[ACTP] parse the par-control configuration from Go by embeaken · Pull Request #54590 · DataDog/datadog-agent

embeaken · 2026-08-07T17:47:32Z

What does this PR do?

Makes par-control a consumer of the configuration Go resolves, instead of an
independent configuration authority.

On startup it runs privateactionrunner bootstrap-par-control (#54870), reads the
single PAR_CONTROL_CONFIG= prefixed JSON line from its stdout, validates it at
the trust boundary, and exits successfully when split mode is disabled.

This deletes the Rust-owned configuration stack:

local YAML loading, Fleet policy discovery and merging, environment decoding and
aliases, configuration precedence and deep merging;
the Windows Fleet registry lookup;
persisted identity-file discovery and inline-versus-persisted selection;
the Agent IPC certificate path fallback;
site and dd_url normalization, and operational defaults already owned by the
Go PAR config.

config.rs drops from ~1,090 lines to a parser plus validation. The org ID and
runner ID now have exactly one source of truth: Rust no longer re-derives them from
the URN.

Because par-control no longer reads datadog.yaml, it takes no --config, and the
Agent version comes from the bootstrap output rather than being injected at build
time, so version.bzl is gone. Dropping the loader also drops the direct
saluki-config, figment, and windows-registry dependencies — saluki-config
and figment remain in the lockfile transitively via datadog-agent-commons,
which #54591 needs for executor IPC mTLS.

The logger is initialized at Trace before bootstrap because its level filter is
immutable afterward; the configured level is applied with log::set_max_level once
bootstrap reports it.

The configuration payload carries the runner private key and may carry proxy
credentials, so it is suppressed from the forwarded bootstrap logs and never
included in an error — including the malformed-JSON case, where a serde error would
otherwise quote the input. Errors name the bootstrap executable only, never the
full argv.

Behavior changes

Using the canonical Go loader intentionally changes several previous Rust
behaviors: ENC[...] values are now resolved through the Agent secret backend;
environment aliases, precedence, proxy resolution and endpoint normalization match
the Go executor exactly; and executor-socket and IPC-certificate defaults match the
Agent's own path resolution. par-control still implements proxy transport through
reqwest, so exact transport-semantic equivalence with Go's httpproxy is not
implied.

Validation

dda env dev run -- bazel test //pkg/privateactionrunner/par-control:par-control_test
env -u PKG_CONFIG_LIBDIR RUSTFLAGS='--cfg tokio_unstable' cargo test --manifest-path pkg/privateactionrunner/par-control/Cargo.toml
env -u PKG_CONFIG_LIBDIR RUSTFLAGS='--cfg tokio_unstable' cargo clippy --manifest-path pkg/privateactionrunner/par-control/Cargo.toml --all-targets -- -D warnings
(cd rust && cargo deny --manifest-path ../Cargo.toml check licenses)

Stack 4 of 9; based on #54870 and followed by #55121.

dd-octo-sts · 2026-08-07T17:58:27Z

Go Package Import Differences

Baseline: 296059f
Comparison: 6d10cfa

binary	os	arch	change
agent	linux	amd64	+1, -0 +github.com/DataDog/datadog-agent/pkg/privateactionrunner/adapters/constants
agent	linux	arm64	+1, -0 +github.com/DataDog/datadog-agent/pkg/privateactionrunner/adapters/constants
agent	windows	amd64	+1, -0 +github.com/DataDog/datadog-agent/pkg/privateactionrunner/adapters/constants
agent	darwin	amd64	+1, -0 +github.com/DataDog/datadog-agent/pkg/privateactionrunner/adapters/constants
agent	darwin	arm64	+1, -0 +github.com/DataDog/datadog-agent/pkg/privateactionrunner/adapters/constants
agent	aix	ppc64	+1, -0 +github.com/DataDog/datadog-agent/pkg/privateactionrunner/adapters/constants
iot-agent	linux	amd64	+1, -0 +github.com/DataDog/datadog-agent/pkg/privateactionrunner/adapters/constants
iot-agent	linux	arm64	+1, -0 +github.com/DataDog/datadog-agent/pkg/privateactionrunner/adapters/constants
heroku-agent	linux	amd64	+1, -0 +github.com/DataDog/datadog-agent/pkg/privateactionrunner/adapters/constants
privateactionrunner	linux	amd64	+2, -0 +github.com/DataDog/datadog-agent/cmd/privateactionrunner/subcommands/bootstrapparcontrol +github.com/DataDog/datadog-agent/cmd/privateactionrunner/subcommands/identity
privateactionrunner	linux	arm64	+2, -0 +github.com/DataDog/datadog-agent/cmd/privateactionrunner/subcommands/bootstrapparcontrol +github.com/DataDog/datadog-agent/cmd/privateactionrunner/subcommands/identity
privateactionrunner	windows	amd64	+2, -0 +github.com/DataDog/datadog-agent/cmd/privateactionrunner/subcommands/bootstrapparcontrol +github.com/DataDog/datadog-agent/cmd/privateactionrunner/subcommands/identity
privateactionrunner	darwin	amd64	+2, -0 +github.com/DataDog/datadog-agent/cmd/privateactionrunner/subcommands/bootstrapparcontrol +github.com/DataDog/datadog-agent/cmd/privateactionrunner/subcommands/identity
privateactionrunner	darwin	arm64	+2, -0 +github.com/DataDog/datadog-agent/cmd/privateactionrunner/subcommands/bootstrapparcontrol +github.com/DataDog/datadog-agent/cmd/privateactionrunner/subcommands/identity

datadog-datadog-prod-us1 · 2026-08-07T18:08:22Z

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 52.61% (-0.02%)

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 6d10cfa | Docs | View more details | Give us feedback!}

dd-octo-sts · 2026-08-07T18:21:45Z

Files inventory check summary

File checks results against ancestor 296059ff:

Results for datadog-agent_7.84.0~devel.git.449.6d10cfa.pipeline.132944455-1_amd64.deb:

No change detected

Results for datadog-iot-agent_7.84.0~devel.git.449.6d10cfa.pipeline.132944455-1_amd64.deb:

No change detected

dd-octo-sts · 2026-08-07T18:34:28Z

Static quality checks

✅ Please find below the results from static quality gates
Comparison made with ancestor 296059f
📊 Static Quality Gates Dashboard
🔗 SQG Job

Successful checks

Info

	Quality gate	Change	Size (prev → curr → max)
✅	agent_deb_amd64	+24.16 KiB (0.00% increase, -0.69% of buffer)	761.181 → 761.204 → 764.600
✅	agent_msi	+21.5 KiB (0.00% increase, -0.16% of buffer)	647.835 → 647.856 → 661.050
✅	agent_rpm_amd64	+24.16 KiB (0.00% increase, -0.69% of buffer)	761.165 → 761.188 → 764.570
✅	agent_rpm_arm64	+20.16 KiB (0.00% increase, -76.93% of buffer)	737.104 → 737.124 → 737.130
✅	agent_suse_amd64	+24.16 KiB (0.00% increase, -0.69% of buffer)	761.165 → 761.188 → 764.570
✅	agent_suse_arm64	+20.16 KiB (0.00% increase, -76.93% of buffer)	737.104 → 737.124 → 737.130
✅	docker_agent_amd64	+24.16 KiB (0.00% increase, -6.22% of buffer)	819.760 → 819.784 → 820.140
✅	docker_agent_arm64	+20.16 KiB (0.00% increase, -11.06% of buffer)	820.712 → 820.732 → 820.890
✅	docker_agent_jmx_amd64	+24.16 KiB (0.00% increase, -9.75% of buffer)	1010.658 → 1010.682 → 1010.900
✅	docker_agent_jmx_arm64	+20.16 KiB (0.00% increase, -6.39% of buffer)	1000.262 → 1000.282 → 1000.570

23 successful checks with minimal change (< 2 KiB)

	Quality gate	Current Size
✅	agent_deb_amd64_fips	713.931 MiB
✅	agent_heroku_amd64	312.896 MiB
✅	agent_rpm_amd64_fips	713.915 MiB
✅	agent_rpm_arm64_fips	693.134 MiB
✅	agent_suse_amd64_fips	713.915 MiB
✅	agent_suse_arm64_fips	693.134 MiB
✅	docker_cluster_agent_amd64	211.423 MiB
✅	docker_cluster_agent_arm64	224.458 MiB
✅	docker_cws_instrumentation_amd64	7.443 MiB
✅	docker_cws_instrumentation_arm64	6.877 MiB
✅	docker_dogstatsd_amd64	39.522 MiB
✅	docker_dogstatsd_arm64	37.623 MiB
✅	docker_host_profiler_amd64	306.843 MiB
✅	docker_host_profiler_arm64	318.121 MiB
✅	dogstatsd_deb_amd64	30.267 MiB
✅	dogstatsd_deb_arm64	28.294 MiB
✅	dogstatsd_rpm_amd64	30.267 MiB
✅	dogstatsd_suse_amd64	30.267 MiB
✅	iot_agent_deb_amd64	46.553 MiB
✅	iot_agent_deb_arm64	43.206 MiB
✅	iot_agent_deb_armhf	44.000 MiB
✅	iot_agent_rpm_amd64	46.554 MiB
✅	iot_agent_suse_amd64	46.553 MiB

cit-pr-commenter-54b7da · 2026-08-07T19:32:02Z

Regression Detector

Regression Detector Results

Metrics dashboard
Target profiles
Job ID: 7d5857ac-da0f-4507-9894-3e25d9192cc6

Baseline: c45db9e
Comparison: 6d10cfa
Diff

Optimization Goals: ✅ No significant changes detected

Fine details of change detection per experiment

perf	experiment	goal	Δ mean %	Δ mean % CI	trials	links
➖	dsd_uds_10mb_3k_timestamped_contexts_memory	memory utilization	+0.42	[+0.20, +0.64]	1	Logs
➖	quality_gate_logs	% cpu utilization	+0.21	[-0.66, +1.09]	1	Logs bounds checks dashboard
➖	quality_gate_idle_all_features	memory utilization	+0.04	[+0.01, +0.08]	1	Logs bounds checks dashboard
➖	quality_gate_security_idle	memory utilization	-0.04	[-0.09, +0.01]	1	Logs bounds checks dashboard
➖	quality_gate_security_mean_fs_load	memory utilization	-0.04	[-0.08, -0.01]	1	Logs bounds checks dashboard
➖	quality_gate_idle	memory utilization	-0.11	[-0.15, -0.06]	1	Logs bounds checks dashboard
➖	quality_gate_security_no_fs_load	memory utilization	-0.16	[-0.24, -0.08]	1	Logs bounds checks dashboard
➖	quality_gate_metrics_logs	memory utilization	-0.29	[-0.51, -0.06]	1	Logs bounds checks dashboard
➖	quality_gate_private_action_runner	memory utilization	-0.29	[-0.41, -0.17]	1	Logs bounds checks dashboard
➖	dsd_uds_10mb_3k_timestamped_contexts_cpu	% cpu utilization	-1.19	[-1.48, -0.90]	1	Logs

Bounds Checks: ✅ Passed

perf	experiment	bounds_check_name	replicates_passed	observed_value	links
✅	quality_gate_idle	intake_connections	10/10	4 = 4	bounds checks dashboard
✅	quality_gate_idle	memory_usage	10/10	173.68MiB ≤ 178MiB	bounds checks dashboard
✅	quality_gate_idle	total_bytes_received	10/10	744.81KiB ≤ 819.20KiB	bounds checks dashboard
✅	quality_gate_idle_all_features	intake_connections	10/10	4 = 4	bounds checks dashboard
✅	quality_gate_idle_all_features	memory_usage	10/10	528.03MiB ≤ 538MiB	bounds checks dashboard
✅	quality_gate_idle_all_features	total_bytes_received	10/10	1.14MiB ≤ 1.25MiB	bounds checks dashboard
✅	quality_gate_logs	intake_connections	10/10	17 ≤ 40	bounds checks dashboard
✅	quality_gate_logs	memory_usage	10/10	210.01MiB ≤ 229MiB	bounds checks dashboard
✅	quality_gate_logs	missed_bytes	10/10	0B = 0B	bounds checks dashboard
✅	quality_gate_logs	total_bytes_received	10/10	263.50MiB ≤ 292MiB	bounds checks dashboard
✅	quality_gate_metrics_logs	cpu_usage	10/10	398.25 ≤ 2000	bounds checks dashboard
✅	quality_gate_metrics_logs	intake_connections	10/10	18 ≤ 40	bounds checks dashboard
✅	quality_gate_metrics_logs	memory_usage	10/10	408.92MiB ≤ 453MiB	bounds checks dashboard
✅	quality_gate_metrics_logs	missed_bytes	10/10	0B = 0B	bounds checks dashboard
✅	quality_gate_metrics_logs	total_bytes_received	10/10	0.94GiB ≤ 1.04GiB	bounds checks dashboard
✅	quality_gate_private_action_runner	memory_usage	10/10	72.08MiB ≤ 76MiB	bounds checks dashboard
✅	quality_gate_security_idle	cpu_usage	10/10	28.78 ≤ 100	bounds checks dashboard
✅	quality_gate_security_idle	memory_usage	10/10	325.24MiB ≤ 335MiB	bounds checks dashboard
✅	quality_gate_security_mean_fs_load	cpu_usage	10/10	76.59 ≤ 200	bounds checks dashboard
✅	quality_gate_security_mean_fs_load	memory_usage	10/10	301.71MiB ≤ 314MiB	bounds checks dashboard
✅	quality_gate_security_no_fs_load	cpu_usage	10/10	22.81 ≤ 100	bounds checks dashboard
✅	quality_gate_security_no_fs_load	memory_usage	10/10	307.99MiB ≤ 343MiB	bounds checks dashboard

Explanation

Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%

Performance changes are noted in the perf column of each table:

✅ = significantly better comparison variant performance
❌ = significantly worse comparison variant performance
➖ = no significant change in performance

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".

For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:

Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.
Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.
Its configuration does not mark it "erratic".

CI Pass/Fail Decision

✅ Passed. All Quality Gates passed.

quality_gate_metrics_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
quality_gate_metrics_logs, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
quality_gate_metrics_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
quality_gate_metrics_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_metrics_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
quality_gate_private_action_runner, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.
quality_gate_idle_all_features, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_security_no_fs_load, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_security_no_fs_load, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
quality_gate_security_mean_fs_load, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
quality_gate_security_mean_fs_load, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.
quality_gate_idle, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
quality_gate_security_idle, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
quality_gate_security_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
quality_gate_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 314690cdcd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

dd-gplassard · 2026-08-17T09:54:48Z

I think this should go under cmd/privateactionrunner-control ?

Is that something new? I don't see that.

I meant AFAIK all entrypoint are currently under cmd/ so I believe we might need to put ours there ?

ohh gotcha ok

dd-gplassard · 2026-08-17T09:59:51Z

this seems really tedious to maintain. It would be good if agent runtime could provide some support. Maybe we could generate from https://github.com/DataDog/datadog-agent/blob/011be837fa5b36920ef14e713dfe667c02111d5b/pkg/config/schema/yaml/private_action_runner.yaml ?

I reached out to @jose-manuel-almaza since he's working on the config layer as well. I would love to share some of that work.

dd-gplassard · 2026-08-17T10:06:01Z

+use anyhow::{Context, Result, bail};
+use std::path::Path;
+
+pub const DEFAULT_IDENTITY_FILE_NAME: &str = "privateactionrunner_private_identity.json";


AFAIK we want to start the executor on startup to ensure its working properly / do the enrollment if needed. I was thinking the executor could keep owning the full identity lifecycle and the control plane would not need to know how to retrieve it ?

A single "EnsureRunnerIdentity" method which returns the identity and handles all the cases

par-control needs the identity because it's used by the OPMS client to sign requests.

I think your question is more whether Rust should get identity from the executor instead. A new EnsureRunnerIdentity RPC in the executor would centralize enrollment in Go, but it would require returning the private key over RPC and keeping the executor alive at boot for a non-execution purpose. Which seems less secure and more complex.

Personally I prefer the ensure-enrollment command approach because it keeps actual enrollment in Go and lets us just read a file in Rust to get identity.

Discussed over slack, no strong opinion we can always revisit later

par-control now receives its configuration from `privateactionrunner bootstrap-par-control` instead of loading Agent configuration itself. It runs the command given by --bootstrap-command, reads the single PAR_CONTROL_CONFIG= prefixed JSON line, validates it at the trust boundary, and exits successfully when split mode is disabled. This deletes the Rust-owned configuration stack: local YAML loading, Fleet policy discovery and merging, environment decoding and aliases, precedence and deep merging, the Windows Fleet registry lookup, persisted identity discovery, inline versus persisted identity selection, the Agent IPC certificate path fallback, and site/dd_url normalization. Go already owns all of it, and the duplicate implementation is what let the two runners disagree. The org ID and runner ID now have one source of truth: Rust no longer re-derives them from the URN. Because par-control no longer reads datadog.yaml, it takes no --config, and the agent version comes from the bootstrap output rather than being injected at build time, so version.bzl is gone. Dropping the config loader also drops saluki-config, figment, windows-registry, and the Windows registry windows-sys features. The logger is initialized at Trace before bootstrap because its level filter is immutable afterward; the configured level is applied with set_max_level once bootstrap reports it. The configuration payload carries the runner private key and may carry proxy credentials, so it is suppressed from forwarded logs and never included in an error, including the malformed-JSON case where a serde error would otherwise quote it. Errors name the bootstrap executable only, never the full argv.

This was referenced Aug 7, 2026

[ACTP] add par-control process lifecycle #54589

Merged

[ACTP] add par-control executor channel #54591

Draft

[ACTP] flesh out par-control lifecycle code #54531

Closed

dd-octo-sts Bot added the internal Identify a non-fork PR label Aug 7, 2026

github-actions Bot added the long review PR is complex, plan time to review it label Aug 7, 2026

dd-octo-sts Bot added team/action-platform team/agent-build team/agent-devx team/fleet-automation labels Aug 7, 2026

embeaken force-pushed the ilya/par-control-lifecycle branch from 73f61a5 to 12769e4 Compare August 7, 2026 20:39

embeaken force-pushed the ilya/par-control-config branch 2 times, most recently from 1eb7a41 to 0291af5 Compare August 7, 2026 20:57

embeaken force-pushed the ilya/par-control-lifecycle branch from 12769e4 to 9121269 Compare August 7, 2026 20:57

embeaken force-pushed the ilya/par-control-config branch from 0291af5 to 86f3e34 Compare August 10, 2026 15:09

embeaken force-pushed the ilya/par-control-lifecycle branch from 9121269 to 0f54bd3 Compare August 10, 2026 15:09

embeaken force-pushed the ilya/par-control-config branch from 86f3e34 to e21877b Compare August 10, 2026 15:21

embeaken force-pushed the ilya/par-control-lifecycle branch from 6c69553 to 94b705e Compare August 10, 2026 18:42

embeaken force-pushed the ilya/par-control-config branch from 5bdf5d0 to 45ae99c Compare August 10, 2026 18:43

embeaken force-pushed the ilya/par-control-lifecycle branch from 94b705e to 2f5ff72 Compare August 10, 2026 18:58

embeaken force-pushed the ilya/par-control-config branch from 45ae99c to 17a1a1c Compare August 10, 2026 18:59

embeaken force-pushed the ilya/par-control-lifecycle branch from 2f5ff72 to bb6b622 Compare August 10, 2026 19:09

embeaken force-pushed the ilya/par-control-config branch 2 times, most recently from 89db57e to 9a22acb Compare August 10, 2026 19:35

embeaken force-pushed the ilya/par-control-lifecycle branch from bb6b622 to 2aaf840 Compare August 10, 2026 19:35

embeaken force-pushed the ilya/par-control-config branch from 9a22acb to d642df7 Compare August 10, 2026 20:07

embeaken mentioned this pull request Aug 13, 2026

[ACTP] orchestrate par-control tasks #54593

Draft

embeaken force-pushed the ilya/par-control-lifecycle branch from 85d1a07 to 6c22069 Compare August 13, 2026 22:31

embeaken force-pushed the ilya/par-control-config branch from 06d94dd to 73a64c3 Compare August 13, 2026 22:33

embeaken changed the base branch from ilya/par-control-lifecycle to ilya/par-ensure-enrollment August 13, 2026 22:41

embeaken mentioned this pull request Aug 13, 2026

[ACTP] add bootstrap-par-control command to PAR binary #54870

Draft

embeaken force-pushed the ilya/par-ensure-enrollment branch from 66e117b to e323571 Compare August 13, 2026 23:04

embeaken force-pushed the ilya/par-control-config branch from 73a64c3 to 7d7201c Compare August 13, 2026 23:04

embeaken force-pushed the ilya/par-ensure-enrollment branch from e323571 to 1a16146 Compare August 13, 2026 23:10

embeaken force-pushed the ilya/par-control-config branch 2 times, most recently from 3bf6f91 to f83ca17 Compare August 13, 2026 23:48

embeaken force-pushed the ilya/par-ensure-enrollment branch from 1a16146 to 6b010be Compare August 13, 2026 23:48

embeaken force-pushed the ilya/par-control-config branch from f83ca17 to 8800d1d Compare August 14, 2026 02:43

embeaken force-pushed the ilya/par-ensure-enrollment branch 2 times, most recently from 00a3402 to ea55c73 Compare August 14, 2026 13:18

embeaken force-pushed the ilya/par-control-config branch from 8800d1d to e5cbec0 Compare August 14, 2026 13:18

embeaken force-pushed the ilya/par-ensure-enrollment branch from ea55c73 to 690bb57 Compare August 14, 2026 14:19

embeaken force-pushed the ilya/par-control-config branch from e5cbec0 to c3e9fbb Compare August 14, 2026 14:21

embeaken force-pushed the ilya/par-ensure-enrollment branch from 690bb57 to c2aaa60 Compare August 14, 2026 16:40

embeaken force-pushed the ilya/par-control-config branch from c3e9fbb to 8e2bbae Compare August 14, 2026 16:43

embeaken force-pushed the ilya/par-ensure-enrollment branch from c2aaa60 to 7677da0 Compare August 14, 2026 16:48

embeaken force-pushed the ilya/par-control-config branch 2 times, most recently from c0227c4 to d9b966c Compare August 14, 2026 17:48

embeaken force-pushed the ilya/par-ensure-enrollment branch from 01b23ab to f821eba Compare August 14, 2026 17:53

embeaken force-pushed the ilya/par-control-config branch from d9b966c to 2ad5ede Compare August 14, 2026 17:53

chatgpt-codex-connector Bot reviewed Aug 14, 2026

View reviewed changes

Comment thread pkg/privateactionrunner/par-control/src/config.rs Outdated

Comment thread pkg/privateactionrunner/par-control/src/config.rs Outdated

dd-gplassard reviewed Aug 17, 2026

View reviewed changes

dd-gplassard approved these changes Aug 18, 2026

View reviewed changes

This was referenced Aug 19, 2026

[ACTP] serve PAR signing keys from the Core Agent #55121

Draft

[ACTP] package and activate par-control #54529

Draft

Uh oh!

Conversation

embeaken commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Behavior changes

Validation

Uh oh!

dd-octo-sts Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Go Package Import Differences

Uh oh!

datadog-datadog-prod-us1 Bot commented Aug 7, 2026 • edited by datadog-datadog-prod-us1-2 Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dd-octo-sts Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Files inventory check summary

Results for datadog-agent_7.84.0~devel.git.449.6d10cfa.pipeline.132944455-1_amd64.deb:

Results for datadog-iot-agent_7.84.0~devel.git.449.6d10cfa.pipeline.132944455-1_amd64.deb:

Uh oh!

dd-octo-sts Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Static quality checks

Info

Uh oh!

cit-pr-commenter-54b7da Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Regression Detector

Regression Detector Results

Optimization Goals: ✅ No significant changes detected

Fine details of change detection per experiment

Bounds Checks: ✅ Passed

Explanation

CI Pass/Fail Decision

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

embeaken commented Aug 7, 2026 •

edited

Loading

dd-octo-sts Bot commented Aug 7, 2026 •

edited

Loading

datadog-datadog-prod-us1 Bot commented Aug 7, 2026 •

edited by datadog-datadog-prod-us1-2 Bot

Loading

dd-octo-sts Bot commented Aug 7, 2026 •

edited

Loading

dd-octo-sts Bot commented Aug 7, 2026 •

edited

Loading

cit-pr-commenter-54b7da Bot commented Aug 7, 2026 •

edited

Loading