Submit Gradle Dependencies #8351
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Hi! 👋 Thanks for your pull request! 🎉 To help us review it, please make sure to:
If you need help, please check our contributing guidelines. |
harmonherring-pro
changed the title
harmonherring-pro
added
type: enhancement
type: documentation
comp: tooling
BenchmarksStartupParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 58 metrics, 5 unstable metrics. Startup time reports for insecure-bankgantt
title insecure-bank - global startup overhead: candidate=1.47.0-SNAPSHOT~8a74e85918, baseline=1.47.0-SNAPSHOT~8a74e85918
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.042 s) : 0, 1042431
Total [baseline] (8.658 s) : 0, 8658439
Agent [candidate] (1.043 s) : 0, 1042912
Total [candidate] (8.638 s) : 0, 8638259
section iast
Agent [baseline] (1.173 s) : 0, 1172517
Total [baseline] (9.221 s) : 0, 9220957
Agent [candidate] (1.174 s) : 0, 1173746
Total [candidate] (9.242 s) : 0, 9241502
section iast_HARDCODED_SECRET_DISABLED
Agent [baseline] (1.173 s) : 0, 1172919
Total [baseline] (9.264 s) : 0, 9264169
Agent [candidate] (1.172 s) : 0, 1172243
Total [candidate] (9.242 s) : 0, 9241600
section iast_TELEMETRY_OFF
Agent [baseline] (1.17 s) : 0, 1169972
Total [baseline] (9.223 s) : 0, 9223499
Agent [candidate] (1.176 s) : 0, 1175988
Total [candidate] (9.269 s) : 0, 9269170
gantt
title insecure-bank - break down per module: candidate=1.47.0-SNAPSHOT~8a74e85918, baseline=1.47.0-SNAPSHOT~8a74e85918
dateFormat X
axisFormat %s
section tracing
BytebuddyAgent [baseline] (717.9 ms) : 0, 717900
BytebuddyAgent [candidate] (715.9 ms) : 0, 715900
GlobalTracer [baseline] (243.038 ms) : 0, 243038
GlobalTracer [candidate] (243.258 ms) : 0, 243258
AppSec [baseline] (54.922 ms) : 0, 54922
AppSec [candidate] (55.087 ms) : 0, 55087
Remote Config [baseline] (711.727 µs) : 0, 712
Remote Config [candidate] (714.665 µs) : 0, 715
Telemetry [baseline] (10.716 ms) : 0, 10716
Telemetry [candidate] (12.825 ms) : 0, 12825
section iast
BytebuddyAgent [baseline] (835.268 ms) : 0, 835268
BytebuddyAgent [candidate] (835.862 ms) : 0, 835862
GlobalTracer [baseline] (233.105 ms) : 0, 233105
GlobalTracer [candidate] (233.284 ms) : 0, 233284
AppSec [baseline] (56.871 ms) : 0, 56871
AppSec [candidate] (57.203 ms) : 0, 57203
Remote Config [baseline] (615.699 µs) : 0, 616
Remote Config [candidate] (625.771 µs) : 0, 626
Telemetry [baseline] (8.69 ms) : 0, 8690
Telemetry [candidate] (8.728 ms) : 0, 8728
IAST [baseline] (22.686 ms) : 0, 22686
IAST [candidate] (22.809 ms) : 0, 22809
section iast_HARDCODED_SECRET_DISABLED
BytebuddyAgent [baseline] (834.662 ms) : 0, 834662
BytebuddyAgent [candidate] (833.966 ms) : 0, 833966
GlobalTracer [baseline] (233.694 ms) : 0, 233694
GlobalTracer [candidate] (233.617 ms) : 0, 233617
AppSec [baseline] (57.157 ms) : 0, 57157
AppSec [candidate] (56.968 ms) : 0, 56968
Remote Config [baseline] (623.415 µs) : 0, 623
Remote Config [candidate] (618.409 µs) : 0, 618
Telemetry [baseline] (8.733 ms) : 0, 8733
Telemetry [candidate] (8.715 ms) : 0, 8715
IAST [baseline] (22.831 ms) : 0, 22831
IAST [candidate] (23.106 ms) : 0, 23106
section iast_TELEMETRY_OFF
BytebuddyAgent [baseline] (831.812 ms) : 0, 831812
BytebuddyAgent [candidate] (834.585 ms) : 0, 834585
GlobalTracer [baseline] (233.305 ms) : 0, 233305
GlobalTracer [candidate] (235.984 ms) : 0, 235984
AppSec [baseline] (56.242 ms) : 0, 56242
AppSec [candidate] (54.677 ms) : 0, 54677
Remote Config [baseline] (630.324 µs) : 0, 630
Remote Config [candidate] (641.572 µs) : 0, 642
Telemetry [baseline] (8.763 ms) : 0, 8763
Telemetry [candidate] (8.938 ms) : 0, 8938
IAST [baseline] (24.02 ms) : 0, 24020
IAST [candidate] (25.903 ms) : 0, 25903
Startup time reports for petclinicgantt
title petclinic - global startup overhead: candidate=1.47.0-SNAPSHOT~8a74e85918, baseline=1.47.0-SNAPSHOT~8a74e85918
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.048 s) : 0, 1047872
Total [baseline] (10.547 s) : 0, 10546753
Agent [candidate] (1.051 s) : 0, 1051143
Total [candidate] (10.593 s) : 0, 10593314
section appsec
Agent [baseline] (1.187 s) : 0, 1187248
Total [baseline] (10.81 s) : 0, 10810063
Agent [candidate] (1.185 s) : 0, 1185316
Total [candidate] (10.724 s) : 0, 10724375
section iast
Agent [baseline] (1.176 s) : 0, 1176228
Total [baseline] (10.963 s) : 0, 10962720
Agent [candidate] (1.173 s) : 0, 1173278
Total [candidate] (11.034 s) : 0, 11033779
section profiling
Agent [baseline] (1.269 s) : 0, 1269062
Total [baseline] (10.863 s) : 0, 10862828
Agent [candidate] (1.278 s) : 0, 1277561
Total [candidate] (10.949 s) : 0, 10948816
gantt
title petclinic - break down per module: candidate=1.47.0-SNAPSHOT~8a74e85918, baseline=1.47.0-SNAPSHOT~8a74e85918
dateFormat X
axisFormat %s
section tracing
BytebuddyAgent [baseline] (718.347 ms) : 0, 718347
BytebuddyAgent [candidate] (722.873 ms) : 0, 722873
GlobalTracer [baseline] (243.634 ms) : 0, 243634
GlobalTracer [candidate] (245.248 ms) : 0, 245248
AppSec [baseline] (55.231 ms) : 0, 55231
AppSec [candidate] (55.463 ms) : 0, 55463
Remote Config [baseline] (721.65 µs) : 0, 722
Remote Config [candidate] (715.684 µs) : 0, 716
Telemetry [baseline] (14.644 ms) : 0, 14644
Telemetry [candidate] (11.567 ms) : 0, 11567
section appsec
BytebuddyAgent [baseline] (734.449 ms) : 0, 734449
BytebuddyAgent [candidate] (733.52 ms) : 0, 733520
GlobalTracer [baseline] (241.023 ms) : 0, 241023
GlobalTracer [candidate] (240.201 ms) : 0, 240201
AppSec [baseline] (176.797 ms) : 0, 176797
AppSec [candidate] (176.565 ms) : 0, 176565
Remote Config [baseline] (664.013 µs) : 0, 664
Remote Config [candidate] (659.338 µs) : 0, 659
Telemetry [baseline] (8.285 ms) : 0, 8285
Telemetry [candidate] (8.251 ms) : 0, 8251
IAST [baseline] (21.653 ms) : 0, 21653
IAST [candidate] (21.744 ms) : 0, 21744
section iast
BytebuddyAgent [baseline] (836.953 ms) : 0, 836953
BytebuddyAgent [candidate] (835.436 ms) : 0, 835436
GlobalTracer [baseline] (234.574 ms) : 0, 234574
GlobalTracer [candidate] (233.481 ms) : 0, 233481
AppSec [baseline] (57.077 ms) : 0, 57077
AppSec [candidate] (57.01 ms) : 0, 57010
Remote Config [baseline] (636.459 µs) : 0, 636
Remote Config [candidate] (628.937 µs) : 0, 629
Telemetry [baseline] (8.71 ms) : 0, 8710
Telemetry [candidate] (8.705 ms) : 0, 8705
IAST [baseline] (22.983 ms) : 0, 22983
IAST [candidate] (22.751 ms) : 0, 22751
section profiling
BytebuddyAgent [baseline] (709.79 ms) : 0, 709790
BytebuddyAgent [candidate] (716.125 ms) : 0, 716125
GlobalTracer [baseline] (354.33 ms) : 0, 354330
GlobalTracer [candidate] (356.777 ms) : 0, 356777
AppSec [baseline] (55.773 ms) : 0, 55773
AppSec [candidate] (54.956 ms) : 0, 54956
Remote Config [baseline] (715.702 µs) : 0, 716
Remote Config [candidate] (708.31 µs) : 0, 708
Telemetry [baseline] (8.891 ms) : 0, 8891
Telemetry [candidate] (9.036 ms) : 0, 9036
ProfilingAgent [baseline] (96.896 ms) : 0, 96896
ProfilingAgent [candidate] (97.136 ms) : 0, 97136
Profiling [baseline] (96.919 ms) : 0, 96919
Profiling [candidate] (97.16 ms) : 0, 97160
LoadParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 11 metrics, 17 unstable metrics. Request duration reports for insecure-bankgantt
title insecure-bank - request duration [CI 0.99] : candidate=1.47.0-SNAPSHOT~8a74e85918, baseline=1.47.0-SNAPSHOT~8a74e85918
dateFormat X
axisFormat %s
section baseline
no_agent (378.829 µs) : 359, 399
. : milestone, 379,
iast (524.142 µs) : 502, 546
. : milestone, 524,
iast_FULL (742.076 µs) : 720, 764
. : milestone, 742,
iast_GLOBAL (551.352 µs) : 529, 573
. : milestone, 551,
iast_HARDCODED_SECRET_DISABLED (504.581 µs) : 483, 526
. : milestone, 505,
iast_INACTIVE (460.594 µs) : 439, 482
. : milestone, 461,
iast_TELEMETRY_OFF (498.13 µs) : 475, 522
. : milestone, 498,
tracing (452.755 µs) : 431, 474
. : milestone, 453,
section candidate
no_agent (379.792 µs) : 359, 400
. : milestone, 380,
iast (513.346 µs) : 491, 536
. : milestone, 513,
iast_FULL (739.55 µs) : 718, 761
. : milestone, 740,
iast_GLOBAL (548.076 µs) : 527, 569
. : milestone, 548,
iast_HARDCODED_SECRET_DISABLED (507.205 µs) : 486, 529
. : milestone, 507,
iast_INACTIVE (458.895 µs) : 437, 480
. : milestone, 459,
iast_TELEMETRY_OFF (498.906 µs) : 476, 522
. : milestone, 499,
tracing (450.724 µs) : 430, 472
. : milestone, 451,
Request duration reports for petclinicgantt
title petclinic - request duration [CI 0.99] : candidate=1.47.0-SNAPSHOT~8a74e85918, baseline=1.47.0-SNAPSHOT~8a74e85918
dateFormat X
axisFormat %s
section baseline
no_agent (1.352 ms) : 1333, 1371
. : milestone, 1352,
appsec (1.767 ms) : 1744, 1790
. : milestone, 1767,
appsec_no_iast (1.774 ms) : 1751, 1796
. : milestone, 1774,
iast (1.508 ms) : 1484, 1532
. : milestone, 1508,
profiling (1.513 ms) : 1489, 1537
. : milestone, 1513,
tracing (1.477 ms) : 1453, 1502
. : milestone, 1477,
section candidate
no_agent (1.356 ms) : 1337, 1376
. : milestone, 1356,
appsec (1.73 ms) : 1705, 1754
. : milestone, 1730,
appsec_no_iast (1.739 ms) : 1715, 1764
. : milestone, 1739,
iast (1.509 ms) : 1485, 1533
. : milestone, 1509,
profiling (1.514 ms) : 1491, 1536
. : milestone, 1514,
tracing (1.491 ms) : 1466, 1517
. : milestone, 1491,
DacapoParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 11 metrics, 1 unstable metrics. Execution time for biojavagantt
title biojava - execution time [CI 0.99] : candidate=1.47.0-SNAPSHOT~8a74e85918, baseline=1.47.0-SNAPSHOT~8a74e85918
dateFormat X
axisFormat %s
section baseline
no_agent (15.169 s) : 15169000, 15169000
. : milestone, 15169000,
appsec (15.035 s) : 15035000, 15035000
. : milestone, 15035000,
iast (19.081 s) : 19081000, 19081000
. : milestone, 19081000,
iast_GLOBAL (17.968 s) : 17968000, 17968000
. : milestone, 17968000,
profiling (14.9 s) : 14900000, 14900000
. : milestone, 14900000,
tracing (14.919 s) : 14919000, 14919000
. : milestone, 14919000,
section candidate
no_agent (14.992 s) : 14992000, 14992000
. : milestone, 14992000,
appsec (14.968 s) : 14968000, 14968000
. : milestone, 14968000,
iast (18.944 s) : 18944000, 18944000
. : milestone, 18944000,
iast_GLOBAL (18.17 s) : 18170000, 18170000
. : milestone, 18170000,
profiling (14.995 s) : 14995000, 14995000
. : milestone, 14995000,
tracing (14.722 s) : 14722000, 14722000
. : milestone, 14722000,
Execution time for tomcatgantt
title tomcat - execution time [CI 0.99] : candidate=1.47.0-SNAPSHOT~8a74e85918, baseline=1.47.0-SNAPSHOT~8a74e85918
dateFormat X
axisFormat %s
section baseline
no_agent (1.475 ms) : 1464, 1487
. : milestone, 1475,
appsec (2.369 ms) : 2325, 2412
. : milestone, 2369,
iast (2.112 ms) : 2057, 2167
. : milestone, 2112,
iast_GLOBAL (2.156 ms) : 2101, 2212
. : milestone, 2156,
profiling (1.974 ms) : 1930, 2017
. : milestone, 1974,
tracing (1.945 ms) : 1903, 1988
. : milestone, 1945,
section candidate
no_agent (1.47 ms) : 1459, 1482
. : milestone, 1470,
appsec (2.367 ms) : 2324, 2411
. : milestone, 2367,
iast (2.121 ms) : 2066, 2177
. : milestone, 2121,
iast_GLOBAL (2.16 ms) : 2104, 2215
. : milestone, 2160,
profiling (2.428 ms) : 2252, 2603
. : milestone, 2428,
tracing (1.953 ms) : 1910, 1996
. : milestone, 1953,
|
There was a problem hiding this comment.
Hey @harmonherring-pro 👋
What's the end goal here? (I quickly had a a look at the link JIRA card)
In a sense of there is a huge amount of dependencies that are not related to what is shipped to customers and you would need to build some logic related to filtering the instrumentation dependencies for example.
Otherwise, we will end up with a lot of false positives.
@PerfectSlayer the end goal is to include the dd-trace-java dependencies in our malicious/vulnerable dependency monitoring program I see the concern about including dependencies that aren't related to what's shipped to customers. The gradle dependency submission action provides a way to scope the projects and configurations that are included in the dependency graph. Any chance you know which projects/configurations should be included or excluded? I'm happy to add to the current regex to filter out instrumentation dependencies |
I guess we could build something but that is not trivial and would need manual maintenance. Have run it on your side first to check what's reported is accurate? |
ygree
requested changes
Feb 28, 2025
|
This pull request has been marked as stale because it has not had activity over the past quarter. It will be closed in 7 days if no further activity occurs. Feel free to reopen the PR if you are still working on it. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What Does This Do
SINT-2813 Gradle dependencies aren't submitted to Github's dependency graph by default, so this PR configures a Github Action to do so. It excludes test and build targets, but let me know if the list of those targets needs to be expanded