stability: implement full findings remediation matrix - #36
Merged
Conversation
Apply all validated remediation waves across core sync/uploader tooling, examples, CI, and docs, including branch-safe refactors for large files and a complete closure checklist for FINDINGS1/FINDINGS2 IDs.
Add a shell shebang for shared integration helpers and adjust template linting behavior so CI no longer fails in the PowerShell lane due parser invocation issues.
Limit buildifier enforcement to Starlark files changed in the PR diff to avoid failing on unrelated pre-existing formatting debt while still gating modified files.
Normalize escaped find parentheses before shellcheck and switch buildifier diff selection to two-dot comparison so shallow PR clones still produce changed-file lists.
Normalize formatting on changed Starlark sources so the shell-lint buildifier gate passes consistently in CI.
Use braced variable concatenation in regex builder snippets so shellcheck no longer misinterprets bracket patterns as array expansion.
Use powershell-specific template normalization that preserves `${var}` interpolation and re-enable parser validation in the PowerShell lint lane.
Drop the generated findings remediation and audit closure markdown files from the repository per cleanup request so they are not tracked in the PR payload.
Restore the OIDC subject and repository claim patterns for rules_test_optimization_tests so dd-octo-sts authentication succeeds in the external test repository CI jobs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.github/workflows/release.yml,.pre-commit-config.yaml,.editorconfig,CHANGELOG.md) plus CI checks for Buildifier, gofmt, fixture JSON validity, parser parity, and template linting.tools/dev/lint_uploader_templates.py --skip-shellcheck) so the PowerShell lane validates parser correctness again.docs/FINDINGS_REMEDIATION_CHECKLIST.mdanddocs/AUDIT_FINDINGS_CLOSURE.md.Test plan
./bazelw test //tools/..../bazelw test //examples/...cd modules/go && ../../bazelw test //... --override_module=datadog-rules-test-optimization=../..python3 tools/dev/check_module_versions.pypython3 tools/core/schemas/sync_agentless_schema.py --checkpython3 tools/dev/lint_uploader_templates.py --skip-shellcheck./tools/tests/integration/run_mock_server_tests.sh