ci: add GitLab pipeline to bump rshell in datadog-agent on new tag by matt-dz · Pull Request #188 · DataDog/rshell

matt-dz · 2026-04-16T20:10:25Z

Summary

Adds a GitLab CI pipeline that automatically opens a draft PR on DataDog/datadog-agent to bump the pinned rshell version whenever a new rshell tag (matching v*.*.*) is detected.

Trigger — tag-only (rules: - if: $CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+$/) plus an opt-in manual path via Run pipeline on main with BUMP_VERSION=vX.Y.Z.
Auth — dd-octo-sts mints a short-lived GitHub token via GitLab OIDC; no static secrets anywhere.
Bump flow — clone datadog-agent → strip the lingering replace github.com/DataDog/rshell directive (one-time v0.0.11 transition) → go get → dda inv tidy → write a reno note → commit → push → open draft PR.
Idempotent — no-ops if a PR for the same version already exists.
Draft PR labels: changelog/no-changelog, ask-review; review requested from @DataDog/action-platform.

Mirrors the generate_windows_gitlab_runner_bump_pr pattern already in datadog-agent/.gitlab/distribute/trigger_release/agent.yml.

Prerequisites

rshell is mirrored to gitlab.ddbuild.io/DataDog/rshell with Trigger pipelines for mirror updates enabled.
Companion PR DataDog/datadog-agent#49490 adding the self.rshell.bump-rshell-version octo-sts policy must merge before this is effective.

Test plan

Lint via GitLab CI Lint API once mirrored.
Dry-run: push a throwaway tag on a fork, point the policy at a scratch datadog-agent fork, verify the PR opens as draft with the right title, labels, reviewers, and a clean go.mod/go.sum/reno diff.
Delete scratch PR + tag.

…lls" This reverts commit 9e0ed9f.

matt-dz · 2026-04-16T22:54:31Z

@codex conduct a comprehensive security and code review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 20d3ba3fda

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

matt-dz · 2026-04-16T23:08:40Z

@codex conduct a comprehensive security and code review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3c0ac3884b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

matt-dz · 2026-04-16T23:18:18Z

@codex conduct a comprehensive security and code review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b363e85897

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…flow

matt-dz · 2026-04-16T23:30:49Z

@codex conduct a comprehensive security and code review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 47b1847a6e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

matt-dz · 2026-04-16T23:37:05Z

@codex conduct a comprehensive security and code review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 810ac250e0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-04-16T23:40:30Z

+    branch = f"bump-rshell-{version}"
+
+    log(f"checking {TARGET_REPO} for existing PR with head={branch}")
+    existing = list(repo.get_pulls(state="open", head=f"{TARGET_REPO.split('/')[0]}:{branch}"))


Handle closed existing PRs before attempting create_pull

The idempotency check only looks for open PRs, so if a prior bump PR for the same bump-rshell-vX.Y.Z branch was closed, this path will still push and then call create_pull. GitHub rejects duplicate head/base PR creation for that branch, which turns retries or manual reruns for the same version into hard failures instead of a safe no-op/update path. Query state="all" (or explicitly closed) and reuse/reopen the existing PR when present.

Useful? React with 👍 / 👎.

AlexandreYang · 2026-04-28T07:44:56Z

@@ -0,0 +1,26 @@
+name: CI scripts


ci: add GitLab pipeline to bump rshell in datadog-agent on new tag

@matt-dz
Q: Don't we already have existing tooling that will do this?

Example PRs like this: #198

By "🤖 Generated by DataDog Automated Dependency Management System"

matt-dz added 2 commits April 16, 2026 13:09

ci: add GitLab pipeline to bump rshell in datadog-agent on new tag

4b8bddb

ci: allow manual web trigger with BUMP_VERSION variable

513701b

matt-dz mentioned this pull request Apr 16, 2026

ci(chainguard): Add dd-octo-sts policy for rshell version bump DataDog/datadog-agent#49490

Open

matt-dz added 9 commits April 16, 2026 14:47

ci(bump): drop bot/ prefix on bump branch

b1ad597

ci(bump): clone datadog-agent anonymously; only auth on push

2acb6bf

test(bump): add stdlib unit tests for bump_datadog_agent.py

e7ee0eb

ci(bump): redact credentials in logged command lines

a5d0181

ci(bump): stop logging commands; move token to git credentials file

d63092d

ci(bump): add progress logging that never touches credentials

26f0d98

ci(bump): drop PyGithub; use stdlib urllib for GitHub REST calls

9e0ed9f

Revert "ci(bump): drop PyGithub; use stdlib urllib for GitHub REST ca…

bd57580

…lls" This reverts commit 9e0ed9f.

ci(bump): install PyGithub in before_script

20d3ba3

chatgpt-codex-connector Bot reviewed Apr 16, 2026

View reviewed changes

Comment thread .gitlab-ci.yml Outdated

Comment thread .gitlab/scripts/bump_datadog_agent.py Outdated

Comment thread .gitlab/scripts/bump_datadog_agent.py Outdated

matt-dz added 4 commits April 16, 2026 16:00

ci(bump): restrict web-triggered bump to protected main branch

9cf0d68

ci(bump): drop redundant ref_protected check (main is always protected)

1b0b333

ci(bump): skip bump flow when target version is already pinned

0633905

ci(bump): make release-note filename deterministic per version

3c0ac38

ci(bump): force-push bot branch to enable retries after partial failure

5ecc8eb

chatgpt-codex-connector Bot reviewed Apr 16, 2026

View reviewed changes

Comment thread .gitlab-ci.yml Outdated

Comment thread .gitlab/scripts/bump_datadog_agent.py Outdated

matt-dz added 2 commits April 16, 2026 16:12

ci(bump): install deps before minting GitHub token

5f4aebd

ci(bump): strip rshell replace directives in all valid go.mod forms

b363e85

chatgpt-codex-connector Bot reviewed Apr 16, 2026

View reviewed changes

Comment thread .gitlab-ci.yml Outdated

Comment thread tools/bump_datadog_agent/bump.py Outdated

matt-dz added 3 commits April 16, 2026 16:23

refactor: move bump script to tools/ and add GitHub Actions test work…

b15a36f

…flow

ci(bump): pin PyGithub to a specific version for reproducibility

9ae59ee

ci(bump): use unique tempdir per run instead of hard-coded /tmp path

47b1847

chatgpt-codex-connector Bot reviewed Apr 16, 2026

View reviewed changes

Comment thread .gitlab-ci.yml Outdated

ci(bump): inline token export instead of !reference template

810ac25

chatgpt-codex-connector Bot reviewed Apr 16, 2026

View reviewed changes

matt-dz added 2 commits April 17, 2026 08:00

ci(bump): scrub GITHUB_TOKEN from env before spawning subprocesses

ef39f15

ci(bump): handle closed/merged PRs; reopen instead of duplicate-creating

8537f5e

matt-dz mentioned this pull request Apr 17, 2026

Add dda inv github.bump-rshell task for automated rshell version bumps DataDog/datadog-agent#49556

Draft

AlexandreYang reviewed Apr 28, 2026

View reviewed changes

Conversation

matt-dz commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Prerequisites

Test plan

Uh oh!

matt-dz commented Apr 16, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

matt-dz commented Apr 16, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

matt-dz commented Apr 16, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

matt-dz commented Apr 16, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

matt-dz commented Apr 16, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

AlexandreYang Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

matt-dz commented Apr 16, 2026 •

edited

Loading

AlexandreYang Apr 28, 2026 •

edited

Loading