chore(release): fix release bump auto-merge - #698
Open
kaahos wants to merge 2 commits into
Open
Conversation
Contributor
CI Test ResultsRun: #30674511726 | Commit:
Status Overview
Legend: ✅ passed | ❌ failed | ⚪ skipped | 🚫 cancelled Summary: Total: 32 | Passed: 32 | Failed: 0 Updated: 2026-08-01 00:24:16 UTC |
Contributor
Benchmark Results (commit edd3930)Pipeline: https://gitlab.ddbuild.io/DataDog/apm-reliability/benchmarking-platform/-/pipelines/127754577 Commit:
|
| Benchmark | JDK | Latest | Dev | Δ (dev vs latest) | Issues L/D |
|---|---|---|---|---|---|
| akka-uct | 21 | ✅ 10344 ms (21 iters) | ✅ 10134 ms (21 iters) | ≈ -2% (±11%) | — / — |
| akka-uct | 25 | ✅ 8794 ms (24 iters) | ✅ 8820 ms (24 iters) | ≈ +0.3% (±10.7%) | — / — |
| finagle-chirper | 21 | ✅ 6018 ms (33 iters) | ✅ 6016 ms (33 iters) | ≈ -0% (±24.9%) | |
| finagle-chirper | 25 | ✅ 5439 ms (36 iters) | ✅ 5468 ms (36 iters) | ≈ +0.5% (±24.7%) | |
| fj-kmeans | 21 | ✅ 2731 ms (68 iters) | ✅ 2663 ms (69 iters) | ≈ -2.5% (±2.7%) | — / — |
| fj-kmeans | 25 | ✅ 2762 ms (68 iters) | ✅ 2817 ms (66 iters) | ≈ +2% (±2.8%) | — / — |
| future-genetic | 21 | ✅ 2052 ms (90 iters) | ✅ 2106 ms (88 iters) | 🔴 +2.6% | — / — |
| future-genetic | 25 | ✅ 2051 ms (90 iters) | ✅ 2011 ms (92 iters) | ≈ -2% (±2.6%) | — / — |
| naive-bayes | 21 | ✅ 1253 ms (136 iters) | ✅ 1244 ms (137 iters) | ≈ -0.7% (±32.7%) | — / — |
| naive-bayes | 25 | ✅ 1012 ms (169 iters) | ✅ 1017 ms (168 iters) | ≈ +0.5% (±31.8%) | — / — |
| reactors | 21 | ✅ 16102 ms (15 iters) | ✅ 16505 ms (15 iters) | ≈ +2.5% (±8.8%) | — / — |
Internal counter details (ddprof)
ddprof internal counters, latest / dev (✅ = 0, · = unavailable):
| Benchmark | JDK | Dropped rec | Dropped jvmti | Dropped trace | Skipped WC | AGCT fail | Unwind fail |
|---|---|---|---|---|---|---|---|
| akka-uct | 21 | ✅ / ✅ | ✅ / ✅ | 2 / 1 | 2045 / 1986 | ✅ / ✅ | ✅ / ✅ |
| akka-uct | 25 | ✅ / ✅ | ✅ / ✅ | 1 / 2 | 2380 / 2421 | ✅ / ✅ | ✅ / ✅ |
| finagle-chirper | 21 | ✅ / ✅ | ✅ / ✅ | 4 / 5 | 8249 / 8606 | ✅ / ✅ | ✅ / ✅ |
| finagle-chirper | 25 | ✅ / ✅ | ✅ / ✅ | ✅ / 1 | 8265 / 8586 | ✅ / ✅ | ✅ / ✅ |
| fj-kmeans | 21 | ✅ / ✅ | ✅ / ✅ | 1 / 12 | 1261 / 1249 | ✅ / ✅ | ✅ / ✅ |
| fj-kmeans | 25 | ✅ / ✅ | ✅ / ✅ | 3 / 3 | 1285 / 1272 | ✅ / ✅ | ✅ / ✅ |
| future-genetic | 21 | ✅ / ✅ | ✅ / ✅ | 1 / 2 | 2941 / 2979 | ✅ / ✅ | ✅ / ✅ |
| future-genetic | 25 | ✅ / ✅ | ✅ / ✅ | ✅ / ✅ | 2867 / 2838 | ✅ / ✅ | ✅ / ✅ |
| naive-bayes | 21 | ✅ / ✅ | ✅ / ✅ | 9 / 6 | 3465 / 3495 | ✅ / ✅ | ✅ / ✅ |
| naive-bayes | 25 | ✅ / ✅ | ✅ / ✅ | 9 / 3 | 3462 / 3469 | ✅ / ✅ | ✅ / ✅ |
| reactors | 21 | ✅ / ✅ | ✅ / ✅ | 1 / ✅ | 1665 / 1631 | ✅ / ✅ | ✅ / ✅ |
| reactors | 25 | ✅ / ✅ | ✅ / ✅ | 1 / 1 | 1930 / 1896 | ✅ / ✅ | ✅ / ✅ |
kaahos
marked this pull request as ready for review
July 31, 2026 15:08
![chatgpt-codex-connector[bot]](https://cdn.github.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 51ab22284b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Contributor
Benchmark Results (commit 51ab222)Pipeline: https://gitlab.ddbuild.io/DataDog/apm-reliability/benchmarking-platform/-/pipelines/128264970 Commit: ✅ Within expected boundariesNo significant runtime deltas (all within run-to-run noise) and no internal-counter outliers. Runtime details (per benchmark × JDK)
Internal counter details (ddprof)ddprof internal counters, latest / dev (✅ = 0, · = unavailable):
|
Contributor
Benchmark Results (commit 8b42e17)Pipeline: https://gitlab.ddbuild.io/DataDog/apm-reliability/benchmarking-platform/-/pipelines/128291352 Commit:
|
| Benchmark | JDK | Latest | Dev | Δ (dev vs latest) | Issues L/D |
|---|---|---|---|---|---|
| akka-uct | 21 | ✅ 10338 ms (21 iters) | ✅ 10347 ms (21 iters) | ≈ +0.1% (±11.1%) | — / — |
| akka-uct | 25 | ✅ 8773 ms (24 iters) | ✅ 8780 ms (24 iters) | ≈ +0.1% (±10%) | — / — |
| finagle-chirper | 21 | ✅ 5957 ms (33 iters) | ✅ 6011 ms (33 iters) | ≈ +0.9% (±25.6%) | |
| finagle-chirper | 25 | ✅ 5511 ms (36 iters) | ✅ 5475 ms (36 iters) | ≈ -0.7% (±24.3%) | |
| fj-kmeans | 21 | ✅ 2688 ms (70 iters) | ✅ 2691 ms (70 iters) | ≈ +0.1% (±2.7%) | — / — |
| fj-kmeans | 25 | ✅ 2720 ms (68 iters) | ✅ 2843 ms (66 iters) | 🔴 +4.5% | — / — |
| future-genetic | 21 | ✅ 2118 ms (88 iters) | ✅ 2066 ms (90 iters) | ≈ -2.5% (±2.6%) | — / — |
| future-genetic | 25 | ✅ 2062 ms (90 iters) | ✅ 2053 ms (91 iters) | ≈ -0.4% (±2.8%) | — / — |
| naive-bayes | 21 | ✅ 1291 ms (133 iters) | ✅ 1272 ms (136 iters) | ≈ -1.5% (±31.9%) | — / — |
| naive-bayes | 25 | ✅ 978 ms (174 iters) | ✅ 1004 ms (170 iters) | ≈ +2.7% (±32%) | — / — |
| reactors | 25 | ✅ 18532 ms (15 iters) | ✅ 18774 ms (15 iters) | ≈ +1.3% (±3.7%) | — / — |
Internal counter details (ddprof)
ddprof internal counters, latest / dev (✅ = 0, · = unavailable):
| Benchmark | JDK | Dropped rec | Dropped jvmti | Dropped trace | Skipped WC | AGCT fail | Unwind fail |
|---|---|---|---|---|---|---|---|
| akka-uct | 21 | ✅ / ✅ | ✅ / ✅ | 2 / ✅ | 2066 / 2032 | ✅ / ✅ | ✅ / ✅ |
| akka-uct | 25 | ✅ / ✅ | ✅ / ✅ | 5 / 1 | 2410 / 2378 | ✅ / ✅ | ✅ / ✅ |
| finagle-chirper | 21 | ✅ / ✅ | ✅ / ✅ | 7 / 4 | 8268 / 8494 | ✅ / ✅ | ✅ / ✅ |
| finagle-chirper | 25 | ✅ / ✅ | ✅ / ✅ | 2 / 1 | 8312 / 8053 | ✅ / ✅ | ✅ / ✅ |
| fj-kmeans | 21 | ✅ / ✅ | ✅ / ✅ | 4 / 2 | 1278 / 1247 | ✅ / ✅ | ✅ / ✅ |
| fj-kmeans | 25 | ✅ / ✅ | ✅ / ✅ | ✅ / 1 | 1260 / 1292 | ✅ / ✅ | ✅ / ✅ |
| future-genetic | 21 | ✅ / ✅ | ✅ / ✅ | 1 / ✅ | 2998 / 2945 | ✅ / ✅ | ✅ / ✅ |
| future-genetic | 25 | ✅ / ✅ | ✅ / ✅ | 2 / 2 | 2856 / 2797 | ✅ / ✅ | ✅ / ✅ |
| naive-bayes | 21 | ✅ / ✅ | ✅ / ✅ | 3 / 3 | 3520 / 3615 | ✅ / ✅ | ✅ / ✅ |
| naive-bayes | 25 | ✅ / ✅ | ✅ / ✅ | 3 / 5 | 3419 / 3428 | ✅ / ✅ | ✅ / ✅ |
| reactors | 21 | ✅ / ✅ | ✅ / ✅ | ✅ / ✅ | ✅ / ✅ | ✅ / ✅ | ✅ / ✅ |
| reactors | 25 | ✅ / ✅ | ✅ / ✅ | 2 / 2 | 1955 / 1926 | ✅ / ✅ | ✅ / ✅ |
Contributor
Benchmark Results (commit fa6b4be)Pipeline: https://gitlab.ddbuild.io/DataDog/apm-reliability/benchmarking-platform/-/pipelines/128313596 Commit:
|
| Benchmark | JDK | Latest | Dev | Δ (dev vs latest) | Issues L/D |
|---|---|---|---|---|---|
| akka-uct | 21 | ✅ 10250 ms (21 iters) | ✅ 10295 ms (21 iters) | ≈ +0.4% (±11.6%) | — / — |
| akka-uct | 25 | ✅ 8870 ms (24 iters) | ✅ 8826 ms (24 iters) | ≈ -0.5% (±10.2%) | — / — |
| finagle-chirper | 21 | ✅ 5970 ms (33 iters) | ✅ 5952 ms (33 iters) | ≈ -0.3% (±25%) | |
| finagle-chirper | 25 | ✅ 5486 ms (36 iters) | ✅ 5442 ms (36 iters) | ≈ -0.8% (±24.2%) | |
| fj-kmeans | 21 | ✅ 2730 ms (68 iters) | ✅ 2767 ms (68 iters) | ≈ +1.4% (±2.8%) | — / — |
| fj-kmeans | 25 | ✅ 2829 ms (66 iters) | ✅ 2827 ms (66 iters) | ≈ -0.1% (±2.7%) | — / — |
| future-genetic | 21 | ✅ 2085 ms (89 iters) | ✅ 2096 ms (88 iters) | ≈ +0.5% (±2.7%) | — / — |
| future-genetic | 25 | ✅ 2049 ms (91 iters) | ✅ 1946 ms (96 iters) | 🟢 -5% | — / — |
| naive-bayes | 21 | ✅ 1287 ms (133 iters) | ✅ 1259 ms (136 iters) | ≈ -2.2% (±32.4%) | — / — |
| naive-bayes | 25 | ✅ 1029 ms (166 iters) | ✅ 993 ms (172 iters) | ≈ -3.5% (±31.4%) | — / — |
| reactors | 21 | ✅ 16400 ms (15 iters) | ✅ 15831 ms (15 iters) | ≈ -3.5% (±7.8%) | — / — |
| reactors | 25 | ✅ 18850 ms (15 iters) | ✅ 18308 ms (15 iters) | ≈ -2.9% (±4.9%) | — / — |
Internal counter details (ddprof)
ddprof internal counters, latest / dev (✅ = 0, · = unavailable):
| Benchmark | JDK | Dropped rec | Dropped jvmti | Dropped trace | Skipped WC | AGCT fail | Unwind fail |
|---|---|---|---|---|---|---|---|
| akka-uct | 21 | ✅ / ✅ | ✅ / ✅ | 3 / 1 | 2021 / 2046 | ✅ / ✅ | ✅ / ✅ |
| akka-uct | 25 | ✅ / ✅ | ✅ / ✅ | 2 / 2 | 2123 / 2088 | ✅ / ✅ | ✅ / ✅ |
| finagle-chirper | 21 | ✅ / ✅ | ✅ / ✅ | 3 / 2 | 8828 / 8315 | ✅ / ✅ | ✅ / ✅ |
| finagle-chirper | 25 | ✅ / ✅ | ✅ / ✅ | ✅ / 2 | 8087 / 8732 | ✅ / ✅ | ✅ / ✅ |
| fj-kmeans | 21 | ✅ / ✅ | ✅ / ✅ | ✅ / 1 | 1261 / 1292 | ✅ / ✅ | ✅ / ✅ |
| fj-kmeans | 25 | ✅ / ✅ | ✅ / ✅ | 2 / 3 | 1274 / 1274 | ✅ / ✅ | ✅ / ✅ |
| future-genetic | 21 | ✅ / ✅ | ✅ / ✅ | 2 / 2 | 2888 / 2864 | ✅ / ✅ | ✅ / ✅ |
| future-genetic | 25 | ✅ / ✅ | ✅ / ✅ | ✅ / ✅ | 2861 / 2906 | ✅ / ✅ | ✅ / ✅ |
| naive-bayes | 21 | ✅ / ✅ | ✅ / ✅ | 4 / ✅ | 3525 / 3525 | ✅ / ✅ | ✅ / ✅ |
| naive-bayes | 25 | ✅ / ✅ | ✅ / ✅ | ✅ / 2 | 3482 / 3517 | ✅ / ✅ | ✅ / ✅ |
| reactors | 21 | ✅ / ✅ | ✅ / ✅ | ✅ / ✅ | 1635 / 1547 | ✅ / ✅ | ✅ / ✅ |
| reactors | 25 | ✅ / ✅ | ✅ / ✅ | ✅ / ✅ | 1903 / 1888 | ✅ / ✅ | ✅ / ✅ |
![dd-octo-sts[bot]](https://cdn.github.com/in/1157446?s=60&v=4){kind=small}
kaahos
force-pushed
the
paul.fournillon/secure-release-bump-auto-merge
branch
from
July 31, 2026 23:21
e9625e0 to
283974e
Compare
This comment has been minimized.
This comment has been minimized.
Contributor
Benchmark Results (commit 283974e)Pipeline: https://gitlab.ddbuild.io/DataDog/apm-reliability/benchmarking-platform/-/pipelines/128377789 Commit: ✅ Within expected boundariesNo significant runtime deltas (all within run-to-run noise) and no internal-counter outliers. Runtime details (per benchmark × JDK)
Internal counter details (ddprof)ddprof internal counters, latest / dev (✅ = 0, · = unavailable):
|
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens and unifies the release automation around a single trivial-label approval workflow, and improves release workflow/run correlation to avoid auto-merging the wrong bump commit.
Changes:
- Adds correlation + SHA-locking between
utils/release.shandrelease-validated.yml, and introduces an immutable bump manifest artifact consumed by a local finalizer. - Replaces the
no-review-based auto-approval flow with atrivial-label workflow that authorizes labelers and validates automated bump PRs before approving a specific head SHA. - Adds hermetic shell tests + CI job coverage for the release automation scripts.
Reviewed changes
Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| utils/release.sh | Adds workflow-run correlation and post-run bump finalization via downloaded manifest. |
| utils/README.md | Updates documentation to describe the new bump approval/finalization flow and tests. |
| utils/finalize-release-bump.sh | New local finalizer to validate, label, wait for approval/checks, and SHA-lock merge of bump PRs. |
| .github/workflows/release-validated.yml | Adds request/source SHA inputs, SHA-locks checkout, and uploads bump finalization manifest. |
| .github/workflows/ci.yml | Adds a CI job to syntax-check, shellcheck, and run hermetic release automation tests. |
| .github/workflows/approve-trivial.yml | Reworks trivial approval to authorize labelers and validate bump PRs before SHA-pinned approval. |
| .github/scripts/validate-trivial-approval.sh | New validator to authorize who can apply trivial (trusted bots + write/maintain/admin humans). |
| .github/scripts/validate-release-bump.sh | New strict validator for automated bump PRs/branches (refs, SHAs, permissions, and exact version-only diff). |
| .github/scripts/tests/test_release_automation.sh | New hermetic test suite covering validators and key workflow/script invariants. |
| .github/scripts/release.sh | Updates bump PR creation/labeling and pins auto-merge to the validated head SHA; emits outputs for manifest. |
| .github/dependabot.yml | Switches Dependabot auto-approval trigger label from no-review to trivial. |
| .github/chainguard/self.release-bump.create-pr.sts.yaml | Tightens STS claim pattern to the specific workflow ref(s) for bump-PR creation. |
| .github/chainguard/self.approve-trivial.approve-pr.sts.yaml | Expands ref pattern to include protected release/X.Y._ branches (but needs an additional fix). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Contributor
Benchmark Results (commit 2d30cf4)Pipeline: https://gitlab.ddbuild.io/DataDog/apm-reliability/benchmarking-platform/-/pipelines/128381417 Commit:
|
| Benchmark | JDK | Latest | Dev | Δ (dev vs latest) | Issues L/D |
|---|---|---|---|---|---|
| akka-uct | 21 | ✅ 10191 ms (21 iters) | ✅ 10290 ms (21 iters) | ≈ +1% (±10.7%) | — / — |
| akka-uct | 25 | ✅ 8822 ms (24 iters) | ✅ 8778 ms (24 iters) | ≈ -0.5% (±9.8%) | — / — |
| finagle-chirper | 21 | ✅ 6009 ms (33 iters) | ✅ 6074 ms (33 iters) | ≈ +1.1% (±25.6%) | |
| finagle-chirper | 25 | ✅ 5415 ms (36 iters) | ✅ 5461 ms (36 iters) | ≈ +0.8% (±24.4%) | |
| fj-kmeans | 21 | ✅ 2828 ms (66 iters) | ✅ 2630 ms (72 iters) | 🟢 -7% | — / — |
| fj-kmeans | 25 | ✅ 2824 ms (66 iters) | ✅ 2817 ms (66 iters) | ≈ -0.2% (±2.6%) | — / — |
| future-genetic | 21 | ✅ 2067 ms (89 iters) | ✅ 2068 ms (89 iters) | ≈ +0% (±2.7%) | — / — |
| future-genetic | 25 | ✅ 2038 ms (90 iters) | ✅ 2128 ms (87 iters) | 🔴 +4.4% | — / — |
| naive-bayes | 21 | ✅ 1239 ms (138 iters) | ✅ 1234 ms (138 iters) | ≈ -0.4% (±32.6%) | — / — |
| naive-bayes | 25 | ✅ 1015 ms (168 iters) | ✅ 1013 ms (169 iters) | ≈ -0.2% (±31.6%) | — / — |
| reactors | 21 | ✅ 16812 ms (15 iters) | ✅ 16385 ms (15 iters) | ≈ -2.5% (±7.1%) | — / — |
| reactors | 25 | ✅ 18495 ms (15 iters) | ✅ 18946 ms (15 iters) | ≈ +2.4% (±4.5%) | — / — |
Internal counter details (ddprof)
ddprof internal counters, latest / dev (✅ = 0, · = unavailable):
| Benchmark | JDK | Dropped rec | Dropped jvmti | Dropped trace | Skipped WC | AGCT fail | Unwind fail |
|---|---|---|---|---|---|---|---|
| akka-uct | 21 | ✅ / ✅ | ✅ / ✅ | ✅ / 1 | 1928 / 1960 | ✅ / ✅ | ✅ / ✅ |
| akka-uct | 25 | ✅ / ✅ | ✅ / ✅ | 1 / 3 | 2261 / 2096 | ✅ / ✅ | ✅ / ✅ |
| finagle-chirper | 21 | ✅ / ✅ | ✅ / ✅ | 5 / 2 | 8816 / 8873 | ✅ / ✅ | ✅ / ✅ |
| finagle-chirper | 25 | ✅ / ✅ | ✅ / ✅ | 3 / 3 | 8171 / 8224 | ✅ / ✅ | ✅ / ✅ |
| fj-kmeans | 21 | ✅ / ✅ | ✅ / ✅ | 2 / 2 | 1263 / 1297 | ✅ / ✅ | ✅ / ✅ |
| fj-kmeans | 25 | ✅ / ✅ | ✅ / ✅ | 1 / 2 | 1265 / 1270 | ✅ / ✅ | ✅ / ✅ |
| future-genetic | 21 | ✅ / ✅ | ✅ / ✅ | 2 / 3 | 2902 / 2873 | ✅ / ✅ | ✅ / ✅ |
| future-genetic | 25 | ✅ / ✅ | ✅ / ✅ | 3 / 2 | 2823 / 2963 | ✅ / ✅ | ✅ / ✅ |
| naive-bayes | 21 | ✅ / ✅ | ✅ / ✅ | 4 / 1 | 3481 / 3505 | ✅ / ✅ | ✅ / ✅ |
| naive-bayes | 25 | ✅ / ✅ | ✅ / ✅ | 2 / 3 | 3491 / 3517 | ✅ / ✅ | ✅ / ✅ |
| reactors | 21 | ✅ / ✅ | ✅ / ✅ | 2 / 1 | 1727 / 1737 | ✅ / ✅ | ✅ / ✅ |
| reactors | 25 | ✅ / ✅ | ✅ / ✅ | ✅ / 1 | 1924 / 1926 | ✅ / ✅ | ✅ / ✅ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?:
Fix release bump PR auto-merge and unify automatic approval around the existing
triviallabel.Motivation:
Fix the broken auto-merge PR process for new version bump.
Changes:
trivial.trivialPRs.automated/bump-*PRs before approval.mainand protectedrelease/X.Y._branches.no-reviewworkflow and STS policy.trivial.Additional Notes:
How to test the change?:
For Datadog employees:
credentials of any kind, I've requested a security review (run the
dd:platform-security-reviewskill, or file a request via the PSEC review form).
bewairealso runs automatically on every PR.Unsure? Have a question? Request a review!