FFL-3568: Share precomputed fixtures and lossless numeric policy

.github/chainguard/self.precomputed-fixtures.sts.yaml

@@ -0,0 +1,9 @@
+issuer: https://token.actions.githubusercontent.com
+subject: repo:DataDog/dd-sdk-android:ref:refs/heads/develop
+claim_pattern:
+  event_name: "(schedule|workflow_dispatch)"
+  workflow_ref: 'DataDog/dd-sdk-android/\.github/workflows/precomputed-fixtures\.yml@refs/heads/develop'
+  repository: "DataDog/dd-sdk-android"
+permissions:
+  contents: write
+  pull_requests: write

.github/workflows/precomputed-fixtures.yml

@@ -0,0 +1,86 @@
+name: Precomputed flag fixtures
+on:
+  pull_request:
+    paths:
+      - 'ci/*precomputed*'
+      - 'reliability/single-fit/flags/src/test/resources/precomputed/**'
+      - '.github/workflows/precomputed-fixtures.yml'
+  schedule:
+    - cron: '23 8 * * 1'
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: precomputed-fixtures-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: false
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - name: Verify the local snapshot
+        run: python3 ci/sync-precomputed-fixtures.py --verify
+      - name: Compare with the recorded upstream commit
+        run: python3 ci/sync-precomputed-fixtures.py --check
+  update:
+    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/develop'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: DataDog/dd-octo-sts-action@c85802a58e202b7e764b5441e4378c76043c8108 # v1.0.5
+        id: token
+        with:
+          scope: DataDog/dd-sdk-android
+          policy: self.precomputed-fixtures
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - name: Import upstream fixtures
+        id: sync
+        run: python3 ci/sync-precomputed-fixtures.py --ref main
+      - name: Prepare a draft update
+        id: prepare
+        if: steps.sync.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
+          SOURCE_COMMIT: ${{ steps.sync.outputs.source_commit }}
+        run: |
+          existing=$(gh pr list --state open --search '"Update precomputed flag fixtures" in:title' --json number --jq 'length')
+          if [ "$existing" != 0 ]; then
+            echo 'An update PR is already open. Merge or close it before the next update.'
+            exit 0
+          fi
+          branch="automation/precomputed-fixtures-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
+          git add -- 'reliability/single-fit/flags/src/test/resources/precomputed'
+          echo "branch=$branch" >> "$GITHUB_OUTPUT"
+          echo 'ready=true' >> "$GITHUB_OUTPUT"
+          python3 - <<'BODY'
+          import os
+          from pathlib import Path
+          template = Path('ci/precomputed-fixtures-pr.md').read_text()
+          Path('/tmp/precomputed-pr.md').write_text(template.replace('SOURCE_COMMIT', os.environ['SOURCE_COMMIT']))
+          BODY
+      - name: Create a signed fixture commit
+        if: steps.prepare.outputs.ready == 'true'
+        uses: DataDog/commit-headless@d6afabfd690ea1dbdd7d368acbefd71304928699 # action/v3.4.1
+        with:
+          command: commit
+          token: ${{ steps.token.outputs.token }}
+          branch: ${{ steps.prepare.outputs.branch }}
+          head-sha: ${{ github.sha }}
+          create-branch: true
+          force: false
+          message: 'FFL-3568: Update precomputed flag fixtures'
+      - name: Open the draft pull request
+        if: steps.prepare.outputs.ready == 'true'
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
+          UPDATE_BRANCH: ${{ steps.prepare.outputs.branch }}
+        run: |
+          gh pr create --draft --base develop --head "$UPDATE_BRANCH" --title 'FFL-3568: Update precomputed flag fixtures' --body-file /tmp/precomputed-pr.md

ci/precomputed-fixtures-pr.md

@@ -0,0 +1,17 @@
+### What does this PR do?
+
+Refresh the shared precomputed response fixtures to `SOURCE_COMMIT`.
+
+### Motivation
+
+Keep mobile response tests aligned with the canonical JSON contract. Ref: FFL-3568.
+
+### Additional Notes
+
+The existing fixture loop runs new cases in normal SDK CI. Review those results before merge.
+
+### Review checklist (to be filled by reviewers)
+
+- [ ] Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
+- [ ] Make sure you discussed the feature or bugfix with the maintaining team in an Issue
+- [ ] Make sure each commit and the PR mention the Issue number (cf the [CONTRIBUTING](../CONTRIBUTING.md) doc)

ci/precomputed-fixtures.json

@@ -0,0 +1,3 @@
+{
+  "destination": "reliability/single-fit/flags/src/test/resources/precomputed"
+}

ci/sync-precomputed-fixtures.py

@@ -0,0 +1,221 @@
+#!/usr/bin/env python3
+# Unless explicitly stated otherwise, all files in this repository are licensed under the
+# Apache License Version 2.0. This product includes software developed at Datadog
+# (https://www.datadoghq.com/). Copyright 2025-Present Datadog, Inc.
+"""Import a reproducible precompute test snapshot; never edit imported JSON."""
+import argparse
+import hashlib
+import json
+import os
+import re
+import subprocess
+import tempfile
+import uuid
+from pathlib import Path
+
+REPOSITORY = 'https://github.com/DataDog/ffe-system-test-data.git'
+PREFIX = 'precomputed-assignments/'
+FILES = {
+    'schemas/precomputed-assignment.schema.json': 'schema.json',
+    'precomputed-assignments/README.md': 'README.md',
+    'LICENSE': 'LICENSE',
+    'NOTICE': 'NOTICE',
+}
+
+
+def git(source, *args):
+    return subprocess.check_output(['git', '-C', str(source), *args])
+
+
+def response_bytes(content):
+    """Extract the top-level response without re-encoding any numeric token."""
+    text = content.decode('utf-8')
+    decoder = json.JSONDecoder()
+    position = text.index('{') + 1
+    while True:
+        while text[position].isspace() or text[position] == ',':
+            position += 1
+        if text[position] == '}':
+            raise ValueError('Fixture is missing response')
+        key, position = decoder.raw_decode(text, position)
+        while text[position].isspace():
+            position += 1
+        if text[position] != ':':
+            raise ValueError('Invalid fixture object')
+        position += 1
+        while text[position].isspace():
+            position += 1
+        start = position
+        _, position = decoder.raw_decode(text, position)
+        if key == 'response':
+            return text[start:position].encode('utf-8') + b'\n'
+
+
+def snapshot(source, ref):
+    if not re.fullmatch(r'[A-Za-z0-9][A-Za-z0-9._/-]*', ref) or '..' in ref:
+        raise ValueError('Invalid fixture revision')
+    sha = git(source, 'rev-parse', '--verify', ref + '^{commit}').decode().strip()
+    if not re.fullmatch(r'[0-9a-f]{40}', sha):
+        raise ValueError('Expected a full source commit SHA')
+    result = {}
+    for entry in git(source, 'ls-tree', '-rz', '--full-tree', sha).split(b'\0'):
+        if not entry:
+            continue
+        metadata, raw_path = entry.split(b'\t', 1)
+        path = raw_path.decode()
+        target = FILES.get(path)
+        if path.startswith(PREFIX + 'cases/') and path.endswith('.json'):
+            target = path[len(PREFIX):]
+        if target is None:
+            continue
+        mode, kind, blob = metadata.decode().split()
+        if mode != '100644' or kind != 'blob':
+            raise ValueError('Fixture entries must be ordinary files: ' + path)
+        result[target] = git(source, 'cat-file', 'blob', blob)
+    cases = sorted(p for p in result if p.startswith('cases/'))
+    if not cases or not all(p in result for p in FILES.values()):
+        raise ValueError('Missing or empty precomputed fixture corpus')
+    for path in cases:
+        data = json.loads(result[path])
+        if not isinstance(data, dict) or data.get('name') != Path(path).stem:
+            raise ValueError('Invalid fixture identity: ' + path)
+        if not isinstance(data.get('evaluations'), list):
+            raise TypeError('Missing evaluations: ' + path)
+        result['responses/' + path] = response_bytes(result[path])
+    result['index.json'] = (json.dumps(cases, indent=2) + '\n').encode()
+    result['SOURCE.json'] = (json.dumps({
+        'repository': REPOSITORY,
+        'commit': sha,
+        'files': {p: hashlib.sha256(v).hexdigest() for p, v in sorted(result.items())},
+    }, indent=2) + '\n').encode()
+    return result
+
+
+def read_snapshot(destination):
+    if not destination.exists():
+        return {}
+    result = {}
+    for path in destination.rglob('*'):
+        if path.is_symlink():
+            raise ValueError('Snapshot must not contain symbolic links')
+        if path.is_file() and path.suffix != '.meta':
+            result[path.relative_to(destination).as_posix()] = path.read_bytes()
+    return result
+
+
+def verify(destination):
+    content = read_snapshot(destination)
+    metadata = json.loads(content.pop('SOURCE.json'))
+    if metadata['repository'] != REPOSITORY or not re.fullmatch(r'[0-9a-f]{40}', metadata['commit']):
+        raise ValueError('Invalid source provenance')
+    hashes = {p: hashlib.sha256(v).hexdigest() for p, v in sorted(content.items())}
+    if hashes != metadata['files']:
+        raise ValueError('Snapshot content differs from its recorded checksums')
+    cases = sorted(p for p in content if p.startswith('cases/') and p.endswith('.json'))
+    if not cases or json.loads(content['index.json']) != cases:
+        raise ValueError('Missing, empty, or stale fixture index')
+    print(f"Verified {len(cases)} fixtures at {metadata['commit']}")
+
+
+def unity_metadata(destination):
+    for asset in sorted(destination.rglob('*')):
+        if asset.suffix == '.meta':
+            continue
+        meta = asset.with_name(asset.name + '.meta')
+        if not meta.exists():
+            guid = uuid.uuid5(uuid.NAMESPACE_URL, 'ffe-precomputed/' + asset.relative_to(destination).as_posix()).hex
+            folder = 'folderAsset: yes\n' if asset.is_dir() else ''
+            importer = 'DefaultImporter' if asset.is_dir() or asset.suffix != '.json' else 'TextScriptImporter'
+            meta.write_text(f'fileFormatVersion: 2\nguid: {guid}\n{folder}{importer}:\n  externalObjects: {{}}\n  userData:\n  assetBundleName:\n  assetBundleVariant:\n')
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--ref', default='main')
+    parser.add_argument('--source', type=Path, help='Read a local Git checkout at the requested committed revision')
+    parser.add_argument('--verify', action='store_true', help='Verify local checksums and discovery index without network access')
+    parser.add_argument('--check', action='store_true', help='Compare with the recorded upstream SHA; do not write')
+    args = parser.parse_args()
+    root = Path(__file__).resolve().parent.parent
+    config = json.loads((root / 'ci/precomputed-fixtures.json').read_text())
+    relative = Path(config['destination'])
+    if relative.is_absolute() or '..' in relative.parts:
+        raise ValueError('Destination must be inside the repository')
+    destination = root / relative
+    resolved = destination.resolve()
+    if not resolved.is_relative_to(root):
+        raise ValueError('Destination escapes the repository')
+    if resolved == root or '.git' in relative.parts:
+        raise ValueError('Destination must be a dedicated directory inside the repository')
+    if resolved != destination:
+        raise ValueError('Destination must not contain symbolic links')
+    if destination.exists():
+        if not destination.is_dir():
+            raise ValueError('Destination must be a directory')
+        if any(destination.iterdir()):
+            provenance = destination / 'SOURCE.json'
+            if not provenance.is_file():
+                raise ValueError('Destination must be empty or contain a previous snapshot')
+            metadata = json.loads(provenance.read_text())
+            if metadata.get('repository') != REPOSITORY or not isinstance(metadata.get('files'), dict):
+                raise ValueError('Destination must contain valid snapshot provenance')
+            extra = read_snapshot(destination).keys() - metadata['files'].keys() - {'SOURCE.json'}
+            if extra:
+                raise ValueError('Destination contains files outside the previous snapshot')
+    if not re.fullmatch(r'[A-Za-z0-9][A-Za-z0-9._/-]*', args.ref) or '..' in args.ref:
+        raise ValueError('Invalid fixture revision')
+    if args.verify:
+        verify(destination)
+        return
+    before = read_snapshot(destination)
+    ref = json.loads(before['SOURCE.json'])['commit'] if args.check else args.ref
+    with tempfile.TemporaryDirectory(prefix='ffe-precompute-') as temporary:
+        source = args.source
+        if source is None:
+            source = Path(temporary) / 'source'
+            subprocess.run(['git', 'init', '-q', str(source)], check=True)
+            subprocess.run(['git', '-C', str(source), 'fetch', '-q', '--depth=1', REPOSITORY, ref], check=True)
+            ref = 'FETCH_HEAD'
+        after = snapshot(source, ref)
+        changed = {p:v for p,v in before.items() if p != 'SOURCE.json'} != {p:v for p,v in after.items() if p != 'SOURCE.json'}
+        if args.check:
+            if before != after:
+                raise ValueError('Snapshot differs from its recorded source commit')
+        elif changed:
+            destination.parent.mkdir(parents=True, exist_ok=True)
+            with tempfile.TemporaryDirectory(prefix='.precompute-', dir=destination.parent) as staging:
+                staged = Path(staging) / 'snapshot'
+                staged.mkdir()
+                for path, content in after.items():
+                    output = staged / path
+                    output.parent.mkdir(parents=True, exist_ok=True)
+                    output.write_bytes(content)
+                # Preserve Unity's existing asset identities when refreshing a snapshot.
+                if destination.exists():
+                    for meta in destination.rglob('*.meta'):
+                        rel = meta.relative_to(destination)
+                        asset = staged / str(rel)[:-5]
+                        if asset.exists():
+                            (staged / rel).write_bytes(meta.read_bytes())
+                    backup = Path(staging) / 'previous'
+                    destination.rename(backup)
+                    try:
+                        staged.rename(destination)
+                    except BaseException:
+                        backup.rename(destination)
+                        raise
+                else:
+                    staged.rename(destination)
+        if config.get('unityMetadata') and not args.check:
+            unity_metadata(destination)
+        selected = before if args.check or not changed else after
+        metadata = json.loads(selected['SOURCE.json'])
+        count = len(json.loads(selected['index.json']))
+        print(f"FFE precomputed fixtures: {metadata['commit']}; {count} files; changed={str(changed).lower()}")
+        if os.environ.get('GITHUB_OUTPUT'):
+            with open(os.environ['GITHUB_OUTPUT'], 'a') as output:
+                output.write(f"changed={str(changed).lower()}\nsource_commit={metadata['commit']}\nfixture_count={count}\n")
+
+
+if __name__ == '__main__':
+    main()

dd-sdk-android-core/build.gradle.kts

@@ -146,14 +146,7 @@ dependencies {
     testFixturesImplementation(libs.okHttp)
     testFixturesImplementation(libs.bundles.testTools)
     testFixturesImplementation(project(":dd-sdk-android-internal"))
-    testFixturesImplementation(project(":tools:unit")) {
-        attributes {
-            attribute(
-                com.android.build.api.attributes.ProductFlavorAttr.of("platform"),
-                objects.named("jvm")
-            )
-        }
-    }
+    testFixturesImplementation(testFixtures(project(":dd-sdk-android-internal")))
 }
 
 unMock {

dd-sdk-android-core/src/testFixtures/kotlin/com/datadog/android/tests/elmyr/AccountInfoForgeryFactory.kt

@@ -7,6 +7,7 @@
 package com.datadog.android.tests.elmyr
 
 import com.datadog.android.api.context.AccountInfo
+import com.datadog.android.internal.tests.elmyr.exhaustiveAttributes
 import fr.xgouchet.elmyr.Forge
 import fr.xgouchet.elmyr.ForgeryFactory
 

dd-sdk-android-core/src/testFixtures/kotlin/com/datadog/android/tests/elmyr/DatadogContextForgeryFactory.kt

@@ -8,6 +8,7 @@ package com.datadog.android.tests.elmyr
 
 import com.datadog.android.DatadogSite
 import com.datadog.android.api.context.DatadogContext
+import com.datadog.android.internal.tests.elmyr.exhaustiveAttributes
 import com.datadog.android.privacy.TrackingConsent
 import fr.xgouchet.elmyr.Forge
 import fr.xgouchet.elmyr.ForgeryFactory