fix(agent-data-plane): fail the build when release metadata is missing

.gitlab/windows.yml

@@ -185,6 +185,7 @@ test-integration-windows-amd64:
       -e BUILD_PROFILE
       -e BUILD_FEATURES
       -e ADP_VERSION="${ADP_IMAGE_VERSION}"
+      -e APP_DEV_BUILD
       -e TARGET_ARCH
       -e OUTPUT_DIR="c:\mnt"
       ${WINBUILDIMAGE}

Makefile

@@ -130,7 +130,7 @@ build-adp-base:
 	APP_IDENTIFIER="$(ADP_APP_IDENTIFIER)" \
 	APP_GIT_HASH="$(ADP_APP_GIT_HASH)" \
 	APP_VERSION="$(ADP_APP_VERSION)" \
-	APP_BUILD_DATE="$(ADP_APP_BUILD_DATE)" \
+	APP_BUILD_TIME="$(ADP_APP_BUILD_TIME)" \
 	cargo build --profile $(BUILD_PROFILE) --package agent-data-plane
 
 .PHONY: build-adp
@@ -646,7 +646,7 @@ build-adp-host: ## Builds the agent-data-plane binary for the current host (Carg
 		APP_IDENTIFIER="$(ADP_APP_IDENTIFIER)" \
 		APP_GIT_HASH="$(ADP_APP_GIT_HASH)" \
 		APP_VERSION="$(ADP_APP_VERSION)" \
-		APP_BUILD_DATE="$(ADP_APP_BUILD_DATE)" \
+		APP_BUILD_TIME="$(ADP_APP_BUILD_TIME)" \
 		cargo $(ADP_CARGO_BUILD_SUBCMD) --profile $(BUILD_PROFILE) --bin agent-data-plane
 
 .PHONY: build-adp-aix

ci/tooling/build-adp-aix.sh

@@ -36,7 +36,10 @@ export APP_SHORT_NAME="${APP_SHORT_NAME:-${ADP_APP_SHORT_NAME:-data-plane}}"
 export APP_IDENTIFIER="${APP_IDENTIFIER:-${ADP_APP_IDENTIFIER:-adp}}"
 export APP_GIT_HASH="${APP_GIT_HASH:-${ADP_APP_GIT_HASH:-${APP_GIT_HASH_AUTO}}}"
 export APP_VERSION="${APP_VERSION:-${ADP_APP_VERSION:-${ADP_APP_VERSION_AUTO}}}"
-export APP_BUILD_TIME="${APP_BUILD_TIME:-${ADP_APP_BUILD_TIME:-${CI_PIPELINE_CREATED_AT:-0000-00-00T00:00:00-00:00}}}"
+# Unlike the Makefile, this script defaults APP_DEV_BUILD to "false", so it can't fall back to a placeholder
+# timestamp: saluki-metadata rejects placeholder metadata on release builds. Stamp the current time instead.
+APP_BUILD_TIME_AUTO="$(date -u '+%Y-%m-%dT%H:%M:%SZ')"
+export APP_BUILD_TIME="${APP_BUILD_TIME:-${ADP_APP_BUILD_TIME:-${CI_PIPELINE_CREATED_AT:-${APP_BUILD_TIME_AUTO}}}}"
 export APP_DEV_BUILD="${APP_DEV_BUILD:-${ADP_APP_DEV_BUILD:-false}}"
 
 require_executable() {

ci/tooling/windows-build-adp.ps1

@@ -46,15 +46,15 @@ Install-CachedZipTool `
 
 # saluki-metadata reads these at build time. Must match the values the Makefile passes through
 # (ADP_APP_FULL_NAME / ADP_APP_SHORT_NAME / ADP_APP_IDENTIFIER / ADP_APP_GIT_HASH /
-# ADP_APP_VERSION / ADP_APP_BUILD_DATE in Makefile) so the Windows binary identifies itself
+# ADP_APP_VERSION / ADP_APP_BUILD_TIME in Makefile) so the Windows binary identifies itself
 # the same way as the linux/darwin binaries do.
 $env:APP_FULL_NAME = "Agent Data Plane"
 $env:APP_SHORT_NAME = "data-plane"
 $env:APP_IDENTIFIER = "agent-data-plane"
 $env:APP_VERSION = $env:ADP_VERSION
 # Windows PowerShell 5.1 (the default `powershell.exe` in the LTSC2022 build image) doesn't
 # have Get-Date's -AsUTC switch (added in PS 7.1). ToUniversalTime() works on both.
-$env:APP_BUILD_DATE = (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")
+$env:APP_BUILD_TIME = (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")
 if (-not $env:APP_GIT_HASH) {
     $env:APP_GIT_HASH = if ($env:CI_COMMIT_SHA) {
         $env:CI_COMMIT_SHA.Substring(0, [Math]::Min(7, $env:CI_COMMIT_SHA.Length))

ci/tooling/windows-integration-tests.ps1

@@ -59,9 +59,21 @@ Invoke-Native docker version
 Write-Host "[*] Building Panoramic and Agent Data Plane for Windows..."
 # saluki-metadata reads these at build time. They must match the values that
 # the Linux Makefile passes through, otherwise ADP's log subagent prefix
-# renders as "UNKNOWN" instead of "DATAPLANE".
+# renders as "UNKNOWN" instead of "DATAPLANE". Keep the set complete: saluki-metadata
+# rejects partial metadata on release builds, so a gap here would break this job if it
+# were ever handed APP_DEV_BUILD=false.
 $env:APP_FULL_NAME = "Agent Data Plane"
 $env:APP_SHORT_NAME = "data-plane"
+$env:APP_IDENTIFIER = "adp"
+# Mirrors ADP_APP_VERSION_AUTO in the Makefile: the version comes from ADP's manifest.
+$AdpManifest = Join-Path $RepoRoot "bin\agent-data-plane\Cargo.toml"
+$AdpVersionMatch = Select-String -Path $AdpManifest -Pattern '^version = "(.+)"' | Select-Object -First 1
+if (-not $AdpVersionMatch) {
+    throw "Could not read the ADP version from ${AdpManifest}"
+}
+$env:APP_VERSION = $AdpVersionMatch.Matches[0].Groups[1].Value
+# Windows PowerShell 5.1 doesn't have Get-Date's -AsUTC switch (added in PS 7.1).
+$env:APP_BUILD_TIME = (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")
 if (-not $env:APP_GIT_HASH) {
     $env:APP_GIT_HASH = if ($env:CI_COMMIT_SHA) {
         $env:CI_COMMIT_SHA.Substring(0, [Math]::Min(7, $env:CI_COMMIT_SHA.Length))

docker/Dockerfile.agent-data-plane

@@ -53,6 +53,7 @@ ARG APP_IDENTIFIER=""
 ARG APP_GIT_HASH=""
 ARG APP_VERSION=""
 ARG APP_BUILD_TIME=""
+ARG APP_DEV_BUILD=""
 ARG DD_AGENT_VERSION=""
 ARG BUILDCACHE_REMOTE=
 ARG BUILDCACHE_DEBUG=
@@ -64,6 +65,7 @@ ENV APP_IDENTIFIER=${APP_IDENTIFIER}
 ENV APP_GIT_HASH=${APP_GIT_HASH}
 ENV APP_VERSION=${APP_VERSION}
 ENV APP_BUILD_TIME=${APP_BUILD_TIME}
+ENV APP_DEV_BUILD=${APP_DEV_BUILD}
 ENV DD_AGENT_VERSION=${DD_AGENT_VERSION}
 ENV BUILDCACHE_REMOTE=${BUILDCACHE_REMOTE}
 ENV BUILDCACHE_DEBUG=${BUILDCACHE_DEBUG}

docs/agent-data-plane/releasing.md

@@ -81,14 +81,20 @@ during the build process and is used to drive a number of behaviors:
 - outputting the version of ADP, when it was built, the build architecture, etc, as a log at startup
 - special constant identifiers that are used to populate things like HTTP request headers (user agent, etc)
 
-This build metadata is calculated with a Make target—`emit-build-metadata`—which populates it during local builds or
+This build metadata is calculated with a Make target—`emit-adp-build-metadata`—which populates it during local builds or
 regular CI builds. The relevant build arguments are all prefixed with `APP_` and are as follows:
 
-- `APP_FULL_NAME`: the full name of the application (hard-coded to `agent-data-plane`)
+- `APP_FULL_NAME`: the full name of the application (hard-coded to `Agent Data Plane`)
 - `APP_SHORT_NAME`: the short name of the application (hard-coded to `data-plane`)
 - `APP_IDENTIFIER`: a short identifier for the application (hard-coded to `adp`)
 - `APP_VERSION`: the version of the application (set to `version` field in `bin/agent-data-plane/Cargo.toml`)
-- `APP_BUILD_DATE`: the date the build was performed (set to the creation time of the GitLab CI pipeline)
+- `APP_GIT_HASH`: the Git commit the build was performed from (set to the GitLab CI commit SHA)
+- `APP_BUILD_TIME`: the time the build was performed (set to the creation time of the GitLab CI pipeline)
+- `APP_DEV_BUILD`: whether this is a development build (set to `false` only for tag pipelines)
+
+Note that `APP_DEV_BUILD` also acts as a safety check: when it is `false`, `saluki-metadata`'s build script fails the
+build if any of the values above are missing or still hold their placeholder defaults. This keeps a release binary from
+silently shipping metadata that reports `unknown`.
 
 This build metadata shouldn't need to be manually changed on a per-release basis, and so this section is mostly
 informational and not relevant to the release process itself.

lib/saluki-metadata/build.rs

@@ -33,6 +33,45 @@ fn main() {
         .and_then(|v| v.parse::<u32>().ok())
         .unwrap_or(0);
 
+    // Release builds shouldn't silently ship the placeholder values above, so treat any that survive as a build
+    // failure. We can't key off APP_DEV_BUILD alone: CI sets it at the workflow level, so on a tag pipeline it's also
+    // set for test/lint jobs that supply no metadata, hence only enforcing when something identified the application.
+    let identifying_build = ["APP_FULL_NAME", "APP_SHORT_NAME", "APP_IDENTIFIER", "APP_VERSION"]
+        .iter()
+        .any(|var_name| env_var_present(var_name));
+
+    if !app_dev_build && identifying_build {
+        let mut placeholders = Vec::new();
+
+        if app_full_name == "unknown" {
+            placeholders.push("APP_FULL_NAME");
+        }
+        if app_short_name == "unknown" {
+            placeholders.push("APP_SHORT_NAME");
+        }
+        if app_identifier == "unknown" {
+            placeholders.push("APP_IDENTIFIER");
+        }
+        if app_git_hash == "unknown" || app_git_hash == "not-in-git" {
+            placeholders.push("APP_GIT_HASH");
+        }
+        if app_version == "0.0.0" {
+            placeholders.push("APP_VERSION");
+        }
+        if app_build_time.starts_with("0000-00-00") {
+            placeholders.push("APP_BUILD_TIME");
+        }
+
+        if !placeholders.is_empty() {
+            panic!(
+                "APP_DEV_BUILD is 'false', marking this a release build, but the following build metadata environment \
+                 variables are unset or still hold their placeholder defaults: {}. Set them in whichever build entry \
+                 point is being used, or set APP_DEV_BUILD=true if this isn't actually a release build.",
+                placeholders.join(", ")
+            );
+        }
+    }
+
     let details_file = std::env::var("OUT_DIR").unwrap() + "/details.rs";
     std::fs::write(
         details_file,
@@ -74,6 +113,11 @@ fn get_env_var_or_default(var_name: &str, default: &str) -> String {
         .unwrap_or(default.to_string())
 }
 
+/// Returns `true` if the given environment variable is set to a non-empty value.
+fn env_var_present(var_name: &str) -> bool {
+    std::env::var(var_name).ok().filter(|s| !s.is_empty()).is_some()
+}
+
 /// Returns the value the given environment variable after parsing as a boolean, or the default value if the environment
 /// variable is missing/empty, or if it's not a valid boolean.
 fn get_env_var_bool_or_default(var_name: &str, default: bool) -> bool {