chore(ci): switch to dd-pkg for publishing public ADP container images - #2212
chore(ci): switch to dd-pkg for publishing public ADP container images#2212AliDatadog wants to merge 1 commit into
dd-pkg for publishing public ADP container images#2212Conversation
…h-image The GitLab job-token trigger against DataDog/public-images is a legacy mechanism being phased out in favor of `dd-pkg publish-image`, which drives the same public-images pipeline through the artifact-gateway service's policy/audit layer. Authorization is implicit via CI job identity, so this is a CI-YAML-only change with no per-repo registration step. See https://datadoghq.atlassian.net/wiki/x/ooQkngE Ref: BARX-1965
Binary Size Analysis (Agent Data Plane)Baseline: edcd3c1 · Comparison: 4093e2b · diff ✅ Binary size difference within thresholdChanges by Module
Detailed Symbol Changes |
Regression Detector (Agent Data Plane)Run ID: Optimization Goals: ✅ No significant changes detectedFine details of change detection per experiment (3)Experiments configured
Bounds Checks: ✅ Passed (3)
ExplanationA change is flagged as a regression when |Δ mean %| > 5.00% in the regressing direction for its optimization goal AND SMP marks the experiment as a regression ( |
tobz
changed the title
dd-pkg for publishing public ADP container images
![datadog-datadog-prod-us1-2[bot]](https://avatars.githubusercontent.com/u/365230?s=60&v=4){kind=small}
There was a problem hiding this comment.
More details
The new release job definition parses correctly and preserves the publish inputs as distinct CLI arguments across ordinary, omitted, and regex-bearing cases. No production behavioral regression was reproduced; the change is CI-only, so no additional tests are recommended beyond the executed syntax and argument-construction checks.
📊 Validated against 4 scenarios · Open Bits AI session
🤖 Datadog Autotest · Commit 4093e2b · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest
3 participants
Summary
We're migrating off the legacy GitLab job-token trigger mechanism for publishing public container images (
trigger: project: DataDog/public-images) in favor of add-pkg publish-imageCLI call against theartifact-gatewayservice. The CLI still drives the samepublic-imagespipeline under the hood, but goes through a policy/audit layer. Authorization is implicit via CI job identity, so no per-repo registration or allowlist step is needed — this is a pure CI-YAML change.This PR onboards
saluki's.gitlab/release.yml:.docker_publish_job_definitiontemplate that runsdd-pkg publish-imagewith the sameIMG_*variables previously consumed by the trigger job, translated into CLI flags.trigger: project: DataDog/public-imagesblock on.publish-image-linux-definitionwithextends: .docker_publish_job_definition.stage,rules,needs, andvariableson the job are unchanged — only the publish mechanism itself is swapped.Background and rationale: https://datadoghq.atlassian.net/wiki/x/ooQkngE
Ref: https://datadoghq.atlassian.net/browse/BARX-1965
Follow-up (outside this PR): this migration adds real authn/authz for public image publishing via artifact-gateway, in place of the old job-token trust-any-caller model. As a next step we'll be asking this repo's owners who should be allowed to release these images, and who/how to reach them if an authz check ever fails.
Test plan
ruby -ryaml -e "YAML.load_file('.gitlab/release.yml'); puts 'OK'"— YAML parses cleanlypublish-standalone-adp-image-linux*jobs still gated behind official-release rules, so a full end-to-end publish exercise happens on the next official release)