690
✅ agent_suse_amd64 N/A N/A → 759.600 → 764.470
✅ agent_suse_amd64_fips N/A N/A → 712.457 → 715.740
✅ agent_suse_arm64 N/A N/A → 735.359 → 736.540
✅ agent_suse_arm64_fips N/A N/A → 691.546 → 693.690
✅ docker_agent_amd64 N/A N/A → 818.232 → 820.040
✅ docker_agent_arm64 N/A N/A → 819.035 → 820.740
✅ docker_agent_jmx_amd64 N/A N/A → 1009.129 → 1010.800
✅ docker_agent_jmx_arm64 N/A N/A → 998.585 → 1000.420
✅ docker_cluster_agent_amd64 N/A N/A → 210.475 → 211.300
✅ docker_cluster_agent_arm64 N/A N/A → 223.456 → 223.810
✅ docker_cws_instrumentation_amd64 N/A N/A → 7.439 → 7.480
✅ docker_cws_instrumentation_arm64 N/A N/A → 6.877 → 7.110
✅ docker_dogstatsd_amd64 N/A N/A → 39.482 → 39.960
✅ docker_dogstatsd_arm64 N/A N/A → 37.560 → 38.270
✅ docker_host_profiler_amd64 N/A N/A → 305.814 → 317.690
✅ docker_host_profiler_arm64 N/A N/A → 317.125 → 328.970
✅ dogstatsd_deb_amd64 N/A N/A → 30.224 → 31.200
✅ dogstatsd_deb_arm64 N/A N/A → 28.247 → 29.580
✅ dogstatsd_rpm_amd64 N/A N/A → 30.224 → 31.200
✅ dogstatsd_suse_amd64 N/A N/A → 30.224 → 31.200
✅ iot_agent_deb_amd64 N/A N/A → 46.467 → 47.530
✅ iot_agent_deb_arm64 N/A N/A → 43.124 → 44.200
✅ iot_agent_deb_armhf N/A N/A → 43.907 → 44.990
✅ iot_agent_rpm_amd64 N/A N/A → 46.468 → 47.530
✅ iot_agent_suse_amd64 N/A N/A → 46.467 → 47.530

@clarkb7

clarkb7 commented Aug 14, 2026

Copy link
Copy Markdown
Contributor

They only needed history so get_version() could run git describe --tags inside the build container, which has no AWS credentials.

is this really accurate? i see previous main jobs like https://gitlab.ddbuild.io/DataDog/datadog-agent/-/jobs/1952726787/raw running the aws s3 cp command to fetch the version cache. the current code looks to have a hard failure, so it shouldn't be failing silently.

@cit-pr-commenter-54b7da

cit-pr-commenter-54b7da Bot commented Aug 14, 2026

Copy link
Copy Markdown

Regression Detector

Regression Detector Results

Metrics dashboard
Target profiles
Job ID: e54cb9a8-ff51-44a5-8fc3-0d715b741cb6

Baseline: 3b2688f
Comparison: e90643c
Diff

Optimization Goals: ✅ No significant changes detected

Fine details of change detection per experiment

perf experiment goal Δ mean % Δ mean % CI trials links
➖ quality_gate_logs % cpu utilization +1.25 [+0.37, +2.12] 1 Logs bounds checks dashboard
➖ quality_gate_security_mean_fs_load memory utilization +0.50 [+0.42, +0.57] 1 Logs bounds checks dashboard
➖ quality_gate_idle memory utilization +0.14 [+0.02, +0.26] 1 Logs bounds checks dashboard
➖ quality_gate_idle_all_features memory utilization +0.11 [+0.07, +0.15] 1 Logs bounds checks dashboard
➖ quality_gate_security_no_fs_load memory utilization +0.03 [-0.11, +0.16] 1 Logs bounds checks dashboard
➖ quality_gate_security_idle memory utilization -0.60 [-0.71, -0.49] 1 Logs bounds checks dashboard
➖ quality_gate_private_action_runner memory utilization -0.63 [-0.76, -0.50] 1 Logs bounds checks dashboard
➖ quality_gate_metrics_logs memory utilization -0.69 [-0.94, -0.44] 1 Logs bounds checks dashboard

Bounds Checks: ✅ Passed

perf experiment bounds_check_name replicates_passed observed_value links
✅ quality_gate_idle intake_connections 10/10 4 = 4 bounds checks dashboard
✅ quality_gate_idle memory_usage 10/10 171.72MiB ≤ 178MiB bounds checks dashboard
✅ quality_gate_idle total_bytes_received 10/10 742.84KiB ≤ 819.20KiB bounds checks dashboard
✅ quality_gate_idle_all_features intake_connections 10/10 4 = 4 bounds checks dashboard
✅ quality_gate_idle_all_features memory_usage 10/10 507.93MiB ≤ 538MiB bounds checks dashboard
✅ quality_gate_idle_all_features total_bytes_received 10/10 1.13MiB ≤ 1.25MiB bounds checks dashboard
✅ quality_gate_logs intake_connections 10/10 17 ≤ 40 bounds checks dashboard
✅ quality_gate_logs memory_usage 10/10 204.22MiB ≤ 229MiB bounds checks dashboard
✅ quality_gate_logs missed_bytes 10/10 0B = 0B bounds checks dashboard
✅ quality_gate_logs total_bytes_received 10/10 263.81MiB ≤ 292MiB bounds checks dashboard
✅ quality_gate_metrics_logs cpu_usage 10/10 359.85 ≤ 2000 bounds checks dashboard
✅ quality_gate_metrics_logs intake_connections 10/10 18 ≤ 40 bounds checks dashboard
✅ quality_gate_metrics_logs memory_usage 10/10 393.77MiB ≤ 439MiB bounds checks dashboard
✅ quality_gate_metrics_logs missed_bytes 10/10 0B = 0B bounds checks dashboard
✅ quality_gate_metrics_logs total_bytes_received 10/10 0.94GiB ≤ 1.04GiB bounds checks dashboard
✅ quality_gate_private_action_runner memory_usage 10/10 72.16MiB ≤ 76MiB bounds checks dashboard
✅ quality_gate_security_idle cpu_usage 10/10 27.70 ≤ 100 bounds checks dashboard
✅ quality_gate_security_idle memory_usage 10/10 323.74MiB ≤ 335MiB bounds checks dashboard
✅ quality_gate_security_mean_fs_load cpu_usage 10/10 60.42 ≤ 200 bounds checks dashboard
✅ quality_gate_security_mean_fs_load memory_usage 10/10 301.65MiB ≤ 314MiB bounds checks dashboard
✅ quality_gate_security_no_fs_load cpu_usage 10/10 20.54 ≤ 100 bounds checks dashboard
✅ quality_gate_security_no_fs_load memory_usage 10/10 306.25MiB ≤ 343MiB bounds checks dashboard

Explanation

Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%

Performance changes are noted in the perf column of each table:

  • ✅ = significantly better comparison variant performance
  • ❌ = significantly worse comparison variant performance
  • ➖ = no significant change in performance

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".

For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:

  1. Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.

  2. Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.

  3. Its configuration does not mark it "erratic".

CI Pass/Fail Decision

✅ Passed. All Quality Gates passed.

  • quality_gate_security_mean_fs_load, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_security_mean_fs_load, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_security_no_fs_load, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_security_no_fs_load, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_private_action_runner, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_idle_all_features, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
  • quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_idle, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
  • quality_gate_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_security_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_security_idle, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.

aiuto
aiuto approved these changes Aug 14, 2026
View reviewed changes

@aiuto aiuto left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks.

@mikesherovdd

mikesherovdd commented Aug 15, 2026

Copy link
Copy Markdown
Contributor Author
  • S3 copy uses the same Invoke-Expression + $lastExitCode pattern as .upload_sbom_artifacts_windows, because PowerShell 5 does not fail the job on a native aws.exe error.

@clarkb7 the key is "S3 copy uses the same Invoke-Expression + $lastExitCode pattern as .upload_sbom_artifacts_windows, because PowerShell 5 does not fail the job on a native aws.exe error."

while it runs the command, the command itself is not successful, and you can see later in the job it doing a git describe to compensate. Let me know if I'm mis-interpreting your question.

The other evidence I have is that this job fails if I do a shallow clone, which proves that the version wasn't being retrieved by the cache and that the falllback git describe was also failing, and with this change, the job works despite a shallow clone, which means it got the version number from the aws cache, I think.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@aiuto aiuto aiuto approved these changes
@mrafi97 mrafi97 Awaiting requested review from mrafi97 mrafi97 is a code owner automatically assigned from DataDog/windows-products

Assignees

No one assigned

Labels

changelog/no-changelog No changelog entry needed internal Identify a non-fork PR qa/no-code-change No code change in Agent code requiring validation short review PR is simple enough to be reviewed quickly team/agent-build team/agent-delivery team/agent-devx team/windows-products

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@mikesherovdd @clarkb7 @aiuto