Use commit-headless to create signed commits from GHA #9302
+90
−74
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Code coverage: total 57.24%, base diff 0.00%, patch 100.00% (view details) This comment will be updated automatically if new data arrives.🔗 Commit SHA: 7744e40 | Docs | Was this helpful? Give us feedback! |
AlexeyKuznetsov-DD
approved these changes
Aug 4, 2025
BenchmarksStartupParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 45 metrics, 14 unstable metrics. Startup time reports for petclinicgantt
title petclinic - global startup overhead: candidate=1.53.0-SNAPSHOT~7744e409f6, baseline=1.53.0-SNAPSHOT~d6b43cba5c
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.053 s) : 0, 1053201
Total [baseline] (10.798 s) : 0, 10797889
Agent [candidate] (1.042 s) : 0, 1042423
Total [candidate] (10.723 s) : 0, 10722910
section appsec
Agent [baseline] (1.225 s) : 0, 1225411
Total [baseline] (10.738 s) : 0, 10737982
Agent [candidate] (1.229 s) : 0, 1228714
Total [candidate] (10.852 s) : 0, 10851608
section iast
Agent [baseline] (1.176 s) : 0, 1175519
Total [baseline] (10.911 s) : 0, 10911008
Agent [candidate] (1.178 s) : 0, 1178401
Total [candidate] (10.949 s) : 0, 10949072
section profiling
Agent [baseline] (1.203 s) : 0, 1203357
Total [baseline] (10.946 s) : 0, 10946260
Agent [candidate] (1.205 s) : 0, 1205033
Total [candidate] (10.882 s) : 0, 10881533
gantt
title petclinic - break down per module: candidate=1.53.0-SNAPSHOT~7744e409f6, baseline=1.53.0-SNAPSHOT~d6b43cba5c
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.44 ms) : 0, 1440
crashtracking [candidate] (1.43 ms) : 0, 1430
BytebuddyAgent [baseline] (736.318 ms) : 0, 736318
BytebuddyAgent [candidate] (730.971 ms) : 0, 730971
GlobalTracer [baseline] (243.643 ms) : 0, 243643
GlobalTracer [candidate] (241.502 ms) : 0, 241502
AppSec [baseline] (30.386 ms) : 0, 30386
AppSec [candidate] (29.745 ms) : 0, 29745
Debugger [baseline] (6.047 ms) : 0, 6047
Debugger [candidate] (6.015 ms) : 0, 6015
Remote Config [baseline] (647.868 µs) : 0, 648
Remote Config [candidate] (645.149 µs) : 0, 645
Telemetry [baseline] (13.567 ms) : 0, 13567
Telemetry [candidate] (11.124 ms) : 0, 11124
section appsec
crashtracking [baseline] (1.441 ms) : 0, 1441
crashtracking [candidate] (1.441 ms) : 0, 1441
BytebuddyAgent [baseline] (756.656 ms) : 0, 756656
BytebuddyAgent [candidate] (757.54 ms) : 0, 757540
GlobalTracer [baseline] (236.473 ms) : 0, 236473
GlobalTracer [candidate] (237.132 ms) : 0, 237132
IAST [baseline] (23.824 ms) : 0, 23824
IAST [candidate] (24.046 ms) : 0, 24046
AppSec [baseline] (168.119 ms) : 0, 168119
AppSec [candidate] (168.792 ms) : 0, 168792
Debugger [baseline] (8.729 ms) : 0, 8729
Debugger [candidate] (9.517 ms) : 0, 9517
Remote Config [baseline] (619.655 µs) : 0, 620
Remote Config [candidate] (637.796 µs) : 0, 638
Telemetry [baseline] (8.392 ms) : 0, 8392
Telemetry [candidate] (8.4 ms) : 0, 8400
section iast
crashtracking [baseline] (1.439 ms) : 0, 1439
crashtracking [candidate] (1.426 ms) : 0, 1426
BytebuddyAgent [baseline] (848.588 ms) : 0, 848588
BytebuddyAgent [candidate] (850.188 ms) : 0, 850188
GlobalTracer [baseline] (231.945 ms) : 0, 231945
GlobalTracer [candidate] (233.33 ms) : 0, 233330
IAST [baseline] (28.215 ms) : 0, 28215
IAST [candidate] (30.755 ms) : 0, 30755
AppSec [baseline] (28.804 ms) : 0, 28804
AppSec [candidate] (26.318 ms) : 0, 26318
Debugger [baseline] (6.646 ms) : 0, 6646
Debugger [candidate] (6.707 ms) : 0, 6707
Remote Config [baseline] (606.863 µs) : 0, 607
Remote Config [candidate] (587.557 µs) : 0, 588
Telemetry [baseline] (8.227 ms) : 0, 8227
Telemetry [candidate] (8.165 ms) : 0, 8165
section profiling
crashtracking [baseline] (1.423 ms) : 0, 1423
crashtracking [candidate] (1.411 ms) : 0, 1411
BytebuddyAgent [baseline] (765.376 ms) : 0, 765376
BytebuddyAgent [candidate] (768.135 ms) : 0, 768135
GlobalTracer [baseline] (224.077 ms) : 0, 224077
GlobalTracer [candidate] (223.5 ms) : 0, 223500
AppSec [baseline] (30.497 ms) : 0, 30497
AppSec [candidate] (30.377 ms) : 0, 30377
Debugger [baseline] (6.393 ms) : 0, 6393
Debugger [candidate] (6.349 ms) : 0, 6349
Remote Config [baseline] (704.949 µs) : 0, 705
Remote Config [candidate] (691.36 µs) : 0, 691
Telemetry [baseline] (15.827 ms) : 0, 15827
Telemetry [candidate] (15.964 ms) : 0, 15964
ProfilingAgent [baseline] (109.475 ms) : 0, 109475
ProfilingAgent [candidate] (108.686 ms) : 0, 108686
Profiling [baseline] (110.114 ms) : 0, 110114
Profiling [candidate] (109.338 ms) : 0, 109338
Startup time reports for insecure-bankgantt
title insecure-bank - global startup overhead: candidate=1.53.0-SNAPSHOT~7744e409f6, baseline=1.53.0-SNAPSHOT~d6b43cba5c
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.041 s) : 0, 1040594
Total [baseline] (8.6 s) : 0, 8600157
Agent [candidate] (1.049 s) : 0, 1048833
Total [candidate] (8.641 s) : 0, 8641421
section iast
Agent [baseline] (1.173 s) : 0, 1173358
Total [baseline] (9.347 s) : 0, 9346916
Agent [candidate] (1.173 s) : 0, 1172860
Total [candidate] (9.324 s) : 0, 9324126
gantt
title insecure-bank - break down per module: candidate=1.53.0-SNAPSHOT~7744e409f6, baseline=1.53.0-SNAPSHOT~d6b43cba5c
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.423 ms) : 0, 1423
crashtracking [candidate] (1.438 ms) : 0, 1438
BytebuddyAgent [baseline] (728.439 ms) : 0, 728439
BytebuddyAgent [candidate] (735.046 ms) : 0, 735046
GlobalTracer [baseline] (241.742 ms) : 0, 241742
GlobalTracer [candidate] (242.969 ms) : 0, 242969
AppSec [baseline] (30.146 ms) : 0, 30146
AppSec [candidate] (30.332 ms) : 0, 30332
Debugger [baseline] (6.025 ms) : 0, 6025
Debugger [candidate] (6.079 ms) : 0, 6079
Remote Config [baseline] (642.569 µs) : 0, 643
Remote Config [candidate] (670.293 µs) : 0, 670
Telemetry [baseline] (11.288 ms) : 0, 11288
Telemetry [candidate] (11.261 ms) : 0, 11261
section iast
crashtracking [baseline] (1.421 ms) : 0, 1421
crashtracking [candidate] (1.433 ms) : 0, 1433
BytebuddyAgent [baseline] (845.864 ms) : 0, 845864
BytebuddyAgent [candidate] (846.786 ms) : 0, 846786
GlobalTracer [baseline] (231.958 ms) : 0, 231958
GlobalTracer [candidate] (231.865 ms) : 0, 231865
IAST [baseline] (27.621 ms) : 0, 27621
IAST [candidate] (30.483 ms) : 0, 30483
AppSec [baseline] (30.022 ms) : 0, 30022
AppSec [candidate] (25.294 ms) : 0, 25294
Debugger [baseline] (6.651 ms) : 0, 6651
Debugger [candidate] (7.456 ms) : 0, 7456
Remote Config [baseline] (602.462 µs) : 0, 602
Remote Config [candidate] (607.996 µs) : 0, 608
Telemetry [baseline] (8.275 ms) : 0, 8275
Telemetry [candidate] (8.064 ms) : 0, 8064
LoadParameters
See matching parameters
SummaryFound 3 performance improvements and 1 performance regressions! Performance is the same for 8 metrics, 12 unstable metrics.
Request duration reports for petclinicgantt
title petclinic - request duration [CI 0.99] : candidate=1.53.0-SNAPSHOT~7744e409f6, baseline=1.53.0-SNAPSHOT~d6b43cba5c
dateFormat X
axisFormat %s
section baseline
no_agent (36.271 ms) : 35979, 36564
. : milestone, 36271,
appsec (45.483 ms) : 45074, 45892
. : milestone, 45483,
code_origins (46.414 ms) : 46004, 46823
. : milestone, 46414,
iast (46.771 ms) : 46345, 47198
. : milestone, 46771,
profiling (49.223 ms) : 48743, 49703
. : milestone, 49223,
tracing (46.527 ms) : 46127, 46926
. : milestone, 46527,
section candidate
no_agent (36.326 ms) : 36028, 36623
. : milestone, 36326,
appsec (46.395 ms) : 45988, 46801
. : milestone, 46395,
code_origins (44.961 ms) : 44567, 45355
. : milestone, 44961,
iast (45.717 ms) : 45318, 46116
. : milestone, 45717,
profiling (49.137 ms) : 48639, 49635
. : milestone, 49137,
tracing (42.589 ms) : 42220, 42957
. : milestone, 42589,
Request duration reports for insecure-bankgantt
title insecure-bank - request duration [CI 0.99] : candidate=1.53.0-SNAPSHOT~7744e409f6, baseline=1.53.0-SNAPSHOT~d6b43cba5c
dateFormat X
axisFormat %s
section baseline
no_agent (4.373 ms) : 4322, 4423
. : milestone, 4373,
iast (9.459 ms) : 9303, 9614
. : milestone, 9459,
iast_FULL (13.976 ms) : 13698, 14254
. : milestone, 13976,
iast_GLOBAL (9.904 ms) : 9721, 10086
. : milestone, 9904,
profiling (9.277 ms) : 9126, 9428
. : milestone, 9277,
tracing (7.442 ms) : 7331, 7554
. : milestone, 7442,
section candidate
no_agent (4.331 ms) : 4278, 4383
. : milestone, 4331,
iast (9.35 ms) : 9199, 9501
. : milestone, 9350,
iast_FULL (14.038 ms) : 13760, 14315
. : milestone, 14038,
iast_GLOBAL (10.748 ms) : 10543, 10953
. : milestone, 10748,
profiling (8.882 ms) : 8745, 9019
. : milestone, 8882,
tracing (7.279 ms) : 7180, 7378
. : milestone, 7279,
DacapoParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 11 metrics, 1 unstable metrics. Execution time for tomcatgantt
title tomcat - execution time [CI 0.99] : candidate=1.53.0-SNAPSHOT~7744e409f6, baseline=1.53.0-SNAPSHOT~d6b43cba5c
dateFormat X
axisFormat %s
section baseline
no_agent (1.471 ms) : 1460, 1483
. : milestone, 1471,
appsec (3.653 ms) : 3436, 3871
. : milestone, 3653,
iast (2.193 ms) : 2130, 2256
. : milestone, 2193,
iast_GLOBAL (2.234 ms) : 2171, 2296
. : milestone, 2234,
profiling (2.052 ms) : 2001, 2104
. : milestone, 2052,
tracing (2.021 ms) : 1972, 2071
. : milestone, 2021,
section candidate
no_agent (1.476 ms) : 1465, 1488
. : milestone, 1476,
appsec (3.659 ms) : 3442, 3875
. : milestone, 3659,
iast (2.197 ms) : 2135, 2260
. : milestone, 2197,
iast_GLOBAL (2.236 ms) : 2173, 2299
. : milestone, 2236,
profiling (2.061 ms) : 2008, 2113
. : milestone, 2061,
tracing (2.005 ms) : 1957, 2054
. : milestone, 2005,
Execution time for biojavagantt
title biojava - execution time [CI 0.99] : candidate=1.53.0-SNAPSHOT~7744e409f6, baseline=1.53.0-SNAPSHOT~d6b43cba5c
dateFormat X
axisFormat %s
section baseline
no_agent (14.954 s) : 14954000, 14954000
. : milestone, 14954000,
appsec (14.909 s) : 14909000, 14909000
. : milestone, 14909000,
iast (18.874 s) : 18874000, 18874000
. : milestone, 18874000,
iast_GLOBAL (17.913 s) : 17913000, 17913000
. : milestone, 17913000,
profiling (15.177 s) : 15177000, 15177000
. : milestone, 15177000,
tracing (15.003 s) : 15003000, 15003000
. : milestone, 15003000,
section candidate
no_agent (15.491 s) : 15491000, 15491000
. : milestone, 15491000,
appsec (14.706 s) : 14706000, 14706000
. : milestone, 14706000,
iast (17.997 s) : 17997000, 17997000
. : milestone, 17997000,
iast_GLOBAL (17.908 s) : 17908000, 17908000
. : milestone, 17908000,
profiling (15.961 s) : 15961000, 15961000
. : milestone, 15961000,
tracing (15.114 s) : 15114000, 15114000
. : milestone, 15114000,
|
sarahchen6
added
type: enhancement
|
Failed After talking to @avidal -- the failure is due to a restriction where a private action cannot be accessed from a public repo, even within the same organization. This PR will be put on hold until a resolution is made (e.g. by making |
sarahchen6
commented
Aug 4, 2025
Merged
| @@ -15,7 +15,7 @@ jobs: | |||
| update-docker-build-image: | |||
| runs-on: ubuntu-latest | |||
| permissions: | |||
| contents: write # Required to create and push branch | |||
| contents: read | |||
There was a problem hiding this comment.
❔ question: If contents: write is no more needed, should we remove it to from add-release-to-clouldfoundry?
There was a problem hiding this comment.
Yes it seems so! content permissions are specifically for GITHUB_TOKEN (ref), and add-release-to-cloudfoundry doesn't use this token to push anymore.
EDIT: just kidding - Since there is no use of dd-octo-sts, I think the workflow is still using GITHUB_TOKEN and needs the write permissions to push 🤔
| @@ -42,40 +34,58 @@ jobs: | |||
| JAVA_21_HOME=$JAVA_HOME_21_X64 \ | |||
| ./gradlew resolveAndLockAll --write-locks --parallel --stacktrace --no-daemon --max-workers=4 | |||
| - name: Commit changes | |||
| id: create-commits | |||
There was a problem hiding this comment.
🎯 suggestion: For this part, I would recommend to get rid of the logic that create small commits (ie commit with less than 10 files) and check how the commit-headless push works for big commits.
It would simplify our workflow by only push one big commit.
There was a problem hiding this comment.
I adjusted the logic for now after not finding evidence that commits are limited. However, this will need another review / pass through before merging 😅
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What Does This Do
This PR uses https://github.com/DataDog/commit-headless/tree/main to sign commits in our GHA workflows.
Motivation
Use Datadog internal tooling instead of third party APIs.
Additional Notes
Contributor Checklist
type:and (comp:orinst:) labels in addition to any usefull labelsclose,fixor any linking keywords when referencing an issue.Use
solvesinstead, and assign the PR milestone to the issueJira ticket: [PROJ-IDENT]