菜单
Sync CWS BTFHub constants after adding a new constantfetch offset, so pre-BTF kernels can resolve it. Use when KMT secagent jobs log "failed to fetch constant for <name>".
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
基于 SOC 职业分类
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/DataDog/datadog-agent --skill cws-btfhub-sync命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
| name | cws-btfhub-sync |
| description | Sync CWS BTFHub constants after adding a new constantfetch offset, so pre-BTF kernels can resolve it. Use when KMT secagent jobs log "failed to fetch constant for <name>". |
| allowed-tools | Read, Grep, Bash, AskUserQuestion |
| model | sonnet |
A new appendOffsetofRequest in probe_ebpf.go resolves via BTF on modern kernels, but
pre-BTF kernels read the offset from the checked-in, arch-split constants:
pkg/security/probe/constantfetch/constants_amd64.jsonpkg/security/probe/constantfetch/constants_arm64.jsonThese predate your change and so lack the new entry. Regenerating them is the fix.
gh workflow run cws-btfhub-sync.yml --ref main -f base_branch=<your-feature-branch>
The trap: --ref selects the workflow definition — keep it main. base_branch is the
ref the generate and combine jobs check out, and the base of the PR it opens. Leave
base_branch at its main default and the generator never sees your new offset requests: the
sync yields an empty diff and it looks like btfhub simply lacks the offsets.
Before running, confirm the failing distros are covered by the cone matrix in
.github/workflows/cws-btfhub-sync.yml.
It is a ~15-job matrix and takes tens of minutes. Poll it from a background shell so the wait costs nothing and you get re-invoked on exit:
until [ "$(gh run view <run-id> --json status -q .status)" = completed ]; do sleep 60; done
gh run view <run-id> --json conclusion -q .conclusion
Do not run gh run watch in the foreground (it outlives the tool timeout) and do not chain
short sleeps in the main loop. When the notification arrives, carry straight on to Land it
in the same turn — this is one task, not a hand-off.
On success the workflow opens a PR titled CWS: sync BTFHub constants from a
cws/constants-sync-* branch, targeting your branch:
gh pr list --search "CWS: sync BTFHub constants" --state open --json number,baseRefName,url
From the list, select the that has the baseRefName equal to this feature branch and
merge it directly (gh pr merge <number> --merge); feature branches carry no protection rule,
so this needs no approval.
Confirm the merged commit touches btfhub/constants.json and that your new offset names appear
in the diff.
Monitor the current PR's GitLab pipeline to completion, then report success or investigate a failure. Use when the user asks to follow, babysit, watch, or wait on a PR/pipeline, or just after pushing to / creating a PR.
Classify a failed CI as either caused by an active incident, flakiness, or a true code regression. Use when a PR's pipeline is red and it isn't obvious whether the PR's own changes are at fault. Trigger phrases include: - "investigate this CI failure" - "please fix CI" - "why did this job fail" - "is there an incident affecting CI" - "should I retry this" This should also be invoked whenever the user asks you to investigate _or fix_ a failing CI, to ensure we don't spend hours trying to fix something broken upstream.
Write or extend Datadog Agent new-e2e tests, including fakeintake coverage and the GitLab wiring that runs them; derives scope from the current diff when no target is named. Not for running tests that already exist (run-e2e, run-windows-e2e), or for judging whether a behavior belongs in E2E at all (e2e-audit).