dd-trace 6.7.0 → 6.9.0

package/ci/test-optimization-validation/approval.js

@@ -12,6 +12,7 @@ const { sanitizeForReport } = require('./redaction')
 const { getManifestInputFiles } = require('./runner-command')
 
 const APPROVAL_DIGEST_PATTERN = /^[a-f0-9]{64}$/
+const MAX_CAPTURED_PROJECT_SOURCE_BYTES = 512 * 1024
 const OFFLINE_FIXTURE_NONCE_PATTERN = /^[a-f0-9]{32}$/
 const PACKAGE_SNAPSHOT_EXCLUDED_NAMES = new Set(['.git', '.nyc_output', 'node_modules'])
 
@@ -105,10 +106,7 @@ function getApprovalMaterial ({
       path: path.resolve(manifest.__path),
       sha256: getManifestDigest(manifest),
     },
-    projectFiles: getManifestInputFiles(manifest, { includeLocal }).map(filename => ({
-      path: filename,
-      sha256: getFileDigest(filename),
-    })),
+    projectFiles: getApprovalProjectFiles(manifest, { includeLocal }),
     selection: {
       frameworks: [...selectedFrameworkIds],
       scenario: requestedScenario,
@@ -117,6 +115,11 @@ function getApprovalMaterial ({
       outputDirectory: path.resolve(out),
       offlineFixtureNonce,
       keepTemporaryFiles: keepTempFiles,
+      requiredCapabilities: getRequiredCapabilities({
+        manifest,
+        requestedScenario,
+        selectedFrameworkIds,
+      }),
       verbose,
     },
     fixtureRecipeDigests: includeLocal
@@ -133,6 +136,51 @@ function getApprovalMaterial ({
   }
 }
 
+// Capability metadata is approval-only; the validator does not request permissions or start prerequisites.
+function getRequiredCapabilities ({ manifest, requestedScenario, selectedFrameworkIds = [] }) {
+  if (requestedScenario === 'ci-wiring') return []
+  const selected = new Set(selectedFrameworkIds)
+  const frameworks = (manifest.frameworks || []).filter(framework => {
+    return framework.status === 'runnable' && (selected.size === 0 || selected.has(framework.id))
+  })
+  const capabilities = new Set()
+  if (frameworks.some(framework => ['cypress', 'playwright'].includes(framework.framework) ||
+    (framework.framework === 'vitest' && framework.validation?.runnerArgs?.includes('--browser')) ||
+    framework.browserRequired === true)) {
+    capabilities.add('browser_process')
+  }
+  if (frameworks.some(framework => framework.localSocketRequired === true ||
+    (framework.validation?.fallbackTests || []).some(fallback => fallback.localSocketRequired === true))) {
+    capabilities.add('localhost_socket')
+  }
+  return [...capabilities].sort()
+}
+
+function getApprovalProjectFiles (manifest, { includeLocal = true } = {}) {
+  return getApprovalProjectSnapshot(manifest, { includeLocal }).projectFiles
+}
+
+// Hashes and static-analysis sources come from the same reads to avoid approval-time races.
+function getApprovalProjectSnapshot (manifest, { includeLocal = true } = {}) {
+  const projectFiles = []
+  const sources = new Map()
+  for (const filename of getManifestInputFiles(manifest, { includeLocal })) {
+    const stat = fs.lstatSync(filename)
+    const contents = fs.readFileSync(filename)
+    projectFiles.push({
+      path: filename,
+      sha256: crypto.createHash('sha256').update(contents).digest('hex'),
+    })
+    sources.set(
+      filename,
+      stat.isFile() && !stat.isSymbolicLink() && contents.length <= MAX_CAPTURED_PROJECT_SOURCE_BYTES
+        ? contents
+        : undefined
+    )
+  }
+  return { projectFiles, sources }
+}
+
 /**
  * Serializes approval material using stable formatting suitable for independent SHA-256 tools.
  *
@@ -192,21 +240,25 @@ function getApprovalCommand (id, command) {
  */
 function getGeneratedFileMaterial (manifest, requestedScenario) {
   const files = []
-  for (const framework of manifest.frameworks || []) {
-    const strategy = framework.generatedTestStrategy
-    const selectedPaths = getSelectedGeneratedPaths(strategy, requestedScenario)
-    for (const file of strategy?.files || []) {
-      if (!selectedPaths.has(path.resolve(file.path))) continue
-      const content = `${file.contentLines.join('\n')}\n`
-      files.push(sanitizeForReport({
-        frameworkId: framework.id,
-        path: path.resolve(file.path),
-        sha256: crypto.createHash('sha256').update(content).digest('hex'),
-        content,
-        removeAfterValidation: (strategy.cleanupPaths || []).some(cleanupPath => {
-          return path.resolve(cleanupPath) === path.resolve(file.path)
-        }),
-      }))
+  if (manifest.frameworks) {
+    for (const framework of manifest.frameworks) {
+      const strategy = framework.generatedTestStrategy
+      const selectedPaths = getSelectedGeneratedPaths(strategy, requestedScenario)
+      if (strategy?.files) {
+        for (const file of strategy.files) {
+          if (!selectedPaths.has(path.resolve(file.path))) continue
+          const content = `${file.contentLines.join('\n')}\n`
+          files.push(sanitizeForReport({
+            frameworkId: framework.id,
+            path: path.resolve(file.path),
+            sha256: crypto.createHash('sha256').update(content).digest('hex'),
+            content,
+            removeAfterValidation: (strategy.cleanupPaths || []).some(cleanupPath => {
+              return path.resolve(cleanupPath) === path.resolve(file.path)
+            }),
+          }))
+        }
+      }
     }
   }
   return files
@@ -230,9 +282,11 @@ function getSelectedGeneratedPaths (strategy, requestedScenario) {
     return path.resolve(scenario.testIdentities[0].file)
   }))
   const selectedPaths = new Set()
-  for (const file of strategy.files || []) {
-    const filename = path.resolve(file.path)
-    if (!requestedScenario || !scenarioPaths.has(filename)) selectedPaths.add(filename)
+  if (strategy.files) {
+    for (const file of strategy.files) {
+      const filename = path.resolve(file.path)
+      if (!requestedScenario || !scenarioPaths.has(filename)) selectedPaths.add(filename)
+    }
   }
   if (generatedId) {
     const scenario = strategy.scenarios?.find(candidate => candidate.id === generatedId)
@@ -332,5 +386,7 @@ module.exports = {
   assertApprovalDigest,
   getApprovalDigest,
   getApprovalMaterial,
+  getApprovalProjectSnapshot,
+  getRequiredCapabilities,
   serializeApprovalMaterial,
 }

package/ci/test-optimization-validation/blocker-category.js

@@ -0,0 +1,24 @@
+'use strict'
+
+const BLOCKER_CATEGORIES = Object.freeze({
+  CLEAN_TEST_FAILED: 'CLEAN_TEST_FAILED',
+  EXECUTION_ENVIRONMENT_BLOCKED: 'EXECUTION_ENVIRONMENT_BLOCKED',
+  PROJECT_SETUP_REQUIRED: 'PROJECT_SETUP_REQUIRED',
+  UNSUPPORTED_VERSION: 'UNSUPPORTED_VERSION',
+  VALIDATOR_LIMITATION: 'VALIDATOR_LIMITATION',
+})
+
+const BLOCKER_CATEGORY_VALUES = new Set(Object.values(BLOCKER_CATEGORIES))
+
+function getBlockerDomain (category) {
+  const domains = {
+    [BLOCKER_CATEGORIES.CLEAN_TEST_FAILED]: 'local_runtime',
+    [BLOCKER_CATEGORIES.EXECUTION_ENVIRONMENT_BLOCKED]: 'execution_environment',
+    [BLOCKER_CATEGORIES.PROJECT_SETUP_REQUIRED]: 'project_setup',
+    [BLOCKER_CATEGORIES.UNSUPPORTED_VERSION]: 'unsupported_version',
+    [BLOCKER_CATEGORIES.VALIDATOR_LIMITATION]: 'validator_adapter',
+  }
+  return domains[category]
+}
+
+module.exports = { BLOCKER_CATEGORIES, BLOCKER_CATEGORY_VALUES, getBlockerDomain }

package/ci/test-optimization-validation/ci-discovery.js

@@ -61,18 +61,22 @@ function buildCiDiscovery ({ manifest, diagnosis }) {
 function getManifestWorkflowLocations (manifest) {
   const root = manifest.repository?.root
   const locations = []
-  for (const framework of manifest.frameworks || []) {
-    const configFile = framework.ciWiring?.configFile
-    if (typeof configFile !== 'string') continue
-    if (!root || !path.isAbsolute(configFile)) {
-      locations.push(configFile)
-      continue
+  if (manifest.frameworks) {
+    for (const framework of manifest.frameworks) {
+      const configFile = framework.ciWiring?.configFile
+      if (typeof configFile !== 'string') continue
+      if (!root || !path.isAbsolute(configFile)) {
+        locations.push(configFile)
+        continue
+      }
+
+      const relative = path.relative(root, configFile)
+      const isRelativePath = relative && relative !== '..' && !relative.startsWith(`..${path.sep}`) &&
+        !path.isAbsolute(relative)
+      locations.push(isRelativePath
+        ? relative.split(path.sep).join('/')
+        : configFile)
     }
-
-    const relative = path.relative(root, configFile)
-    locations.push(relative && relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative)
-      ? relative.split(path.sep).join('/')
-      : configFile)
   }
   return uniqueStrings(locations)
 }
@@ -106,12 +110,14 @@ function getCiDiscoveryContradictions ({ manifest, declaredFound, staticFound })
     )
   }
 
-  for (const framework of manifest.frameworks || []) {
-    if (!frameworkClaimsNoCi(framework)) continue
-    contradictions.push(
-      `framework ${framework.id || '<unknown>'} records no CI workflow, but static diagnosis found ` +
-        formatList(staticFound)
-    )
+  if (manifest.frameworks) {
+    for (const framework of manifest.frameworks) {
+      if (!frameworkClaimsNoCi(framework)) continue
+      contradictions.push(
+        `framework ${framework.id || '<unknown>'} records no CI workflow, but static diagnosis found ` +
+          formatList(staticFound)
+      )
+    }
   }
 
   return contradictions

package/ci/test-optimization-validation/ci-package-scripts.js

@@ -3,7 +3,21 @@
 const { parseLiteralEnvironmentPrefix } = require('./literal-environment')
 
 const MAX_SCRIPT_EXPANSIONS = 16
-const DYNAMIC_VALUE_PATTERN = /[$`]|\r|\n|%[^%\s]+%|![^!\s]+!/
+const DYNAMIC_VALUE_PATTERN = /[$`\r\n]|%[^%\s]+%|![^!\s]+!/
+const RESERVED_PACKAGE_MANAGER_COMMANDS = {
+  pnpm: new Set([
+    'add', 'audit', 'bin', 'c', 'config', 'create', 'deploy', 'dlx', 'env', 'exec', 'fetch', 'i', 'import', 'init',
+    'install', 'link', 'list', 'ln', 'ls', 'outdated', 'pack', 'patch', 'patch-commit', 'prune', 'publish', 'rebuild',
+    'remove', 'rm', 'root', 'self-update', 'server', 'setup', 'store', 'uninstall', 'unlink', 'up', 'update', 'view',
+    'why',
+  ]),
+  yarn: new Set([
+    'add', 'audit', 'bin', 'cache', 'check', 'config', 'constraints', 'create', 'dedupe', 'dlx', 'exec', 'global',
+    'help', 'import', 'info', 'init', 'install', 'link', 'list', 'node', 'npm', 'outdated', 'owner', 'pack', 'patch',
+    'plugin', 'policies', 'publish', 'rebuild', 'remove', 'set', 'stage', 'tag', 'team', 'unlink', 'unplug', 'up',
+    'upgrade', 'version', 'versions', 'why', 'workspace', 'workspaces',
+  ]),
+}
 
 /**
  * Expands bounded local package-script references without executing them.
@@ -45,7 +59,7 @@ function expandCommand (command, scripts, path, stack, state) {
     if (stack.has(invocation.script)) {
       return { error: `local package-script cycle includes ${invocation.script}` }
     }
-    const lifecycleNames = invocation.manager === 'npm'
+    const lifecycleNames = invocation.manager === 'npm' || invocation.manager === 'bun'
       ? [`pre${invocation.script}`, `post${invocation.script}`]
           .filter(name => typeof scripts[name] === 'string')
       : []
@@ -60,8 +74,11 @@ function expandCommand (command, scripts, path, stack, state) {
       const nextStack = new Set(stack)
       nextStack.add(invocation.script)
       nextStack.add(scriptName)
+      const scriptCommand = scriptName === invocation.script && invocation.arguments
+        ? `${scripts[scriptName]} ${invocation.arguments}`
+        : scripts[scriptName]
       const expanded = expandCommand(
-        scripts[scriptName],
+        scriptCommand,
         scripts,
         [...path, segment],
         nextStack,
@@ -129,13 +146,24 @@ function getPackageScriptInvocation (command) {
   const literalPrefix = parseLiteralEnvironmentPrefix(command)
   const source = command.slice(literalPrefix.length).trim()
     .replace(/^(?:c8|nyc)(?:\.cmd)?\s+/, '')
-  const match = /^(npm(?:\.cmd)?|pnpm(?:\.cmd)?|yarn(?:pkg)?(?:\.cmd)?)\s+(?:(run|run-script)\s+)?([\w:-]+)$/
+  const match = /^(bun|npm(?:\.cmd)?|pnpm(?:\.cmd)?|yarn(?:pkg)?(?:\.cmd)?)\s+(?:(run|run-script)\s+)?([\w:-]+)(?:\s+(.+))?$/
     .exec(source)
   if (!match) return
 
-  const manager = match[1].replace(/\.cmd$/i, '')
+  const manager = match[1].replace(/\.cmd$/i, '').replace(/^yarnpkg$/, 'yarn')
   if (manager === 'npm' && !match[2] && !['restart', 'start', 'stop', 'test'].includes(match[3])) return
-  return { manager, script: match[3] }
+  if (manager === 'bun' && match[2] !== 'run') return
+  if (!match[2] && RESERVED_PACKAGE_MANAGER_COMMANDS[manager]?.has(match[3])) return
+  const args = match[4]?.trim()
+  const separatedArguments = args ? /^--(?:\s+(.+))?$/.exec(args) : undefined
+  if (['npm', 'pnpm'].includes(manager) && args && !separatedArguments) return
+  const scriptArguments = ['npm', 'pnpm'].includes(manager) ? separatedArguments?.[1]?.trim() : args
+  if (scriptArguments && !splitLiteralAndChain(scriptArguments)) return
+  return {
+    ...(scriptArguments ? { arguments: scriptArguments } : {}),
+    manager,
+    script: match[3],
+  }
 }
 
 module.exports = { expandLocalPackageScripts }

package/ci/test-optimization-validation/ci-remediation.js

@@ -183,7 +183,7 @@ function isDatadogModuleSpecifier (specifier, entrypoint) {
 }
 
 function hasDynamicEnvironmentReference (value) {
-  return /(?:\$[A-Za-z_{]|\$\(|%[A-Za-z_][A-Za-z0-9_]*%)/.test(value)
+  return /\$[A-Za-z_{]|\$\(|%[A-Za-z_][A-Za-z0-9_]*%/.test(value)
 }
 
 function getRecommendedValues (framework) {