[SINT-4550] Use CI Identities in Windows CI Jobs #8033
Merged
+50
−92
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions
bot
added
the
area:builds
BenchmarksBenchmark execution time: 2026-01-14 09:15:56 Comparing candidate commit 5f71017 in PR branch Some scenarios are present only in baseline or only in candidate runs. If you didn't create or remove some scenarios in your branch, this maybe a sign of crashed benchmarks 💥💥💥 Scenarios present only in baseline:
Found 6 performance improvements and 2 performance regressions! Performance is the same for 50 metrics, 4 unstable metrics. scenario:Benchmarks.Trace.ActivityBenchmark.StartStopWithChild net6.0
scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.AllCycleMoreComplexBody net6.0
scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorSimpleBody net6.0
scenario:Benchmarks.Trace.AspNetCoreBenchmark.SendRequest net6.0
scenario:Benchmarks.Trace.CharSliceBenchmark.OptimizedCharSlice net6.0
scenario:Benchmarks.Trace.CharSliceBenchmark.OriginalCharSlice net6.0
scenario:Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatBenchmark net6.0
|
andrewlock
reviewed
Jan 9, 2026
Co-authored-by: Andrew Lock <andrew.lock@datadoghq.com>
Co-authored-by: Andrew Lock <andrew.lock@datadoghq.com>
Co-authored-by: Andrew Lock <andrew.lock@datadoghq.com>
Co-authored-by: Andrew Lock <andrew.lock@datadoghq.com>
Execution-Time Benchmarks Report ⏱️Execution-time results for samples comparing This PR (8033) and master. ✅ No regressions detected - check the details below Full Metrics ComparisonFakeDbCommand
HttpMessageHandler
Comparison explanationExecution-time benchmarks measure the whole time it takes to execute a program, and are intended to measure the one-off costs. Cases where the execution time results for the PR are worse than latest master results are highlighted in **red**. The following thresholds were used for comparing the execution times:
Note that these results are based on a single point-in-time result for each branch. For full results, see the dashboard. Graphs show the p99 interval based on the mean and StdDev of the test run, as well as the mean value of the run (shown as a diamond below the graph). Duration chartsFakeDbCommand (.NET Framework 4.8)gantt
title Execution time (ms) FakeDbCommand (.NET Framework 4.8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8033) - mean (69ms) : 67, 70
master - mean (68ms) : 67, 70
section Bailout
This PR (8033) - mean (72ms) : 71, 74
master - mean (72ms) : 71, 73
section CallTarget+Inlining+NGEN
This PR (8033) - mean (1,012ms) : 939, 1086
master - mean (1,010ms) : 934, 1086
FakeDbCommand (.NET Core 3.1)gantt
title Execution time (ms) FakeDbCommand (.NET Core 3.1)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8033) - mean (106ms) : 103, 108
master - mean (105ms) : 103, 108
section Bailout
This PR (8033) - mean (107ms) : 105, 108
master - mean (106ms) : 105, 107
section CallTarget+Inlining+NGEN
This PR (8033) - mean (744ms) : 697, 790
master - mean (743ms) : 693, 794
FakeDbCommand (.NET 6)gantt
title Execution time (ms) FakeDbCommand (.NET 6)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8033) - mean (94ms) : 91, 96
master - mean (94ms) : 91, 96
section Bailout
This PR (8033) - mean (94ms) : 93, 95
master - mean (94ms) : 93, 95
section CallTarget+Inlining+NGEN
This PR (8033) - mean (719ms) : 690, 747
master - mean (721ms) : 701, 741
FakeDbCommand (.NET 8)gantt
title Execution time (ms) FakeDbCommand (.NET 8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8033) - mean (92ms) : 90, 94
master - mean (92ms) : 89, 94
section Bailout
This PR (8033) - mean (93ms) : 92, 94
master - mean (93ms) : 91, 94
section CallTarget+Inlining+NGEN
This PR (8033) - mean (635ms) : 618, 651
master - mean (633ms) : 615, 651
HttpMessageHandler (.NET Framework 4.8)gantt
title Execution time (ms) HttpMessageHandler (.NET Framework 4.8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8033) - mean (197ms) : 192, 202
master - mean (194ms) : 190, 197
section Bailout
This PR (8033) - mean (198ms) : 194, 201
master - mean (197ms) : 194, 200
section CallTarget+Inlining+NGEN
This PR (8033) - mean (1,131ms) : 1058, 1204
master - mean (1,126ms) : 1061, 1190
HttpMessageHandler (.NET Core 3.1)gantt
title Execution time (ms) HttpMessageHandler (.NET Core 3.1)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8033) - mean (277ms) : 270, 284
master - mean (277ms) : 272, 281
section Bailout
This PR (8033) - mean (277ms) : 273, 281
master - mean (277ms) : 272, 283
section CallTarget+Inlining+NGEN
This PR (8033) - mean (931ms) : 882, 980
master - mean (927ms) : 873, 981
HttpMessageHandler (.NET 6)gantt
title Execution time (ms) HttpMessageHandler (.NET 6)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8033) - mean (270ms) : 265, 275
master - mean (270ms) : 265, 275
section Bailout
This PR (8033) - mean (270ms) : 266, 274
master - mean (270ms) : 266, 274
section CallTarget+Inlining+NGEN
This PR (8033) - mean (929ms) : 886, 971
master - mean (914ms) : 852, 976
HttpMessageHandler (.NET 8)gantt
title Execution time (ms) HttpMessageHandler (.NET 8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8033) - mean (271ms) : 264, 277
master - mean (268ms) : 263, 273
section Bailout
This PR (8033) - mean (269ms) : 266, 273
master - mean (268ms) : 265, 272
section CallTarget+Inlining+NGEN
This PR (8033) - mean (832ms) : 817, 847
master - mean (827ms) : 805, 848
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
andrewlock
reviewed
Jan 13, 2026
Co-authored-by: Andrew Lock <andrew.lock@datadoghq.com>
andrewlock
approved these changes
Jan 14, 2026
Member
andrewlock
left a comment
andrewlock
left a comment
There was a problem hiding this comment.
LGTM, my only concern is whether we should be checking for failure of assume-role?
|
|
||
| :: the CI Identities client will write the credentials to the path in the environment variable AWS_SHARED_CREDENTIALS_FILE, | ||
| :: and if the variable is not set, it will write to %USERPROFILE%\.aws\credentials | ||
| c:\devtools\ci-identities-gitlab-job-client.exe assume-role |
Member
There was a problem hiding this comment.
Thinking about this more, this could fail, right? What happens if we can't assume the role? Does signing fail? Are we sure that would result in a failure of the build pipeline? Or should we be checking for a non-zero exit code here?
Suggested change
| c:\devtools\ci-identities-gitlab-job-client.exe assume-role | |
| c:\devtools\ci-identities-gitlab-job-client.exe assume-role | |
| if %ERRORLEVEL% NEQ 0 exit /B %ERRORLEVEL% |
Member
Author
There was a problem hiding this comment.
If assume-role fails then no credentials are written in the "AWS shared credentials" file, meaning that the AWS SDK will instead use the instance profile credentials.
Right now, the CI job would still be able to do its job using these credentials, this is actually what made me lose some time during this PR because assume-role was failing but I did not notice it at first.
Now the reason why we are doing all of this is to remove permissions currently given to the instance profile, so one day the CI job will not be able to do its job if assume-role fail.
I would suggest that for now we don't fail the job if assume-role fails, protecting you from a failure of the CI Identities system that's still quite young, and later we add this "if error, exit" logic.
cedricvanrompay-datadog
deleted the
cedric.vanrompay/sint-4550-use-ci-identities
branch
andrewlock
added a commit
that referenced
this pull request
Jan 14, 2026
This reverts commit aa68bc5.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary of changes
We use the CI Identities system for authentication in Windows CI jobs.
We also:
Reason for change
The CI Identities allows finer-grained authentication than the existing systems, and give Windows CI Jobs access to Vault (for retrieving secrets for instance).
Implementation details
assume-roleas part of the entrypoint executionTest coverage
This is the test, as long as the build works, and the artifacts are signed, we're good 👍