ci(APMSP-3083): fix security issue by splitting the job by hoolioh · Pull Request #2420 · DataDog/libdatadog

hoolioh · 2026-08-26T09:46:02Z

What does this PR do?

This PR hardens the workflow by improving its security model:

Usepull_request_target which runs the definition from the default branch instead, which also pins the OIDC ref and job_workflow_ref claims to refs/heads/main, so the trust policy can require a protected ref like the repository's other STS policies do.
The trade-off of pull_request_target is that the job context is privileged, so the work is split in two:
1.rustfmt checks out the pull request and runs cargo fmt with no token and no id-token permission.
2. rustfmt-commit only applies the resulting patch and pushes it only using verified tools from the image, in this case 'git'. Note that --force-with-lease is used which makes the push a no-op if the branch moved on from the revision that was formatted. Not using third-party tools in this job is deliberate as it prevents using uncontrolled code with elevated permissions.

datadog-datadog-prod-us1-2 · 2026-08-26T09:58:29Z

✅ All CI checks and tests passed.

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 76.68% (-0.01%)

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 6824093 | Docs | View more details | Give us feedback!}

dd-octo-sts · 2026-08-26T10:25:51Z

Artifact Size Benchmark Report

aarch64-alpine-linux-musl

Artifact	Baseline	Commit	Change
/aarch64-alpine-linux-musl/lib/libdatadog_profiling.so	8.26 MB	8.26 MB	0% (0 B) 👌
/aarch64-alpine-linux-musl/lib/libdatadog_profiling.a	89.59 MB	89.59 MB	0% (0 B) 👌

aarch64-unknown-linux-gnu

Artifact	Baseline	Commit	Change
/aarch64-unknown-linux-gnu/lib/libdatadog_profiling.a	100.77 MB	100.77 MB	0% (0 B) 👌
/aarch64-unknown-linux-gnu/lib/libdatadog_profiling.so	11.07 MB	11.07 MB	0% (0 B) 👌

libdatadog-x64-windows

Artifact	Baseline	Commit	Change
/libdatadog-x64-windows/debug/dynamic/datadog_profiling_ffi.dll	26.65 MB	26.65 MB	0% (0 B) 👌
/libdatadog-x64-windows/debug/dynamic/datadog_profiling_ffi.lib	94.96 KB	94.96 KB	0% (0 B) 👌
/libdatadog-x64-windows/debug/dynamic/datadog_profiling_ffi.pdb	180.94 MB	180.95 MB	+0% (+16.00 KB) 👌
/libdatadog-x64-windows/debug/static/datadog_profiling_ffi.lib	773.55 MB	773.55 MB	0% (0 B) 👌
/libdatadog-x64-windows/release/dynamic/datadog_profiling_ffi.dll	8.74 MB	8.74 MB	0% (0 B) 👌
/libdatadog-x64-windows/release/dynamic/datadog_profiling_ffi.lib	94.96 KB	94.96 KB	0% (0 B) 👌
/libdatadog-x64-windows/release/dynamic/datadog_profiling_ffi.pdb	25.68 MB	25.68 MB	0% (0 B) 👌
/libdatadog-x64-windows/release/static/datadog_profiling_ffi.lib	51.15 MB	51.15 MB	0% (0 B) 👌

libdatadog-x86-windows

Artifact	Baseline	Commit	Change
/libdatadog-x86-windows/debug/dynamic/datadog_profiling_ffi.dll	23.23 MB	23.23 MB	0% (0 B) 👌
/libdatadog-x86-windows/debug/dynamic/datadog_profiling_ffi.lib	96.45 KB	96.45 KB	0% (0 B) 👌
/libdatadog-x86-windows/debug/dynamic/datadog_profiling_ffi.pdb	185.84 MB	185.86 MB	+0% (+16.00 KB) 👌
/libdatadog-x86-windows/debug/static/datadog_profiling_ffi.lib	760.32 MB	760.32 MB	0% (0 B) 👌
/libdatadog-x86-windows/release/dynamic/datadog_profiling_ffi.dll	6.75 MB	6.75 MB	0% (0 B) 👌
/libdatadog-x86-windows/release/dynamic/datadog_profiling_ffi.lib	96.45 KB	96.45 KB	0% (0 B) 👌
/libdatadog-x86-windows/release/dynamic/datadog_profiling_ffi.pdb	27.62 MB	27.62 MB	0% (0 B) 👌
/libdatadog-x86-windows/release/static/datadog_profiling_ffi.lib	48.67 MB	48.67 MB	0% (0 B) 👌

x86_64-alpine-linux-musl

Artifact	Baseline	Commit	Change
/x86_64-alpine-linux-musl/lib/libdatadog_profiling.a	79.87 MB	79.87 MB	0% (0 B) 👌
/x86_64-alpine-linux-musl/lib/libdatadog_profiling.so	9.17 MB	9.17 MB	0% (0 B) 👌

x86_64-unknown-linux-gnu

Artifact	Baseline	Commit	Change
/x86_64-unknown-linux-gnu/lib/libdatadog_profiling.a	95.51 MB	95.51 MB	0% (0 B) 👌
/x86_64-unknown-linux-gnu/lib/libdatadog_profiling.so	11.19 MB	11.19 MB	0% (0 B) 👌

pr-commenter · 2026-08-26T10:30:10Z

Benchmarks

Comparison

Benchmark execution time: 2026-08-26 10:27:30

Comparing candidate commit 6824093 in PR branch julio/APMSP-3083 with baseline commit 7d13807 in branch main.

Found 1 performance improvements and 8 performance regressions! Performance is the same for 159 metrics, 10 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

🟩 = significantly better candidate vs. baseline
🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

scenario:alloc_free/system/16

🟥 execution_time [+2.252ns; +2.301ns] or [+15.705%; +16.052%]

scenario:datadog_sample_span/service_rule_not_matching/wall_time

🟥 execution_time [+12.023ns; +12.470ns] or [+9.005%; +9.340%]

scenario:datadog_sample_span/unicode_uppercase_service_rule/wall_time

🟥 execution_time [+17.578ns; +17.734ns] or [+5.165%; +5.211%]

scenario:glob_matcher/unicode_pattern_ascii_subject/wall_time

🟥 execution_time [+6.660ns; +6.919ns] or [+7.372%; +7.659%]

scenario:glob_matcher/unicode_pattern_wildcard_match/wall_time

🟥 execution_time [+5.209ns; +5.318ns] or [+4.115%; +4.200%]

scenario:profiler_attached/fast_path_system/4096

🟥 execution_time [+7.087ns; +7.278ns] or [+7.305%; +7.501%]

scenario:profiler_attached/slow_path_system/4096

🟩 execution_time [-10.648ns; -10.530ns] or [-6.914%; -6.838%]

scenario:trace_buffer/2_senders/no_delay

🟥 execution_time [+190.939µs; +202.781µs] or [+12.622%; +13.405%]
🟥 throughput [-141180.829op/s; -132912.312op/s] or [-11.861%; -11.166%]

Candidate

Omitted due to size.

Baseline

Omitted due to size.

ekump

Code is LGTM, but could you do an editorial pass on the comments before merging?

ekump · 2026-08-27T15:31:57Z

+# Pin policy to proper guards:
+# - Code went through review on main so 'ref' reflect that.
+# - The reference is protected.
+# - Assure the workflow provenance.


Should this comment be here? It reads more like AI explaining what it did.

ekump · 2026-08-27T15:34:55Z

+# 1.`rustfmt` checks out the pull request and runs cargo fmt with no token and no `id-token`
+# permission.
+# 2. `rustfmt-commit` only applies the resulting patch and pushes it only using verified tools
+# from the image, in this case 'git'. Not that --force-with-lease is used which makes the push


Suggested change

# from the image, in this case 'git'. Not that --force-with-lease is used which makes the push

# from the image, in this case 'git'. Note that --force-with-lease is used which makes the push

ekump · 2026-08-27T15:35:47Z

@@ -1,42 +1,145 @@
 name: Rustfmt Auto
+
+# Security model:


Can we make this comment block more concise? It reads like AI explaining what it did, rather than something useful for future readers.

ci: fix security issue by splitting the job

6824093

hoolioh requested a review from a team as a code owner August 26, 2026 09:46

github-actions Bot added the ci-build label Aug 26, 2026

hoolioh changed the title ~~ci: fix security issue by splitting the job~~ ci(APMSP-3083): fix security issue by splitting the job Aug 26, 2026

ekump approved these changes Aug 27, 2026

View reviewed changes

Navigation Menu

Uh oh!

ci(APMSP-3083): fix security issue by splitting the job - #2420

ci(APMSP-3083): fix security issue by splitting the job#2420
hoolioh wants to merge 1 commit into
mainfrom
julio/APMSP-3083

hoolioh commented Aug 26, 2026 •

edited

Loading

Uh oh!

datadog-datadog-prod-us1-2 Bot commented Aug 26, 2026 •

edited

Loading

Uh oh!

dd-octo-sts Bot commented Aug 26, 2026

Uh oh!

pr-commenter Bot commented Aug 26, 2026 •

edited

Loading

Explanation

More details about the CI and significant changes

Uh oh!

ekump left a comment

Uh oh!

ekump Aug 27, 2026

Uh oh!

ekump Aug 27, 2026

Uh oh!

ekump Aug 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	# from the image, in this case 'git'. Not that --force-with-lease is used which makes the push
	# from the image, in this case 'git'. Note that --force-with-lease is used which makes the push

Uh oh!

Conversation

hoolioh commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Uh oh!

datadog-datadog-prod-us1-2 Bot commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dd-octo-sts Bot commented Aug 26, 2026

Artifact Size Benchmark Report

Uh oh!

pr-commenter Bot commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchmarks

Comparison

Explanation

More details about the CI and significant changes

scenario:alloc_free/system/16

scenario:datadog_sample_span/service_rule_not_matching/wall_time

scenario:datadog_sample_span/unicode_uppercase_service_rule/wall_time

scenario:glob_matcher/unicode_pattern_ascii_subject/wall_time

scenario:glob_matcher/unicode_pattern_wildcard_match/wall_time

scenario:profiler_attached/fast_path_system/4096

scenario:profiler_attached/slow_path_system/4096

scenario:trace_buffer/2_senders/no_delay

Candidate

Baseline

Uh oh!

ekump left a comment

Choose a reason for hiding this comment

Uh oh!

ekump Aug 27, 2026

Choose a reason for hiding this comment

Uh oh!

ekump Aug 27, 2026

Choose a reason for hiding this comment

Uh oh!

ekump Aug 27, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

hoolioh commented Aug 26, 2026 •

edited

Loading

datadog-datadog-prod-us1-2 Bot commented Aug 26, 2026 •

edited

Loading

pr-commenter Bot commented Aug 26, 2026 •

edited

Loading