Skip to content

stability: harden sync/uploader reliability and CI guardrails - #29

Merged
tonyredondo merged 4 commits into
mainfrom
findings-remediation
Feb 18, 2026
Merged

stability: harden sync/uploader reliability and CI guardrails#29
tonyredondo merged 4 commits into
mainfrom
findings-remediation

Conversation

@tonyredondo

Copy link
Copy Markdown
Member

Summary

  • Harden sync/uploader correctness by detaching module payload mutations, standardizing shared helper usage, and tightening schema/export safety.
  • Remove flaky and non-hermetic example behaviors while improving error handling in Go examples and integration tooling.
  • Expand CI/security guardrails with action SHA pinning, coverage signal, broader shell linting, Dependabot, and CodeQL/dependency review automation.

Test plan

  • ./bazelw test //tools/...
  • ./bazelw test //examples/...
  • cd modules/go && ../../bazelw test //... --override_module=datadog-rules-test-optimization=../..
  • tools/tests/integration/run_mock_server_tests.sh

Consolidate shared helper usage, tighten parsing/error handling paths, and remove flaky example behaviors so test optimization flows remain deterministic and secure across environments. Expand test and CI coverage plus maintainer docs to make policy and upgrade paths explicit.
@tonyredondo
tonyredondo requested a review from a team as a code owner February 18, 2026 15:01
@github-advanced-security

Copy link
Copy Markdown

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

Handle Bazel manifest-mode runfiles lookup for Python tooling tests so the Windows lane can resolve test files reliably. Relax the coverage gate to require report presence while skipping threshold enforcement when Bazel emits zero instrumented lines.
Disable Git Bash argument/path conversion for the inline retry-check Python invocation so expected API endpoint paths stay POSIX-form in Windows CI integration runs.
Mark EXPECTED_PATH as conversion-exempt for the inline Python retry checker so Git Bash on Windows preserves API endpoint literals instead of rewriting them to host paths.
@tonyredondo
tonyredondo merged commit 6fa958c into main Feb 18, 2026
14 checks passed
@tonyredondo
tonyredondo deleted the findings-remediation branch February 18, 2026 16:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants