debugger: scrub API Security schema tags from exception replay span approvals - #7543
Merged
Merged
Conversation
…pprovals API Security samples schemas per (route, method, status) within a time window (30s by default), the same order as the test's own retry interval, so whether a given request carries `_dd.appsec.s.*` is not deterministic. Remove those keys like the `_dd.appsec.fp.*` fingerprints already are.
Contributor
|
|
![datadog-datadog-prod-us1-2[bot]](https://avatars.githubusercontent.com/u/365230?s=60&v=4){kind=small}
There was a problem hiding this comment.
More details
The prefix filter removes nondeterministic API Security schema tags from both supported span formats before approval comparison, while it keeps unrelated validation unchanged.
🤖 Datadog Autotest · Commit a605ce2 · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest
dromanol
enabled auto-merge (squash)
August 20, 2026 09:05
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Test_Debugger_Exception_Replay::test_exception_replay_rockpaperscissorscompares theaspnet_core.requestspans against a stored approval, and the .NET tracer is about to start emitting API Security schemas (_dd.appsec.s.*) on error responses (dd-trace-dotnet#9082 makes the response phase reach the WAF for server-generated 500s).Those tags cannot be pinned in an approval: API Security samples schemas once per (route, method, status) per
DD_API_SECURITY_SAMPLE_DELAY(30s by default), which is the same order of magnitude as this test's own retry interval (_timeout_next = 30). Which of the three rock/paper/scissors requests carries the schemas is therefore a race — in the failing run it was therockspan, and it could just as easily be another one or none.Changes
Drop every
_dd.appsec.s.*key in_validate_spans, the same treatment the_dd.appsec.fp.*fingerprints already get. No approval file currently contains those keys, so no expected data changes.Workflow
🚀 Once your PR is reviewed and the CI green, you can merge it!
🛟 #apm-shared-testing 🛟
Reviewer checklist
tests/ormanifests/is modified ? I have the approval from R&P teambuild-XXX-imagelabel is present