chore(asm): keep trace without events if waf decides

.github/workflows/system-tests.yml

@@ -11,33 +11,6 @@ on:
     - cron: '00 04 * * 2-6'
 
 jobs:
-  system-tests-build-agent:
-    runs-on: ubuntu-latest
-    steps:
-
-      - name: Checkout system tests
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-          repository: 'DataDog/system-tests'
-          # Automatically managed, use scripts/update-system-tests-version to update
-          ref: '64afc5f8c1c2aa19adefdf1abf5559b62af8e784'
-
-      - name: Build agent
-        run: ./build.sh -i agent
-
-      - name: Save
-        id: save
-        run: |
-          docker image save system_tests/agent:latest | gzip > agent_${{ github.sha }}.tar.gz
-
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: agent_${{ github.sha }}
-          path: |
-            agent_${{ github.sha }}.tar.gz
-          retention-days: 2
-
   system-tests-build-weblog:
     runs-on: ubuntu-latest
     strategy:
@@ -69,7 +42,7 @@ jobs:
           persist-credentials: false
           repository: 'DataDog/system-tests'
           # Automatically managed, use scripts/update-system-tests-version to update
-          ref: '64afc5f8c1c2aa19adefdf1abf5559b62af8e784'
+          ref: '40654a690db784079c5969bfc0a6031964f833a8'
 
       - name: Checkout dd-trace-py
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -98,7 +71,7 @@ jobs:
 
   system-tests:
     runs-on: ubuntu-latest
-    needs: [system-tests-build-agent, system-tests-build-weblog]
+    needs: [system-tests-build-weblog]
     strategy:
       matrix:
         weblog-variant: [flask-poc, uwsgi-poc , django-poc, fastapi, python3.12, django-py3.13]
@@ -123,7 +96,7 @@ jobs:
           persist-credentials: false
           repository: 'DataDog/system-tests'
           # Automatically managed, use scripts/update-system-tests-version to update
-          ref: '64afc5f8c1c2aa19adefdf1abf5559b62af8e784'
+          ref: '40654a690db784079c5969bfc0a6031964f833a8'
 
       - name: Build runner
         uses: ./.github/actions/install_runner
@@ -133,16 +106,10 @@ jobs:
           name: ${{ matrix.weblog-variant }}_${{ github.sha }}
           path: images_artifacts/
 
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          name: agent_${{ github.sha }}
-          path: images_artifacts/
-
       - name: docker load
         id: docker_load
         run: |
           docker load < images_artifacts/${{ matrix.weblog-variant}}_weblog_${{ github.sha }}.tar.gz
-          docker load < images_artifacts/agent_${{ github.sha }}.tar.gz
 
       - name: Run DEFAULT
         if: always() && steps.docker_load.outcome == 'success' && matrix.scenario == 'other'
@@ -310,7 +277,7 @@ jobs:
           persist-credentials: false
           repository: 'DataDog/system-tests'
           # Automatically managed, use scripts/update-system-tests-version to update
-          ref: '64afc5f8c1c2aa19adefdf1abf5559b62af8e784'
+          ref: '40654a690db784079c5969bfc0a6031964f833a8'
       - name: Checkout dd-trace-py
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:

ddtrace/appsec/_processor.py

@@ -323,9 +323,7 @@ def _waf_action(
             _asm_request_context.set_blocked(blocked)
 
         allowed = True
-        if waf_results.data or blocked:
-            # We run the rate limiter only if there is an attack,
-            # its goal is to limit the number of collected asm events
+        if waf_results.keep:
             allowed = self._rate_limiter.is_allowed()
 
         _asm_request_context.set_waf_telemetry_results(
@@ -336,9 +334,6 @@ def _waf_action(
             not allowed,
         )
 
-        if not allowed:
-            return waf_results
-
         if waf_results.data:
             _asm_request_context.store_waf_results_data(waf_results.data)
             if blocked:
@@ -355,10 +350,12 @@ def _waf_action(
 
             # Right now, we overwrite any value that could be already there. We need to reconsider when ASM/AppSec's
             # specs are updated.
-            if waf_results.keep:
-                _asm_manual_keep(span)
             if span.get_tag(_ORIGIN_KEY) is None:
                 span.set_tag_str(_ORIGIN_KEY, APPSEC.ORIGIN_VALUE)
+
+        if waf_results.keep and allowed:
+            _asm_manual_keep(span)
+
         return waf_results
 
     def _is_needed(self, address: str) -> bool: