[mq] [skip ddci] working branch - merge 1d4e9ff on top of main at 8b5db9e

{"baseBranch":"main","baseCommit":"8b5db9ee36330a39f214919d2b92385577e56865","createdAt":"2026-07-17T14:02:22.949698Z","headSha":"1d4e9ff8ff3c926a37537bd13a981af31f1cc67a","id":"840e3dc0-7f41-467a-8889-eb1d1518b5ff","priority":"200","pullRequestNumber":"53483","queuedAt":"2026-07-17T14:02:22.948343Z","status":"STATUS_QUEUED"}

Author: gh-worker-dd-mergequeue-cf854d[bot]

pkg/config/BUILD.bazel

@@ -38,6 +38,7 @@ schema_template_config(
 
 schema_template_config(
     name = "system_probe_config",
+    srcs = ["//pkg/config/schema:system_probe_schema_subfiles"],
     out = "system-probe.yaml",
     build_type = "system-probe",
     os_target = _OS_TARGET,

pkg/config/schema/BUILD.bazel

@@ -46,6 +46,17 @@ filegroup(
     visibility = ["//visibility:public"],
 )
 
+# Per-section sub-files referenced by yaml/system-probe_schema.yaml via $ref
+filegroup(
+    name = "system_probe_schema_subfiles",
+    srcs = [
+        "yaml/system-probe-cws.yaml",
+        "yaml/system-probe-usm.yaml",
+        "yaml/system-probe_schema.yaml",
+    ],
+    visibility = ["//visibility:public"],
+)
+
 ZSTD_ARGS = [
     "--no-check",  # match DataDog/zstd Go library behavior: no XXH64 frame checksum
     "-5",  # match DataDog/zstd: DefaultCompression = 5
@@ -66,6 +77,18 @@ run_binary(
     tool = "//tasks/schema:merge_schema",
 )
 
+# yaml/system-probe_schema.yaml uses sub-files in a similar manner as the core_schema
+run_binary(
+    name = "merged_system_probe_schema",
+    srcs = glob(["yaml/*.yaml"]),
+    outs = ["system-probe_schema.merged.yaml"],
+    args = [
+        "$(execpath yaml/system-probe_schema.yaml)",
+        "$@",
+    ],
+    tool = "//tasks/schema:merge_schema",
+)
+
 # Derive the "embedded" schema output from the merged schema: a variant trimmed
 # of build-time-only data (documentation strings, ...) so the compressed,
 # embedded artifact stays small and runtime RSS low. What the "embedded" output
@@ -82,14 +105,14 @@ run_binary(
     tool = "//tasks/schema:produce_byproduct",
 )
 
-# system-probe is a single-file schema (no $ref), so it is processed directly.
+# system-probe "embedded" schema, trimmed of build-time-only data
 run_binary(
     name = "embedded_system_probe_schema",
-    srcs = ["yaml/system-probe_schema.yaml"],
+    srcs = [":merged_system_probe_schema"],
     outs = ["system-probe_schema.embedded.yaml"],
     args = [
         "embedded",
-        "$(execpath yaml/system-probe_schema.yaml)",
+        "$(execpath :merged_system_probe_schema)",
         "$@",
     ],
     tool = "//tasks/schema:produce_byproduct",