From e3cc1bd382992bbd27d5252937a51e5d6db39bda Mon Sep 17 00:00:00 2001 From: Andrew Lee Date: Wed, 8 Jul 2026 17:58:16 +0000 Subject: [PATCH 1/6] ci: migrate macOS jobs to tart VM runner Co-Authored-By: Claude Opus 4.8 (1M context) --- .gitlab-ci.yml | 21 ++++++++++++++------- benchmarks/.benchmarks-ci.yml | 3 ++- 2 files changed, 16 insertions(+), 8 deletions(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 36485cb44..cd716776d 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -45,7 +45,8 @@ stages: # TESTS test:lint: - tags: ['macos:sonoma', 'specific:true'] + tags: ['macos:tart'] + image: "486234852809.dkr.ecr.us-east-1.amazonaws.com/ci/ci-platform-machine-images/tart-vm:dd-sdk-reactnative-sonoma-latest" stage: test rules: - if: '$BUILD_BENCHMARK != "true"' @@ -55,7 +56,8 @@ test:lint: - yarn run lint test:js: - tags: ['macos:sonoma', 'specific:true'] + tags: ['macos:tart'] + image: "486234852809.dkr.ecr.us-east-1.amazonaws.com/ci/ci-platform-machine-images/tart-vm:dd-sdk-reactnative-sonoma-latest" stage: test rules: - if: '$BUILD_BENCHMARK != "true"' @@ -66,7 +68,8 @@ test:js: - NODE_OPTIONS='-r dd-trace/ci/init' DD_ENV=ci DD_SERVICE=dd-sdk-reactnative yarn test test:build: - tags: ['macos:sonoma', 'specific:true'] + tags: ['macos:tart'] + image: "486234852809.dkr.ecr.us-east-1.amazonaws.com/ci/ci-platform-machine-images/tart-vm:dd-sdk-reactnative-sonoma-latest" stage: test rules: - if: '$BUILD_BENCHMARK != "true"' @@ -76,7 +79,8 @@ test:build: - yarn prepare test:native-android: - tags: ['macos:sonoma', 'specific:true'] + tags: ['macos:tart'] + image: "486234852809.dkr.ecr.us-east-1.amazonaws.com/ci/ci-platform-machine-images/tart-vm:dd-sdk-reactnative-sonoma-latest" stage: test rules: - if: '$BUILD_BENCHMARK != "true"' @@ -94,7 +98,8 @@ test:native-android: - (cd packages/internal-testing-tools/android && ./gradlew build -PDdSdkReactNative_minSdkVersion=24 -PDatadogInternalTesting_minSdkVersion=24) test:native-ios: - tags: ['macos:sonoma', 'specific:true'] + tags: ['macos:tart'] + image: "486234852809.dkr.ecr.us-east-1.amazonaws.com/ci/ci-platform-machine-images/tart-vm:dd-sdk-reactnative-sonoma-latest" stage: test rules: - if: '$BUILD_BENCHMARK != "true"' @@ -105,7 +110,8 @@ test:native-ios: - set -o pipefail && xcodebuild -workspace example/ios/DdSdkReactNativeExample.xcworkspace -scheme DatadogSDKReactNative test -destination "platform=iOS Simulator,OS=17.4,name=iPhone 15 Pro Max" | xcbeautify test:native-ios-sr: - tags: ['macos:sonoma', 'specific:true'] + tags: ['macos:tart'] + image: "486234852809.dkr.ecr.us-east-1.amazonaws.com/ci/ci-platform-machine-images/tart-vm:dd-sdk-reactnative-sonoma-latest" stage: test rules: - if: '$BUILD_BENCHMARK != "true"' @@ -116,7 +122,8 @@ test:native-ios-sr: - set -o pipefail && xcodebuild -workspace example/ios/DdSdkReactNativeExample.xcworkspace -scheme DatadogSDKReactNativeSessionReplay test -destination "platform=iOS Simulator,OS=17.4,name=iPhone 15 Pro Max" | xcbeautify test:native-ios-newarch: - tags: ['macos:sonoma', 'specific:true'] + tags: ['macos:tart'] + image: "486234852809.dkr.ecr.us-east-1.amazonaws.com/ci/ci-platform-machine-images/tart-vm:dd-sdk-reactnative-sonoma-latest" stage: test rules: - if: '$BUILD_BENCHMARK != "true"' diff --git a/benchmarks/.benchmarks-ci.yml b/benchmarks/.benchmarks-ci.yml index 54d851ddf..ce712dcad 100644 --- a/benchmarks/.benchmarks-ci.yml +++ b/benchmarks/.benchmarks-ci.yml @@ -60,7 +60,8 @@ stages: build-and-upload:app: stage: build-and-upload - tags: ['macos:sonoma', 'specific:true'] + tags: ['macos:tart'] + image: "486234852809.dkr.ecr.us-east-1.amazonaws.com/ci/ci-platform-machine-images/tart-vm:dd-sdk-reactnative-sonoma-latest" script: - !reference [.snippets, install-node] - !reference [.snippets, install-android-sdk] From 5510a33e08396e98d79c8319fb7221b714958695 Mon Sep 17 00:00:00 2001 From: Andrew Lee Date: Wed, 8 Jul 2026 18:56:34 +0000 Subject: [PATCH 2/6] ci: make Java discoverable for sdkmanager on tart VMs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The test:native-android job (and benchmarks build-and-upload:app) failed with "Unable to locate a Java Runtime" when running sdkmanager. Java 17 is installed in the tart VM image, but openjdk@17 is keg-only and the image only exports JAVA_HOME/PATH in ~/.zshrc — which the tart runner's non-interactive shell does not source. Export JAVA_HOME/PATH in the install-android-sdk snippet so sdkmanager can find Java. Co-Authored-By: Claude Opus 4.8 (1M context) --- .gitlab-ci.yml | 5 +++++ benchmarks/.benchmarks-ci.yml | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index cd716776d..b7780dd3f 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -25,6 +25,11 @@ stages: install-jdk-17: - brew install openjdk@17 install-android-sdk: + # sdkmanager needs a Java runtime. openjdk@17 is keg-only and the VM only + # exports JAVA_HOME/PATH in ~/.zshrc, which the tart runner's non-interactive + # shell does not source, so make Java discoverable here. + - export JAVA_HOME="/opt/homebrew/opt/openjdk@17" + - export PATH="$JAVA_HOME/bin:$PATH" - curl -sSL -o commandlinetools.zip https://dl.google.com/android/repository/$ANDROID_SDK_VERSION.zip - rm -rf ~/android_sdk - rm -rf ~/cmdline-tools diff --git a/benchmarks/.benchmarks-ci.yml b/benchmarks/.benchmarks-ci.yml index ce712dcad..3c1c5eabd 100644 --- a/benchmarks/.benchmarks-ci.yml +++ b/benchmarks/.benchmarks-ci.yml @@ -36,6 +36,11 @@ stages: install-jdk-17: - brew install openjdk@17 install-android-sdk: + # sdkmanager needs a Java runtime. openjdk@17 is keg-only and the VM only + # exports JAVA_HOME/PATH in ~/.zshrc, which the tart runner's non-interactive + # shell does not source, so make Java discoverable here. + - export JAVA_HOME="/opt/homebrew/opt/openjdk@17" + - export PATH="$JAVA_HOME/bin:$PATH" - curl -sSL -o commandlinetools.zip https://dl.google.com/android/repository/$ANDROID_SDK_VERSION.zip - rm -rf ~/android_sdk - rm -rf ~/cmdline-tools From 635e1be649e74da0f81cdb0c1ff10ebec7d5a6a9 Mon Sep 17 00:00:00 2001 From: Andrew Lee Date: Wed, 8 Jul 2026 18:57:02 +0000 Subject: [PATCH 3/6] ci: drop explanatory comments from install-android-sdk java export Co-Authored-By: Claude Opus 4.8 (1M context) --- .gitlab-ci.yml | 3 --- benchmarks/.benchmarks-ci.yml | 3 --- 2 files changed, 6 deletions(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index b7780dd3f..56c7c0b08 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -25,9 +25,6 @@ stages: install-jdk-17: - brew install openjdk@17 install-android-sdk: - # sdkmanager needs a Java runtime. openjdk@17 is keg-only and the VM only - # exports JAVA_HOME/PATH in ~/.zshrc, which the tart runner's non-interactive - # shell does not source, so make Java discoverable here. - export JAVA_HOME="/opt/homebrew/opt/openjdk@17" - export PATH="$JAVA_HOME/bin:$PATH" - curl -sSL -o commandlinetools.zip https://dl.google.com/android/repository/$ANDROID_SDK_VERSION.zip diff --git a/benchmarks/.benchmarks-ci.yml b/benchmarks/.benchmarks-ci.yml index 3c1c5eabd..d0b23a1d7 100644 --- a/benchmarks/.benchmarks-ci.yml +++ b/benchmarks/.benchmarks-ci.yml @@ -36,9 +36,6 @@ stages: install-jdk-17: - brew install openjdk@17 install-android-sdk: - # sdkmanager needs a Java runtime. openjdk@17 is keg-only and the VM only - # exports JAVA_HOME/PATH in ~/.zshrc, which the tart runner's non-interactive - # shell does not source, so make Java discoverable here. - export JAVA_HOME="/opt/homebrew/opt/openjdk@17" - export PATH="$JAVA_HOME/bin:$PATH" - curl -sSL -o commandlinetools.zip https://dl.google.com/android/repository/$ANDROID_SDK_VERSION.zip From 1d2f84c927094bd638be31404a58ce6985d67e0a Mon Sep 17 00:00:00 2001 From: Andrew Lee Date: Fri, 17 Jul 2026 17:37:05 +0000 Subject: [PATCH 4/6] ci: export AWS creds before vault login for tart runners vault's aws auth does not honor AWS_EC2_METADATA_SERVICE_ENDPOINT on the tart VMs, so it cannot reach the IAM-proxy creds. The AWS CLI does; export the resolved creds so vault's credential chain picks them up. Co-Authored-By: Claude Opus 4.8 (1M context) --- benchmarks/scripts/secrets/get-secret.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/benchmarks/scripts/secrets/get-secret.sh b/benchmarks/scripts/secrets/get-secret.sh index 40417fa21..d071e03ce 100644 --- a/benchmarks/scripts/secrets/get-secret.sh +++ b/benchmarks/scripts/secrets/get-secret.sh @@ -9,6 +9,7 @@ get_secret() { export VAULT_ADDR=$DD_VAULT_ADDR if [ "$CI" = "true" ]; then + eval "$(aws configure export-credentials --format env)" vault login -method=aws -no-print else if vault token lookup &>/dev/null; then From 004e0722e0a550ca9856db6ccc7e622461131556 Mon Sep 17 00:00:00 2001 From: Andrew Lee Date: Fri, 17 Jul 2026 16:51:39 -0400 Subject: [PATCH 5/6] prevent overriding existing AWS_* credentials Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- benchmarks/scripts/secrets/get-secret.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/benchmarks/scripts/secrets/get-secret.sh b/benchmarks/scripts/secrets/get-secret.sh index d071e03ce..cc572fd45 100644 --- a/benchmarks/scripts/secrets/get-secret.sh +++ b/benchmarks/scripts/secrets/get-secret.sh @@ -9,7 +9,9 @@ get_secret() { export VAULT_ADDR=$DD_VAULT_ADDR if [ "$CI" = "true" ]; then - eval "$(aws configure export-credentials --format env)" + if [ -z "${AWS_ACCESS_KEY_ID:-}" ] || [ -z "${AWS_SECRET_ACCESS_KEY:-}" ]; then + eval "$(aws configure export-credentials --format env)" + fi vault login -method=aws -no-print else if vault token lookup &>/dev/null; then From 07aaa09b39ebac68915a97fe7df1aff23a5f403d Mon Sep 17 00:00:00 2001 From: Andrew Lee Date: Fri, 17 Jul 2026 21:04:17 +0000 Subject: [PATCH 6/6] fix: address Copilot review comments on PR #1335 - Fix JAVA_HOME/install-jdk-17 ordering in test:native-android and build-and-upload:app so JDK 17 is installed before the Android SDK snippet relies on it - Centralize the duplicated tart VM image string into a TART_VM_IMAGE variable in .gitlab-ci.yml and benchmarks/.benchmarks-ci.yml - Check the exit status of `aws configure export-credentials` before eval'ing its output in get-secret.sh, instead of failing silently --- .gitlab-ci.yml | 17 +++++++++-------- benchmarks/.benchmarks-ci.yml | 5 +++-- benchmarks/scripts/secrets/get-secret.sh | 7 ++++++- 3 files changed, 18 insertions(+), 11 deletions(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 56c7c0b08..3cd451874 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -6,6 +6,7 @@ include: variables: GIT_DEPTH: 5 DEVELOP_BRANCH: 'develop' + TART_VM_IMAGE: '486234852809.dkr.ecr.us-east-1.amazonaws.com/ci/ci-platform-machine-images/tart-vm:dd-sdk-reactnative-sonoma-latest' ANDROID_SDK_VERSION: 'commandlinetools-mac-11076708_latest' EMULATOR_NAME: 'android_emulator' ANDROID_ARCH: 'arm64-v8a' @@ -48,7 +49,7 @@ stages: test:lint: tags: ['macos:tart'] - image: "486234852809.dkr.ecr.us-east-1.amazonaws.com/ci/ci-platform-machine-images/tart-vm:dd-sdk-reactnative-sonoma-latest" + image: "$TART_VM_IMAGE" stage: test rules: - if: '$BUILD_BENCHMARK != "true"' @@ -59,7 +60,7 @@ test:lint: test:js: tags: ['macos:tart'] - image: "486234852809.dkr.ecr.us-east-1.amazonaws.com/ci/ci-platform-machine-images/tart-vm:dd-sdk-reactnative-sonoma-latest" + image: "$TART_VM_IMAGE" stage: test rules: - if: '$BUILD_BENCHMARK != "true"' @@ -71,7 +72,7 @@ test:js: test:build: tags: ['macos:tart'] - image: "486234852809.dkr.ecr.us-east-1.amazonaws.com/ci/ci-platform-machine-images/tart-vm:dd-sdk-reactnative-sonoma-latest" + image: "$TART_VM_IMAGE" stage: test rules: - if: '$BUILD_BENCHMARK != "true"' @@ -82,14 +83,14 @@ test:build: test:native-android: tags: ['macos:tart'] - image: "486234852809.dkr.ecr.us-east-1.amazonaws.com/ci/ci-platform-machine-images/tart-vm:dd-sdk-reactnative-sonoma-latest" + image: "$TART_VM_IMAGE" stage: test rules: - if: '$BUILD_BENCHMARK != "true"' timeout: 1h script: - - !reference [.snippets, install-android-sdk] - !reference [.snippets, install-jdk-17] + - !reference [.snippets, install-android-sdk] - /opt/homebrew/opt/openjdk@17/bin/java --version - echo "org.gradle.java.home=/opt/homebrew/opt/openjdk@17" >> packages/core/android/gradle.properties - echo "org.gradle.java.home=/opt/homebrew/opt/openjdk@17" >> packages/react-native-session-replay/android/gradle.properties @@ -101,7 +102,7 @@ test:native-android: test:native-ios: tags: ['macos:tart'] - image: "486234852809.dkr.ecr.us-east-1.amazonaws.com/ci/ci-platform-machine-images/tart-vm:dd-sdk-reactnative-sonoma-latest" + image: "$TART_VM_IMAGE" stage: test rules: - if: '$BUILD_BENCHMARK != "true"' @@ -113,7 +114,7 @@ test:native-ios: test:native-ios-sr: tags: ['macos:tart'] - image: "486234852809.dkr.ecr.us-east-1.amazonaws.com/ci/ci-platform-machine-images/tart-vm:dd-sdk-reactnative-sonoma-latest" + image: "$TART_VM_IMAGE" stage: test rules: - if: '$BUILD_BENCHMARK != "true"' @@ -125,7 +126,7 @@ test:native-ios-sr: test:native-ios-newarch: tags: ['macos:tart'] - image: "486234852809.dkr.ecr.us-east-1.amazonaws.com/ci/ci-platform-machine-images/tart-vm:dd-sdk-reactnative-sonoma-latest" + image: "$TART_VM_IMAGE" stage: test rules: - if: '$BUILD_BENCHMARK != "true"' diff --git a/benchmarks/.benchmarks-ci.yml b/benchmarks/.benchmarks-ci.yml index d0b23a1d7..8bf47dd18 100644 --- a/benchmarks/.benchmarks-ci.yml +++ b/benchmarks/.benchmarks-ci.yml @@ -5,6 +5,7 @@ include: variables: GIT_DEPTH: 5 NODE_VERSION: '22.5.1' + TART_VM_IMAGE: '486234852809.dkr.ecr.us-east-1.amazonaws.com/ci/ci-platform-machine-images/tart-vm:dd-sdk-reactnative-sonoma-latest' ANDROID_SDK_VERSION: 'commandlinetools-mac-11076708_latest' EMULATOR_NAME: 'android_emulator' ANDROID_ARCH: 'arm64-v8a' @@ -63,11 +64,11 @@ stages: build-and-upload:app: stage: build-and-upload tags: ['macos:tart'] - image: "486234852809.dkr.ecr.us-east-1.amazonaws.com/ci/ci-platform-machine-images/tart-vm:dd-sdk-reactnative-sonoma-latest" + image: "$TART_VM_IMAGE" script: - !reference [.snippets, install-node] - - !reference [.snippets, install-android-sdk] - !reference [.snippets, install-jdk-17] + - !reference [.snippets, install-android-sdk] - !reference [.snippets, check-versions] - echo $(pwd) diff --git a/benchmarks/scripts/secrets/get-secret.sh b/benchmarks/scripts/secrets/get-secret.sh index cc572fd45..26dbca151 100644 --- a/benchmarks/scripts/secrets/get-secret.sh +++ b/benchmarks/scripts/secrets/get-secret.sh @@ -10,7 +10,12 @@ get_secret() { export VAULT_ADDR=$DD_VAULT_ADDR if [ "$CI" = "true" ]; then if [ -z "${AWS_ACCESS_KEY_ID:-}" ] || [ -z "${AWS_SECRET_ACCESS_KEY:-}" ]; then - eval "$(aws configure export-credentials --format env)" + local aws_env + if ! aws_env="$(aws configure export-credentials --format env)"; then + echo "Error: Failed to export AWS credentials via 'aws configure export-credentials'." >&2 + exit 1 + fi + eval "$aws_env" fi vault login -method=aws -no-print else