From dcd10562cbc96d4e43fb2a3653000c0605cc01ee Mon Sep 17 00:00:00 2001 From: "ali.benabdallah" Date: Mon, 27 Jul 2026 14:50:44 +0200 Subject: [PATCH 1/4] Onboard off public-images GitLab job-token trigger, use dd-pkg publish-image Replaces the direct `trigger: project: DataDog/public-images` CI jobs with `dd-pkg publish-image` calls against the artifact-gateway service. This routes public image publishing through a policy/audit layer while still driving the same public-images pipeline; no per-repo registration is required since authorization is implicit via CI job identity. See https://datadoghq.atlassian.net/wiki/x/ooQkngE Ref: BARX-1951 --- .gitlab-ci.yml | 34 ++++++++++++++++++++++------------ 1 file changed, 22 insertions(+), 12 deletions(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 234e313e..74c7758f 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -130,6 +130,25 @@ build_eds_check_image_arm64: - if [ -n "$CI_COMMIT_TAG" ]; then docker buildx imagetools create $TARGET_IMAGE --tag $RELEASE_IMAGE; fi +.docker_publish_job_definition: + image: registry.ddbuild.io/agent-delivery/dd-pkg:v0.9.0 + variables: + IMG_SIGNING: "false" + PUBLIC_IMAGES_PUBLISH_TIMEOUT: "1800" + script: + - | + set -euo pipefail + dd-pkg version + args=(publish-image --timeout "${PUBLIC_IMAGES_PUBLISH_TIMEOUT}" --poll-interval 30 --signing="${IMG_SIGNING}") + if [[ -n "${IMG_REGISTRIES:-}" ]]; then args+=(--registries "${IMG_REGISTRIES}"); fi + if [[ -n "${IMG_SOURCES:-}" ]]; then args+=(--sources "${IMG_SOURCES}"); fi + if [[ -n "${IMG_DESTINATIONS:-}" ]]; then args+=(--destinations "${IMG_DESTINATIONS}"); fi + if [[ -n "${IMG_DESTINATIONS_REGEX:-}" ]]; then args+=(--regex-expression "${IMG_DESTINATIONS_REGEX}"); fi + if [[ -n "${IMG_DESTINATIONS_REGEX_REPL:-}" ]]; then args+=(--regex-replacement "${IMG_DESTINATIONS_REGEX_REPL}"); fi + if [[ -n "${IMG_TAG_REFERENCE:-}" ]]; then args+=(--tag-reference "${IMG_TAG_REFERENCE}"); fi + if [[ -n "${IMG_NEW_TAGS:-}" ]]; then args+=(--new-tags "${IMG_NEW_TAGS}"); fi + dd-pkg "${args[@]}" + publish_public_main: stage: release rules: @@ -139,10 +158,7 @@ publish_public_main: needs: - build_eds_image_arm64 - build_eds_image_amd64 - trigger: - project: DataDog/public-images - branch: main - strategy: depend + extends: .docker_publish_job_definition variables: IMG_SOURCES: $BUILD_DOCKER_REGISTRY/$PROJECTNAME:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}-amd64,$BUILD_DOCKER_REGISTRY/$PROJECTNAME:v${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}-arm64 IMG_DESTINATIONS: $PROJECTNAME:main @@ -163,10 +179,7 @@ publish_public_tag: needs: - build_eds_image_arm64 - build_eds_image_amd64 - trigger: - project: DataDog/public-images - branch: main - strategy: depend + extends: .docker_publish_job_definition variables: IMG_SOURCES: $BUILD_DOCKER_REGISTRY/$PROJECTNAME:$CI_COMMIT_TAG-amd64,$BUILD_DOCKER_REGISTRY/$PROJECTNAME:$CI_COMMIT_TAG-arm64 IMG_DESTINATIONS: $PROJECTNAME:$CI_COMMIT_TAG @@ -187,10 +200,7 @@ publish_public_latest: needs: - build_eds_image_arm64 - build_eds_image_amd64 - trigger: - project: DataDog/public-images - branch: main - strategy: depend + extends: .docker_publish_job_definition variables: IMG_SOURCES: $BUILD_DOCKER_REGISTRY/$PROJECTNAME:$CI_COMMIT_TAG-amd64,$BUILD_DOCKER_REGISTRY/$PROJECTNAME:$CI_COMMIT_TAG-arm64 IMG_DESTINATIONS: $PROJECTNAME:latest From 6c39cacc79e177d62ca472409324b13e15889a16 Mon Sep 17 00:00:00 2001 From: "ali.benabdallah" Date: Tue, 28 Jul 2026 16:51:34 +0200 Subject: [PATCH 2/4] Override before_script and set explicit IMG_REGISTRIES for publish jobs Publishing jobs now run as ordinary jobs (not bridge triggers), so they inherit the top-level before_script (make install-tools), which can fail on the purpose-built dd-pkg image and is unnecessary overhead. Also make the target registry explicit instead of relying on the dd-pkg default. --- .gitlab-ci.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 74c7758f..a67de6da 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -132,8 +132,10 @@ build_eds_check_image_arm64: .docker_publish_job_definition: image: registry.ddbuild.io/agent-delivery/dd-pkg:v0.9.0 + before_script: [] variables: IMG_SIGNING: "false" + IMG_REGISTRIES: "public" PUBLIC_IMAGES_PUBLISH_TIMEOUT: "1800" script: - | From f8ce44191367363950d2c20d0b4d44339c6308f0 Mon Sep 17 00:00:00 2001 From: "ali.benabdallah" Date: Wed, 29 Jul 2026 11:09:44 +0200 Subject: [PATCH 3/4] Add runner tags to converted publish jobs Publishing jobs run as ordinary script jobs now, not bridge trigger jobs, so they need explicit runner tags like every other script job in this pipeline; without one they'd have no eligible runner. Matches the arch:amd64 convention used by sibling repos onboarded off the same public-images trigger (e.g. fips-proxy). --- .gitlab-ci.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 4b24752e..229e5603 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -132,6 +132,7 @@ build_eds_check_image_arm64: .docker_publish_job_definition: image: registry.ddbuild.io/agent-delivery/dd-pkg:v0.9.0 + tags: [ "arch:amd64" ] before_script: [] variables: IMG_SIGNING: "false" From 7b0a1fe059369d1eae0b37c670ec79a868a73bd5 Mon Sep 17 00:00:00 2001 From: "ali.benabdallah" Date: Wed, 29 Jul 2026 11:38:37 +0200 Subject: [PATCH 4/4] gitlab-ci: use arch:arm64 runner tag for dd-pkg publish job Switches the shared publish-image job template's runner tag from arch:amd64 to arch:arm64 per updated runner allocation guidance. --- .gitlab-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 229e5603..5b08f7a3 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -132,7 +132,7 @@ build_eds_check_image_arm64: .docker_publish_job_definition: image: registry.ddbuild.io/agent-delivery/dd-pkg:v0.9.0 - tags: [ "arch:amd64" ] + tags: [ "arch:arm64" ] before_script: [] variables: IMG_SIGNING: "false"