Merge branch 'master' into sarahchen6/implement-48h-cooldown-for-gradle-dependencies

Author: sarahchen6

.github/CODEOWNERS

@@ -21,10 +21,6 @@
 /dd-smoke-tests/vertx-*/                                                                         @DataDog/apm-idm-java
 /dd-smoke-tests/wildfly/                                                                         @DataDog/apm-idm-java
 
-# @DataDog/apm-release-platform
-/.gitlab/                              @DataDog/apm-release-platform
-/.gitlab-ci.yml                        @DataDog/apm-release-platform
-
 # @DataDog/apm-sdk-capabilities-java
 /dd-java-agent/agent-otel                                       @DataDog/apm-sdk-capabilities-java
 /dd-smoke-tests/log-injection                                   @DataDog/apm-sdk-capabilities-java
@@ -56,6 +52,8 @@
 
 # @DataDog/apm-lang-platform-java
 /.github/                               @DataDog/apm-lang-platform-java
+/.gitlab/                               @DataDog/apm-lang-platform-java
+/.gitlab-ci.yml                         @DataDog/apm-lang-platform-java
 /benchmark/                             @DataDog/apm-lang-platform-java
 /components/                            @DataDog/apm-lang-platform-java
 /dd-java-agent/instrumentation/java/    @DataDog/apm-lang-platform-java

.github/scripts/dependency_age.py

@@ -67,6 +67,7 @@ def parse_args() -> argparse.Namespace:
 def add_common_selection_args(parser: argparse.ArgumentParser) -> None:
     parser.add_argument("--min-age-hours", type=int, default=default_min_age_hours())
     parser.add_argument("--now")
+    parser.add_argument("--current-version", default=None)
     parser.add_argument("--github-output", default=None)
 
 
@@ -117,6 +118,11 @@ def format_datetime(value: datetime) -> str:
     return value.astimezone(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
 
 
+# normalize datetime to YYYY-MM-DD date for more readable PR comment outputs
+def format_date(value: datetime) -> str:
+    return value.astimezone(timezone.utc).strftime("%Y-%m-%d")
+
+
 # emit key=value lines to stdout and GitHub Actions output file
 def emit_outputs(outputs: dict[str, Any], github_output: str | None) -> None:
     lines = [f"{key}={'' if value is None else value}" for key, value in outputs.items()]
@@ -166,6 +172,7 @@ def select_gradle_release(args: argparse.Namespace) -> int:
         not_found_reason=(
             f"No eligible stable Gradle release is at least {args.min_age_hours} hours old."
         ),
+        current_version=args.current_version,
     )
 
 
@@ -199,6 +206,7 @@ def select_maven_release(args: argparse.Namespace) -> int:
             f"No eligible stable release found for {args.group_id}:{args.artifact_id} "
             f"that is at least {args.min_age_hours} hours old."
         ),
+        current_version=args.current_version,
     )
 
 
@@ -250,15 +258,24 @@ def load_maven_documents(
 
 # parse a version string into a sortable tuple for comparison; numeric segments sort before non-numeric
 def _version_sort_key(version: str) -> tuple:
-    parts = []
+    segments = []
     for segment in re.split(r"([.\-])", version):
         if segment in {"", ".", "-"}:
             continue
         try:
-            parts.append((0, int(segment)))
+            segments.append((0, int(segment)))
         except ValueError:
-            parts.append((1, segment))
-    return tuple(parts)
+            segments.append((1, segment))
+
+    release = []
+    prerelease = []
+    for i, seg in enumerate(segments):
+        if seg[0] == 1:  # first string segment starts the prerelease part
+            prerelease = segments[i:]
+            break
+        release.append(seg)
+
+    return (tuple(release), not bool(prerelease), tuple(prerelease))
 
 
 # emit selection result to stdout and GitHub Actions output file for select-gradle and select-maven
@@ -269,11 +286,37 @@ def emit_selection_result(
     github_output: str | None,
     candidates: list[Candidate],
     not_found_reason: str,
+    current_version: str | None = None,
 ) -> int:
     selected = max(candidates, key=lambda candidate: _version_sort_key(candidate.version), default=None)
-    outputs: dict[str, Any] = {
-        "cutoff_at": format_datetime(cutoff),
-    }
+    outputs: dict[str, Any] = {}
+
+    # If the current version is already >= the best candidate, keep it
+    if current_version and (
+        not selected
+        or _version_sort_key(current_version) >= _version_sort_key(selected.version)
+    ):
+        outputs.update(
+            {
+                "found": "true",
+                "version": current_version,
+                "published_at": "",
+                "reason": "",
+            }
+        )
+        emit_outputs(outputs, github_output)
+        if selected:
+            print(
+                f"Current version {current_version} for {label} is already >= "
+                f"latest eligible {selected.version}; keeping current version."
+            )
+        else:
+            print(
+                f"No eligible version found for {label}; "
+                f"keeping current version {current_version}."
+            )
+        return 0
+
     if not selected:
         outputs.update(
             {
@@ -291,14 +334,14 @@ def emit_selection_result(
         {
             "found": "true",
             "version": selected.version,
-            "published_at": format_datetime(selected.published_at),
+            "published_at": format_date(selected.published_at),
             "reason": "",
         }
     )
     emit_outputs(outputs, github_output)
     print(
         f"Selected latest eligible stable version for {label}: "
-        f"{selected.version} (published {format_datetime(selected.published_at)}, cutoff {format_datetime(cutoff)})"
+        f"{selected.version} (published {format_date(selected.published_at)})"
     )
     return 0
 

.github/scripts/tests/fixtures/maven-ga-replaces-beta.json

@@ -0,0 +1,18 @@
+{
+  "response": {
+    "docs": [
+      {
+        "v": "4.0.0",
+        "timestamp": "2026-04-20T12:00:00Z"
+      },
+      {
+        "v": "4.0.0-beta-3",
+        "timestamp": "2026-04-18T12:00:00Z"
+      },
+      {
+        "v": "3.9.8",
+        "timestamp": "2026-04-15T12:00:00Z"
+      }
+    ]
+  }
+}

.github/scripts/tests/test_dependency_age.py

@@ -51,8 +51,7 @@ def test_selects_previous_gradle_release_when_newest_is_too_new(self) -> None:
         self.assertEqual(result.returncode, 0, result.stderr)
         outputs = self.parse_outputs(result.stdout)
         self.assertEqual(outputs["version"], "9.4.1")
-        self.assertEqual(outputs["published_at"], "2026-04-22T11:00:00Z")
-        self.assertEqual(outputs["cutoff_at"], "2026-04-22T12:00:00Z")
+        self.assertEqual(outputs["published_at"], "2026-04-22")
 
     def test_reports_when_no_eligible_gradle_release_exists(self) -> None:
         result = self.run_script(
@@ -124,7 +123,104 @@ def test_exact_48_hour_boundary_is_accepted(self) -> None:
         self.assertEqual(result.returncode, 0, result.stderr)
         outputs = self.parse_outputs(result.stdout)
         self.assertEqual(outputs["version"], "3.5.5")
-        self.assertEqual(outputs["published_at"], "2026-04-22T12:00:00Z")
+        self.assertEqual(outputs["published_at"], "2026-04-22")
+
+
+    def test_ga_version_overrides_current_prerelease(self) -> None:
+        result = self.run_script(
+            "select-maven",
+            "--now",
+            NOW,
+            "--group-id",
+            "org.apache.maven",
+            "--artifact-id",
+            "apache-maven",
+            "--search-response-file",
+            str(FIXTURES / "maven-ga-replaces-beta.json"),
+            "--prerelease-pattern",
+            "alpha",
+            "--prerelease-pattern",
+            "beta",
+            "--prerelease-pattern",
+            "rc",
+            "--current-version",
+            "4.0.0-beta-3",
+        )
+
+        self.assertEqual(result.returncode, 0, result.stderr)
+        outputs = self.parse_outputs(result.stdout)
+        self.assertEqual(outputs["found"], "true")
+        self.assertEqual(outputs["version"], "4.0.0")
+        self.assertEqual(outputs["published_at"], "2026-04-20")
+
+    def test_keeps_current_version_when_higher_than_eligible(self) -> None:
+        result = self.run_script(
+            "select-maven",
+            "--now",
+            NOW,
+            "--group-id",
+            "org.apache.maven",
+            "--artifact-id",
+            "apache-maven",
+            "--search-response-file",
+            str(FIXTURES / "maven-newest-too-new.json"),
+            "--prerelease-pattern",
+            "alpha",
+            "--prerelease-pattern",
+            "beta",
+            "--prerelease-pattern",
+            "rc",
+            "--current-version",
+            "4.0.0-beta-3",
+        )
+
+        self.assertEqual(result.returncode, 0, result.stderr)
+        outputs = self.parse_outputs(result.stdout)
+        self.assertEqual(outputs["found"], "true")
+        self.assertEqual(outputs["version"], "4.0.0-beta-3")
+        self.assertEqual(outputs["published_at"], "")
+
+    def test_updates_when_eligible_version_is_higher_than_current(self) -> None:
+        result = self.run_script(
+            "select-maven",
+            "--now",
+            NOW,
+            "--group-id",
+            "org.apache.maven.plugins",
+            "--artifact-id",
+            "maven-surefire-plugin",
+            "--search-response-file",
+            str(FIXTURES / "surefire-boundary.json"),
+            "--prerelease-pattern",
+            "alpha",
+            "--prerelease-pattern",
+            "beta",
+            "--current-version",
+            "3.5.4",
+        )
+
+        self.assertEqual(result.returncode, 0, result.stderr)
+        outputs = self.parse_outputs(result.stdout)
+        self.assertEqual(outputs["found"], "true")
+        self.assertEqual(outputs["version"], "3.5.5")
+        self.assertEqual(outputs["published_at"], "2026-04-22")
+
+    def test_keeps_current_version_when_no_eligible_version_exists(self) -> None:
+        result = self.run_script(
+            "select-gradle",
+            "--now",
+            NOW,
+            "--versions-file",
+            str(FIXTURES / "gradle-no-eligible.json"),
+            "--current-version",
+            "9.0.0",
+        )
+
+        self.assertEqual(result.returncode, 0, result.stderr)
+        outputs = self.parse_outputs(result.stdout)
+        self.assertEqual(outputs["found"], "true")
+        self.assertEqual(outputs["version"], "9.0.0")
+        self.assertEqual(outputs["published_at"], "")
 
 
     def run_validate_lockfiles(

.github/workflows/check-pull-request-labels.yaml

@@ -141,6 +141,11 @@ jobs:
               'performance:',  // To refactor to 'ci: ' in the future
               'run-tests:'     // Unused since GitLab migration
             ]
+            // Exact-match labels that don't fit a category prefix (e.g. labels applied
+            // by external automation tooling).
+            const exactAllowlist = [
+              'campaigner-automated-change'
+            ]
             // Re-fetch labels only if the previous step modified them (ex: "Bits AI" removal)
             let prLabels
             if (process.env.LABELS_STALE === 'true') {
@@ -156,7 +161,10 @@ jobs:
             // Look for invalid labels
             const invalidLabels = prLabels
               .map(label => label.name)
-              .filter(label => validCategories.every(prefix => !label.startsWith(prefix)))
+              .filter(label =>
+                !exactAllowlist.includes(label) &&
+                validCategories.every(prefix => !label.startsWith(prefix))
+              )
             const hasInvalidLabels = invalidLabels.length > 0
             // Get existing comments to check for blocking comment
             const comments = await github.rest.issues.listComments({

.github/workflows/update-smoke-test-latest-versions.yaml

@@ -29,11 +29,22 @@ jobs:
           DATE=$(date +'%Y%m%d')
           echo "branch=ci/update-smoke-test-latest-versions-${DATE}" >> "$GITHUB_OUTPUT"
 
+      - name: Read current pinned versions
+        id: current
+        run: |
+          gradle_props="dd-smoke-tests/gradle/src/test/resources/latest-tool-versions.properties"
+          maven_props="dd-smoke-tests/maven/src/test/resources/latest-tool-versions.properties"
+          get_prop() { grep "^$1=" "$2" 2>/dev/null | cut -d= -f2 || true; }
+          echo "gradle_version=$(get_prop gradle.version "$gradle_props")" >> "$GITHUB_OUTPUT"
+          echo "maven_version=$(get_prop maven.version "$maven_props")" >> "$GITHUB_OUTPUT"
+          echo "surefire_version=$(get_prop maven-surefire.version "$maven_props")" >> "$GITHUB_OUTPUT"
+
       - name: Resolve latest eligible Gradle version
         id: gradle
         run: |
           python3 .github/scripts/dependency_age.py select-gradle \
             --min-age-hours "${MIN_DEPENDENCY_AGE_HOURS}" \
+            --current-version "${{ steps.current.outputs.gradle_version }}" \
             --github-output "$GITHUB_OUTPUT"
 
       - name: Resolve latest eligible stable Maven version
@@ -46,6 +57,7 @@ jobs:
             --prerelease-pattern beta \
             --prerelease-pattern rc \
             --min-age-hours "${MIN_DEPENDENCY_AGE_HOURS}" \
+            --current-version "${{ steps.current.outputs.maven_version }}" \
             --github-output "$GITHUB_OUTPUT"
 
       - name: Resolve latest eligible stable Maven Surefire version
@@ -57,19 +69,29 @@ jobs:
             --prerelease-pattern alpha \
             --prerelease-pattern beta \
             --min-age-hours "${MIN_DEPENDENCY_AGE_HOURS}" \
+            --current-version "${{ steps.current.outputs.surefire_version }}" \
             --github-output "$GITHUB_OUTPUT"
 
       - name: Update properties files
+        id: update
         env:
           GRADLE_VERSION: ${{ steps.gradle.outputs.version }}
+          GRADLE_PUBLISHED: ${{ steps.gradle.outputs.published_at }}
           MAVEN_VERSION: ${{ steps.maven.outputs.version }}
+          MAVEN_PUBLISHED: ${{ steps.maven.outputs.published_at }}
           SUREFIRE_VERSION: ${{ steps.surefire.outputs.version }}
+          SUREFIRE_PUBLISHED: ${{ steps.surefire.outputs.published_at }}
         run: |
+          version_line() { if [ -n "$2" ]; then echo "$1 (published $2)"; else echo "$1 (unchanged)"; fi; }
           echo "Writing latest eligible stable versions (>=${MIN_DEPENDENCY_AGE_HOURS}h old) to properties files:"
-          echo "  Gradle:         ${GRADLE_VERSION} (published ${{ steps.gradle.outputs.published_at }})"
-          echo "  Maven:          ${MAVEN_VERSION} (published ${{ steps.maven.outputs.published_at }})"
-          echo "  Maven Surefire: ${SUREFIRE_VERSION} (published ${{ steps.surefire.outputs.published_at }})"
-          echo "  Eligibility cutoff: ${{ steps.gradle.outputs.cutoff_at }}"
+          echo "  Gradle:         $(version_line "${GRADLE_VERSION}" "${GRADLE_PUBLISHED}")"
+          echo "  Maven:          $(version_line "${MAVEN_VERSION}" "${MAVEN_PUBLISHED}")"
+          echo "  Maven Surefire: $(version_line "${SUREFIRE_VERSION}" "${SUREFIRE_PUBLISHED}")"
+
+          # Build version lines for PR body
+          echo "gradle_line=$(version_line "${GRADLE_VERSION}" "${GRADLE_PUBLISHED}")" >> "$GITHUB_OUTPUT"
+          echo "maven_line=$(version_line "${MAVEN_VERSION}" "${MAVEN_PUBLISHED}")" >> "$GITHUB_OUTPUT"
+          echo "surefire_line=$(version_line "${SUREFIRE_VERSION}" "${SUREFIRE_PUBLISHED}")" >> "$GITHUB_OUTPUT"
 
           printf '%s\n' \
             "# Pinned latest eligible stable versions (>=${MIN_DEPENDENCY_AGE_HOURS}h old) for CI Visibility Gradle smoke tests." \
@@ -138,10 +160,9 @@ jobs:
           This PR updates the pinned latest eligible stable tool versions used by CI Visibility smoke tests.
           Only releases at least ${{ env.MIN_DEPENDENCY_AGE_HOURS }} hours old are eligible.
 
-          - Gradle: ${{ steps.gradle.outputs.version }} (published ${{ steps.gradle.outputs.published_at }})
-          - Maven: ${{ steps.maven.outputs.version }} (published ${{ steps.maven.outputs.published_at }})
-          - Maven Surefire: ${{ steps.surefire.outputs.version }} (published ${{ steps.surefire.outputs.published_at }})
-          - Eligibility cutoff: ${{ steps.gradle.outputs.cutoff_at }}
+          - Gradle: ${{ steps.update.outputs.gradle_line }}
+          - Maven: ${{ steps.update.outputs.maven_line }}
+          - Maven Surefire: ${{ steps.update.outputs.surefire_line }}
 
           # Motivation