Skip to content

Stricter agent jar validation upon build#11684

Merged
gh-worker-dd-mergequeue-cf854d[bot] merged 1 commit into
masterfrom
bdu/agent-jar-checks
Jun 22, 2026
Merged

Stricter agent jar validation upon build#11684
gh-worker-dd-mergequeue-cf854d[bot] merged 1 commit into
masterfrom
bdu/agent-jar-checks

Conversation

@bric3

@bric3 bric3 commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

What Does This Do

  • Maintains the size check.
  • Verify some required entries
  • Ensure there's a minimum number of classes in the whole jar
  • Ensure products are correctly included and have at least one class
  • Light size check on the indexes
  • Fixed list of packages that should not appear in the jar
  • Run the checks during the build job to catch issues earlier

Motivation

Improve the safety of publishing a bad agent jar.

Additional Notes

Contributor Checklist

  • Format the title according to the contribution guidelines
  • Assign the type: and (comp: or inst:) labels in addition to any other useful labels
  • Avoid using close, fix, or any linking keywords when referencing an issue
    Use solves instead, and assign the PR milestone to the issue
  • Update the CODEOWNERS file on source file addition, migration, or deletion
  • Update public documentation with any new configuration flags or behaviors
  • Add your completed PR to the merge queue by commenting /merge. You can also:
    • Customize the commit message associated with the merge with /merge --commit-message "..."
    • Remove your PR from the merge queue with /merge -c
    • Skip all merge queue checks with /merge -f --reason "reason"; please use this judiciously, as some checks do not run at the PR-level (note: the PR still needs to be mergeable, this will only skip the pre-merge build)
    • Get more information in this doc

Jira ticket: [PROJ-IDENT]

* Maintains the size check.
* Verify some required entries
* Ensure there's a minimum number of classes in the whole jar
* Ensure products are correctly included and have at least one class
* Light size check on the indexes
* Fixed list of packages that should not appear in the jar
* Run checks as part of the build job, to catch issues earlier
@bric3 bric3 requested review from a team as code owners June 19, 2026 16:31
@bric3 bric3 requested review from dougqh, mcculls and randomanderson and removed request for a team June 19, 2026 16:31
@bric3 bric3 added tag: no release notes Changes to exclude from release notes comp: tooling Build & Tooling labels Jun 19, 2026
@datadog-datadog-prod-us1

datadog-datadog-prod-us1 Bot commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

Pipelines

Fix all issues with BitsAI

⚠️ Warnings

🚦 1 Pipeline job failed

DataDog/apm-reliability/dd-trace-java | linux-java-spring-petclinic-sca-load-parallel   View in Datadog   GitLab

Useful? React with 👍 / 👎

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 74022b7 | Docs | Datadog PR Page | Give us feedback!

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 74022b7a6a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread .gitlab-ci.yml
@dd-octo-sts

dd-octo-sts Bot commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite Status
Startup 🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results
Scenario Candidate master Δ (95% CI of mean)
startup:insecure-bank:iast:Agent 13.95 s 13.88 s [-0.3%; +1.2%] (no difference)
startup:insecure-bank:tracing:Agent 12.89 s 12.94 s [-1.0%; +0.2%] (no difference)
startup:petclinic:appsec:Agent 16.58 s 16.67 s [-1.5%; +0.5%] (no difference)
startup:petclinic:iast:Agent 16.81 s 16.91 s [-1.4%; +0.3%] (no difference)
startup:petclinic:profiling:Agent 16.71 s 16.56 s [+0.1%; +1.8%] (maybe worse)
startup:petclinic:sca:Agent 16.92 s 16.65 s [+0.8%; +2.5%] (maybe worse)
startup:petclinic:tracing:Agent 15.92 s 16.03 s [-1.8%; +0.5%] (no difference)

Commit: 74022b7a · CI Pipeline · Benchmarking Platform UI


Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

@bric3 bric3 changed the title Expand the jar checks to stricter agent jar validation Stricter agent jar validation upon build Jun 19, 2026

@PerfectSlayer PerfectSlayer left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking good but if anyone want to have another pair of eyes, that could be handy :)

How did you come up from the check cases? Are they based on past issues or mostly come to check most of the tricky parts of the build?


// Sanity check on the minimum number of classes; update as needed. Set to about 98% of that number.
def classCount = entries.keySet().count { it.endsWith('.class') || it.endsWith('.classdata') }
def classFloor = 17_000 // a bit moe than 98% of 17,279 at time of writing

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

❔ question: ‏Would there be a way to not hardcode this number but to derive it from the project sources (with minimal cost, of course 😬 )?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed, I don't like the hard numbers there, and quite frankly that's the part I like the less, but that's the cheapest check I found for what the purpose of this check, which is to avoid regressions in the build.

I believe it's doable, however I believe it's probably too complex to be worth it "at this time".

  • How to include modules (and their dependencies) that actually end-up in the final jar, which is not always the case within :dd-java-agent. Maybe with convention plugin something is feasible, but this initiative is still at the early stages.
  • Also this number acts as a "minimum" threshold, if we derived it could be skewed (build file changes, etc.) without properly noticing.

Map<String, Long> entries = [:]

// Jar size ceiling — raise only when the growth is intentional
def sizeCeiling = 33L * 1024 * 1024

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

❔ question: Same here, not sure how we can do better to avoid magic numbers here‏

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In this case I think it's the right call, this number is a threshold. If it's derived from the actual size, we could miss the size increase.

@bric3 bric3 left a comment

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@PerfectSlayer

How did you come up from the check cases?
Are they based on past issues or mostly come to check most of the tricky parts of the build?

A bit of both. The oltp issue was one of the main driver. And I expanded from that. I also listed a few other items to prevent inadvertent changes.

Also, I anticipate this build file can and will be reworked, and I'd rather err on the cautious side.

@dd-octo-sts dd-octo-sts Bot added the tag: ai generated Largely based on code generated by an AI or LLM label Jun 22, 2026
@bric3 bric3 force-pushed the bdu/agent-jar-checks branch from 89c32c4 to 74022b7 Compare June 22, 2026 11:20

@PerfectSlayer PerfectSlayer left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I came here to comment about the golden instrumentation list (that could introduce toll for limited benefits) but it seems to be gone already? 👀

@bric3

bric3 commented Jun 22, 2026

Copy link
Copy Markdown
Contributor Author

@PerfectSlayer

I came here to comment about the golden instrumentation list (that could introduce toll for limited benefits) but it seems to be gone already? 👀

Sorry, it was meant to be in a stacked PR. So I removed that commit and opened a new PR #11692

@bric3

bric3 commented Jun 22, 2026

Copy link
Copy Markdown
Contributor Author

/merge

@gh-worker-devflow-routing-ef8351

gh-worker-devflow-routing-ef8351 Bot commented Jun 22, 2026

Copy link
Copy Markdown

View all feedbacks in Devflow UI.

2026-06-22 12:47:23 UTC ℹ️ Start processing command /merge


2026-06-22 12:47:28 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 1h (p90).


2026-06-22 13:47:06 UTC ℹ️ MergeQueue: This merge request was merged

@gh-worker-dd-mergequeue-cf854d gh-worker-dd-mergequeue-cf854d Bot merged commit 11c9d48 into master Jun 22, 2026
987 of 992 checks passed
@gh-worker-dd-mergequeue-cf854d gh-worker-dd-mergequeue-cf854d Bot deleted the bdu/agent-jar-checks branch June 22, 2026 13:47
@github-actions github-actions Bot added this to the 1.64.0 milestone Jun 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

comp: tooling Build & Tooling tag: ai generated Largely based on code generated by an AI or LLM tag: no release notes Changes to exclude from release notes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants