fix(ffe): stop raw-PII scan from matching digits in event timestamps

[vjfridge]

Test_FFE_EVP_Flagevaluation_ObserveFullData_Absent_Hashed and
Test_FFE_EVP_Flagevaluation_ObserveFullData_False_Hashed flaked on a
clock-driven schedule, independent of the library under test.

assert_no_raw_pii_in_event previously converted the complete event to a
serialized string and searched it for each forbidden value.
PII_ATTRIBUTES["org_id"] is the integer 1234. Its string representation
can occur by chance inside 13-digit millisecond timestamps. This caused a
clean event with timestamp 1788901234711 to fail even though the targeting
key was hashed and the evaluation context was omitted.

Replace the serialized substring scan with a type-aware recursive scan.
String values and dictionary keys still use substring matching. Numeric
values use equality matching against numeric PII. This prevents 1234 from
matching part of a larger timestamp while preserving detection if an SDK
leaks 1234 into any numeric field or converts it to a string.

Keep PII_ATTRIBUTES unchanged so the cross-SDK fixture remains stable. Add
deterministic tests for the original timestamp collision, every generated
numeric event field, string conversion, dictionary keys, nested dictionaries,
and lists.

Verified with 11 focused TEST_THE_TEST cases, Ruff, formatting checks, and
Mypy.

[github-actions]

CODEOWNERS have been resolved as:

tests/test_the_test/test_ffe_pii_scan.py                                @DataDog/system-tests-core
tests/ffe/test_flag_eval_evp.py                                         @DataDog/feature-flagging-and-experimentation-sdk @DataDog/system-tests-core

[datadog-official]

 

⚠️ Warnings

❌ Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 6 Pipeline jobs failed

Testing the test | System Tests (golang, prod) / End-to-end #1 / chi 1 — ❌ 1 test failed

View more details · View in GitHub Actions

1 failed test. AssertionError: Timed out waiting for EVP flagevaluation count >= 12000 for flag 'evp-degradation-flag' in tests/ffe/test_flag_eval_evp.py:535.

Showing tests most relevant to this failure.

❄️ Known flaky: tests.ffe.test_flag_eval_evp.Test_FFE_EVP_Flagevaluation_Degradation.test_ffe_evp_flagevaluation_degradation[chi] from system_tests_suite

AssertionError: Timed out waiting for EVP flagevaluation count >= 12000 for flag evp-degradation-flag
assert False
 +  where False = <bound method ProxyBasedInterfaceValidator.wait_for of AgentInterfaceValidator('agent')>(<function wait_for_evp_flagevaluation_count.<locals>.<lambda> at 0x7f928daab1a0>, timeout=60)
 +    where <bound method ProxyBasedInterfaceValidator.wait_for of AgentInterfaceValidator('agent')> = AgentInterfaceValidator('agent').wait_for
 +      where AgentInterfaceValidator('agent') = interfaces.agent

self = <tests.ffe.test_flag_eval_evp.Test_FFE_EVP_Flagevaluation_Degradation object at 0x7f92be74de80>

    def test_ffe_evp_flagevaluation_degradation(self) -> None:
        for index, response in enumerate(self.responses):
...

Testing the test | System Tests (php, dev) / Build end-to-end (laravel11x) — 🔧 Needs a code fix, caused by this PR

View more details · View in GitHub Actions

Failed to read '/etc/apt/sources.list': No such file or directory while executing Dockerfile commands.

Testing the test | System Tests (php, dev) / Build end-to-end (symfony7x)

View more details · View in GitHub Actions

Sed command failed: can't read '/etc/apt/sources.list': No such file or directory in symfony7x.Dockerfile at line 10.

View all 6 failed jobs.

📋 Copy fix prompt

CI on my pull request is failing. Help me find and fix the root cause of each failing job below — they were flagged as caused by changes in this PR, so focus on the diff. For each job, explain the failure and propose a fix.

Before you start, set up the Datadog software-delivery tooling so you can
query the CI data yourself:

1. Check whether you already have the Datadog software-delivery MCP tools
   (e.g. a `search_datadog_ci_pipeline_events` tool) and the `unblock-pr` skill.
2. If either is missing, STOP and ask me for permission before installing
   anything. Do not install or run anything until I have said yes.
3. Only with my explicit approval, set up the Datadog software-delivery MCP
   server and skills by following:
     https://docs.datadoghq.com/getting_started/software_delivery_mcp_tools/
   then restart so the skill is picked up.
4. If I decline, skip all of the above and work from the context below alone.

Then run /unblock-pr — it will pull the CI data itself. The job context below is what we already know.

If /unblock-pr is not available — because I declined the setup above, or it did not install — work from the context below instead.

Datadog has already classified this failure as caused by changes in this PR.
Take that as given and work the fix:

1. Locate the change. Diff this branch against its base and find the change
   that produces this error. Explain the mechanism, don't just name a file:
     git fetch origin && git diff $(git merge-base origin/main HEAD)...HEAD
2. Reproduce it locally. Run the failing job's command or test before
   proposing anything.
3. Propose the smallest fix that addresses the root cause — not a workaround,
   not a broadened assertion, not a disabled or skipped test.
4. Re-run the same command to confirm, and say exactly what you ran.
5. If the failure turns out to be intermittent rather than deterministic, say
   so plainly instead of "fixing" it — that is a flaky test, and patching it
   hides the problem.

If the right move is to re-run the job rather than change code, use the job
link in the context below. For GitHub Actions: `gh run rerun <run-id> --failed`,
where the run ID is the number after `/runs/` in that URL (not the trailing
number, which is the job ID).

Branch: vickie/ffe-fix-pii-substring-flake

Testing the test | System Tests (php, dev) / Build end-to-end (laravel11x)
Commit: 90b681cf017ebdf125b8c0c2d2969129d7e56703
Error (code / build):
Failed to read '/etc/apt/sources.list': No such file or directory while executing Dockerfile commands.
CI job: https://github.com/DataDog/system-tests/actions/runs/34403888255/job/102643600825

ℹ️ Info

No other issues found (see more)

❄️ No new flaky tests detected

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 0b882eb | Docs | View more details | Give us feedback!}