From 92a65a5e3c7f47f411da7985c761a8af1a98cb54 Mon Sep 17 00:00:00 2001
From: Jules Macret <jules.macret@datadoghq.com>
Date: Fri, 2 Oct 2026 13:53:52 +0200
Subject: [PATCH] Add DD_PRIVATE_ACTION_RUNNER_SPLIT_ENABLED env var

Allow initial installations to explicitly configure PAR split mode while preserving the Agent default when the option is unset.

Co-authored-by: Gabriel Plassard <gabriel.plassard@datadoghq.com>
---
 install_script.sh.template        | 12 +++++++++++-
 unit_tests/test_install_script.sh | 25 +++++++++++++++++++++++++
 2 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/install_script.sh.template b/install_script.sh.template
index 7b3a9b26..0bdfde40 100644
--- a/install_script.sh.template
+++ b/install_script.sh.template
@@ -1027,6 +1027,11 @@ if [ -n "$DD_PRIVATE_ACTION_RUNNER_API_KEY_ONLY_ENROLLMENT" ]; then
   par_api_key_only_enrollment=$DD_PRIVATE_ACTION_RUNNER_API_KEY_ONLY_ENROLLMENT
 fi
 
+par_split_enabled=
+if [ -n "$DD_PRIVATE_ACTION_RUNNER_SPLIT_ENABLED" ]; then
+  par_split_enabled=$DD_PRIVATE_ACTION_RUNNER_SPLIT_ENABLED
+fi
+
 ##
 # INSTALL SCRIPT CONFIGURATION OPTIONS
 # Technical options to test with non-production values for signature keys, packages or reporting telemetry.
@@ -2260,6 +2265,7 @@ function update_par(){
   local par_enabled="$3"
   local par_actions_allowlist="$4"
   local par_api_key_only_enrollment="$5"
+  local par_split_enabled="$6"
 
   if [ "$par_enabled" != "true" ]; then
     return
@@ -2294,6 +2300,10 @@ function update_par(){
     par_config="${par_config}
   api_key_only_enrollment: ${par_api_key_only_enrollment}"
   fi
+  if [ -n "$par_split_enabled" ]; then
+    par_config="${par_config}
+  split_enabled: ${par_split_enabled}"
+  fi
   $sudo_cmd sh -c "cat >> '$config_file'" <<EOF
 
 ${par_config}
@@ -2401,7 +2411,7 @@ elif [ ! "$no_agent" ]; then
       update_logs_config_process_collect_all "$sudo_cmd" "$config_file"
     fi
     update_remote_updates "$sudo_cmd" "$remote_updates" "$config_file"
-    update_par "$sudo_cmd" "$config_file" "$par_enabled" "$par_actions_allowlist" "$par_api_key_only_enrollment"
+    update_par "$sudo_cmd" "$config_file" "$par_enabled" "$par_actions_allowlist" "$par_api_key_only_enrollment" "$par_split_enabled"
   fi
 
   # DD_LOGS_CONFIG_PROCESS_COLLECT_ALL needs discovery to be enabled
diff --git a/unit_tests/test_install_script.sh b/unit_tests/test_install_script.sh
index e861f643..10a24414 100755
--- a/unit_tests/test_install_script.sh
+++ b/unit_tests/test_install_script.sh
@@ -417,6 +417,31 @@ testParEnabledWithoutApiKeyOnlyEnrollment() {
   # Should not add api_key_only_enrollment when not provided
   assertEquals "$(sudo yq eval '.private_action_runner.api_key_only_enrollment' $config_file)" "null"
 }
+testParEnabledWithSplitMode() {
+  sudo rm $config_file 2> /dev/null
+  ensure_config_file_exists "sudo" $config_file "dd-agent"
+  update_par "sudo" $config_file "true" "" "" "true"
+  yamllint -c "$yaml_config" --no-warnings $config_file
+  assertEquals 0 $?
+  assertEquals "$(sudo yq eval '.private_action_runner.enabled' $config_file)" "true"
+  assertEquals "$(sudo yq eval '.private_action_runner.split_enabled' $config_file)" "true"
+}
+testParEnabledWithoutSplitMode() {
+  sudo rm $config_file 2> /dev/null
+  ensure_config_file_exists "sudo" $config_file "dd-agent"
+  update_par "sudo" $config_file "true" "" "" "false"
+  yamllint -c "$yaml_config" --no-warnings $config_file
+  assertEquals 0 $?
+  assertEquals "$(sudo yq eval '.private_action_runner.enabled' $config_file)" "true"
+  assertEquals "$(sudo yq eval '.private_action_runner.split_enabled' $config_file)" "false"
+}
+testParEnabledWithDefaultSplitMode() {
+  sudo rm $config_file 2> /dev/null
+  ensure_config_file_exists "sudo" $config_file "dd-agent"
+  update_par "sudo" $config_file "true" ""
+  # Should not add split_enabled when not provided, preserving the Agent's platform default
+  assertEquals "$(sudo yq eval '.private_action_runner.split_enabled' $config_file)" "null"
+}
 
 ### get_redhat_release_version
 setUpReleaseFiles() {