You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
test(appsec): split FastAPI ddtest jobs for safe parallelism - #19894
Split the ddtest FastAPI AppSec IAST coverage into separate snapshot-backed and non-snapshot suites so non-snapshot checks can use pytest xdist safely.
Changes
Keep threat/WAF coverage in appsec_threats_fastapi_iast with the testagent-backed snapshot configuration and serialized workers.
Add appsec_threats_fastapi_non_snapshot for endpoint and API-security metadata checks.
Move the non-snapshot collection surface into _test_fastapi_non_snapshot.py and run it with -n auto.
Keep ddtest_nodes: 2 for both suites, so each venv is split across independent CI jobs.
Preserve the original FastAPI class for legacy Riot suites; the ddtest snapshot selector excludes the checks now owned by the non-snapshot suite.
The leading underscore on the new file keeps it out of legacy directory-based Riot test discovery; the new suite invokes it explicitly.
Testing
Generated the GitLab configuration successfully and verified both suite matrices.
Passed formatting/style checks, Riot checks, suitespec validation, and the targeted generator tests (11 passed).
Risks
This is a follow-up to #19870 and is intentionally based on the gnufede/ddtest-dogfooding branch. The main validation is CI: confirm that the non-snapshot suite is safe with xdist and that the snapshot suite remains isolated from testagent cross-contamination.
Resolved from the full PR diff against gnufede/ddtest-dogfooding using the target branch CODEOWNERS file.
CODEOWNERS team requests not listed below are not required by the current file set.
Found 0 performance improvements and 6 performance regressions! Performance is the same for 577 metrics, 10 unstable metrics, 18 flaky benchmarks without significant changes.
Explanation
This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:
🟩 = significantly better candidate vs. baseline
🟥 = significantly worse candidate vs. baseline
We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.
If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.
Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.
More details about the CI and significant changes
You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.
CIs of the difference of means are often centered around 0%, because often changes are not that big:
---------------------------------(------|---^--------)-------------------------------->
-0.6% 0% 0.3% +1.2%
| | |
lower bound of the CI --' | |
sample mean (center of the CI) -------------' |
upper bound of the CI ----------------------'
As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).
For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:
----------------------------------------|---------|---(---------^---------)---------->
0% 1% 1.3% 2.2% 3.1%
| | | |
significant impact threshold --------------' | | |
lower bound of CI --------------' | |
sample mean (center of the CI) --------------------------' |
upper bound of CI ----------------------------------'
Follow-up note: this PR intentionally scopes the snapshot/non-snapshot split to FastAPI as a pilot. The shared Contrib_TestClass_For_Threats architecture is used by Django, Flask, FastAPI, and Tornado, so a complete rollout should extract/reuse the split across all framework threat suites and add the corresponding Riot/suitespec jobs rather than treating FastAPI as a one-off.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Split the ddtest FastAPI AppSec IAST coverage into separate snapshot-backed and non-snapshot suites so non-snapshot checks can use pytest xdist safely.
Changes
appsec_threats_fastapi_iastwith the testagent-backed snapshot configuration and serialized workers.appsec_threats_fastapi_non_snapshotfor endpoint and API-security metadata checks._test_fastapi_non_snapshot.pyand run it with-n auto.ddtest_nodes: 2for both suites, so each venv is split across independent CI jobs.The leading underscore on the new file keeps it out of legacy directory-based Riot test discovery; the new suite invokes it explicitly.
Testing
11 passed).Risks
This is a follow-up to #19870 and is intentionally based on the
gnufede/ddtest-dogfoodingbranch. The main validation is CI: confirm that the non-snapshot suite is safe with xdist and that the snapshot suite remains isolated from testagent cross-contamination.