Repository navigation
ci: Introduce ast-grep, rule skill guidance, extern c panic rule - #2595
Open
colin-higgins wants to merge 5 commits into
Open
colin-higgins wants to merge 5 commits into
colin-higgins wants to merge 5 commits into
Conversation
colin-higgins
changed the title
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9a03908415
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
|
✅ All CI checks and tests passed. 🎉 All green!🧪 All tests passed 🎯 Code Coverage (details) 🔗 Commit SHA: 3f70e94 | Docs | View more details | Give us feedback! |
Contributor
Artifact Size Benchmark Reportaarch64-alpine-linux-musl
aarch64-unknown-linux-gnu
libdatadog-x64-windows
libdatadog-x86-windows
x86_64-alpine-linux-musl
x86_64-unknown-linux-gnu
|
BenchmarksComparisonBenchmark execution time: 2026-10-14 03:02:25 Comparing candidate commit 3f70e94 in PR branch Found 28 performance improvements and 40 performance regressions! Performance is the same for 109 metrics, 0 unstable metrics.
|
ast-grep cannot expand macros, so a new c_setters! path produced an uncontained export with no matching function_item. Also propagate filtered scan failures and diff github.event.before on push so origin/main being HEAD does not empty the range. Co-authored-by: Cursor <cursoragent@cursor.com>
Comment on lines
+142
to
+144
| If a correct rule would fail on a large, intentional legacy set, do | ||
| **not** rewrite the repo and do **not** fall back to regex. Copy the | ||
| FFI panic rule: |
Collaborator
There was a problem hiding this comment.
I disagree with this. If we decide a pattern is harmful and lint against it, we should lint the whole codebase.
It is fine to have escape hatches in the codebase, adding local lint skips in comments but we should not have code that causes lint violations go unnoticed until someone decides to touch it for whatever reason.
I think the pattern for adding lints should probably be stacked PR:
- One adding skips for parts of the code that would fails
- A stacked PR on top of this adding the lint in the CI
This ways it's easy to know what code is non compliant, and if the lint actually makes sense to apply to the whole codebase
Comment on lines
+204
to
+216
| # Format / Clippy (touched crate) | ||
| cargo +nightly-2026-07-26 fmt --all -- --check | ||
| cargo +stable clippy -p <crate> --all-targets -- -D warnings | ||
|
|
||
| # Workspace dependency declarations | ||
| (cd .github/actions && cargo run -p workspace-deps-lint) | ||
|
|
||
| # Deps / licenses | ||
| cargo deny check | ||
| cargo machete --with-metadata --skip-target-dir | ||
|
|
||
| # Crypto graph | ||
| ./scripts/check_crypto_providers.sh |
Collaborator
There was a problem hiding this comment.
these should already be in AGENTS.md so prefer referring to it in the skill. This way we have only one place to maintain
Comment on lines
+220
to
+226
| alt = "|".join(re.escape(name) for name in sorted(macro_names)) | ||
| rule = f""" | ||
| id: ffi-macro-invocation-emits-extern-c | ||
| language: rust | ||
| rule: | ||
| kind: macro_invocation | ||
| regex: "(^|::)({alt})!" |
Collaborator
There was a problem hiding this comment.
A bash script that contains inline python that contains inline ast-grep rules?? Seems a bit too.. sloppy honestly
Leiyks
reviewed
Oct 5, 2026
Comment on lines
+21
to
+24
| ignores: | ||
| - "**/tests/**" | ||
| - "**/examples/**" | ||
| - "symbolizer-ffi/**" |
Contributor
There was a problem hiding this comment.
Could we add datadog-sidecar-ffi/** to ignores? AGENTS.md rules out catch_unwind there, so otherwise it'd need ~140 allow comments.
yannham
approved these changes
Oct 14, 2026
| rule: | ||
| all: | ||
| - kind: function_item | ||
| # `pub(crate)` is not an export. `#[no_mangle]` / `#[export_name]` are, |
Contributor
There was a problem hiding this comment.
We've updated to edition 2024 which turned many #[no_mangle] to #[unsafe(no_mangle)]. Does this need to be updated?
| @@ -0,0 +1,88 @@ | |||
| #!/usr/bin/env python3 | |||
Contributor
There was a problem hiding this comment.
What is the intended use of this script? I feel like if we have to add many allow by hand in bulk, something is wrong. Either:
- we should filter out the file in the job
- the lint is questionable, because they are many offenders
Ideally exceptions would be rare and should be added manually so that it's conscious.
Member
Author
There was a problem hiding this comment.
A few ways to tackle this, if we decide a rule is worthwhile and want to start enforcing it:
- Start with warnings and tackle them bit by bit
- Fix all of them in the PR which introduces the rule
- Add exceptions, and use that as the TODO list
I'm okay with any of them, but I think picking one as a policy is important.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Adds a whole-repository ast-grep scan that reports exported FFI entry points whose bodies do not acknowledge panic containment. Matching is on the Rust AST. Both rules are
severity: warning, so the existing hits are reported and do not fail the Lint job.ffi-extern-c-panic-containmentmatches exported functions:pub,#[no_mangle], or#[export_name], with ABIextern "C", bareextern(C by default), orextern "system". Accepted containment isstd::panic::catch_unwind,wrap_with_ffi_result!,wrap_with_void_ffi_result!, the*_no_catch!variants, andcatch_panic!.// allow(ffi-panic-boundary): <justification>on a line directly above the function is accepted. An empty justification, or the same words only in a comment or string, is not.ffi-macro-emits-extern-cmatches amacro_rulestemplate that emits those functions. ast-grep does not expand macros, so containment has to be in the template or in an allow comment above it../scripts/run-ast-grep.shis the local and CI command: rule tests, then a whole-repo scan. The Lint job and pre-commit use that script. The first run downloads a pinned ast-grep binary into~/.cache.AGENTS.mdandCONTRIBUTING.md, and adds anadd-lint-ruleskill that prefers ast-grep for new syntactic checks.Motivation
A panic that crosses an
extern "C"orextern "system"boundary aborts the host process. Clippy's panic and unwrap lints only see explicit panic constructs, not panics from callees, so reviews kept flagging new uncontained FFI entry points. There are too many existing sites to fix or allow-comment in this change, so the rules warn on the whole tree instead of failing the job or checking only the diff.Additional Notes
No existing FFI function or runtime behavior changes.
datadog-sidecar-ffistill usespanic=abort; do not addcatch_unwindthere. Privateexterncallbacks withoutpub,#[no_mangle], or#[export_name]are not entry points.extern "C-unwind"is not matched.scripts/_add_ffi_panic_allows.pyis a local one-shot for inserting allow comments later. CI does not run it.How to test the change?