chore(eslint): block process.env rule bypasses

[bm1549]

What does this PR do?

• Adds an ESLint rule that rejects directives disabling the process.env guardrail, including block, line, next-line, mixed-rule, and explained directives.
• Preserves one existing suppression in each explicitly listed legacy file while rejecting additional or newly introduced bypasses.
• Adds focused RuleTester coverage for rejected directives, baseline allowances, and cross-platform file matching.

Motivation

Review feedback on PR #9075 identified that an inline ESLint disable can bypass the repository's tracked environment-variable access policy. Centralizing the existing baseline and rejecting new suppressions keeps configuration reads observable without forcing unrelated legacy cleanup into this change.

Testing

• npm run test:eslint-rules
• npm run lint
• Verified an inline suppression in packages/dd-trace/src/proxy.js fails with the new guardrail message.

Additional Notes

This changes lint enforcement only and has no production runtime impact.

---

PR by Bits - View session in Datadog

Comment @DataDog to request changes

[datadog-prod-us1-4]

View session in Datadog

Bits Code status: ✅ Done

CI Auto-fix: Disabled | Enable

Comment @DataDog to request changes

[datadog-datadog-prod-us1-2]

I can only run on private repositories.

[dd-octo-sts]

Overall package size

Self size: 7.81 MB
Deduped: 8.48 MB
No deduping: 8.48 MB

Dependency sizes

| name | version | self size | total size | |------|---------|-----------|------------| | import-in-the-middle | 3.3.3 | 125.43 kB | 441.68 kB | | opentracing | 0.14.7 | 194.81 kB | 194.81 kB | | dc-polyfill | 0.1.11 | 25.74 kB | 25.74 kB |

_{🤖 This report was automatically generated by heaviest-objects-in-the-universe}

[datadog-prod-us1-4]

 

⚠️ Warnings

🚦 3 Pipeline jobs failed

System Tests | main / End-to-end #15 / nextjs 15     

🔧 Fix in code. This looks caused by changes in this PR.

1 failed test. AssertionError: assert None == '/' in tests/test_resource_renaming.py:45.

🧪 1 Test failed · 🎯 related to the job error above

🎯 tests.test_resource_renaming.Test_Resource_Renaming_HTTP_Endpoint_Tag.test_http_endpoint_root[nextjs] from system_tests_suite  

assert None == '/'
 +  where None = get_endpoint_tag(HttpResponse(status_code:200, headers:{'Vary': 'RSC, Next-Router-State-Tree, Next-Router-Prefetch, Next-Url, Accept-En...t\":\"Generated by create next app\"}]]\n3:null\n"])</script><script>self.__next_f.push([1,""])</script></body></html>))
 +    where HttpResponse(status_code:200, headers:{'Vary': 'RSC, Next-Router-State-Tree, Next-Router-Prefetch, Next-Url, Accept-En...t\":\"Generated by create next app\"}]]\n3:null\n"])</script><script>self.__next_f.push([1,""])</script></body></html>) = <tests.test_resource_renaming.Test_Resource_Renaming_HTTP_Endpoint_Tag object at 0x7f5a282f2630>.r_root

self = <tests.test_resource_renaming.Test_Resource_Renaming_HTTP_Endpoint_Tag object at 0x7f5a282f2630>

    def test_http_endpoint_root(self):
        """Test that root endpoint is handled correctly"""
>       assert get_endpoint_tag(self.r_root) == "/"
E       assert None == '/'
...

System Tests | main / End-to-end #14 / nextjs 14     

🔧 Fix in code. This looks caused by changes in this PR.

1 failed test. AssertionError: assert None == '/' in tests/test_resource_renaming.py:45.

All Green | all-green     

📋 Copy prompt for your agent

CI on my pull request is failing. Help me find and fix the root cause of each failing job below — they were flagged as caused by changes in this PR, so focus on the diff. For each job, explain the failure and propose a fix.

Branch: dd/prevent-process-env-lint-bypasses-20260804145604

System Tests | main / End-to-end #15 / nextjs 15
Commit: 7243df2ecdeeb25e3b979b4c481388b89e5863c7
Error (code / test):
1 failed test. AssertionError: assert None == '/' in tests/test_resource_renaming.py:45.
CI job: https://github.com/DataDog/dd-trace-js/actions/runs/30922441866/job/92039606955

System Tests | main / End-to-end #14 / nextjs 14
Commit: 7243df2ecdeeb25e3b979b4c481388b89e5863c7
Error (code / test):
1 failed test. AssertionError: assert None == '/' in tests/test_resource_renaming.py:45.
CI job: https://github.com/DataDog/dd-trace-js/actions/runs/30922441866/job/92039607175

ℹ️ Info

No other issues found (see more)

❄️ No new flaky tests detected

🔄 Datadog retried 1 test - 1 passed on retry

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 98.52% (+1.24%)

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 2140105 | Docs | Datadog PR Page | Give us feedback!}

[pr-commenter]

Benchmarks

Benchmark execution time: 2026-08-04 15:20:01

Comparing candidate commit 2140105 in PR branch dd/prevent-process-env-lint-bypasses-20260804145604 with baseline commit 27f5dc2 in branch master.

📊 Benchmarking dashboard

Found 0 performance improvements and 0 performance regressions! Performance is the same for 2315 metrics, 43 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

• 🟩 = significantly better candidate vs. baseline
• 🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

Unstable benchmarks

These benchmarks have a confidence interval too wide to call a change; treat them as noise rather than signal.

scenario:appsec-appsec-enabled-24

• unstable execution_time [-207482.437µs; +208874.504µs] or [-7.767%; +7.819%]

scenario:appsec-appsec-enabled-26

• unstable execution_time [-239.118ms; +234.638ms] or [-9.322%; +9.147%]

scenario:appsec-appsec-enabled-with-attacks-24

• unstable execution_time [-156.522ms; +171.966ms] or [-5.051%; +5.549%]

scenario:appsec-appsec-enabled-with-attacks-26

• unstable execution_time [-189.259ms; +182.938ms] or [-6.507%; +6.290%]

scenario:appsec-control-20

• unstable execution_time [-124023.845µs; +125044.079µs] or [-7.483%; +7.545%]

scenario:appsec-control-24

• unstable execution_time [-115328.802µs; +114336.102µs] or [-9.272%; +9.192%]

scenario:appsec-control-26

• unstable execution_time [-126.779ms; +129.085ms] or [-10.164%; +10.349%]

scenario:appsec-iast-no-vulnerability-control-20

• unstable execution_time [-14292.900µs; +14169.300µs] or [-5.520%; +5.472%]

scenario:appsec-iast-no-vulnerability-iast-enabled-default-config-20

• unstable execution_time [-13325.895µs; +12883.720µs] or [-5.214%; +5.041%]

scenario:appsec-iast-with-vulnerability-iast-enabled-always-active-20

• unstable execution_time [-30.851ms; +33.142ms] or [-5.567%; +5.981%]

scenario:appsec-iast-with-vulnerability-iast-enabled-default-config-20

• unstable execution_time [-26633.761µs; +28000.227µs] or [-4.898%; +5.150%]

scenario:debugger-line-probe-with-snapshot-minimal-24

• unstable cpu_user_time [-1784.768ms; +574.458ms] or [-21.521%; +6.927%]
• unstable execution_time [-1796.391ms; +583.327ms] or [-19.921%; +6.469%]
• unstable instructions [-15.0G instructions; +4.9G instructions] or [-22.201%; +7.189%]
• unstable throughput [-156.415op/s; +476.933op/s] or [-4.279%; +13.047%]

scenario:debugger-line-probe-without-snapshot-24

• unstable cpu_user_time [-1752.032ms; +545.112ms] or [-21.218%; +6.602%]
• unstable execution_time [-1764.837ms; +555.621ms] or [-19.679%; +6.196%]
• unstable instructions [-15.1G instructions; +4.8G instructions] or [-22.322%; +7.108%]
• unstable throughput [-149.576op/s; +480.176op/s] or [-4.073%; +13.076%]

scenario:debugger-line-probe-without-snapshot-26

• unstable cpu_user_time [-3.620s; +0.503s] or [-35.074%; +4.870%]
• unstable execution_time [-3.728s; +0.532s] or [-33.708%; +4.807%]
• unstable instructions [-32.0G instructions; +4.3G instructions] or [-37.051%; +4.927%]
• unstable throughput [-108.431op/s; +716.636op/s] or [-3.513%; +23.216%]

scenario:dogstatsd-aggregated-20

• unstable cpu_usage_percentage [-6.419%; +5.578%]
• unstable execution_time [-100.079ms; +120.197ms] or [-7.700%; +9.247%]
• unstable throughput [-770839.338op/s; +666015.116op/s] or [-6.593%; +5.696%]

scenario:dogstatsd-with-tags-20

• unstable cpu_user_time [-388.260ms; +298.495ms] or [-8.027%; +6.172%]
• unstable execution_time [-388.905ms; +298.922ms] or [-7.919%; +6.087%]
• unstable throughput [-107725.874op/s; +136660.375op/s] or [-6.298%; +7.989%]

scenario:plugin-graphql-long-with-depth-off-20

• unstable max_rss_usage [-5606.266KB; +7432.551KB] or [-4.418%; +5.857%]

scenario:plugin-graphql-long-with-depth-off-26

• unstable max_rss_usage [-33.346MB; +24.720MB] or [-15.649%; +11.601%]

scenario:plugin-graphql-long-with-depth-on-max-20

• unstable cpu_user_time [-639.718ms; +559.532ms] or [-5.532%; +4.839%]
• unstable execution_time [-649.710ms; +570.786ms] or [-5.505%; +4.836%]
• unstable throughput [-3.333op/s; +3.835op/s] or [-4.889%; +5.626%]

scenario:plugin-pg-service-24

• unstable cpu_usage_percentage [-9.390%; +5.990%]
• unstable execution_time [-151.619ms; +244.656ms] or [-8.978%; +14.487%]
• unstable throughput [-357673.722op/s; +218677.643op/s] or [-9.925%; +6.068%]

scenario:plugin-pg-service-26

• unstable cpu_usage_percentage [-6.946%; +6.288%]
• unstable execution_time [-81.783ms; +73.855ms] or [-9.046%; +8.169%]
• unstable throughput [-397610.697op/s; +499038.271op/s] or [-5.894%; +7.397%]

scenario:test-optimization-large-suite-20

• unstable max_rss_usage [-3.349MB; +8.234MB] or [-4.167%; +10.244%]

scenario:test-optimization-wide-tags-24

• unstable cpu_user_time [-158.382ms; +296.820ms] or [-3.843%; +7.202%]
• unstable execution_time [-158.632ms; +297.948ms] or [-3.818%; +7.172%]

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (master@27f5dc2). Learn more about missing BASE report.
⚠️ Report is 3 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff            @@
##             master    #9679   +/-   ##
=========================================
  Coverage          ?   98.51%           
=========================================
  Files             ?      957           
  Lines             ?   134805           
  Branches          ?    11805           
=========================================
  Hits              ?   132808           
  Misses            ?     1997           
  Partials          ?        0           

Flag	Coverage Δ
aiguard	56.93% <ø> (?)
aiguard-integration	55.77% <ø> (?)
apm-bucket-0	57.19% <ø> (?)
apm-bucket-1	63.32% <ø> (?)
apm-bucket-2	62.13% <ø> (?)
apm-bucket-3	59.65% <ø> (?)
apm-capabilities-tracing	62.50% <ø> (?)
apm-integrations-aerospike	56.23% <ø> (?)
apm-integrations-confluentinc-kafka-javascript	60.97% <ø> (?)
apm-integrations-couchbase	56.66% <ø> (?)
apm-integrations-http	61.99% <ø> (?)
apm-integrations-kafkajs	61.56% <ø> (?)
apm-integrations-next	59.22% <ø> (?)
apm-integrations-prisma	58.25% <ø> (?)
appsec	72.06% <ø> (?)
appsec-express_fastify_graphql	69.47% <ø> (?)
appsec-integration	50.07% <ø> (?)
appsec-kafka_ldapjs_lodash	63.36% <ø> (?)
appsec-mongodb-core_mongoose_mysql	66.96% <ø> (?)
appsec-next	56.50% <ø> (?)
appsec-node-serialize_passport_postgres	66.61% <ø> (?)
appsec-sourcing_stripe_template	64.96% <ø> (?)
debugger	64.23% <ø> (?)
instrumentations-bucket-0	51.48% <ø> (?)
instrumentations-bucket-1	59.58% <ø> (?)
instrumentations-bucket-10	61.38% <ø> (?)
instrumentations-bucket-11	51.39% <ø> (?)
instrumentations-bucket-12	52.19% <ø> (?)
instrumentations-bucket-13	51.50% <ø> (?)
instrumentations-bucket-2	53.30% <ø> (?)
instrumentations-bucket-3	58.63% <ø> (?)
instrumentations-bucket-4	52.03% <ø> (?)
instrumentations-bucket-5	57.17% <ø> (?)
instrumentations-bucket-6	60.24% <ø> (?)
instrumentations-bucket-7	58.00% <ø> (?)
instrumentations-bucket-8	58.97% <ø> (?)
instrumentations-bucket-9	60.91% <ø> (?)
instrumentations-instrumentation-couchbase	50.73% <ø> (?)
instrumentations-integration-esbuild	33.73% <ø> (?)
llmobs-ai_anthropic_bedrock	62.43% <ø> (?)
llmobs-bucket-1	61.23% <ø> (?)
llmobs-openai	61.77% <ø> (?)
llmobs-openai-agents_vertex-ai	59.72% <ø> (?)
llmobs-sdk	66.11% <ø> (?)
master-coverage	98.51% <ø> (?)
openfeature	55.56% <ø> (?)
openfeature-unit	53.06% <ø> (?)
platform-core_esbuild_instrumentations-misc	40.33% <ø> (?)
platform-integration	60.47% <ø> (?)
platform-shimmer_unit-guardrails_webpack	38.57% <ø> (?)
plugins-bucket-0	56.76% <ø> (?)
plugins-bucket-1	53.85% <ø> (?)
plugins-bucket-11	61.82% <ø> (?)
plugins-bucket-18	61.35% <ø> (?)
plugins-bucket-19	59.56% <ø> (?)
plugins-bucket-20	61.58% <ø> (?)
plugins-bucket-4	58.14% <ø> (?)
plugins-bullmq_cassandra_cookie	61.23% <ø> (?)
plugins-cookie-parser_crypto_dd-trace-api	56.29% <ø> (?)
plugins-fetch_fs_generic-pool	58.15% <ø> (?)
plugins-google-cloud-pubsub_grpc_handlebars	64.09% <ø> (?)
plugins-hapi_hono_ioredis	59.74% <ø> (?)
plugins-jest_knex_langgraph	55.27% <ø> (?)
plugins-ldapjs_light-my-request_limitd-client	58.07% <ø> (?)
plugins-lodash_mariadb_memcached	57.62% <ø> (?)
plugins-moleculer_mongodb_mongodb-core	61.34% <ø> (?)
plugins-mongoose_multer_mysql	58.62% <ø> (?)
plugins-mysql2_nats_node-serialize	60.16% <ø> (?)
plugins-opensearch_passport-http_pino	59.06% <ø> (?)
plugins-postgres_process_pug	58.21% <ø> (?)
plugins-redis_router_sequelize	61.43% <ø> (?)
plugins-test-and-upstream-rhea_undici_url	60.95% <ø> (?)
plugins-valkey_vm_winston	57.52% <ø> (?)
plugins-ws	59.08% <ø> (?)
profiling	61.45% <ø> (?)
serverless-aws-sdk-aws-sdk	54.86% <ø> (?)
serverless-aws-sdk-base-inject-field	50.68% <ø> (?)
serverless-aws-sdk-bedrockruntime	54.45% <ø> (?)
serverless-aws-sdk-client	56.08% <ø> (?)
serverless-aws-sdk-dynamodb	55.32% <ø> (?)
serverless-aws-sdk-eventbridge	49.28% <ø> (?)
serverless-aws-sdk-kinesis	58.88% <ø> (?)
serverless-aws-sdk-lambda	57.02% <ø> (?)
serverless-aws-sdk-s3	55.42% <ø> (?)
serverless-aws-sdk-serverless-peer-service	59.29% <ø> (?)
serverless-aws-sdk-sns	59.71% <ø> (?)
serverless-aws-sdk-sqs	60.14% <ø> (?)
serverless-aws-sdk-stepfunctions	55.25% <ø> (?)
serverless-aws-sdk-util	51.23% <ø> (?)
serverless-bucket-0	53.93% <ø> (?)
serverless-bucket-1	58.81% <ø> (?)
test-optimization-cucumber	71.46% <ø> (?)
test-optimization-cypress	65.31% <ø> (?)
test-optimization-jest	73.12% <ø> (?)
test-optimization-mocha	72.62% <ø> (?)
test-optimization-playwright-playwright-atr	60.07% <ø> (?)
test-optimization-playwright-playwright-efd	60.21% <ø> (?)
test-optimization-playwright-playwright-final-status	60.38% <ø> (?)
test-optimization-playwright-playwright-impacted-tests	59.91% <ø> (?)
test-optimization-playwright-playwright-reporting	61.10% <ø> (?)
test-optimization-playwright-playwright-test-management	60.92% <ø> (?)
test-optimization-playwright-playwright-test-span	60.12% <ø> (?)
test-optimization-selenium	59.44% <ø> (?)
test-optimization-testopt	57.81% <ø> (?)
test-optimization-vitest	73.71% <ø> (?)
test-optimization-vitest-browser	58.97% <ø> (?)
test-optimization-webdriverio	64.84% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.