Merge branch 'master' into fix/okhttp-virtual-thread-dispatcher-trace-contamination

Author: dougqh

.claude/skills/add-apm-integrations/SKILL.md

@@ -63,6 +63,13 @@ pattern before writing new code. Use it as a template.
    - `testImplementation` dependencies for tests
    - `muzzle { pass { } }` directives (see Step 9)
 4. Register the new module in `settings.gradle.kts` in **alphabetical order**
+5. Register the integration name in `metadata/supported-configurations.json`, or
+   `checkInstrumenterModuleConfigurations` fails. The name in `super(...)` maps to env var
+   `DD_TRACE_<NAME>_ENABLED` (`.` and `-` become `_`, uppercased — `couchbase-3` →
+   `DD_TRACE_COUCHBASE_3_ENABLED`). Add a `"type": "boolean"` entry, in alphabetical order, with
+   aliases `DD_TRACE_INTEGRATION_<NAME>_ENABLED` and `DD_INTEGRATION_<NAME>_ENABLED`. Set `default`
+   to the module's real default — `"true"`, or `"false"` if it overrides `defaultEnabled()` (e.g.
+   OpenTelemetry, Hazelcast). Declaring several names (`super("a", "b")`) means one entry each.
 
 ## Step 5 – Write the InstrumenterModule
 
@@ -193,11 +200,15 @@ Run these commands in order and fix any failures before proceeding:
 ./gradlew :dd-java-agent:instrumentation:$framework-$version:muzzle
 ./gradlew :dd-java-agent:instrumentation:$framework-$version:test
 ./gradlew :dd-java-agent:instrumentation:$framework-$version:latestDepTest
+./gradlew checkInstrumenterModuleConfigurations
 ./gradlew spotlessCheck
 ```
 
 **If muzzle fails:** check for missing helper class names in `helperClassNames()`.
 
+**If `checkInstrumenterModuleConfigurations` fails:** an integration name from `super(...)` is missing
+(or mismatched) in `metadata/supported-configurations.json` — see Step 4, item 5.
+
 **If tests fail:** verify span lifecycle order (start → activate → error → finish → close), helper registration,
 and `contextStore()` map entries match actual usage.
 
@@ -208,6 +219,7 @@ and `contextStore()` map entries match actual usage.
 Output this checklist and confirm each item is satisfied:
 
 - [ ] `settings.gradle.kts` entry added in alphabetical order
+- [ ] `metadata/supported-configurations.json` has a `DD_TRACE_<NAME>_ENABLED` entry (+ the two aliases) for every name passed to `super(...)`
 - [ ] `build.gradle` has `compileOnly` deps and `muzzle` directives with `assertInverse = true`
 - [ ] `@AutoService(InstrumenterModule.class)` annotation present on the module class
 - [ ] `helperClassNames()` lists ALL referenced helpers (including inner, anonymous, and enum synthetic classes)

.claude/skills/migrate-groovy-to-java/SKILL.md

@@ -33,6 +33,8 @@ When converting Groovy code to Java code, make sure that:
 - Replace `injectSysConfig(key, value)` calls with `@WithConfig` when the key and value are static literals. Put it on the test method for per-test config, or on the class when every test needs it. The `dd.` prefix is added automatically — use the bare key (e.g. `"trace.scope.strict.mode"`, not `"dd.trace.scope.strict.mode"`). For dynamic or parameterized values, keep the imperative `WithConfigExtension.injectSysConfig(key, value)` call.
 - Keep inline comments
 - Migrate the named Spock clauses if they exist as inline comments in the Java unit test
+- When Groovy tests navigate a JSON request body through helpers like `asMap()` / `asLong()` / `asList()`, check whether `json-unit-assertj` (`libs.json.unit.assertj`) is already in the module's build file. If it is, add a method that returns the raw JSON string and use `assertThatJson(json).node("some.nested.field").isEqualTo(value)` directly instead of the map traversal.
+- Groovy's `[key: val]` map literals use a `LinkedHashMap`. When the test doesn't care about insertion order, use `singletonMap` for a single entry or `HashMap` for two or more. If a helper method builds these maps, add a two-arg overload rather than scattering `new LinkedHashMap<>()` constructions through test bodies.
 
 TableTest usage
   Import: `import org.tabletest.junit.TableTest;`

.github/CODEOWNERS

@@ -21,6 +21,10 @@
 /dd-smoke-tests/vertx-*/                                                                         @DataDog/apm-idm-java
 /dd-smoke-tests/wildfly/                                                                         @DataDog/apm-idm-java
 
+# @DataDog/apm-release-platform
+/.gitlab/                              @DataDog/apm-release-platform @DataDog/apm-lang-platform-java
+/.gitlab-ci.yml                        @DataDog/apm-release-platform @DataDog/apm-lang-platform-java
+
 # @DataDog/apm-sdk-capabilities-java
 /dd-java-agent/agent-otel                                       @DataDog/apm-sdk-capabilities-java
 /dd-smoke-tests/log-injection                                   @DataDog/apm-sdk-capabilities-java
@@ -52,8 +56,6 @@
 
 # @DataDog/apm-lang-platform-java
 /.github/                               @DataDog/apm-lang-platform-java
-/.gitlab/                               @DataDog/apm-lang-platform-java
-/.gitlab-ci.yml                         @DataDog/apm-lang-platform-java
 /benchmark/                             @DataDog/apm-lang-platform-java
 /components/                            @DataDog/apm-lang-platform-java
 /dd-java-agent/instrumentation/java/    @DataDog/apm-lang-platform-java
@@ -88,6 +90,8 @@
 /dd-trace-api/src/main/java/datadog/trace/api/EventTracker.java @DataDog/asm-java
 /internal-api/src/main/java/datadog/trace/api/gateway/          @DataDog/asm-java
 /internal-api/src/main/java/datadog/trace/api/http/             @DataDog/asm-java
+/internal-api/src/main/java/datadog/trace/api/telemetry/ScaReachability* @DataDog/asm-java
+/telemetry/src/main/java/datadog/telemetry/sca/                 @DataDog/asm-java
 **/appsec/                                                      @DataDog/asm-java
 **/*CallSite*.java                                              @DataDog/asm-java
 **/*CallSite*.groovy                                            @DataDog/asm-java

.github/pull_request_template.md

@@ -15,7 +15,7 @@
 - Add your completed PR to the merge queue by commenting `/merge`. You can also:
   - Customize the commit message associated with the merge with `/merge --commit-message "..."`
   - Remove your PR from the merge queue with `/merge -c`
-  - Skip all merge queue checks with `/merge -f --reason "reason"`; please use this judiciously, as some checks do not run at the PR-level
+  - Skip all merge queue checks with `/merge -f --reason "reason"`; please use this judiciously, as some checks do not run at the PR-level (note: the PR still needs to be mergeable, this will only skip the pre-merge build)
   - Get more information in [this doc](https://datadoghq.atlassian.net/wiki/spaces/DEVX/pages/3121612126/MergeQueue)
 
 Jira ticket: [PROJ-IDENT]

.github/scripts/dependency_age.py

@@ -13,7 +13,7 @@
 from dataclasses import dataclass
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
-from typing import Any
+from typing import Any, Callable
 
 
 GRADLE_VERSIONS_URL = "https://services.gradle.org/versions/all"
@@ -428,25 +428,49 @@ def validate_lockfiles(args: argparse.Namespace) -> int:
                 print(f"::warning file={relative_path}::{gav}: {'Cannot verify age' if kind == 'unverified' else 'Too new'}. Reverted lockfile to baseline.")
 
     reverted_files = len(violations_by_file)
-    summary = build_validation_summary(violations_by_file=violations_by_file, replacements_by_file=replacements_by_file, baseline_lockfiles=baseline_lockfiles, min_age_hours=args.min_age_hours)
-    emit_outputs({"cutoff_at": format_datetime(cutoff), "reverted_files": reverted_files, "summary": summary}, args.github_output)
+    summary_instrumentation = build_validation_summary(violations_by_file=violations_by_file, replacements_by_file=replacements_by_file, baseline_lockfiles=baseline_lockfiles, min_age_hours=args.min_age_hours, path_filter=is_instrumentation_path)
+    summary_core = build_validation_summary(violations_by_file=violations_by_file, replacements_by_file=replacements_by_file, baseline_lockfiles=baseline_lockfiles, min_age_hours=args.min_age_hours, path_filter=lambda path: not is_instrumentation_path(path))
+    emit_outputs(
+        {
+            "cutoff_at": format_datetime(cutoff),
+            "reverted_files": reverted_files,
+            "summary_core": summary_core,
+            "summary_instrumentation": summary_instrumentation,
+        },
+        args.github_output,
+    )
     print(f"Validated {len(changed)} changed coordinate(s) across {len(changed_by_file)} lockfile(s). {reverted_files} lockfile(s) reverted.")
     return 0
 
 
+# instrumentation lockfiles live under these prefixes and ship in a separate PR from core modules.
+# Keep in sync with the file split in .github/workflows/update-gradle-dependencies.yaml
+INSTRUMENTATION_PATH_PREFIXES = ("dd-smoke-tests/", "dd-java-agent/instrumentation/")
+
+
+# classify a lockfile path as belonging to the instrumentation PR (vs the core modules PR)
+def is_instrumentation_path(relative_path: str) -> bool:
+    normalized = relative_path.replace(os.sep, "/")
+    return normalized.startswith(INSTRUMENTATION_PATH_PREFIXES)
+
+
 # build summary of reverted/downgraded dependencies for PR descriptions
+# path_filter restricts the summary to lockfiles whose relative path matches,
+# so each PR (core vs instrumentation) only lists the dependencies it actually changes
 def build_validation_summary(
     *,
     violations_by_file: dict[str, list[tuple[str, str, int]]],
     replacements_by_file: dict[str, dict[str, tuple[str, int]]],
     baseline_lockfiles: dict[str, set[str]],
     min_age_hours: int,
+    path_filter: Callable[[str], bool],
 ) -> str:
-    if not violations_by_file and not replacements_by_file:
-        return ""
-    lines = [f"## Dependency age policy", ""]
+    header = ["## Dependency age policy", ""]
+    lines = list(header)
     seen: set[str] = set()
     for relative_path, replacements in replacements_by_file.items():
+        if not path_filter(relative_path):
+            continue
         baseline_coords = baseline_lockfiles.get(relative_path, set())
         for old_gav, (new_gav, hours_remaining) in replacements.items():
             if old_gav not in seen:
@@ -456,14 +480,18 @@ def build_validation_summary(
                 else:
                     new_version = new_gav.rsplit(":", 1)[1]
                     lines.append(f"- `{old_gav}` is {hours_remaining}h away from meeting {min_age_hours}h cooldown, updated to `{new_version}`")
-    for entries in violations_by_file.values():
+    for relative_path, entries in violations_by_file.items():
+        if not path_filter(relative_path):
+            continue
         for gav, kind, hours_remaining in entries:
             if gav not in seen:
                 seen.add(gav)
                 if kind == "unverified":
                     lines.append(f"- `{gav}` — cannot verify age, reverted")
                 else:
                     lines.append(f"- `{gav}` is {hours_remaining}h away from meeting {min_age_hours}h cooldown, reverted")
+    if len(lines) == len(header):  # nothing matched the filter
+        return ""
     return "\n".join(lines)
 
 

.github/scripts/tests/test_dependency_age.py

@@ -3,13 +3,20 @@
 import re
 import shutil
 import subprocess
+import sys
 import tempfile
 import unittest
 from pathlib import Path
 
-
 REPO_ROOT = Path(__file__).resolve().parents[3]
 SCRIPT = REPO_ROOT / ".github/scripts/dependency_age.py"
+
+# dependency_age.py is a loose script (not a package); add its dir to sys.path
+# so its helpers can be imported and unit-tested.
+sys.path.insert(0, str(SCRIPT.parent))
+import dependency_age
+
+
 FIXTURES = Path(__file__).resolve().parent / "fixtures"
 NOW = "2026-04-24T12:00:00Z"
 OUTPUT_PATTERN = re.compile(
@@ -373,6 +380,50 @@ def test_reverts_lockfile_when_metadata_override_has_invalid_timestamp(self) ->
         self.assertEqual(outputs["reverted_files"], "1")
         self.assertEqual((current_dir / "module/gradle.lockfile").read_text(encoding="utf-8"), baseline_content)
 
+    def test_is_instrumentation_path_classifies_prefixes(self) -> None:
+        self.assertTrue(dependency_age.is_instrumentation_path("dd-smoke-tests/foo/gradle.lockfile"))
+        self.assertTrue(dependency_age.is_instrumentation_path("dd-java-agent/instrumentation/bar/gradle.lockfile"))
+        # core modules are not instrumentation
+        self.assertFalse(dependency_age.is_instrumentation_path("dd-trace-core/gradle.lockfile"))
+        self.assertFalse(dependency_age.is_instrumentation_path("dd-java-agent/agent-bootstrap/gradle.lockfile"))
+        # real sibling modules that share the "dd-java-agent/instrumentation" stem but are
+        # NOT under the "dd-java-agent/instrumentation/" prefix — the trailing slash excludes them
+        self.assertFalse(dependency_age.is_instrumentation_path("dd-java-agent/instrumentation-testing/gradle.lockfile"))
+        self.assertFalse(dependency_age.is_instrumentation_path("dd-java-agent/instrumentation-annotation-processor/gradle.lockfile"))
+
+    def _summary(self, *, path_filter) -> str:
+        # one too-new violation in a core module, one in an instrumentation module
+        return dependency_age.build_validation_summary(
+            violations_by_file={
+                "dd-trace-core/gradle.lockfile": [("com.example:core-lib:2.0.0", "too_new", 5)],
+                "dd-java-agent/instrumentation/foo/gradle.lockfile": [("com.example:inst-lib:3.0.0", "too_new", 7)],
+            },
+            replacements_by_file={},
+            baseline_lockfiles={},
+            min_age_hours=48,
+            path_filter=path_filter,
+        )
+
+    def test_core_summary_excludes_instrumentation_entries(self) -> None:
+        summary = self._summary(path_filter=lambda p: not dependency_age.is_instrumentation_path(p))
+        self.assertIn("com.example:core-lib:2.0.0", summary)
+        self.assertNotIn("com.example:inst-lib:3.0.0", summary)
+
+    def test_instrumentation_summary_excludes_core_entries(self) -> None:
+        summary = self._summary(path_filter=dependency_age.is_instrumentation_path)
+        self.assertIn("com.example:inst-lib:3.0.0", summary)
+        self.assertNotIn("com.example:core-lib:2.0.0", summary)
+
+    def test_summary_is_empty_when_filter_matches_nothing(self) -> None:
+        empty = dependency_age.build_validation_summary(
+            violations_by_file={"dd-trace-core/gradle.lockfile": [("com.example:core-lib:2.0.0", "too_new", 5)]},
+            replacements_by_file={},
+            baseline_lockfiles={},
+            min_age_hours=48,
+            path_filter=dependency_age.is_instrumentation_path,  # nothing under instrumentation
+        )
+        self.assertEqual(empty, "")
+
 
 if __name__ == "__main__":
     unittest.main()

.github/workflows/add-release-to-cloudfoundry.yaml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout "cloudfoundry" branch
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
         with:
           ref: cloudfoundry
       - name: Get release version

.github/workflows/analyze-changes.yaml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
         with:
           submodules: 'recursive'
       - name: Cache Gradle dependencies
@@ -30,7 +30,7 @@ jobs:
             ${{ runner.os }}-gradle-
         
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           languages: 'java'
           build-mode: 'manual'
@@ -43,7 +43,7 @@ jobs:
           ./gradlew clean :dd-java-agent:shadowJar --build-cache --parallel --stacktrace --no-daemon --max-workers=4
 
       - name: Perform CodeQL Analysis and upload results to GitHub Security tab
-        uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
 
   trivy:
     name: Analyze changes with Trivy
@@ -55,7 +55,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
         with:
           submodules: 'recursive'
 
@@ -102,13 +102,13 @@ jobs:
           TRIVY_JAVA_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-java-db,public.ecr.aws/aquasecurity/trivy-java-db
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         if: always()
         with:
           sarif_file: 'trivy-results.sarif'
 
       - name: Install datadog-ci
-        uses: DataDog/install-datadog-ci-github-action@6d7f0c7c5402a4b1912055b76970ca76bef71fe5 # v1.0.4
+        uses: DataDog/install-datadog-ci-github-action@501e9d922bf506902d2ecc2c830b0f4471760396 # v1.0.6
         with:
           version: v5.17.0
       - name: Upload results to Datadog CI Static Analysis

.github/workflows/create-release-branch.yaml

@@ -40,7 +40,7 @@ jobs:
           echo "branch=release/${TAG%.0}.x" >> "$GITHUB_OUTPUT"
 
       - name: Check out repo at tag
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
         with:
           ref: ${{ steps.determine-tag.outputs.tag }}
 
@@ -76,7 +76,7 @@ jobs:
           policy: self.pin-system-tests.create-pr
 
       - name: Check out repo at release branch
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
         with:
           ref: ${{ needs.create-release-branch.outputs.release-branch-name }}
 

.github/workflows/run-system-tests.yaml

@@ -24,7 +24,7 @@ jobs:
       group: APM Larger Runners
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
         with:
           submodules: 'recursive'
           fetch-depth: 0