test: add dd-trace without OpenFeature system test

[leoromanovsky]

Motivation

This PR adds a system test to verify that dd-trace works correctly when the OpenFeature SDK is not installed. This validates the fix for DataDog/dd-trace-js#6986

Users of dd-trace who don't use OpenFeature were encountering peer dependency errors. This test ensures dd-trace initializes and runs correctly at runtime without OpenFeature packages.

Changes

New Files

• utils/build/docker/nodejs/express4-no-openfeature.Dockerfile: New weblog variant that installs dd-trace then removes OpenFeature packages
• utils/build/docker/nodejs/express/app-no-openfeature.js: Minimal app with required system-tests endpoints
• tests/openfeature/test_ddtrace_without_openfeature.py: Test verifying dd-trace works without OpenFeature
• tests/openfeature/__init__.py: Package init

Modified Files

• manifests/*.yml: Added manifest entries marking test as irrelevant for all weblogs except express4-no-openfeature

Test Coverage

The test validates that dd-trace initializes successfully and the weblog responds to requests when OpenFeature packages are not installed. The key assertion is that the root endpoint returns 200, proving dd-trace didn't crash during initialization.

Decisions

• Minimal app: The test app only implements required endpoints (/, /healthcheck, /flush) to keep it focused
• Version constraint: Set to >=5.75.0 since that's when OpenFeature integration was added and the runtime behavior works correctly

Related Issues

• [BUG]: Installs of [email protected] fail due to peer-dependency violations in @datadog/openfeature-node-server dd-trace-js#6986

[github-actions]

CODEOWNERS have been resolved as:

tests/openfeature/__init__.py                                           @DataDog/system-tests-core
tests/openfeature/test_ddtrace_without_openfeature.py                   @DataDog/system-tests-core
utils/build/docker/nodejs/express/app-no-openfeature.js                 @DataDog/dd-trace-js @DataDog/system-tests-core
utils/build/docker/nodejs/express4-no-openfeature.Dockerfile            @DataDog/dd-trace-js @DataDog/system-tests-core
manifests/cpp.yml                                                       @DataDog/dd-trace-cpp
manifests/dotnet.yml                                                    @DataDog/apm-dotnet @DataDog/asm-dotnet
manifests/golang.yml                                                    @DataDog/dd-trace-go-guild
manifests/java.yml                                                      @DataDog/asm-java @DataDog/apm-java
manifests/nodejs.yml                                                    @DataDog/dd-trace-js
manifests/php.yml                                                       @DataDog/apm-php @DataDog/asm-php
manifests/python.yml                                                    @DataDog/apm-python @DataDog/asm-python
manifests/ruby.yml                                                      @DataDog/ruby-guild @DataDog/asm-ruby
utils/scripts/ci_orchestrators/workflow_data.py                         @DataDog/system-tests-core

[datadog-official]

⚠️ Tests

✨ Fix all issues with Cursor

⚠️ Warnings

❄️ 1 New flaky test detected

tests.appsec.iast.sink.test_unvalidated_redirect.TestUnvalidatedRedirect.test_secure[uds-flask] from system_tests_suite (Datadog) (Fix with Cursor)

ValueError: Unexpected vulnerability reported: UNVALIDATED_REDIRECT

self = <tests.appsec.iast.sink.test_unvalidated_redirect.TestUnvalidatedRedirect object at 0x7fe6acde4470>

    def test_secure(self):
>       super().test_secure()

tests/appsec/iast/sink/test_unvalidated_redirect.py:47: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
tests/appsec/iast/utils.py:181: in test_secure
...

🧪 178 Tests failed

tests.appsec.iast.sink.test_code_injection.TestCodeInjection_ExtendedLocation.test_extended_location_data[express4-no-openfeature] from system_tests_suite (Datadog) (Fix with Cursor)

AssertionError: Expected at least one vulnerability in span 7118075567469923292
assert None

self = <tests.appsec.iast.sink.test_code_injection.TestCodeInjection_ExtendedLocation object at 0x7f9f38b61490>

    def test_extended_location_data(self):
>       validate_extended_location_data(self.r, self.vulnerability_type)

tests/appsec/iast/sink/test_code_injection.py:56: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
...

tests.appsec.iast.sink.test_code_injection.TestCodeInjection_StackTrace.test_stack_trace[express4-no-openfeature] from system_tests_suite (Datadog) (Fix with Cursor)

AssertionError: No iast event in root span
assert None is not None

self = <tests.appsec.iast.sink.test_code_injection.TestCodeInjection_StackTrace object at 0x7f9f38b60dd0>

    def test_stack_trace(self):
>       validate_stack_traces(self.r)

tests/appsec/iast/sink/test_code_injection.py:42: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
...

tests.appsec.iast.sink.test_code_injection.TestCodeInjection.test_insecure[express4-no-openfeature] from system_tests_suite (Datadog) (Fix with Cursor)

assert ('_dd.iast.json' in {'_dd.appsec.event_rules.version': '1.16.1', '_dd.appsec.fp.http.endpoint': 'http-post-8afde3a2--', '_dd.appsec.fp.http.header': 'hdr-0010000100-75038f1e-2-da57b738', '_dd.appsec.fp.http.network': 'net-0-0000000000', ...} or 'iast' in {})

self = <tests.appsec.iast.sink.test_code_injection.TestCodeInjection object at 0x7f9f38b615e0>

    def test_insecure(self) -> None:
>       assert_iast_vulnerability(
            request=self.insecure_request,
            vulnerability_type=self.vulnerability_type,
            expected_location=self.expected_location,
            expected_evidence=self.expected_evidence,
...

View all

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: ebf1976 | Docs | Datadog PR Page | Was this helpful? Give us feedback!}