[SINT-4550] Use CI Identities in Windows CI Jobs #8033
Draft
+49
−93
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions
bot
added
the
area:builds
BenchmarksBenchmark execution time: 2026-01-09 15:52:03 Comparing candidate commit 7d6fb50 in PR branch Found 11 performance improvements and 5 performance regressions! Performance is the same for 159 metrics, 11 unstable metrics. scenario:Benchmarks.Trace.ActivityBenchmark.StartStopWithChild net472
scenario:Benchmarks.Trace.ActivityBenchmark.StartStopWithChild net6.0
scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.AllCycleMoreComplexBody net6.0
scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorMoreComplexBody netcoreapp3.1
scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorSimpleBody net6.0
scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorSimpleBody netcoreapp3.1
scenario:Benchmarks.Trace.Asm.AppSecEncoderBenchmark.EncodeLegacyArgs netcoreapp3.1
scenario:Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark.WriteAndFlushEnrichedTraces net472
scenario:Benchmarks.Trace.CharSliceBenchmark.OriginalCharSlice net6.0
scenario:Benchmarks.Trace.Log4netBenchmark.EnrichedLog net472
scenario:Benchmarks.Trace.SerilogBenchmark.EnrichedLog netcoreapp3.1
scenario:Benchmarks.Trace.SpanBenchmark.StartFinishSpan net6.0
|
andrewlock
reviewed
Jan 9, 2026
Comment on lines
-113
to
-114
| // dd-wcs will return 0 even if there are errors | ||
| if (line.StartsWith("ERROR:", StringComparison.OrdinalIgnoreCase)) |
Member
There was a problem hiding this comment.
I take it this is no longer the case, and the sign tool returns an error now if it fails for any reason? Just checking because this was a cause of releasing unsigned artifacts and causing an incident previously 😅
Member
Author
There was a problem hiding this comment.
The previous signing tool had many issues so we re-wrote it entirely, and I am pretty confident it should exit with a non-zero status if there is any problem: https://github.com/DataDog/windows-code-signer/blob/ee081a1e9d092654c24a037a3e5c524b6f5cc52e/cmd/windows-code-signer/windows-code-signer.go#L21
Was the signature verification step added after the incident? I would expect it to catch any missing signature.
Member
There was a problem hiding this comment.
Was the signature verification step added after the incident? I would expect it to catch any missing signature.
Yes, it was 🙂
Co-authored-by: Andrew Lock <[email protected]>
Co-authored-by: Andrew Lock <[email protected]>
Co-authored-by: Andrew Lock <[email protected]>
Co-authored-by: Andrew Lock <[email protected]>
Execution-Time Benchmarks Report ⏱️Execution-time results for samples comparing This PR (8033) and master. ✅ No regressions detected - check the details below Full Metrics ComparisonFakeDbCommand
HttpMessageHandler
Comparison explanationExecution-time benchmarks measure the whole time it takes to execute a program, and are intended to measure the one-off costs. Cases where the execution time results for the PR are worse than latest master results are highlighted in **red**. The following thresholds were used for comparing the execution times:
Note that these results are based on a single point-in-time result for each branch. For full results, see the dashboard. Graphs show the p99 interval based on the mean and StdDev of the test run, as well as the mean value of the run (shown as a diamond below the graph). Duration chartsFakeDbCommand (.NET Framework 4.8)gantt
title Execution time (ms) FakeDbCommand (.NET Framework 4.8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8033) - mean (69ms) : 67, 70
master - mean (68ms) : 67, 70
section Bailout
This PR (8033) - mean (72ms) : 71, 73
master - mean (72ms) : 71, 73
section CallTarget+Inlining+NGEN
This PR (8033) - mean (1,010ms) : 970, 1050
master - mean (1,013ms) : 949, 1076
FakeDbCommand (.NET Core 3.1)gantt
title Execution time (ms) FakeDbCommand (.NET Core 3.1)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8033) - mean (106ms) : 103, 108
master - mean (106ms) : 104, 108
section Bailout
This PR (8033) - mean (107ms) : 106, 108
master - mean (107ms) : 106, 108
section CallTarget+Inlining+NGEN
This PR (8033) - mean (738ms) : 674, 803
master - mean (737ms) : 679, 796
FakeDbCommand (.NET 6)gantt
title Execution time (ms) FakeDbCommand (.NET 6)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8033) - mean (94ms) : 92, 96
master - mean (93ms) : 91, 95
section Bailout
This PR (8033) - mean (94ms) : 93, 95
master - mean (94ms) : 93, 95
section CallTarget+Inlining+NGEN
This PR (8033) - mean (714ms) : 685, 743
master - mean (711ms) : 674, 747
FakeDbCommand (.NET 8)gantt
title Execution time (ms) FakeDbCommand (.NET 8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8033) - mean (93ms) : 90, 95
master - mean (92ms) : 89, 95
section Bailout
This PR (8033) - mean (93ms) : 92, 95
master - mean (93ms) : 92, 94
section CallTarget+Inlining+NGEN
This PR (8033) - mean (634ms) : 619, 650
master - mean (633ms) : 619, 646
HttpMessageHandler (.NET Framework 4.8)gantt
title Execution time (ms) HttpMessageHandler (.NET Framework 4.8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8033) - mean (194ms) : 188, 200
master - mean (193ms) : 189, 196
section Bailout
This PR (8033) - mean (197ms) : 194, 200
master - mean (196ms) : 193, 199
section CallTarget+Inlining+NGEN
This PR (8033) - mean (1,119ms) : 1065, 1173
master - mean (1,111ms) : 1063, 1158
HttpMessageHandler (.NET Core 3.1)gantt
title Execution time (ms) HttpMessageHandler (.NET Core 3.1)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8033) - mean (278ms) : 272, 284
master - mean (277ms) : 270, 283
section Bailout
This PR (8033) - mean (278ms) : 273, 282
master - mean (277ms) : 273, 280
section CallTarget+Inlining+NGEN
This PR (8033) - mean (927ms) : 875, 978
master - mean (921ms) : 870, 973
HttpMessageHandler (.NET 6)gantt
title Execution time (ms) HttpMessageHandler (.NET 6)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8033) - mean (271ms) : 265, 277
master - mean (269ms) : 265, 274
section Bailout
This PR (8033) - mean (270ms) : 267, 273
master - mean (271ms) : 266, 276
section CallTarget+Inlining+NGEN
This PR (8033) - mean (935ms) : 894, 975
master - mean (921ms) : 871, 971
HttpMessageHandler (.NET 8)gantt
title Execution time (ms) HttpMessageHandler (.NET 8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8033) - mean (273ms) : 267, 278
master - mean (269ms) : 264, 273
section Bailout
This PR (8033) - mean (277ms) : 267, 286
master - mean (269ms) : 264, 273
section CallTarget+Inlining+NGEN
This PR (8033) - mean (834ms) : 803, 864
master - mean (825ms) : 803, 846
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary of changes
We use the CI Identities system for authentication in Windows CI jobs.
We also:
Reason for change
The CI Identities allows finer-grained authentication than the existing systems, and give Windows CI Jobs access to Vault (for retrieving secrets for instance).
Implementation details
Test coverage
Other details