[GOLANG] Enable IAST features in `net-http-orchestrion` variant by RomainMuller · Pull Request #7342 · DataDog/system-tests

RomainMuller · 2026-07-20T09:24:53Z

Changes

Adds dd-iast-go to the net-http-orchestrion compile-time integrations set, and enable select IAST tests that are supposed to be passing now.

Workflow

⚠️ Create your PR as draft ⚠️
Work on you PR until the CI passes
Mark it as ready for review
- Test logic is modified? -> Get a review from RFC owner.
- Framework is modified, or non obvious usage of it -> get a review from R&P team

🚀 Once your PR is reviewed and the CI green, you can merge it!

🛟 #apm-shared-testing 🛟

Reviewer checklist

Anything but tests/ or manifests/ is modified ? I have the approval from R&P team
A docker base image is modified?
- the relevant build-XXX-image label is present
A scenario is added, removed or renamed?
- Get a review from R&P team

JJ-Change-Id: nlvymv

Add the documented insecure hashing routes to the `net-http-orchestrion` weblog so the IAST proof of concept can exercise MD5, SHA-1, and SHA-256 operations. Enable only the functional weak-hash checks supported by the proof of concept for that weblog variant. Keep deduplication, telemetry, extended location, and stack trace coverage disabled. JJ-Change-Id: kvkmov

Enable weak-hash coverage for the orchestrion-instrumented Go weblog with the tracer development version. Align evidence and location expectations with the Go tracer output, and update the weblog image to Go 1.26. JJ-Change-Id: npnyrt

Exercise RC4 and AES from the `net-http-orchestrion` weblog so the Go IAST integration can distinguish weak and secure cipher usage. Enable the weak-cipher, stack-trace, and extended-location tests for Go 2.11 and document the endpoint contract. JJ-Change-Id: txwxmx

Keep `TestWeakCipher_StackTrace` marked as `missing_feature` for all Go weblog variants while retaining the core and extended-location test activation for `net-http-orchestrion`. JJ-Change-Id: rvxlpn

JJ-Change-Id: txlxtp

github-actions · 2026-07-20T09:25:22Z

CODEOWNERS have been resolved as:

.github/workflows/system-tests.yml                                      @DataDog/system-tests-core
docs/understand/weblogs/end-to-end_weblog.md                            @DataDog/system-tests-core
manifests/golang.yml                                                    @DataDog/dd-trace-go-guild
tests/appsec/iast/sink/test_weak_hash.py                                @DataDog/asm-libraries @DataDog/system-tests-core
tests/appsec/iast/utils.py                                              @DataDog/asm-libraries @DataDog/system-tests-core
utils/build/docker/golang/app/net-http-orchestrion/go.mod               @DataDog/dd-trace-go-guild @DataDog/system-tests-core
utils/build/docker/golang/app/net-http-orchestrion/go.sum               @DataDog/dd-trace-go-guild @DataDog/system-tests-core
utils/build/docker/golang/app/net-http-orchestrion/main.go              @DataDog/dd-trace-go-guild @DataDog/system-tests-core
utils/build/docker/golang/app/net-http-orchestrion/orchestrion.tool.go  @DataDog/dd-trace-go-guild @DataDog/system-tests-core
utils/build/docker/golang/go.work.sum                                   @DataDog/dd-trace-go-guild @DataDog/system-tests-core
utils/build/docker/golang/install_orchestrion.sh                        @DataDog/dd-trace-go-guild @DataDog/system-tests-core
utils/build/docker/golang/net-http-orchestrion.Dockerfile               @DataDog/dd-trace-go-guild @DataDog/system-tests-core

datadog-datadog-prod-us1-2 · 2026-07-20T09:27:06Z

✨ Unblock PR with BitsAI

⚠️ Warnings

🚦 19 Pipeline jobs failed

Testing the test | System Tests (php, dev) / End-to-end #2 / apache-mod-7.0 2

🧪 1 Test failed

tests.test_telemetry.Test_Telemetry.test_app_heartbeats_delays[apache-mod-7.0] from system_tests_suite

AssertionError: Heartbeat sent too fast: 1.474464s. It should be sent every 2s
assert 1.474464 &gt; 1.5

self = &lt;tests.test_telemetry.Test_Telemetry object at 0x7f99513b0080&gt;

    @features.telemetry_heart_beat_collected
    def test_app_heartbeats_delays(self):
        &#34;&#34;&#34;Check for telemetry heartbeat are not sent too fast/slow, regarding DD_TELEMETRY_HEARTBEAT_INTERVAL
        There are a lot of reason for individual heartbeats to be sent too slow/fast, and the subsequent ones
        to be sent too fast/slow so the RFC says that it must not drift. So we will check the average delay
...

Testing the test | System Tests (php, dev) / End-to-end #2 / apache-mod-7.0-zts 2

🧪 1 Test failed

tests.test_telemetry.Test_Telemetry.test_app_heartbeats_delays[apache-mod-7.0-zts] from system_tests_suite

AssertionError: Heartbeat sent too fast: 1.4746086315789473s. It should be sent every 2s
assert 1.4746086315789473 &gt; 1.5

self = &lt;tests.test_telemetry.Test_Telemetry object at 0x7f66dca93c20&gt;

    @features.telemetry_heart_beat_collected
    def test_app_heartbeats_delays(self):
        &#34;&#34;&#34;Check for telemetry heartbeat are not sent too fast/slow, regarding DD_TELEMETRY_HEARTBEAT_INTERVAL
        There are a lot of reason for individual heartbeats to be sent too slow/fast, and the subsequent ones
        to be sent too fast/slow so the RFC says that it must not drift. So we will check the average delay
...

Testing the test | System Tests (php, dev) / End-to-end #2 / apache-mod-7.1 2

🧪 1 Test failed

tests.test_telemetry.Test_Telemetry.test_app_heartbeats_delays[apache-mod-7.1] from system_tests_suite

AssertionError: Heartbeat sent too fast: 1.4452019444444444s. It should be sent every 2s
assert 1.4452019444444444 &gt; 1.5

self = &lt;tests.test_telemetry.Test_Telemetry object at 0x7fb131fb19a0&gt;

    @features.telemetry_heart_beat_collected
    def test_app_heartbeats_delays(self):
        &#34;&#34;&#34;Check for telemetry heartbeat are not sent too fast/slow, regarding DD_TELEMETRY_HEARTBEAT_INTERVAL
        There are a lot of reason for individual heartbeats to be sent too slow/fast, and the subsequent ones
        to be sent too fast/slow so the RFC says that it must not drift. So we will check the average delay
...

View all 19 failed jobs.

🧪 1 Test failed in 1 job

Testing the test | main

tests.test_telemetry.Test_Telemetry.test_app_heartbeats_delays[apache-mod-7.4-zts] from system_tests_suite

AssertionError: Heartbeat sent too fast: 1.474410052631579s. It should be sent every 2s
assert 1.474410052631579 &gt; 1.5

self = &lt;tests.test_telemetry.Test_Telemetry object at 0x7f6ae069ad80&gt;

    @features.telemetry_heart_beat_collected
    def test_app_heartbeats_delays(self):
        &#34;&#34;&#34;Check for telemetry heartbeat are not sent too fast/slow, regarding DD_TELEMETRY_HEARTBEAT_INTERVAL
        There are a lot of reason for individual heartbeats to be sent too slow/fast, and the subsequent ones
        to be sent too fast/slow so the RFC says that it must not drift. So we will check the average delay
...

ℹ️ Info

No other issues found (see more)

❄️ No new flaky tests detected

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 0d3318a | Docs | Datadog PR Page | Give us feedback!}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 68bfcbeb49

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

JJ-Change-Id: nnknpn

JJ-Change-Id: mnsymx

JJ-Change-Id: pruzmq

Consume the existing optional `github_token` BuildKit secret when building the Orchestrion weblog. Configure Git only in the build process environment so the initial module download can access private DataDog repositories without persisting or logging the credential. JJ-Change-Id: tlokyq

Exchange the PR workflow OIDC identity for a read-only token scoped to the internal `dd-iast-go` repository. Limit the exchange to the Go Orchestrion build in PR 7342 while the repository awaits open-sourcing. Create the BuildKit token file with restrictive permissions immediately before the build and remove it through shell exit traps. JJ-Change-Id: kxwrvp

JJ-Change-Id: tookvu

RomainMuller added 6 commits July 20, 2026 11:22

wip: register dd-iast-go instrumentation in orchestrion varant

2ab127e

JJ-Change-Id: nlvymv

feat(iast): enable weak hash tests for Go

3262936

Enable weak-hash coverage for the orchestrion-instrumented Go weblog with the tracer development version. Align evidence and location expectations with the Go tracer output, and update the weblog image to Go 1.26. JJ-Change-Id: npnyrt

fix(golang): disable weak cipher stack traces

1a7a132

Keep `TestWeakCipher_StackTrace` marked as `missing_feature` for all Go weblog variants while retaining the core and extended-location test activation for `net-http-orchestrion`. JJ-Change-Id: rvxlpn

chore: dependency upgrades

68bfcbe

JJ-Change-Id: txlxtp

RomainMuller requested review from a team as code owners July 20, 2026 09:24

RomainMuller marked this pull request as draft July 20, 2026 09:25

chatgpt-codex-connector Bot reviewed Jul 20, 2026

View reviewed changes

Comment thread utils/build/docker/golang/app/net-http-orchestrion/go.mod Outdated

RomainMuller added 6 commits July 20, 2026 11:45

chore: linter fixes

63539c9

JJ-Change-Id: nnknpn

chore: use go1.25 compatible commit

2c41c1d

JJ-Change-Id: mnsymx

chore: also use 1.25 image

f098294

JJ-Change-Id: pruzmq

chore: improve build setup logic

0d3318a

JJ-Change-Id: tookvu

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[GOLANG] Enable IAST features in `net-http-orchestrion` variant - #7342

[GOLANG] Enable IAST features in `net-http-orchestrion` variant#7342
RomainMuller wants to merge 12 commits into
mainfrom
romain.marcadier/dd-iast-go

RomainMuller commented Jul 20, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 20, 2026 •

edited

Loading

Uh oh!

datadog-datadog-prod-us1-2 Bot commented Jul 20, 2026 •

edited by datadog-prod-us1-4 Bot

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

RomainMuller commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Workflow

Reviewer checklist

Uh oh!

github-actions Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

datadog-datadog-prod-us1-2 Bot commented Jul 20, 2026 • edited by datadog-prod-us1-4 Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Warnings

ℹ️ Info

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

RomainMuller commented Jul 20, 2026 •

edited

Loading

github-actions Bot commented Jul 20, 2026 •

edited

Loading

datadog-datadog-prod-us1-2 Bot commented Jul 20, 2026 •

edited by datadog-prod-us1-4 Bot

Loading