Merge branch 'master' into sarahchen6/move-macrobenchmarks

Author: sarahchen6

.claude/skills/migrate-groovy-to-java/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: migrate-groovy-to-java
+description: >
+  Converts Spock/Groovy test files in a Gradle module to equivalent JUnit 5 Java tests.
+  Use when asked to "migrate groovy", "convert groovy to java", "g2j", or when a module
+  has .groovy test files that need to be replaced with .java equivalents.
+---
+
+Migrate test Groovy files to Java using JUnit 5
+
+1. List all Groovy files of the current Gradle module
+2. Convert Groovy files to Java using JUnit 5
+3. Make sure the tests are still passing after migration and that the test count has not changed
+4. Remove Groovy files
+5. Add the migrated module path(s) to `.github/g2j-migrated-modules.txt`
+
+When converting Groovy code to Java code, make sure that:
+- The Java code generated is compatible with JDK 8
+- When translating Spock tests, favor using `@CsvSource` with `|` delimiters
+- When using `@MethodSource`, name the arguments method by appending `Arguments` using camelCase to the test method name (e.g. `testMethodArguments`) and return a `Stream` of arguments using `Stream.of(...)` and `arguments(...)` with static import.
+- Ensure parameterized test names are human-readable (i.e. no hashcodes); instead add a description string as the first `Arguments.arguments(...)` value or index the test case
+- When converting tuples, create a light dedicated structure instead to keep the typing system
+- Instead of checking a state and throwing an exception, use JUnit asserts
+- Instead of using `assertTrue(a.equals(b))` or `assertFalse(a.equals(b))`, use `assertEquals(expected, actual)` and `assertNotEquals(unexpected, actual)`
+- Import frequently used types rather than using fully-qualified names inline, to improve readability
+- Do not wrap checked exceptions and throw a Runtime exception; prefer adding a throws clause at method declaration
+- Do not mark local variables `final`
+- Ensure variables are human-readable; avoid single-letter names and pre-define variables that are referenced multiple times
+- When translating Spock `Mock(...)` usage, use `libs.bundles.mockito` instead of writing manual recording/stub implementations

.github/CODEOWNERS

@@ -51,11 +51,10 @@
 **/InferredProxy*.groovy                                        @DataDog/apm-serverless
 
 # @DataDog/apm-lang-platform-java
-/.circleci/                             @DataDog/apm-lang-platform-java
 /.github/                               @DataDog/apm-lang-platform-java
 /benchmark/                             @DataDog/apm-lang-platform-java
 /components/                            @DataDog/apm-lang-platform-java
-/dd-java-agent/instrumentation/java-*/  @DataDog/apm-lang-platform-java
+/dd-java-agent/instrumentation/java/    @DataDog/apm-lang-platform-java
 /dd-smoke-tests/concurrent/             @DataDog/apm-lang-platform-java
 /dd-smoke-tests/lib-injection/          @DataDog/apm-lang-platform-java
 /metadata/                              @DataDog/apm-lang-platform-java
@@ -80,7 +79,7 @@
 /dd-smoke-tests/iast-propagation/                               @DataDog/asm-java
 /dd-smoke-tests/iast-util/                                      @DataDog/asm-java
 /dd-smoke-tests/spring-security/                                @DataDog/asm-java
-/dd-java-agent/instrumentation/commons-fileupload/              @DataDog/asm-java
+/dd-java-agent/instrumentation/commons-fileupload-1.5/          @DataDog/asm-java
 /dd-java-agent/instrumentation/spring/spring-security/          @DataDog/asm-java
 /dd-trace-api/src/main/java/datadog/trace/api/aiguard/          @DataDog/asm-java
 /dd-trace-api/src/main/java/datadog/trace/api/EventTracker.java @DataDog/asm-java
@@ -103,12 +102,12 @@
 /dd-java-agent/instrumentation/cucumber-5.4/        @DataDog/ci-app-libraries
 /dd-java-agent/instrumentation/jacoco-0.8.9/        @DataDog/ci-app-libraries
 /dd-java-agent/instrumentation/junit                @DataDog/ci-app-libraries
-/dd-java-agent/instrumentation/karate/              @DataDog/ci-app-libraries
+/dd-java-agent/instrumentation/karate-1.0/          @DataDog/ci-app-libraries
 /dd-java-agent/instrumentation/scalatest-3.0.8/     @DataDog/ci-app-libraries
-/dd-java-agent/instrumentation/selenium/            @DataDog/ci-app-libraries
+/dd-java-agent/instrumentation/selenium-3.13/       @DataDog/ci-app-libraries
 /dd-java-agent/instrumentation/testng/              @DataDog/ci-app-libraries
 /dd-java-agent/instrumentation/gradle/              @DataDog/ci-app-libraries
-/dd-java-agent/instrumentation/gradle-testing/      @DataDog/ci-app-libraries
+/dd-java-agent/instrumentation/gradle-testing-5.1/  @DataDog/ci-app-libraries
 /dd-java-agent/instrumentation/maven                @DataDog/ci-app-libraries
 /dd-java-agent/instrumentation/weaver-0.9/          @DataDog/ci-app-libraries
 /dd-smoke-tests/gradle/                             @DataDog/ci-app-libraries
@@ -130,24 +129,24 @@
 /dd-java-agent/instrumentation/spark/           @DataDog/data-jobs-monitoring
 
 # @DataDog/data-streams-monitoring
-/dd-java-agent/testing/src/main/groovy/datadog/trace/agent/test/datastreams  @DataDog/data-streams-monitoring
-/dd-trace-core/src/main/java/datadog/trace/core/datastreams                  @DataDog/data-streams-monitoring
-/dd-trace-core/src/test/groovy/datadog/trace/core/datastreams                @DataDog/data-streams-monitoring
-/internal-api/src/main/java/datadog/trace/api/datastreams                    @DataDog/data-streams-monitoring
-/dd-smoke-tests/datastreams/                                                 @DataDog/data-streams-monitoring
-/internal-api/src/test/groovy/datadog/trace/api/datastreams                  @DataDog/data-streams-monitoring
-**/datastreams/                                                              @DataDog/data-streams-monitoring
-**/DataStreams*                                                              @DataDog/data-streams-monitoring
-**/dsmTest/**                                                                @DataDog/data-streams-monitoring
+/dd-java-agent/instrumentation-testing/src/main/groovy/datadog/trace/agent/test/datastreams @DataDog/data-streams-monitoring
+/dd-trace-core/src/main/java/datadog/trace/core/datastreams                                 @DataDog/data-streams-monitoring
+/dd-trace-core/src/test/groovy/datadog/trace/core/datastreams                               @DataDog/data-streams-monitoring
+/internal-api/src/main/java/datadog/trace/api/datastreams                                   @DataDog/data-streams-monitoring
+/dd-smoke-tests/datastreams/                                                                @DataDog/data-streams-monitoring
+/internal-api/src/test/groovy/datadog/trace/api/datastreams                                 @DataDog/data-streams-monitoring
+**/datastreams/                                                                             @DataDog/data-streams-monitoring
+**/DataStreams*                                                                             @DataDog/data-streams-monitoring
+**/dsmTest/**                                                                               @DataDog/data-streams-monitoring
 
 /dd-java-agent/instrumentation/armeria/armeria-grpc-0.84/       @DataDog/data-streams-monitoring @DataDog/apm-idm-java
-/dd-java-agent/instrumentation/avro/                            @DataDog/data-streams-monitoring @DataDog/apm-idm-java
+/dd-java-agent/instrumentation/avro-1.11.3/                     @DataDog/data-streams-monitoring @DataDog/apm-idm-java
 /dd-java-agent/instrumentation/aws-java/aws-java-sns-1.0/       @DataDog/data-streams-monitoring @DataDog/apm-idm-java
 /dd-java-agent/instrumentation/aws-java/aws-java-sns-2.0/       @DataDog/data-streams-monitoring @DataDog/apm-idm-java
 /dd-java-agent/instrumentation/aws-java/aws-java-sqs-1.0/       @DataDog/data-streams-monitoring @DataDog/apm-idm-java
 /dd-java-agent/instrumentation/aws-java/aws-java-sqs-2.0/       @DataDog/data-streams-monitoring @DataDog/apm-idm-java
 /dd-java-agent/instrumentation/confluent-schema-registry/       @DataDog/data-streams-monitoring @DataDog/apm-idm-java
-/dd-java-agent/instrumentation/google-pubsub/                   @DataDog/data-streams-monitoring @DataDog/apm-idm-java
+/dd-java-agent/instrumentation/google-pubsub-1.116/             @DataDog/data-streams-monitoring @DataDog/apm-idm-java
 /dd-java-agent/instrumentation/grpc-1.5/                        @DataDog/data-streams-monitoring @DataDog/apm-idm-java
 /dd-java-agent/instrumentation/kafka/kafka-clients-0.11/        @DataDog/data-streams-monitoring @DataDog/apm-idm-java
 /dd-java-agent/instrumentation/kafka/kafka-clients-3.8/         @DataDog/data-streams-monitoring @DataDog/apm-idm-java
@@ -183,7 +182,8 @@
 /dd-trace-core/src/test/groovy/datadog/trace/llmobs/  @DataDog/ml-observability
 
 # @DataDog/database-monitoring
-datadog/trace/bootstrap/instrumentation/dbm  @DataDog/database-monitoring @DataDog/apm-idm-java
+/dd-java-agent/agent-bootstrap/src/main/java/datadog/trace/bootstrap/instrumentation/dbm/   @DataDog/database-monitoring @DataDog/apm-idm-java
+/dd-java-agent/agent-bootstrap/src/test/groovy/datadog/trace/bootstrap/instrumentation/dbm/ @DataDog/database-monitoring @DataDog/apm-idm-java
 
 # @DataDog/rum
 /internal-api/src/main/java/datadog/trace/api/rum/   @DataDog/rum

.github/chainguard/self.enforce-datadog-merge-queue.comment-pr.sts.yaml

@@ -0,0 +1,11 @@
+issuer: https://token.actions.githubusercontent.com
+
+subject: repo:DataDog/dd-trace-java:pull_request
+
+claim_pattern:
+  event_name: pull_request
+  job_workflow_ref: DataDog/dd-trace-java/\.github/workflows/enforce-datadog-merge-queue\.yaml@refs/pull/[0-9]+/merge
+
+permissions:
+  issues: write
+  pull_requests: write

.github/chainguard/self.pin-system-tests.create-pr.sts.yaml

@@ -1,11 +1,11 @@
 issuer: https://token.actions.githubusercontent.com
 
-subject_pattern: repo:DataDog/dd-trace-java:ref:refs/heads/(master|release/v.+)
+subject_pattern: repo:DataDog/dd-trace-java:ref:refs/(heads/master|tags/v\d+\.\d+\.0)
 
 claim_pattern:
-  event_name: (create|workflow_dispatch)
-  ref: refs/heads/(master|release/v.+)
-  job_workflow_ref: DataDog/dd-trace-java/\.github/workflows/pin-system-tests\.yaml@refs/heads/(master|release/v.+)
+  event_name: (workflow_dispatch|push)
+  ref: refs/(heads/master|tags/v\d+\.\d+\.0)
+  job_workflow_ref: DataDog/dd-trace-java/\.github/workflows/create-release-branch\.yaml@refs/(heads/master|tags/v\d+\.\d+\.0)
 
 permissions:
   contents: write

.github/chainguard/self.update-smoke-test-latest-versions.create-pr.sts.yaml

@@ -0,0 +1,13 @@
+issuer: https://token.actions.githubusercontent.com
+
+subject: repo:DataDog/dd-trace-java:ref:refs/heads/master
+
+claim_pattern:
+  event_name: (schedule|workflow_dispatch)
+  ref: refs/heads/master
+  ref_protected: "true"
+  job_workflow_ref: DataDog/dd-trace-java/\.github/workflows/update-smoke-test-latest-versions\.yaml@refs/heads/master
+
+permissions:
+  contents: write
+  pull_requests: write

.github/g2j-migrated-modules.txt

@@ -0,0 +1,10 @@
+# This file lists modules that have been migrated from Groovy to Java / JUnit 5.
+# New *.groovy files under any src/<*test*>/groovy/ path
+# in these modules will fail the 'enforce-groovy-migration' PR check.
+#
+# After a module is migrated, add it on a new line here.
+# Use the filesystem path prefix as seen below.
+
+buildSrc/call-site-instrumentation-plugin
+components/json
+dd-trace-api

.github/workflows/README.md

@@ -36,13 +36,26 @@ _Action:_ Check the pull request did not introduce unexpected label.
 
 _Recovery:_ Update the pull request or add a comment to trigger the action again.
 
+### enforce-datadog-merge-queue [🔗](enforce-datadog-merge-queue.yaml)
+
+_Trigger:_ When creating or updating a pull request, or when a pull request is added to GitHub merge queue.
+
+_Actions:_
+
+* Pass the `Merge queue check` status check on pull requests so they remain in a mergeable state,
+* When a pull request is enqueued in GitHub merge queue, post a `/merge` comment to trigger the Datadog merge queue,
+* Fail the `Merge queue check` status check on merge groups to prevent GitHub from merging directly.
+
+_Recovery:_ The workflow is expected to fail to block GitHub merge queue.
+This redirects GitHub's "Merge when ready" button to the Datadog merge queue system.
+
 ### create-release-branch [🔗](create-release-branch.yaml)
 
 _Trigger:_ When a git tag matching the pattern "vM.N.0" is pushed (e.g. for a minor release).
 
-_Action:_ Create a release branch that corresponds to the pushed tag (e.g. "release/vM.N.x").
+_Action:_ Create a release branch that corresponds to the pushed tag (e.g. "release/vM.N.x"). Then open a PR against the release branch that pins system tests.
 
-_Recovery:_ Manually create the branch from the "vM.N.0" git tag.
+_Recovery:_ Manually create the release branch from the "vM.N.0" git tag, and pin system tests to this branch by running the `./tooling/update_system_test_reference.sh` script.
 
 ### draft-release-notes-on-tag [🔗](draft-release-notes-on-tag.yaml)
 
@@ -110,6 +123,19 @@ _Action:_
 
 _Recovery:_ Check at the milestone for the related issues and update them manually.
 
+### enforce-groovy-migration [🔗](enforce-groovy-migration.yaml)
+
+_Trigger:_ When creating or updating a pull request targeting `master`, or when labels are updated.
+
+_Actions:_
+
+* Fail the PR if a new Groovy test file is added to a module listed in [`.github/g2j-migrated-modules.txt`](../g2j-migrated-modules.txt) (hard enforcement),
+* Post a warning comment on the PR if a new Groovy test file is added to any other non-exempt module (soft warning). Instrumentation (`dd-java-agent/instrumentation/`) and smoke-test (`dd-smoke-tests/`) modules are exempt from this warning.
+
+_Recovery:_ Re-write the Groovy test files in Java / JUnit 5. To override this check entirely, add the `tag: override-groovy-enforcement` label to the PR. Remove the label to re-enable enforcement.
+
+_Notes:_ The migrated modules list is always read from `master`. Add a new entry to `.github/g2j-migrated-modules.txt` each time a module is migrated to Java / JUnit 5.
+
 ## Code Quality and Security
 
 ### analyze-changes [🔗](analyze-changes.yaml)
@@ -145,6 +171,14 @@ _Action:_ Create a PR updating the Grade dependencies and their locking files.
 
 _Recovery:_ Manually trigger the action again.
 
+### update-smoke-test-latest-versions [🔗](update-smoke-test-latest-versions.yaml)
+
+_Trigger:_ Every week or manually.
+
+_Action:_ Create a PR updating the pinned "latest" tool versions (Gradle, Maven, Maven Surefire) used by CI Visibility smoke tests.
+
+_Recovery:_ Manually trigger the action again.
+
 ### update-jmxfetch-submodule [🔗](update-jmxfetch-submodule.yaml)
 
 _Trigger:_ Monthly or manually

.github/workflows/analyze-changes.yaml

@@ -30,7 +30,7 @@ jobs:
             ${{ runner.os }}-gradle-
         
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
+        uses: github/codeql-action/init@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5
         with:
           languages: 'java'
           build-mode: 'manual'
@@ -39,17 +39,11 @@ jobs:
         env:
           ORG_GRADLE_PROJECT_akkaRepositoryToken: ${{ secrets.AKKA_REPO_TOKEN }}
         run: |
-          GRADLE_OPTS="-Dorg.gradle.jvmargs='-Xmx3G -Xms2G'" \
-          JAVA_HOME=$JAVA_HOME_8_X64 \
-          JAVA_8_HOME=$JAVA_HOME_8_X64 \
-          JAVA_11_HOME=$JAVA_HOME_11_X64 \
-          JAVA_17_HOME=$JAVA_HOME_17_X64 \
-          JAVA_21_HOME=$JAVA_HOME_21_X64 \
-          ./gradlew clean :dd-java-agent:shadowJar \
-            --build-cache --parallel --stacktrace --no-daemon --max-workers=4
+          GRADLE_OPTS="-Dorg.gradle.jvmargs='-Xms2G -Xmx3G'" \
+          ./gradlew clean :dd-java-agent:shadowJar --build-cache --parallel --stacktrace --no-daemon --max-workers=4
 
       - name: Perform CodeQL Analysis and upload results to GitHub Security tab
-        uses: github/codeql-action/analyze@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
+        uses: github/codeql-action/analyze@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5
 
   trivy:
     name: Analyze changes with Trivy
@@ -85,14 +79,8 @@ jobs:
         env:
           ORG_GRADLE_PROJECT_akkaRepositoryToken: ${{ secrets.AKKA_REPO_TOKEN }}
         run: |
-          GRADLE_OPTS="-Dorg.gradle.jvmargs='-Xmx3G -Xms2G'" \
-          JAVA_HOME=$JAVA_HOME_8_X64 \
-          JAVA_8_HOME=$JAVA_HOME_8_X64 \
-          JAVA_11_HOME=$JAVA_HOME_11_X64 \
-          JAVA_17_HOME=$JAVA_HOME_17_X64 \
-          JAVA_21_HOME=$JAVA_HOME_21_X64 \
-          ./gradlew clean publishToMavenLocal \
-            --build-cache --parallel --stacktrace --no-daemon --max-workers=4
+          GRADLE_OPTS="-Dorg.gradle.jvmargs='-Xms2G -Xmx3G'" \
+          ./gradlew clean publishToMavenLocal --build-cache --parallel --stacktrace --no-daemon --max-workers=4
 
       - name: Copy published artifacts
         run: |
@@ -101,7 +89,7 @@ jobs:
           ls -laR "./workspace/.trivy"
 
       - name: Run Trivy security scanner
-        uses: aquasecurity/trivy-action@c1824fd6edce30d7ab345a9989de00bbd46ef284 # v0.34.0
+        uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # v0.34.2
         with:
           scan-type: rootfs
           scan-ref: './workspace/.trivy/'
@@ -114,7 +102,7 @@ jobs:
           TRIVY_JAVA_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-java-db,public.ecr.aws/aquasecurity/trivy-java-db
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
+        uses: github/codeql-action/upload-sarif@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5
         if: always()
         with:
           sarif_file: 'trivy-results.sarif'