dd-trace 6.7.0 → 6.9.0

package/ci/test-optimization-validation/preflight-runner.js

@@ -1,5 +1,6 @@
 'use strict'
 
+const { BLOCKER_CATEGORIES, getBlockerDomain } = require('./blocker-category')
 const { getCommandBlocker } = require('./command-blocker')
 const { runCommand, serializeDisplayCommand } = require('./command-runner')
 const { getBasicCommand } = require('./runner-command')
@@ -17,12 +18,81 @@ const { getObservedTestCount } = require('./test-output')
  * @returns {Promise<{ok: boolean, failure?: object, preflight: object}>} preflight outcome
  */
 async function runFrameworkPreflight ({ framework, out, options }) {
-  const command = getBasicCommand(framework)
-  const outDir = frameworkOutDir(out, framework, 'preflight')
+  const candidates = [
+    {
+      localSocketRequired: framework.localSocketRequired,
+      testFile: framework.validation.testFile,
+    },
+    ...(framework.validation.fallbackTests || []),
+  ]
+  const attempts = []
+  let last
+
+  for (const [index, candidate] of candidates.entries()) {
+    // Fallbacks are ordered and later candidates must not run after one succeeds.
+    // eslint-disable-next-line no-await-in-loop
+    const attempt = await runCandidate({ framework, index, options, out, testFile: candidate.testFile })
+    attempts.push(attempt.preflight)
+    last = attempt
+    if (!attempt.ok) {
+      if (isSharedCandidateBlocker(attempt.commandFailure, framework)) break
+      continue
+    }
+
+    framework.validation.testFile = candidate.testFile
+    const preflight = { ...attempt.preflight, attempts, selectedTestFile: candidate.testFile }
+    framework.preflight = preflight
+    return { ok: true, preflight }
+  }
+
+  const { commandFailure, observedTestCount, preflight, result } = last
+  const completePreflight = {
+    ...preflight,
+    attempts,
+    selectedTestFile: undefined,
+  }
+  framework.preflight = completePreflight
+  const blockerCategory = commandFailure?.blockerCategory ||
+    (observedTestCount === 0
+      ? BLOCKER_CATEGORIES.VALIDATOR_LIMITATION
+      : BLOCKER_CATEGORIES.CLEAN_TEST_FAILED)
+  const domain = getBlockerDomain(blockerCategory)
+  const diagnosis = getFailureDiagnosis(
+    result,
+    observedTestCount,
+    commandFailure,
+    preflight.diagnosticSummary,
+    framework
+  )
+  return {
+    ok: false,
+    preflight: completePreflight,
+    failure: {
+      frameworkId: framework.id,
+      scenario: 'basic-reporting',
+      status: 'blocked',
+      diagnosis,
+      evidence: {
+        blockerCategory,
+        commandFailure,
+        domain,
+        recommendation: commandFailure?.recommendation ||
+          `Resolve the selected project test failure before retrying validation: ${diagnosis}`,
+        validationIncomplete: true,
+      },
+      artifacts: Object.values(result.artifacts),
+    },
+  }
+}
+
+async function runCandidate ({ framework, index, options, out, testFile }) {
+  const suffix = index === 0 ? '' : `-fallback-${index}`
+  const command = getBasicCommand(framework, testFile)
+  const outDir = frameworkOutDir(out, framework, `preflight${suffix}`)
   const result = await runCommand(command, {
     artifactRoot: out,
     envMode: 'clean',
-    label: `${framework.id}:preflight`,
+    label: `${framework.id}:preflight${suffix}`,
     outDir,
     repositoryRoot: options.repositoryRoot,
     requireExecutableApproval: options.requireExecutableApproval,
@@ -32,12 +102,13 @@ async function runFrameworkPreflight ({ framework, out, options }) {
   const commandFailure = getCommandBlocker(result, {
     browserRequired: framework.browserRequired,
     framework: framework.framework,
+    packageJson: framework.project.packageJson,
     testsRan: Number.isInteger(observedTestCount) && observedTestCount > 0,
   })
   const preflight = {
     command: serializeDisplayCommand(command),
     diagnosticSummary: findInterestingLines(`${result.stdout}\n${result.stderr}`, [
-      /\b(?:Abort trap|Cannot find|Error|ERR_[A-Z_]+|Failed to|Received signal|SIGABRT)\b/i,
+      /\b(?:Abort trap|Cannot find|Error|TypeError|ReferenceError|RangeError|SyntaxError|ERR_[A-Z_]+|FAIL|Failed to|No tests found|Received signal|SIGABRT)\b/i,
     ], 4),
     durationMs: result.durationMs,
     exitCode: result.exitCode,
@@ -49,35 +120,16 @@ async function runFrameworkPreflight ({ framework, out, options }) {
     source: 'validator',
     stderrSummary: summarizeTestOutput('', result.stderr).join('\n'),
     stdoutSummary: summarizeTestOutput(result.stdout).join('\n'),
+    testFile,
     timedOut: result.timedOut,
     ...(commandFailure ? { commandFailure } : {}),
   }
-  framework.preflight = preflight
-
-  if (!result.timedOut && result.exitCode === 0 && observedTestCount !== 0) {
-    return { ok: true, preflight }
-  }
-
-  const domain = commandFailure?.blockedByExecutionEnvironment
-    ? 'execution_environment'
-    : commandFailure?.localRuntimeBlocked
-      ? 'local_runtime'
-      : 'project_setup'
   return {
-    ok: false,
+    commandFailure,
+    observedTestCount,
+    ok: !result.timedOut && result.exitCode === 0 && observedTestCount !== 0,
     preflight,
-    failure: {
-      frameworkId: framework.id,
-      scenario: 'basic-reporting',
-      status: 'blocked',
-      diagnosis: getFailureDiagnosis(result, observedTestCount, commandFailure),
-      evidence: {
-        commandFailure,
-        domain,
-        validationIncomplete: true,
-      },
-      artifacts: Object.values(result.artifacts),
-    },
+    result,
   }
 }
 
@@ -87,11 +139,17 @@ async function runFrameworkPreflight ({ framework, out, options }) {
  * @param {object} result command result
  * @param {number|null} observedTestCount parsed test count
  * @param {object|undefined} commandFailure classified blocker
+ * @param {string[]} diagnosticSummary bounded diagnostic lines
+ * @param {object} framework framework manifest entry
  * @returns {string} customer-facing diagnosis
  */
-function getFailureDiagnosis (result, observedTestCount, commandFailure) {
+function getFailureDiagnosis (result, observedTestCount, commandFailure, diagnosticSummary, framework) {
+  const sharedPrerequisite = !commandFailure && framework.allCandidatesRequireLocalSocket
+    ? ' Every approved candidate appears to require localhost, so retry in the project environment where its ' +
+      'listener-based tests normally pass.'
+    : ''
   if (commandFailure?.summary) {
-    return `${commandFailure.summary} Basic Reporting could not be tested reliably.`
+    return `${commandFailure.summary} Basic Reporting could not be tested reliably.${sharedPrerequisite}`
   }
   if (result.timedOut) {
     return 'The direct representative test exceeded its approved timeout. Basic Reporting could not be tested ' +
@@ -101,8 +159,29 @@ function getFailureDiagnosis (result, observedTestCount, commandFailure) {
     return 'The direct runner completed without reporting a test. The selected file may require project wrapper or ' +
       'configuration semantics, so Basic Reporting remains incomplete.'
   }
+  if (diagnosticSummary.length > 0) {
+    return `The direct representative test exited ${result.exitCode} without Datadog initialization. ` +
+      `The first reported issue was: ${diagnosticSummary[0]}${sharedPrerequisite}`
+  }
   return `The direct representative test exited ${result.exitCode} without Datadog initialization. Fix or prepare ` +
-    'that test normally, then create a fresh validation plan.'
+    `that test normally, then create a fresh validation plan.${sharedPrerequisite}`
+}
+
+// Do not try fallbacks when every disclosed candidate shares the same prerequisite.
+function isSharedCandidateBlocker (commandFailure, framework) {
+  if (!commandFailure) return false
+  if (commandFailure.kind === 'local-test-socket-blocked') {
+    return framework.allCandidatesRequireLocalSocket === true
+  }
+  return commandFailure.kind.endsWith('-browser-launch-blocked') ||
+    [
+      'cucumber-browser-missing',
+      'cypress-runtime-missing',
+      'playwright-browser-missing',
+      'project-command-environment-missing',
+      'test-runner-command-missing',
+      'vitest-browser-provider-missing',
+    ].includes(commandFailure.kind)
 }
 
 module.exports = { runFrameworkPreflight }

package/ci/test-optimization-validation/project-build-artifact.js

@@ -0,0 +1,31 @@
+'use strict'
+
+const path = require('node:path')
+
+const BUILD_DIRECTORY_PATTERN = /(?:^|\/)(?:build|dist|generated)(?:\/|$)/
+const WINDOWS_ABSOLUTE_PATH_PATTERN = /^[A-Za-z]:\//
+
+// Bare package subpaths and node_modules paths belong to dependencies, not to the customer project.
+function isProjectBuildArtifactPath (filename, projectRoot, baseDirectory = projectRoot) {
+  const normalized = String(filename).replaceAll('\\', '/')
+  if (!BUILD_DIRECTORY_PATTERN.test(normalized) ||
+    /(?:^|\/)node_modules(?:\/|$)/.test(normalized)) return false
+
+  const relativePath = normalized.startsWith('./') || normalized.startsWith('../')
+  if ((!relativePath && !normalized.startsWith('/') && !WINDOWS_ABSOLUTE_PATH_PATTERN.test(normalized)) ||
+    typeof projectRoot !== 'string') return false
+
+  const normalizedRoot = projectRoot.replaceAll('\\', '/')
+  const windowsPath = WINDOWS_ABSOLUTE_PATH_PATTERN.test(normalized)
+  const windowsRoot = WINDOWS_ABSOLUTE_PATH_PATTERN.test(normalizedRoot)
+  if (windowsPath !== windowsRoot && windowsPath) return false
+  const pathApi = windowsRoot ? path.win32 : path.posix
+  const root = pathApi.resolve(normalizedRoot)
+  const candidate = relativePath
+    ? pathApi.resolve(String(baseDirectory).replaceAll('\\', '/'), normalized)
+    : pathApi.resolve(normalized)
+  const relative = pathApi.relative(root, candidate)
+  return relative === '' || (!relative.startsWith('..') && !pathApi.isAbsolute(relative))
+}
+
+module.exports = { isProjectBuildArtifactPath }

package/ci/test-optimization-validation/redaction.js

@@ -13,7 +13,6 @@ const SECRET_NAME_SOURCE = [
   'PASSPHRASE',
   'CREDENTIAL',
   'PRIVATE_?KEY',
-  'CLIENT_?SECRET',
   'ACCESS_?KEY',
   'COOKIE',
 ].join('|')
@@ -22,23 +21,18 @@ const EXACT_SECRET_ASSIGNMENT_NAME_SOURCE = [
   'AUTH',
   'AUTHORIZATION',
   'PASS',
-  'SET-COOKIE',
   'PAT',
   'JWT',
   'WEBHOOK(?:_URL)?',
 ].join('|')
-const SECRET_NAME_CHARS = '[A-Za-z0-9_.-]'
+// Every pattern built from these name sources carries the `i` flag; the classes list uppercase only.
+const SECRET_NAME_CHARS = '[A-Z0-9_.-]'
 const SECRET_ASSIGNMENT_NAME_SOURCE = [
-  `(?:${EXACT_SECRET_ASSIGNMENT_NAME_SOURCE})`,
-  `[A-Za-z_]${SECRET_NAME_CHARS}*(?:${SECRET_NAME_SOURCE})${SECRET_NAME_CHARS}*`,
-  `[A-Za-z_]${SECRET_NAME_CHARS}*[-_]PASS`,
-  `[A-Za-z_]${SECRET_NAME_CHARS}*[-_]AUTH(?:ORIZATION)?`,
-  `[A-Za-z_]${SECRET_NAME_CHARS}*[-_](?:PAT|JWT|WEBHOOK(?:_URL)?)`,
-  'PASS',
-  'AUTH',
-  'AUTHORIZATION',
-  'COOKIE',
-  'SET-COOKIE',
+  EXACT_SECRET_ASSIGNMENT_NAME_SOURCE,
+  `[A-Z_]${SECRET_NAME_CHARS}*(?:${SECRET_NAME_SOURCE})${SECRET_NAME_CHARS}*`,
+  `[A-Z_]${SECRET_NAME_CHARS}*[-_]PASS`,
+  `[A-Z_]${SECRET_NAME_CHARS}*[-_]AUTH(?:ORIZATION)?`,
+  `[A-Z_]${SECRET_NAME_CHARS}*[-_](?:PAT|JWT|WEBHOOK(?:_URL)?)`,
 ].join('|')
 const SECRET_FLAG_SOURCE = [
   'api-key',
@@ -54,7 +48,7 @@ const SECRET_FLAG_SOURCE = [
   'auth',
 ].join('|')
 const SECRET_VALUE_SOURCE = String.raw`("[^"]*"|'[^']*'|[^\s,;]+)`
-const SENSITIVE_NAME_PATTERN = new RegExp(`(?:${SECRET_NAME_SOURCE})`, 'i')
+const SENSITIVE_NAME_PATTERN = new RegExp(SECRET_NAME_SOURCE, 'i')
 const SENSITIVE_AUTH_NAME_PATTERN = /(?:^|_)AUTH(?:ORIZATION)?(?:_|$)/i
 const SENSITIVE_COOKIE_NAME_PATTERN = /(?:^|_)SET_?COOKIE(?:_|$)|(?:^|_)COOKIE(?:_|$)/i
 const SENSITIVE_PASS_NAME_PATTERN = /(?:^|_)PASS(?:_|$)/i
@@ -64,16 +58,16 @@ const SECRET_ASSIGNMENT_PATTERN = new RegExp(
   'gi'
 )
 const SECRET_FLAG_PATTERN = new RegExp(
-  String.raw`(--(?:${SECRET_FLAG_SOURCE})(?:-[A-Za-z0-9]+)*)(=|\s+)` + SECRET_VALUE_SOURCE,
+  String.raw`(--(?:${SECRET_FLAG_SOURCE})(?:-[A-Z0-9]+)*)(=|\s+)` + SECRET_VALUE_SOURCE,
   'gi'
 )
 const SECRET_FLAG_NAME_PATTERN = new RegExp(
-  `^--(?:${SECRET_FLAG_SOURCE})(?:-[A-Za-z0-9]+)*$`,
+  `^--(?:${SECRET_FLAG_SOURCE})(?:-[A-Z0-9]+)*$`,
   'i'
 )
 const AUTH_HEADER_PATTERN = /\b(Bearer)\s+([^\s'",}\]]+)/gi
 const AUTH_SCHEME_ASSIGNMENT_QUOTED_PATTERN = new RegExp(
-  String.raw`\b(${SECRET_ASSIGNMENT_NAME_SOURCE})\s*=\s*(["'])(?:Bearer|Basic)\s+.*?\2`,
+  String.raw`\b(${SECRET_ASSIGNMENT_NAME_SOURCE})\s*=\s*(["'])(?:Bearer|Basic)\s.*?\2`,
   'gi'
 )
 const AUTH_SCHEME_ASSIGNMENT_PATTERN = new RegExp(
@@ -83,7 +77,7 @@ const AUTH_SCHEME_ASSIGNMENT_PATTERN = new RegExp(
 const DEFAULT_IGNORABLE_PATTERN = /\p{Default_Ignorable_Code_Point}/gu
 const DEFAULT_IGNORABLE_TEST_PATTERN = /\p{Default_Ignorable_Code_Point}/u
 const CONTROL_CHARACTER_TEST_PATTERN = /\p{Cc}/u
-const UNSAFE_CONTROL_SOURCE = String.raw`[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]`
+const UNSAFE_CONTROL_SOURCE = String.raw`[\u0000-\u0008\v\f\u000E-\u001F\u007F-\u009F]`
 const UNSAFE_CONTROL_PATTERN = new RegExp(UNSAFE_CONTROL_SOURCE, 'g')
 const UNSAFE_CONTROL_TEST_PATTERN = new RegExp(UNSAFE_CONTROL_SOURCE)
 const PRIVATE_KEY_BLOCK_PATTERN =
@@ -92,10 +86,10 @@ const JWT_VALUE_PATTERN = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9
 const KNOWN_TOKEN_VALUE_PATTERN =
   /\b(?:gh[pousr]_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]{20,}|glpat-[A-Za-z0-9_-]{20,}|xox[baprs]-[A-Za-z0-9-]{20,})\b/g
 const SECRET_HEADER_ENV_NAME_SOURCE = [
-  `(?:${SECRET_NAME_SOURCE}|PAT|JWT|WEBHOOK(?:_URL)?)`,
-  `[A-Za-z_]${SECRET_NAME_CHARS}*(?:${SECRET_NAME_SOURCE})${SECRET_NAME_CHARS}*`,
-  `[A-Za-z_]${SECRET_NAME_CHARS}*[-_]AUTH(?:ORIZATION)?`,
-  `[A-Za-z_]${SECRET_NAME_CHARS}*[-_](?:PAT|JWT|WEBHOOK(?:_URL)?)`,
+  `${SECRET_NAME_SOURCE}|PAT|JWT|WEBHOOK(?:_URL)?`,
+  `[A-Z_]${SECRET_NAME_CHARS}*(?:${SECRET_NAME_SOURCE})${SECRET_NAME_CHARS}*`,
+  `[A-Z_]${SECRET_NAME_CHARS}*[-_]AUTH(?:ORIZATION)?`,
+  `[A-Z_]${SECRET_NAME_CHARS}*[-_](?:PAT|JWT|WEBHOOK(?:_URL)?)`,
 ].join('|')
 const SECRET_HEADER_NAME_SOURCE = [
   'dd-api-key',
@@ -103,16 +97,13 @@ const SECRET_HEADER_NAME_SOURCE = [
   'api-key',
   'authorization',
   'proxy-authorization',
-  'token',
-  'cookie',
-  'set-cookie',
   SECRET_HEADER_ENV_NAME_SOURCE,
 ].join('|')
 const SECRET_HEADER_PATTERN = new RegExp(
-  String.raw`\b((?:${SECRET_HEADER_NAME_SOURCE}))\s*:\s*("[^"]*"|'[^']*'|[^\r\n,}]+)`,
+  String.raw`\b(${SECRET_HEADER_NAME_SOURCE})\s*:\s*("[^"]*"|'[^']*'|[^\r\n,}]+)`,
   'gi'
 )
-const URL_CREDENTIAL_PATTERN = /([a-z][a-z0-9+.-]*:\/\/)([^@\s/]+)(@)/gi
+const URL_CREDENTIAL_PATTERN = /(?<![a-z0-9+.-])([a-z][a-z0-9+.-]*:\/\/)([^@\s/]+)(@)/gi
 const GITHUB_SECRET_REFERENCE_PATTERN =
   /(?:\b[A-Za-z_][A-Za-z0-9_.-]*\s*[:=]\s*)?\$\{\{\s*secrets\.([A-Za-z_][A-Za-z0-9_]*)\s*\}\}/g
 const SAFE_REFERENCE_MARKER_PATTERN = /DDCIVARREF([0-9]+)X/g