Skip to content

CI: fix Datadog credentials OIDC exchange broken by environment: dev - #359

Merged
xlamorlette-datadog merged 4 commits into
mainfrom
xlamorlette/system-test-oidc-exchange-failure
Aug 24, 2026
Merged

CI: fix Datadog credentials OIDC exchange broken by environment: dev#359
xlamorlette-datadog merged 4 commits into
mainfrom
xlamorlette/system-test-oidc-exchange-failure

Conversation

@xlamorlette-datadog

@xlamorlette-datadog xlamorlette-datadog commented Aug 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Description

For the CI, remove environment: name: dev in CMake builds, because it made the OIDC exchanges (to get credentials) fail, and it was actually useless.

Motivation

dd-sts-action OIDC exchange has been failing with HTTP 401 since #357. Example:

Get Datadog credentials
Run DataDog/dd-sts-action@639d841c72f15e4e77747bd726ef8105ce971da2
Successfully retrieved GitHub OIDC token.
Exchanging OIDC token for Datadog credentials at 'https://webhooks.build.datadoghq.com/sts/datadog/exchange?policy=public-datadog-dd-trace-cpp'...
Error: Failed to exchange OIDC token for Datadog credentials: HTTP error! status: 401,

Additional Notes

These failures were silent because we know that such 'get credentials' steps fail on PRs. Thus, we narrow the continue-on-error for these steps to PRs.

Validation:

Run DataDog/dd-sts-action@639d841c72f15e4e77747bd726ef8105ce971da2
  Requesting GitHub OIDC token with audience 'dd-sts'...
  Response from https://run-actions-2-azure-eastus.actions.githubusercontent.com/190//idtoken/4c38ac50-79eb-4088-be77-7bf328820afc/bc9f2347-f972-5c9d-b8a3-f71d61fb657a?api-version=2.0&audience=dd-sts: HTTP 200 (301ms)
  Successfully retrieved GitHub OIDC token.
  Exchanging OIDC token for Datadog credentials at 'https://webhooks.build.datadoghq.com/sts/datadog/exchange?policy=public-datadog-dd-trace-cpp'...
  Response from https://webhooks.build.datadoghq.com/sts/datadog/exchange?policy=public-datadog-dd-trace-cpp: HTTP 200 (329ms)
  Received credentials
  dd-sts-action completed successfully.

Jira ticket: IDMPL-821 https://datadoghq.atlassian.net/browse/IDMPL-821

@pr-commenter

pr-commenter Bot commented Aug 24, 2026 •
edited
Loading

Copy link
Copy Markdown

Benchmarks

Benchmark execution time: 2026-08-24 14:51:06

Comparing candidate commit c037313 in PR branch xlamorlette/system-test-oidc-exchange-failure with baseline commit 1f33435 in branch main.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 8 metrics, 0 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

  • 🟩 = significantly better candidate vs. baseline
  • 🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

@xlamorlette-datadog xlamorlette-datadog changed the title CI: remove useless and harmful environment 'dev' CI: fix Datadog credentials OIDC exchange broken by environment: dev Aug 24, 2026
@datadog-datadog-prod-us1

datadog-datadog-prod-us1 Bot commented Aug 24, 2026 •
edited by datadog-prod-us1-6 Bot
Loading

Copy link
Copy Markdown

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 84.48%

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: c037313 | Docs | View more details | Give us feedback!

@xlamorlette-datadog
xlamorlette-datadog marked this pull request as ready for review August 24, 2026 14:06
@xlamorlette-datadog
xlamorlette-datadog requested review from a team as code owners August 24, 2026 14:06
@xlamorlette-datadog
xlamorlette-datadog force-pushed the xlamorlette/system-test-oidc-exchange-failure branch from e230b90 to ad01798 Compare August 24, 2026 14:08
dubloom
dubloom reviewed Aug 24, 2026
View reviewed changes
Comment thread .github/workflows/dev.yml Outdated
@xlamorlette-datadog
xlamorlette-datadog merged commit 0642d9d into main Aug 24, 2026
68 checks passed
@xlamorlette-datadog
xlamorlette-datadog deleted the xlamorlette/system-test-oidc-exchange-failure branch August 24, 2026 18:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pawelchcki pawelchcki pawelchcki approved these changes
@dubloom dubloom dubloom approved these changes
@Anilm3 Anilm3 Awaiting requested review from Anilm3 Anilm3 is a code owner automatically assigned from DataDog/dd-trace-cpp

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@xlamorlette-datadog @pawelchcki @dubloom