Merge branch 'main' of github.com:DataDog/datadog-agent into kfairise/auto-workspace-update

Author: KevinFairise2

.bazelrc

@@ -17,6 +17,7 @@ common --@rules_python//python/config_settings:bootstrap_impl=script # https://g
 common --check_direct_dependencies=error # Escalate any bypassed `bazel_dep` to a resolution failure
 common --enable_platform_specific_config # Supported OS identifiers are linux, macos, windows, freebsd, and openbsd
 common --experimental_disk_cache_gc_max_size=5G # Cap applied whenever --disk_cache is also set, no-op otherwise
+common --experimental_proto_descriptor_sets_include_source_info # Preserve comments in generated pb.go
 common --experimental_strict_repo_env # Do not leak uncontrolled environment variables into repository rules
 common --experimental_ui_max_stdouterr_bytes=1073741819 # why?
 common --http_timeout_scaling=3.0 # At least one attempt reaches 30s (3,6,12,24,30,30,30,30) instead of only 10s (1,2,4,8,10,10,10,10)
@@ -39,17 +40,17 @@ common:lint --aspects=@rules_rust//rust:defs.bzl%rust_clippy_aspect --output_gro
 common:lint --aspects=@rules_rust//rust:defs.bzl%rustfmt_aspect --output_groups=+rustfmt_checks
 
 # Linux config ---------------------------------------------------------------------------------------------------------
-common:linux --credential_helper=*.us1.ddbuild.io=%workspace%/bazel/tools/credential-helper
+common:linux --credential_helper=buildbarn-edge-cache.buildbarn.local-cluster.local-dc.fabric.dog=%workspace%/bazel/tools/credential-helper
 common:linux --strategy=sandboxed
 
 # macOS config ---------------------------------------------------------------------------------------------------------
-common:macos --credential_helper=*.us1.ddbuild.io=%workspace%/bazel/tools/credential-helper
+common:macos --credential_helper=buildbarn-edge-cache.buildbarn.local-cluster.local-dc.fabric.dog=%workspace%/bazel/tools/credential-helper
 common:macos --features=-macos_default_link_flags # https://github.com/bazelbuild/bazel/issues/23312
 common:macos --macos_minimum_os=12.0 # Keep in sync with https://docs.datadoghq.com/agent/supported_platforms/?tab=macos
 common:macos --strategy=sandboxed
 
 # Windows config -------------------------------------------------------------------------------------------------------
-common:windows --credential_helper=*.us1.ddbuild.io=%workspace%/bazel/tools/credential-helper.bat
+common:windows --credential_helper=buildbarn-edge-cache.buildbarn.local-cluster.local-dc.fabric.dog=%workspace%/bazel/tools/credential-helper.bat
 common:windows --strategy=standalone # Valid values are: [dynamic_worker, standalone, dynamic, remote, worker, local]
 # rules_python 1.9.0 transitions enable_runfiles to `true` for every py_ target on Windows. Pre-setting it here makes
 # that transition a no-op, so Bazel deduplicates python_win and avoids 2 concurrent MSBuild racing on shared resources.
@@ -61,14 +62,15 @@ common:windows --repo_env=SYSTEMROOT # used by COM to load system DLLs, needed b
 common:windows --repo_env=USERPROFILE # used by MSYS2 bash to emulate HOME, needed by git to fetch repositories
 common:windows --repo_env=VSTUDIO_ROOT # visual_studio(path_variable) in MODULE.bazel
 common:windows --shell_executable=C:/tools/msys64/usr/bin/bash.exe
+
 # Force the x86_64-pc-windows-gnu Rust toolchain (compact name for rust_windows_gnu_x86_64)
 # to take priority over the default MSVC toolchain, since the CI cc_toolchain is MinGW/GCC.
 common:windows --extra_toolchains=@rust_toolchains//:rw-2070622084
 
 # Remote cache config --------------------------------------------------------------------------------------------------
 # datadog-agent virtually isolates caching instance from its parent (which is remote-caching).
 # If entry isn't found in datadog-agent, it will be searched in remote-caching.
-common:cache --remote_cache=grpcs://buildbarn-frontend.us1.ddbuild.io:443
+common:cache --remote_cache=grpc://buildbarn-edge-cache.buildbarn.local-cluster.local-dc.fabric.dog:443
 common:cache --remote_instance_name=ci/datadog-agent
 common:cache --remote_local_fallback # best-effort on transient connection errors (no such host)
 common:cache --incompatible_remote_local_fallback_for_remote_cache # works only if --remote_local_fallback is also set

.claude-plugins/datadog-agent-gopls/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "datadog-agent-gopls",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Go LSP (gopls) pre-configured for the datadog-agent repository with build tags and performance flags",
   "author": {
     "name": "L\u00e9na\u00efc Huard",
@@ -14,7 +14,7 @@
       },
       "initializationOptions": {
         "build.buildFlags": [
-          "-tags=cel,clusterchecks,consul,containerd,cri,crio,datadog.no_waf,docker,ec2,etcd,fargateprocess,grpcnotrace,jetson,jmx,kubeapiserver,kubelet,linux_bpf,ncm,netcgo,netgo,no_dynamic_plugins,npm,nvml,oracle,orchestrator,osusergo,otlp,pcap,podman,python,retrynotrace,seclmax,serverless,sharedlibrarycheck,systemd,systemprobechecks,test,trivy,trivy_no_javadb,zk,zlib,zstd",
+          "-tags=cel,clusterchecks,consul,containerd,cri,crio,datadog.no_waf,docker,ec2,etcd,fargateprocess,grpcnotrace,jetson,jmx,kubeapiserver,kubelet,linux_bpf,ncm,netcgo,netgo,no_dynamic_plugins,npm,nvml,oracle,orchestrator,osusergo,otlp,pcap,podman,python,remove_all_sd,retrynotrace,seclmax,serverless,sharedlibrarycheck,systemd,systemprobechecks,test,trivy,trivy_no_javadb,zk,zlib,zstd",
           "-buildvcs=false"
         ],
         "formatting.local": "github.com/DataDog/datadog-agent"

.claude/skills/create-pr/SKILL.md

@@ -10,26 +10,34 @@ Create a pull request for the current branch following the Datadog Agent contrib
 
 ## Instructions
 
-1. **Check the current branch** and ensure it's not `main`
+1. **Check the current branch**. If the current branch is `main` (or the default branch):
+   - Check for uncommitted or staged changes (`git status`). If there are changes, create a new feature branch from the default branch (`git checkout -b <branch-name>`), stage the changes, commit, and push.
+   - If there are no changes at all, stop and inform the user there is nothing to open a PR for.
 2. **Get the commits** on this branch compared to `main` using `git log main..HEAD`
 3. **Get the diff** using `git diff main..HEAD` to understand all changes
 4. **Read the PR template** from `.github/PULL_REQUEST_TEMPLATE.md`
-5. **Push the branch** to origin if needed
-6. **Open the PR**: By default, open as **Draft** using `gh pr create --draft`. If `$ARGUMENTS` contains `--real`, open as a regular (non-draft) PR instead (omit the `--draft` flag). Remove `--real` from `$ARGUMENTS` before processing remaining arguments as labels.
-7. **PR title**: Use [conventional commits](https://www.conventionalcommits.org/en/v1.0.0/) format, prefixed with the general area of change. Examples:
+5. **Codex review** (optional): Check if `codex` is installed (`command -v codex`). If it is, run a review against the default branch:
+   ```bash
+   DEFAULT_BRANCH=$(git rev-parse --abbrev-ref origin/HEAD | sed 's|^origin/||')
+   codex review --base "$DEFAULT_BRANCH"
+   ```
+   Show the review output to the user. If codex is not installed, skip this step silently.
+6. **Push the branch** to origin if needed
+7. **Open the PR**: By default, open as **Draft** using `gh pr create --draft`. If `$ARGUMENTS` contains `--real`, open as a regular (non-draft) PR instead (omit the `--draft` flag). Remove `--real` from `$ARGUMENTS` before processing remaining arguments as labels.
+8. **PR title**: Use [conventional commits](https://www.conventionalcommits.org/en/v1.0.0/) format, prefixed with the general area of change. Examples:
    - `fix(e2e): Fix flaky diagnose test`
    - `feat(logs): Add new log pipeline`
    - `refactor(config): Simplify endpoint resolution`
-8. **Labels**: Choose appropriate labels (plus any additional labels passed as $ARGUMENTS):
+9. **Labels**: Choose appropriate labels (plus any additional labels passed as $ARGUMENTS):
    - If the PR only changes tests, docs, CI config, or developer tooling (no Agent binary code changes), use `changelog/no-changelog` and `qa/no-code-change`
    - If the PR changes Agent binary code and QA was done, use `qa/done`
    - If the PR changes Agent binary code, a reno release note is expected (remind the user)
    - Add `backport/<branch-name>` if the user asks for a backport
-9. **PR body**: Fill in the PR template sections:
+10. **PR body**: Fill in the PR template sections:
    - **What does this PR do?**: A clear description of what is changed. Must be readable independently, tying back to the changed code.
    - **Motivation**: A reason why the change is made. Point to an issue if applicable. Include drawbacks or tradeoffs if any.
    - **Describe how you validated your changes**: How you validated the change (tests added/run, benchmarks, manual testing). Only needed when testing included work not covered by test suites.
-   - **Additional Notes**: Any extra context, links to predecessor PRs if part of a chain, notes that make code understanding easier.
+   - **Additional Notes**: Any extra context, links to predecessor PRs if part of a chain, notes that make code understanding easier. **Only include this section if there is genuinely useful context to add** — omit it entirely rather than filling it with filler.
 
 ## PR Description Guidelines (from CONTRIBUTING.md)
 

.ddqa/config.toml

@@ -18,6 +18,14 @@ github_team = "agent-metric-pipelines"
 github_labels = ["team/agent-metric-pipelines"]
 exclude_members = [""]
 
+[teams."Agent Data Plane"]
+jira_project = "DADP"
+jira_issue_type = "Task"
+jira_statuses = ["To Do", "In Progress", "Done"]
+github_team = "agent-data-plane"
+github_labels = ["team/agent-data-plane"]
+exclude_members = [""]
+
 [teams."Agent Runtimes"]
 jira_project = "AGENTRUN"
 jira_issue_type = "QA"

.devcontainer/datadog/default/devcontainer.json

@@ -1,4 +1,4 @@
-// This devcontainer directs workspaces to use a pre-built image.  To make
+// This devcontainer directs workspaces to use a pre-built image. To make
 // configuration changes, edit prebuild-devcontainer.json in this folder instead
 {
     "image": "registry.ddbuild.io/workspaces/prebuilt/datadog-agent@sha256:d18c23b7116fc84c9c7b04906c34df25b32dfd02f79df1e510e52dd65b19476e"

.devcontainer/datadog/default/features/datadog-agent/install.sh

@@ -16,6 +16,5 @@ install -m 755 "$featureDir/lifecycle/postCreate.sh" /opt/doghome/devcontainer/f
 # File name convention *-workspace-env.sh is important:
 # /etc/zsh/zshenv sources these files.
 cat > /etc/profile.d/10-ddagent-workspace-env.sh << 'EOF'
-export PATH="/usr/local/go/bin:$PATH"
-export PATH="$HOME/go/bin:$PATH"
+export PATH="/usr/local/go/bin:$HOME/go/bin:$PATH"
 EOF

.github/CODEOWNERS

@@ -583,7 +583,6 @@
 /pkg/procmgr/                           @DataDog/agent-runtimes
 /pkg/procmgr/rust/src/platform/windows.rs          @DataDog/agent-runtimes @DataDog/windows-products
 /pkg/procmgr/rust/src/transport/named_pipe.rs       @DataDog/agent-runtimes @DataDog/windows-products
-/pkg/procmgr/rust/src/bins/dd-procmgr-service.rs    @DataDog/agent-runtimes @DataDog/windows-products
 /pkg/privateactionrunner/               @DataDog/action-platform
 /pkg/privateactionrunner/bundles/remoteaction/networks  @DataDog/action-platform @Datadog/network-path
 /pkg/proto/                             @DataDog/agent-runtimes
@@ -800,8 +799,7 @@
 /tasks/unit_tests/testdata/components_src/ @DataDog/agent-runtimes
 /tasks/unit_tests/testdata/collector/   @DataDog/opentelemetry-agent
 /tasks/unit_tests/experimental_gates_tests.py @DataDog/agent-build
-/tasks/unit_tests/static_quality_gates_tests.py @DataDog/agent-build
-/tasks/unit_tests/static_quality_gates_reporter_tests.py @DataDog/agent-build
+/tasks/unit_tests/static_quality_gates/    @DataDog/agent-build
 /tasks/installer.py                     @DataDog/fleet
 /tasks/host_profiler.py                 @DataDog/opentelemetry-agent @DataDog/profiling-full-host
 /test/                                  @DataDog/agent-devx

.github/workflows/backport-pr.yml

@@ -15,19 +15,24 @@ jobs:
     steps:
       - name: Get backport targets
         id: get-targets
+        env:
+          EVENT_ACTION: ${{ github.event.action }}
+          EVENT_LABEL_NAME: ${{ github.event.label.name }}
+          PR_LABEL_NAMES_JSON: ${{ toJson(github.event.pull_request.labels.*.name) }}
         run: |
           # For 'labeled' event, use just the added label
           # For 'closed' event, use all backport labels
-          if [[ "${{ github.event.action }}" == "labeled" ]]; then
-            if [[ "${{ github.event.label.name }}" == backport/* ]]; then
-              echo "targets=[\"${{ github.event.label.name }}\"]" >> $GITHUB_OUTPUT
+          if [[ "$EVENT_ACTION" == "labeled" ]]; then
+            if [[ "$EVENT_LABEL_NAME" =~ ^backport/([0-9]+\.[0-9]+\.x|main)$ ]]; then
+              targets=$(jq -cn --arg label "$EVENT_LABEL_NAME" '[$label]')
+              echo "targets=$targets" >> "$GITHUB_OUTPUT"
             else
-              echo "targets=[]" >> $GITHUB_OUTPUT
+              echo "targets=[]" >> "$GITHUB_OUTPUT"
             fi
           else
-            # Extract all backport/* labels as JSON array
-            targets=$(echo '${{ toJson(github.event.pull_request.labels.*.name) }}' | jq -c '[.[] | select(startswith("backport/"))]')
-            echo "targets=$targets" >> $GITHUB_OUTPUT
+            # Extract all well-formed backport/* labels as JSON array
+            targets=$(jq -c '[.[] | select(test("^backport/([0-9]+\\.[0-9]+\\.x|main)$"))]' <<< "$PR_LABEL_NAMES_JSON")
+            echo "targets=$targets" >> "$GITHUB_OUTPUT"
           fi
 
   backport:
@@ -46,10 +51,12 @@ jobs:
     steps:
       - name: Compute target branch
         id: target
+        env:
+          MATRIX_TARGET: ${{ matrix.target }}
         run: |
-          target="${{ matrix.target }}"
+          target="$MATRIX_TARGET"
           target_branch="${target/backport\//}"
-          echo "target_branch=$target_branch" >> $GITHUB_OUTPUT
+          echo "target_branch=$target_branch" >> "$GITHUB_OUTPUT"
 
       - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
         id: octo-sts

.gitignore

@@ -251,3 +251,6 @@ AUTO_JIRA.md
 # Devcontainer
 .devcontainer/
 !.devcontainer/datadog/default
+
+# Ignoring compressed schema
+pkg/config/schema/compressed/*.zstd

.gitlab-ci.yml

@@ -268,21 +268,21 @@ variables:
   # Build images versions
   # To use images from datadog-agent-buildimages dev branches, set the corresponding
   # SUFFIX variable to
-  CI_IMAGE_BTF_GEN: v107034079-0ba6ff53
+  CI_IMAGE_BTF_GEN: v109491709-17310930
   CI_IMAGE_BTF_GEN_SUFFIX: ""
-  CI_IMAGE_DOCKER_X64: v107034079-0ba6ff53
+  CI_IMAGE_DOCKER_X64: v109491709-17310930
   CI_IMAGE_DOCKER_X64_SUFFIX: ""
-  CI_IMAGE_DOCKER_ARM64: v107034079-0ba6ff53
+  CI_IMAGE_DOCKER_ARM64: v109491709-17310930
   CI_IMAGE_DOCKER_ARM64_SUFFIX: ""
-  CI_IMAGE_GITLAB_AGENT_DEPLOY: v107034079-0ba6ff53
+  CI_IMAGE_GITLAB_AGENT_DEPLOY: v109491709-17310930
   CI_IMAGE_GITLAB_AGENT_DEPLOY_SUFFIX: ""
-  CI_IMAGE_LINUX: v107034079-0ba6ff53
+  CI_IMAGE_LINUX: v109491709-17310930
   CI_IMAGE_LINUX_SUFFIX: ""
-  CI_IMAGE_RPM_X64: v107034079-0ba6ff53
+  CI_IMAGE_RPM_X64: v109491709-17310930
   CI_IMAGE_RPM_X64_SUFFIX: ""
-  CI_IMAGE_RPM_ARM64: v107034079-0ba6ff53
+  CI_IMAGE_RPM_ARM64: v109491709-17310930
   CI_IMAGE_RPM_ARM64_SUFFIX: ""
-  CI_IMAGE_RPM_ARMHF: v107034079-0ba6ff53
+  CI_IMAGE_RPM_ARMHF: v109491709-17310930
   CI_IMAGE_RPM_ARMHF_SUFFIX: ""
   CI_IMAGE_WIN_LTSC2022_X64: v107034079-0ba6ff53
   CI_IMAGE_WIN_LTSC2022_X64_SUFFIX: ""