[szibis]

Summary

This resolves the six open Semgrep code-scanning alerts on main (626–631) by changing the code, not by dismissing the alerts.

• 626–630, unsafe-add-mask-workflow-command: five steps in auto-release.yaml, perf-daily.yaml and release.yaml built a base64 Authorization header from a token and hid it with ::add-mask::. A step that stops workflow command processing defeats that mask.
  • Git now gets the token from a credential helper that reads it from the environment for that one command.
  • No derived value is created, so nothing needs masking.
  • The token is a repository secret or the job token, both of which GitHub masks itself.
  • It is still never put in a URL or in the git config, and the checkouts still keep no credentials.
• 631, trailofbits.go.iterate-over-empty-map: the same finding as alert 607. fix(security): mark the parseJSON-filled extracted map as a reviewed Semgrep false positive #788 marked it with an in-source nosemgrep comment and the alert was dismissed. Semgrep does emit that result with suppressions: [{kind: inSource}], but GitHub code scanning opened it again as a new alert when the line's fingerprint changed.
  • The loop that copies the names | json extracted into parsed is now maps.Copy(parsed, extracted).
  • It behaves the same: parseJSON writes only true values into extracted.

Changes

• .github/workflows/auto-release.yaml: the re-read fetch and the tag-push git_as use the credential helper.
• .github/workflows/perf-daily.yaml: the history fetch and the report-branch push use the credential helper.
• .github/workflows/release.yaml: the metadata-branch git_as uses the credential helper.
• In all three workflows, the comments that described a request header now describe the credential helper.
• Each helper line has # shellcheck disable=SC2016. The single quotes are intentional: git expands GIT_AUTH_TOKEN when it runs the helper.
• internal/proxy/unwrap_conversion_error.go: maps.Copy replaces the loop, and the nosemgrep marker is removed.
• internal/proxy/unwrap_conversion_error_test.go: a new test, TestUnwrapParseLineJSONNamesStayParsedForLaterStages, covers a | json stage followed by a | regexp stage that captures the same name.
  • The json value stays and no _extracted duplicate is added.
  • No existing test covered the changed line: removing the copy entirely left all 7 unwrap conversion tests green. The new test fails in that case (level_extracted:level appears), so the line is now pinned.
  • It pins the behaviour the code already had; nothing changes here.
• CHANGELOG.md: two Security entries under [Unreleased].

Proofs

• Semgrep 1.161.0, the CI version, with every config the heavy scan uses, run on the changed files: 0 findings. On main the same run reports the add-mask findings, plus the map finding marked inSource.
• Credential helper, live against GitHub, using the exact lines from the workflows:
  • release.yaml and auto-release.yaml git_as: a token-authenticated ls-remote of a private repository works, the same call with an empty token fails with "Authentication failed", and push --dry-run authenticates.
  • perf-daily.yaml inline fetch and push, and the auto-release.yaml re-read fetch: they authenticate the same way.
  • No branch was created on the remote.
• Go: gofmt, go vet ./internal/proxy/, the 7 unwrap conversion tests plus the new one, and the same set with -race, all pass.
• Workflows: actionlint (local) passes; pinned zizmor 1.30.1 reports "No findings".
• Other gates: scripts/ci/tests (77 tests), the conformance gate and the changelog gate pass.

Not applicable: the Go change is a refactor with no behaviour change, covered by the new test. The rest is CI. So e2e vs Loki, the Grafana range matrix, visual proof, A/B, benchstat and the load test do not apply.

Release note: the release this PR's merge cuts is the first to push its tag through the credential helper. If that step fails, no tag is created and [Unreleased] stays intact; a .github/-only revert does not cut a release.

[github-actions]

⚪ Performance A/B: no change beyond noise

65 shape×range — 65 ⚪ same · results vs Loki: 51 same, 0 new difference(s), 14 pre-existing

Every shape is within noise of the base build (±30% and 100 ms).

65 unchanged shape×range (within noise)

	shape	range	base p50	PR p50	change	Loki p50	PR ÷ Loki	result vs Loki
⚪	drilldown service landing	1h	30 ms	31 ms	⚪ +3%	32 ms	0.97×	✅ same
⚪	instant json filtered	instant	10 ms	9 ms	⚪ -10%	71 ms	0.13×	✅ same
⚪	instant json volume	instant	33 ms	32 ms	⚪ -3%	98 ms	0.33×	✅ same
⚪	instant ungrouped rate	instant	7 ms	7 ms	⚪ +0%	86 ms	0.08×	✅ same
⚪	json rate by level (no filter, no drop)	1h	400	400	⚪ +0%	400	—	✅ same
⚪	json volume no filters	1h	203 ms	203 ms	⚪ +0%	52 ms	3.90×	✅ same
⚪	logs plain	1h	82 ms	93 ms	⚪ +13%	42 ms	2.21×	✅ same
⚪	logs | json	1h	122 ms	109 ms	⚪ -11%	65 ms	1.68×	✅ same
⚪	stream-label count by app	1h	31 ms	30 ms	⚪ -3%	46 ms	0.65×	✅ same
⚪	topk rate by app	1h	49 ms	44 ms	⚪ -10%	96 ms	0.46×	➖ differs (as base)
⚪	X1 json filter level_extracted, by level	1h	493 ms	410 ms	⚪ -17%	48 ms	8.54×	✅ same
⚪	X2 json group by level_extracted	1h	321 ms	330 ms	⚪ +3%	51 ms	6.47×	✅ same
⚪	X3 json rate, level_extracted equality	1h	295 ms	293 ms	⚪ -1%	41 ms	7.15×	✅ same
⚪	X4 json bytes, level_extracted regexp	1h	412 ms	413 ms	⚪ +0%	97 ms	4.26×	✅ same
⚪	X5 logfmt filter level_extracted, by level	1h	692 ms	690 ms	⚪ -0%	59 ms	12×	✅ same
⚪	E1 logs, json parser over stream labels	1h	105 ms	116 ms	⚪ +10%	64 ms	1.81×	✅ same
⚪	E2 logs, logfmt parser over stream labels	1h	69 ms	61 ms	⚪ -12%	52 ms	1.17×	✅ same
⚪	E3 logs, json, existence filter on level_extracted	1h	148 ms	136 ms	⚪ -8%	69 ms	1.97×	✅ same
⚪	E4 logs, logfmt, existence filter on level_extracted	1h	85 ms	87 ms	⚪ +2%	59 ms	1.47×	✅ same
⚪	E5 logs, json, drop level_extracted	1h	112 ms	104 ms	⚪ -7%	63 ms	1.65×	✅ same
⚪	E6 logfmt count by level_extracted	1h	50 ms	56 ms	⚪ +12%	7 ms	8.00×	✅ same
⚪	E7 json count by level_extracted	1h	150 ms	146 ms	⚪ -3%	15 ms	9.73×	✅ same
⚪	E8 instant logfmt by level_extracted	instant	7 ms	7 ms	⚪ +0%	9 ms	0.78×	✅ same
⚪	A explore volume, 2 filters, drop	1h	157 ms	159 ms	⚪ +1%	180 ms	0.88×	✅ same
⚪	B grouped sum, filter, no drop	1h	103 ms	101 ms	⚪ -2%	40 ms	2.52×	✅ same
⚪	C ungrouped sum, filter, no drop	1h	98 ms	102 ms	⚪ +4%	40 ms	2.55×	✅ same
⚪	D volume, no filters	1h	218 ms	216 ms	⚪ -1%	51 ms	4.24×	✅ same
⚪	F field breakdown service_version (explore)	1h	131 ms	147 ms	⚪ +12%	48 ms	3.06×	✅ same
⚪	H field breakdown service_version (drilldown)	1h	74 ms	76 ms	⚪ +3%	31 ms	2.45×	✅ same
⚪	I grafana volume of B	1h	98 ms	98 ms	⚪ +0%	40 ms	2.45×	✅ same
⚪	O2 explore log volume (Grafana form), underscore structured-metadata filter	1h	76 ms	68 ms	⚪ -11%	39 ms	1.74×	✅ same
⚪	DL2 drilldown field breakdown, level + stream-label filter before json	1h	41 ms	40 ms	⚪ -2%	7 ms	5.71×	✅ same
⚪	DL6 explore volume, level filter before json	1h	143 ms	148 ms	⚪ +3%	45 ms	3.29×	✅ same
⚪	P1 logs, json, level equals	1h	141 ms	121 ms	⚪ -14%	80 ms	1.51×	✅ same
⚪	P2 logs, logfmt, level not equal	1h	32 ms	30 ms	⚪ -6%	6 ms	5.00×	✅ same
⚪	P3 logs, json, level existence	1h	134 ms	121 ms	⚪ -10%	74 ms	1.64×	✅ same
⚪	P4 logfmt count by level	1h	31 ms	32 ms	⚪ +3%	8 ms	4.00×	✅ same
⚪	P5 json count by level	1h	79 ms	84 ms	⚪ +6%	15 ms	5.60×	✅ same
⚪	P6 json count, level filter	1h	15 ms	15 ms	⚪ +0%	14 ms	1.07×	✅ same
⚪	P7 json rate by level, level regexp	1h	16 ms	16 ms	⚪ +0%	15 ms	1.07×	✅ same
⚪	P8 json count by a name that is no stream label	1h	84 ms	86 ms	⚪ +2%	14 ms	6.14×	✅ same
⚪	P9 instant logfmt by level	instant	5 ms	5 ms	⚪ +0%	9 ms	0.56×	✅ same
⚪	E1 json duration_ms sum by service	1h	85 ms	85 ms	⚪ +0%	16 ms	5.31×	➖ differs (as base)
⚪	E2 json duration_ms p95 by service	1h	255 ms	257 ms	⚪ +1%	15 ms	17×	✅ same
⚪	E3 logfmt latency_ms rate, production	1h	501 ms	517 ms	⚪ +3%	132 ms	3.92×	➖ differs (as base)
⚪	E4 logfmt size_bytes max by service	1h	47 ms	45 ms	⚪ -4%	14 ms	3.21×	➖ differs (as base)
⚪	E5 json duration_ms sum, instant	instant	35 ms	33 ms	⚪ -6%	25 ms	1.32×	✅ same
⚪	E6 logfmt ttl unit string (Loki 400)	1h	400	400	⚪ -6%	400	—	✅ same
⚪	E7 json hexadecimal trace_id (Loki 400)	1h	400	400	⚪ +2%	400	—	✅ same
⚪	E8 json duration_ms sum by service, namespace prod	1h	190 ms	188 ms	⚪ -1%	83 ms	2.27×	➖ differs (as base)
⚪	E9 logfmt latency_ms sum by service, namespace prod	1h	305 ms	307 ms	⚪ +1%	93 ms	3.30×	➖ differs (as base)
⚪	U1 json duration_ms sum by service	1h	84 ms	82 ms	⚪ -2%	17 ms	4.82×	➖ differs (as base)
⚪	U10 instant sum_over_time unwrap	instant	32 ms	39 ms	⚪ +22%	27 ms	1.44×	✅ same
⚪	U11 instant max_over_time missing label	instant	5 ms	5 ms	⚪ +0%	14 ms	0.36×	✅ same
⚪	U12 json duration_ms over every service	1h	237 ms	234 ms	⚪ -1%	47 ms	4.98×	➖ differs (as base)
⚪	U13 logfmt latency_ms over every service	1h	509 ms	516 ms	⚪ +1%	61 ms	8.46×	➖ differs (as base)
⚪	U14 duration() of a unit string	1h	43 ms	44 ms	⚪ +2%	7 ms	6.29×	➖ differs (as base)
⚪	U2 json duration_ms max by service	1h	93 ms	101 ms	⚪ +9%	39 ms	2.59×	➖ differs (as base)
⚪	U3 json duration_ms sliding sum	1h	83 ms	81 ms	⚪ -2%	33 ms	2.45×	➖ differs (as base)
⚪	U4 logfmt size_bytes sum by service	1h	53 ms	38 ms	⚪ -28%	8 ms	4.75×	➖ differs (as base)
⚪	U5 logfmt ttl unit string (no sample)	1h	39 ms	38 ms	⚪ -3%	6 ms	6.33×	✅ same
⚪	U6 missing label, no parser	1h	21 ms	20 ms	⚪ -5%	10 ms	2.00×	✅ same
⚪	U7 missing label, ungrouped sum	1h	19 ms	18 ms	⚪ -5%	10 ms	1.80×	✅ same
⚪	U8 rate of an unwrapped label	1h	88 ms	87 ms	⚪ -1%	15 ms	5.80×	✅ same
⚪	U9 bytes() conversion	1h	50 ms	54 ms	⚪ +8%	11 ms	4.91×	➖ differs (as base)

Cold (first-run) timings — what a user opening a panel sees

shape	range	base cold	PR cold	Loki cold	PR ÷ Loki cold
drilldown service landing	1h	40 ms	39 ms	566 ms	0.07×
instant json filtered	instant	10 ms	14 ms	73 ms	0.19×
instant json volume	instant	32 ms	39 ms	101 ms	0.39×
instant ungrouped rate	instant	9 ms	9 ms	74 ms	0.12×
json rate by level (no filter, no drop)	1h	400	400	400	—
json volume no filters	1h	204 ms	201 ms	897 ms ↺	0.22×
logs plain	1h	96 ms	97 ms	116 ms	0.84×
logs | json	1h	140 ms	141 ms	68 ms	2.07×
stream-label count by app	1h	25 ms	25 ms	557 ms	0.04×
topk rate by app	1h	50 ms	51 ms	828 ms	0.06×
X1 json filter level_extracted, by level	1h	3.64 s	3.77 s	893 ms	4.23×
X2 json group by level_extracted	1h	330 ms	323 ms	725 ms	0.45×
X3 json rate, level_extracted equality	1h	302 ms	294 ms	525 ms	0.56×
X4 json bytes, level_extracted regexp	1h	416 ms	434 ms	638 ms	0.68×
X5 logfmt filter level_extracted, by level	1h	687 ms	694 ms	1.03 s	0.67×
E1 logs, json parser over stream labels	1h	80 ms	69 ms	66 ms	1.05×
E2 logs, logfmt parser over stream labels	1h	43 ms	59 ms	52 ms	1.13×
E3 logs, json, existence filter on level_extracted	1h	98 ms	86 ms	204 ms	0.42×
E4 logs, logfmt, existence filter on level_extracted	1h	57 ms	63 ms	53 ms	1.19×
E5 logs, json, drop level_extracted	1h	85 ms	74 ms	60 ms	1.23×
E6 logfmt count by level_extracted	1h	82 ms	60 ms	65 ms	0.92×
E7 json count by level_extracted	1h	1.41 s	1.43 s	230 ms	6.20×
E8 instant logfmt by level_extracted	instant	7 ms	7 ms	9 ms	0.78×
A explore volume, 2 filters, drop	1h	2.14 s	1.39 s	1.34 s	1.03×
B grouped sum, filter, no drop	1h	192 ms	172 ms	1.17 s	0.15×
C ungrouped sum, filter, no drop	1h	123 ms	122 ms	626 ms	0.19×
D volume, no filters	1h	229 ms	209 ms	897 ms	0.23×
F field breakdown service_version (explore)	1h	1.34 s	1.37 s	716 ms	1.91×
H field breakdown service_version (drilldown)	1h	127 ms	123 ms	726 ms	0.17×
I grafana volume of B	1h	112 ms	109 ms	609 ms	0.18×
O2 explore log volume (Grafana form), underscore structured-metadata filter	1h	162 ms	152 ms	603 ms	0.25×
DL2 drilldown field breakdown, level + stream-label filter before json	1h	50 ms	52 ms	25 ms	2.08×
DL6 explore volume, level filter before json	1h	215 ms	200 ms	615 ms	0.33×
P1 logs, json, level equals	1h	137 ms	126 ms	88 ms	1.43×
P2 logs, logfmt, level not equal	1h	31 ms	31 ms	38 ms	0.82×
P3 logs, json, level existence	1h	153 ms	120 ms	81 ms	1.48×
P4 logfmt count by level	1h	32 ms	31 ms	51 ms	0.61×
P5 json count by level	1h	91 ms	89 ms	188 ms	0.47×
P6 json count, level filter	1h	14 ms	14 ms	171 ms	0.08×
P7 json rate by level, level regexp	1h	16 ms	15 ms	189 ms	0.08×
P8 json count by a name that is no stream label	1h	95 ms	98 ms	153 ms	0.64×
P9 instant logfmt by level	instant	5 ms	11 ms	9 ms	1.22×
E1 json duration_ms sum by service	1h	92 ms	85 ms	221 ms	0.38×
E2 json duration_ms p95 by service	1h	255 ms	263 ms	220 ms	1.20×
E3 logfmt latency_ms rate, production	1h	500 ms	500 ms	1.00 s	0.50×
E4 logfmt size_bytes max by service	1h	46 ms	45 ms	197 ms	0.23×
E5 json duration_ms sum, instant	instant	37 ms	36 ms	25 ms	1.44×
E6 logfmt ttl unit string (Loki 400)	1h	400	400	400	—
E7 json hexadecimal trace_id (Loki 400)	1h	400	400	400	—
E8 json duration_ms sum by service, namespace prod	1h	188 ms	183 ms	852 ms	0.21×
E9 logfmt latency_ms sum by service, namespace prod	1h	302 ms	323 ms	695 ms	0.46×
U1 json duration_ms sum by service	1h	123 ms	102 ms	171 ms	0.60×
U10 instant sum_over_time unwrap	instant	36 ms	38 ms	27 ms	1.41×
U11 instant max_over_time missing label	instant	5 ms	5 ms	14 ms	0.36×
U12 json duration_ms over every service	1h	235 ms	234 ms	634 ms	0.37×
U13 logfmt latency_ms over every service	1h	515 ms	540 ms	925 ms	0.58×
U14 duration() of a unit string	1h	43 ms	42 ms	41 ms	1.02×
U2 json duration_ms max by service	1h	91 ms	95 ms	684 ms	0.14×
U3 json duration_ms sliding sum	1h	89 ms	93 ms	188 ms	0.49×
U4 logfmt size_bytes sum by service	1h	52 ms	52 ms	45 ms	1.16×
U5 logfmt ttl unit string (no sample)	1h	40 ms	39 ms	39 ms	1.00×
U6 missing label, no parser	1h	21 ms	23 ms	66 ms	0.35×
U7 missing label, ungrouped sum	1h	19 ms	18 ms	70 ms	0.26×
U8 rate of an unwrapped label	1h	94 ms	83 ms	306 ms	0.27×
U9 bytes() conversion	1h	53 ms	51 ms	48 ms	1.06×

↺ Loki cold taken from the first set that ran the same query; Loki's cache answered this one.

Why these shapes

• internal/proxy/unwrap_conversion_error.go → 59: control/instant json filtered, control/instant json volume, control/json rate by level (no filter, no drop), control/json volume no filters, extracted-pushdown/X1 json filter level_extracted, by level, extracted-pushdown/X2 json group by level_extracted, extracted-pushdown/X3 json rate, level_extracted equality, extracted-pushdown/X4 json bytes, level_extracted regexp …
• control smoke → 8: control/drilldown service landing, control/instant ungrouped rate, control/json rate by level (no filter, no drop), control/json volume no filters, control/logs plain, control/logs | json, control/stream-label count by app, control/topk rate by app

_{base 80e94721f7 → PR 9e01126aa6 · 4 runs (first is cold), warm p50 · ranges 1h · noise ±30% and 100 ms · VictoriaLogs restarts 0→0 · 7.6 min. Same runner, one fresh stack, targets interleaved per request. How to read and reproduce: bench/ab/README.md.}

[github-actions]

✅ Visual smoke: passed with warnings

Base 80e94721f7 vs PR 7116d0ba32, Grafana through the proxy builds and Loki on one fresh stack; run.
Core set: 5 capture(s) at 1h. Detailed set: 14 entries (explore-A, explore-B, explore-C, explore-F, explore-logs-extracted, explore-extracted-metric, explore-extracted-filter-metric, explore-extracted-group-metric, ...). 19 capture(s), 15m/1h/6h, 24h and 7d stay out of PR runs.
Trimmed to the 1h range for the capture budget: explore-A, explore-B, explore-C, explore-F, explore-logs-extracted, explore-extracted-metric, explore-extracted-filter-metric, explore-extracted-group-metric, explore-logs-plain-level, explore-plain-level-metric, explore-unwrap-sum, explore-unwrap-unit-string, explore-unwrap-missing-label, explore-unwrap-conversion-error.

page	range	set	base = PR (data)	vs Loki (PR)	pixel diff	result
dd-fields	1h	core	✅ identical	identical (4 explained, 1 history-dependent)	0.12%	⚠️ history-dependent difference, not gated (1): resource /api/datasources/uid/*/res
dd-landing	1h	core	✅ identical	identical (3 explained)	2.16%	✅
dd-service-logs	1h	core	✅ identical	identical (3 explained, 1 history-dependent)	0.12%	⚠️ history-dependent difference, not gated (1): resource /api/datasources/uid/*/res
explore-logs-plain	1h	core	✅ identical	identical (1 explained)	0.07%	✅
explore-metric-plain	1h	core	✅ identical	identical (1 explained)	0.04%	✅
explore-A	1h	detailed	✅ identical	identical (1 explained)	0.04%	✅
explore-B	1h	detailed	✅ identical	identical (1 explained)	0.04%	✅
explore-C	1h	detailed	✅ identical	identical (1 explained)	0.04%	✅
explore-F	1h	detailed	✅ identical	identical (1 explained)	0.04%	✅
explore-extracted-filter-metric	1h	detailed	✅ identical	identical (1 explained)	0.04%	✅
explore-extracted-group-metric	1h	detailed	✅ identical	identical (1 explained)	0.04%	✅
explore-extracted-metric	1h	detailed	✅ identical	identical (1 explained)	0.04%	✅
explore-logs-extracted	1h	detailed	✅ identical	identical (1 explained)	0.07%	✅
explore-logs-plain-level	1h	detailed	✅ identical	identical (2 explained)	0.07%	✅
explore-plain-level-metric	1h	detailed	✅ identical	identical (1 explained)	0.04%	✅
explore-unwrap-conversion-error	1h	detailed	✅ identical	identical (1 explained)	0.04%	✅
explore-unwrap-missing-label	1h	detailed	✅ identical	identical (1 explained)	0.04%	✅
explore-unwrap-sum	1h	detailed	✅ identical	1 difference(s), 1 on base too; 1 explained	0.04%	✅
explore-unwrap-unit-string	1h	detailed	✅ identical	identical (1 explained)	0.04%	✅

Gate: a base-vs-PR data difference passes when the PR is closer to Loki, and fails when the PR diverges from Loki or Loki cannot decide it (at a range Loki does not hold, a difference passes when the same page proved it closer to Loki at a shorter range; otherwise label the pull request visual-change-expected to accept an intended change). Also failing: a panel empty on the PR but not on the base, an error banner, panel error, error answer or new "No data" panel on the PR, a PR side that never settled, a difference that did not reproduce on the recapture. Pixel differences only warn.

dd-fields-1h: history-dependent difference, not gated (1): resource /api/datasources/uid/*/resources/patterns?end=2026-10-22T05%3A49%3

• history-dependent difference, not gated (1): resource /api/datasources/uid/*/resources/patterns?end=2026-10-22T05%3A49%3A00.000Z&query=%7Bservic: body: content differs (rows 5 vs 2)
• vs Loki, explained: query ('sum by (service_name_extracted) (count_over_time({service_name="otel-collector"} | servi: request only on one side (right) -- explained: Loki's _extracted suffix for a key named like a stream label, where the build does not return it (detected_fields: open, semantics/detected-fields-extracted-suffix; service/service.name: owner decision)
• vs Loki, explained: resource /api/datasources/uid/*/resources/detected_fields?end=2026-10-22T05%3A49%3A00.000Z&query=%7: body: content differs (rows 13 vs 15) -- explained: Loki's _extracted suffix for a key named like a stream label, where the build does not return it (detected_fields: open, semantics/detected-fields-extracted-suffix; service/service.name: owner decision); the proxy also returns data, status; Loki lists fields in no fixed order
• vs Loki, explained: resource /api/datasources/uid/*/resources/detected_labels?end=2026-10-22T05%3A49%3A00.000Z&query=%7: body: content differs (rows 9 vs 9) -- explained: sampled cardinality: Loki counts every stream its ingesters hold, not the requested window (pkg/ingester/instance.go LabelsWithValues), the proxy the window's last 5 minutes (metadataMaxFieldNamesWindow); the label names match; the proxy also returns data, limit, status; Loki lists labels in no fixed order
• vs Loki, explained: resource /api/datasources/uid/*/resources/drilldown-limits: body: content differs (rows 0 vs 0) -- explained: configuration probe: each backend publishes its own limits, version and settings (the proxy's pattern persistence)

dd-service-logs-1h: history-dependent difference, not gated (1): resource /api/datasources/uid/*/resources/patterns?end=2026-10-22T05%3A49%3

• history-dependent difference, not gated (1): resource /api/datasources/uid/*/resources/patterns?end=2026-10-22T05%3A49%3A00.000Z&query=%7Bservic: body: content differs (rows 5 vs 2)
• vs Loki, explained: resource /api/datasources/uid/*/resources/detected_fields?end=2026-10-22T05%3A49%3A00.000Z&query=%7: body: content differs (rows 13 vs 15) -- explained: Loki's _extracted suffix for a key named like a stream label, where the build does not return it (detected_fields: open, semantics/detected-fields-extracted-suffix; service/service.name: owner decision); the proxy also returns data, status; Loki lists fields in no fixed order
• vs Loki, explained: resource /api/datasources/uid/*/resources/detected_labels?end=2026-10-22T05%3A49%3A00.000Z&query=%7: body: content differs (rows 9 vs 9) -- explained: sampled cardinality: Loki counts every stream its ingesters hold, not the requested window (pkg/ingester/instance.go LabelsWithValues), the proxy the window's last 5 minutes (metadataMaxFieldNamesWindow); the label names match; the proxy also returns data, limit, status; Loki lists labels in no fixed order
• vs Loki, explained: resource /api/datasources/uid/*/resources/drilldown-limits: body: content differs (rows 0 vs 0) -- explained: configuration probe: each backend publishes its own limits, version and settings (the proxy's pattern persistence)

Core set montages (3): base | PR | Loki

dd-landing-1h

explore-logs-plain-1h

explore-metric-plain-1h

All montages of this run: pr-visuals/pr-804.

[github-actions]

PR Quality Report

Compared against base branch main.

Coverage and tests

Signal	Base	PR	Delta
Test count	11826	11827	1
Coverage	88.3%	88.3%	0.0% (stable)

Compatibility

Track	Base	PR	Delta
Loki API	100.0%	11/11 (100.0%)	0.0% (stable)
Logs Drilldown	100.0%	17/17 (100.0%)	0.0% (stable)
VictoriaLogs	100.0%	11/11 (100.0%)	0.0% (stable)

Performance smoke

Lower CPU cost (ns/op) is better. Lower benchmark memory cost (B/op, allocs/op) is better. Higher throughput is better. Lower load-test memory growth is better. Benchmark rows are medians from repeated samples.

Signal	Base	PR	Delta
QueryRange cache-hit CPU cost	3552.0 ns/op	3499.0 ns/op	-1.5% (stable)
QueryRange cache-hit memory	1240.0 B/op	1240.0 B/op	0.0% (stable)
QueryRange cache-hit allocations	27.0 allocs/op	27.0 allocs/op	0.0% (stable)
QueryRange cache-bypass CPU cost	4283.0 ns/op	4151.0 ns/op	-3.1% (stable)
QueryRange cache-bypass memory	1305.0 B/op	1303.0 B/op	-0.2% (stable)
QueryRange cache-bypass allocations	27.0 allocs/op	27.0 allocs/op	0.0% (stable)
Labels cache-hit CPU cost	898.9 ns/op	921.9 ns/op	+2.6% (stable)
Labels cache-hit memory	48.0 B/op	48.0 B/op	0.0% (stable)
Labels cache-hit allocations	3.0 allocs/op	3.0 allocs/op	0.0% (stable)
Labels cache-bypass CPU cost	1515.0 ns/op	1531.0 ns/op	+1.1% (stable)
Labels cache-bypass memory	400.0 B/op	399.0 B/op	-0.2% (stable)
Labels cache-bypass allocations	14.0 allocs/op	14.0 allocs/op	0.0% (stable)

State

• Coverage, compatibility, and sampled performance are reported here from the same PR workflow.
• This is a delta report, not a release gate by itself. Required checks still decide merge safety.
• Performance is a smoke comparison, not a full benchmark lab run.
• Delta states use the same noise guards as the quality gate (percent + absolute + low-baseline checks), so report labels match merge-gate behavior.