Skip to content

chore(ci_visibility): improve git security settings#16552

Merged
gh-worker-dd-mergequeue-cf854d[bot] merged 9 commits into
mainfrom
dd/improve-git-security-settings
Feb 19, 2026
Merged

chore(ci_visibility): improve git security settings#16552
gh-worker-dd-mergequeue-cf854d[bot] merged 9 commits into
mainfrom
dd/improve-git-security-settings

Conversation

@gnufede

@gnufede gnufede commented Feb 18, 2026

Copy link
Copy Markdown
Member

PR by Bits
View session in Datadog

Comment @DataDog to request changes

Feedback (especially what can be better) welcome in #code-gen-aka-bits-dev-feedback!


Description

Improves Git security settings by replacing the global safe.directory configuration approach with per-command configuration overrides. Instead of modifying Git's global configuration, the implementation now:

  • Resolves the Git repository root from the working directory
  • Passes the repository root as a command-line override using -c safe.directory=<repo> for each Git command
  • Eliminates global Git configuration mutations entirely
  • Removes the in-memory cache of safe directory entries

This approach maintains security by limiting safe directory configuration to only the specific repository being accessed on a per-command basis, while avoiding global configuration changes and their associated performance and maintenance overhead.

Testing

Updated two test cases:

  • test_git_safe_directory_override_added_for_repo_root: Verifies that Git commands include the -c safe.directory=<repo> override for the repository root
  • test_git_safe_directory_override_skipped_without_repo: Verifies that no override is added when operating outside a Git repository

Removed the mocked _set_safe_directory call from test_extract_git_metadata to test the actual metadata extraction flow with the new override mechanism.

Risks

None

Additional Notes

This implementation aligns with the Java tracer's approach (PR 10486) by using repository-specific safe directory configuration rather than a global wildcard or global entries, improving both security posture and Git configuration cleanliness. The per-command override approach ensures that Git security checks remain effective while allowing the tracer to access metadata from repositories in security-restricted environments.

SDTEST-3222

Co-authored-by: gnufede <412857+gnufede@users.noreply.github.com>
@datadog-official

datadog-official Bot commented Feb 18, 2026

Copy link
Copy Markdown
Contributor

[View session in Datadog]

Bits Dev status: ✅ Done

CI Auto-fix: Disabled | Enable

Comment @DataDog to request changes

@gnufede gnufede added changelog/no-changelog A changelog entry is not required for this PR. CI App labels Feb 18, 2026
@cit-pr-commenter-54b7da

cit-pr-commenter-54b7da Bot commented Feb 18, 2026

Copy link
Copy Markdown

Codeowners resolved as

ddtrace/ext/git.py                                                      @DataDog/ci-app-libraries @DataDog/apm-core-python
tests/tracer/test_ci.py                                                 @DataDog/ci-app-libraries

@gnufede gnufede marked this pull request as ready for review February 18, 2026 12:30
@gnufede gnufede requested review from a team as code owners February 18, 2026 12:30
@gnufede gnufede requested a review from juanjux February 18, 2026 12:30

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d5a9b886ee

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread ddtrace/ext/git.py Outdated
Co-authored-by: gnufede <412857+gnufede@users.noreply.github.com>
@gnufede gnufede changed the title chore(ci_visibility): improve git security settings Improve Git Security Settings - Python Feb 18, 2026
@gnufede gnufede changed the title Improve Git Security Settings - Python chore(ci_visibility): improve git security settings Feb 18, 2026
@gnufede

gnufede commented Feb 18, 2026

Copy link
Copy Markdown
Member Author

@codex review

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8840784666

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread ddtrace/ext/git.py
@datadog-official

This comment has been minimized.

@gnufede

gnufede commented Feb 19, 2026

Copy link
Copy Markdown
Member Author

/merge

@gh-worker-devflow-routing-ef8351

gh-worker-devflow-routing-ef8351 Bot commented Feb 19, 2026

Copy link
Copy Markdown

View all feedbacks in Devflow UI.

2026-02-19 10:57:33 UTC ℹ️ Start processing command /merge


2026-02-19 10:57:44 UTC ℹ️ MergeQueue: waiting for PR to be ready

This pull request is not mergeable according to GitHub. Common reasons include pending required checks, missing approvals, or merge conflicts — but it could also be blocked by other repository rules or settings.
It will be added to the queue as soon as checks pass and/or get approvals. View in MergeQueue UI.
Note: if you pushed new commits since the last approval, you may need additional approval.
You can remove it from the waiting list with /remove command.


2026-02-19 11:22:06 UTC ℹ️ MergeQueue: merge request added to the queue

The expected merge time in main is approximately 4h (p90).


2026-02-19 11:59:23 UTC ℹ️ MergeQueue: This merge request was merged

@juanjux juanjux left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Test lacks typing, but this is typical of our tests, LGTM otherwise.

@gh-worker-dd-mergequeue-cf854d gh-worker-dd-mergequeue-cf854d Bot merged commit 8f7b888 into main Feb 19, 2026
790 checks passed
@gh-worker-dd-mergequeue-cf854d gh-worker-dd-mergequeue-cf854d Bot deleted the dd/improve-git-security-settings branch February 19, 2026 11:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Bits AI changelog/no-changelog A changelog entry is not required for this PR. CI App

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants