fix(ci): publish system-tests image via S3 + GH Actions dispatch by MilanGarnier · Pull Request #4065 · DataDog/dd-trace-php

MilanGarnier · 2026-07-27T07:52:23Z

Description

#4013 pushed the per-branch system-tests image to GHCR directly from GitLab CI, authenticating with an octo-sts token scoped packages: write. That token is minted from a GitHub App installation, and GHCR refuses package writes from installation tokens (permission_denied: installation not allowed to Write organization package).

The fix replaces that job with a two-step, two-runtime pipeline:

GitLab CI uploads the built tarballs + installer to s3://dd-trace-php-builds/ci/<ref-slug>/, then dispatches a GitHub Actions workflow (actions: write-scoped octo-sts token). (in fix(ci): wire GitLab CI to publish the system-tests image #4079)
.github/workflows/publish-system-tests-image.yml (this PR) downloads the artifacts from S3 and pushes to GHCR using the workflow's native GITHUB_TOKEN, which — unlike the octo-sts token — is actually allowed to write org packages.

Scope of this PR: only the GitHub Actions workflow file. The GitLab CI wiring (S3 upload + dispatch, plus the octo-sts policy scope change) is stacked on top in #4079, split out because workflow_dispatch resolves a workflow by filename against the default branch's registered workflow list, regardless of the ref the dispatch targets — so this file has to land on master before the GitLab side can successfully dispatch it from any branch. Nothing calls the workflow until #4079 is merged.

datadog-datadog-prod-us1-2 · 2026-07-27T08:01:44Z

✨ Unblock PR with BitsAI

⚠️ Warnings

🚦 143 Pipeline jobs failed

DataDog/apm-reliability/dd-trace-php | PHP Language Tests: [7.1]
🧪 2 Tests failed
curl_basic_008.phpt - Test curl_error() & curl_errno() function with problematic host from php-src.php-src.ext.curl.tests
001&#43; DNS resolution failurestring(0) &#34;&#34;
002&#43; int(0)
001- %s resolve%s
002- int(6)
curl_error_basic.phpt - curl_error() function - basic test for curl_error using a fake url from php-src.php-src.ext.curl.tests
002&#43; string(0) &#34;&#34;
002- string(%d) &#34;%sfakeURL%S&#34;
DataDog/apm-reliability/dd-trace-php | PHP Language Tests: [8.0]
🧪 3 Tests failed
ext/curl/tests/curl_basic_008.phpt (Test curl_error() & curl_errno() function with problematic host) from PHP.ext.curl.tests
001&#43; DNS resolution failurestring(0) &#34;&#34;
002&#43; int(0)
001- %s resolve%s
002- int(6)
ext/curl/tests/curl_error_basic.phpt (curl_error() function - basic test for curl_error using a fake url) from PHP.ext.curl.tests
== Testing curl_error with a fake URL ==
002&#43; string(0) &#34;&#34;
002- string(%d) &#34;%sfakeURL%S&#34;
View all failed tests
DataDog/apm-reliability/dd-trace-php | PHP Language Tests: [8.2]
🧪 3 Tests failed
ext/curl/tests/curl_basic_008.phpt (Test curl_error() & curl_errno() function with problematic host) from php.ext.curl.tests
001&#43; DNS resolution failurestring(0) &#34;&#34;
002&#43; int(0)
001- %s resolve%s
002- int(6)
ext/curl/tests/curl_error_basic.phpt (curl_error() function - basic test for curl_error using a fake url) from php.ext.curl.tests
== Testing curl_error with a fake URL ==
002&#43; string(0) &#34;&#34;
002- string(%d) &#34;%sfakeURL%S&#34;
View all failed tests
View all 143 failed jobs.

ℹ️ Info

No other issues found (see more)

❄️ No new flaky tests detected

🔄 Datadog auto-retried 21 jobs - 2 passed on retry

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 82.53% (-5.20%)

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: e14d7f9 | Docs | Datadog PR Page | Give us feedback!}

MilanGarnier · 2026-07-27T12:00:15Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 97f2a40fe0

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6e12d4abed

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

pr-commenter · 2026-07-28T14:19:14Z

Benchmarks [ tracer ]

Benchmark execution time: 2026-08-03 10:49:31

Comparing candidate commit e14d7f9 in PR branch milan.garnier/publish-ci-builds with baseline commit b2d669e in branch master.

Found 2 performance improvements and 2 performance regressions! Performance is the same for 190 metrics, 0 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

🟩 = significantly better candidate vs. baseline
🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

scenario:MessagePackSerializationBench/benchMessagePackSerialization

🟩 execution_time [-7.505µs; -4.875µs] or [-6.723%; -4.368%]

scenario:MessagePackSerializationBench/benchMessagePackSerialization-opcache

🟩 execution_time [-4.748µs; -2.872µs] or [-4.129%; -2.497%]

scenario:PDOBench/benchPDOOverhead

🟥 execution_time [+9.445µs; +11.430µs] or [+3.671%; +4.442%]

scenario:PDOBench/benchPDOOverheadWithDBM

🟥 execution_time [+9.086µs; +11.140µs] or [+3.535%; +4.334%]

Standalone workflow that pulls per-branch build artifacts from S3 and pushes a multi-arch dd-library-php image so system-tests can pull it by branch slug. Lands first, before GitLab CI is wired to dispatch it, since workflow_dispatch resolves the workflow by filename against the default branch's registered workflows regardless of target ref.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1cc5cf50d3

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-07-30T12:19:37Z

+          docker buildx build --platform linux/amd64,linux/arm64 \
+            --label org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }} \
+            -f Dockerfile.system-tests -t "${IMAGE}:${REF_SLUG}" --push .


Connect the existing GHCR package before pushing

On the first dispatch against the existing dd-trace-php/dd-library-php package, this GITHUB_TOKEN push will be rejected if that package is still the current org-scoped package: GitHub documents that GITHUB_TOKEN cannot push to a namespace that was previously published but not connected to the workflow repository, and the public package page for dd-library-php does not redirect under the repo the way the linked dd-lib-php-init package does. The source label cannot grant access until the push succeeds, so connect the existing package/add Actions access first or publish to a new linked package.

Useful? React with 👍 / 👎.

…write

MilanGarnier force-pushed the milan.garnier/publish-ci-builds branch from f4dedbc to 97f2a40 Compare July 27, 2026 08:11

chatgpt-codex-connector Bot reviewed Jul 27, 2026

View reviewed changes

Comment thread .gitlab/generate-package.php Outdated

Comment thread .gitlab/generate-package.php

Comment thread .gitlab/generate-package.php Outdated

MilanGarnier marked this pull request as ready for review July 28, 2026 12:59

MilanGarnier requested a review from a team as a code owner July 28, 2026 12:59

chatgpt-codex-connector Bot reviewed Jul 28, 2026

View reviewed changes

Comment thread .github/workflows/publish-system-tests-image.yml Outdated

Comment thread .gitlab/generate-package.php Outdated

Comment thread .gitlab/generate-package.php Outdated

MilanGarnier marked this pull request as draft July 30, 2026 09:44

MilanGarnier force-pushed the milan.garnier/publish-ci-builds branch from 6e12d4a to 1cc5cf5 Compare July 30, 2026 09:44

MilanGarnier mentioned this pull request Jul 30, 2026

fix(ci): wire GitLab CI to publish the system-tests image #4079

Draft

4 tasks

MilanGarnier marked this pull request as ready for review July 30, 2026 11:59

chatgpt-codex-connector Bot reviewed Jul 30, 2026

View reviewed changes

MilanGarnier added 2 commits August 3, 2026 11:19

fix(ci): scope system-tests image cleanup to digests this run superseded

dc1b2ac

fix(ci): scope gitlab-ci-publish-packages octo-sts policy to actions:…

e14d7f9

…write

Uh oh!

Conversation

MilanGarnier commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Uh oh!

datadog-datadog-prod-us1-2 Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Warnings

ℹ️ Info

Uh oh!

MilanGarnier commented Jul 27, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pr-commenter Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchmarks [ tracer ]

Explanation

More details about the CI and significant changes

scenario:MessagePackSerializationBench/benchMessagePackSerialization

scenario:MessagePackSerializationBench/benchMessagePackSerialization-opcache

scenario:PDOBench/benchPDOOverhead

scenario:PDOBench/benchPDOOverheadWithDBM

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot Jul 30, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

MilanGarnier commented Jul 27, 2026 •

edited

Loading

datadog-datadog-prod-us1-2 Bot commented Jul 27, 2026 •

edited

Loading

pr-commenter Bot commented Jul 28, 2026 •

edited

Loading