Merge remote-tracking branch 'origin/master' into alexeyk/test-base-windows

# Conflicts:
#	dd-java-agent/agent-crashtracking/src/test/java/datadog/crashtracking/buildid/BuildIdExtractorIntegrationTest.java

Author: AlexeyKuznetsov-DD

.claude/skills/migrate-groovy-to-java/SKILL.md

@@ -20,6 +20,7 @@ When converting Groovy code to Java code, make sure that:
 - `@TableTest` and `@MethodSource` may be combined on the same `@ParameterizedTest` when most cases are tabular but a few cases require programmatic setup.
 - In combined mode, keep table-friendly cases in `@TableTest`, and put only non-tabular/complex cases in `@MethodSource`.
 - If `@TableTest` is not viable for the test at all, use `@MethodSource` only.
+- If `@TableTest` was successfully used and if the `@ParameterizedTest` is not used to specify the test name, `@ParameterizedTest` can then be removed as `@TableTest` replace it fully.
 - For `@MethodSource`, name the arguments method `<testMethodName>Arguments` (camelCase, e.g. `testMethodArguments`) and return `Stream<Arguments>` using `Stream.of(...)` and `arguments(...)` with static import.
 - Ensure parameterized test names are human-readable (i.e. no hashcodes); instead add a description string as the first `Arguments.arguments(...)` value or index the test case
 - When converting tuples, create a light dedicated structure instead to keep the typing system

.github/CODEOWNERS

@@ -45,10 +45,14 @@
 /internal-api/src/test/groovy/datadog/trace/api/sampling        @DataDog/apm-sdk-capabilities-java
 
 # @DataDog/apm-serverless
-/dd-trace-core/src/main/java/datadog/trace/lambda/              @DataDog/apm-serverless
-/dd-trace-core/src/test/groovy/datadog/trace/lambda/            @DataDog/apm-serverless
-**/InferredProxy*.java                                          @DataDog/apm-serverless
-**/InferredProxy*.groovy                                        @DataDog/apm-serverless
+/dd-java-agent/instrumentation/aws-java/aws-java-lambda-handler-1.2/    @DataDog/apm-serverless
+/dd-java-agent/instrumentation/azure-functions/                         @DataDog/apm-serverless
+/dd-java-agent/instrumentation/azure-functions-1.2.2/                   @DataDog/apm-serverless
+/dd-trace-core/src/main/java/datadog/trace/lambda/                      @DataDog/apm-serverless
+/dd-trace-core/src/test/groovy/datadog/trace/lambda/                    @DataDog/apm-serverless
+/utils/container-utils/                                                 @DataDog/apm-serverless
+**/InferredProxy*.java                                                  @DataDog/apm-serverless
+**/InferredProxy*.groovy                                                @DataDog/apm-serverless
 
 # @DataDog/apm-lang-platform-java
 /.github/                               @DataDog/apm-lang-platform-java

.github/dependabot.yml

@@ -1,36 +1,38 @@
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
 version: 2
 updates:
-- package-ecosystem: github-actions
-  directory: /
-  schedule:
-    interval: weekly
-  labels:
-  - 'comp: tooling'
-  - 'tag: dependencies'
-  - 'tag: no release notes'
-  commit-message:
-    prefix: 'chore(ci): '
-  groups:
-    gh-actions-packages:
-      patterns:
-      - '*'
-  cooldown:
-    default-days: 14
-- package-ecosystem: gradle
-  directory: /
-  schedule:
-    interval: weekly
-  allow:
-  - dependency-name: gradle
-  ignore:
-  - dependency-name: gradle
-    update-types:
-    - version-update:semver-major
-  labels:
-  - 'comp: tooling'
-  - 'tag: dependencies'
-  - 'tag: no release notes'
-  commit-message:
-    prefix: 'chore(build): '
-  cooldown:
-    default-days: 14
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    labels:
+      - 'comp: tooling'
+      - 'tag: dependencies'
+      - 'tag: no release notes'
+    commit-message:
+      prefix: 'chore(ci): '
+    groups:
+      gh-actions-packages:
+        patterns:
+          - '*'
+    cooldown:
+      default-days: 2
+
+  - package-ecosystem: gradle
+    directory: /
+    schedule:
+      interval: weekly
+    allow:
+      - dependency-name: gradle
+    ignore:
+      - dependency-name: gradle
+        update-types:
+          - version-update:semver-major
+    labels:
+      - 'comp: tooling'
+      - 'tag: dependencies'
+      - 'tag: no release notes'
+    commit-message:
+      prefix: 'chore(build): '
+    cooldown:
+      default-days: 2

.github/workflows/analyze-changes.yaml

@@ -20,7 +20,7 @@ jobs:
         with:
           submodules: 'recursive'
       - name: Cache Gradle dependencies
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: |
             ~/.gradle/caches
@@ -30,7 +30,7 @@ jobs:
             ${{ runner.os }}-gradle-
         
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0
+        uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
         with:
           languages: 'java'
           build-mode: 'manual'
@@ -43,7 +43,7 @@ jobs:
           ./gradlew clean :dd-java-agent:shadowJar --build-cache --parallel --stacktrace --no-daemon --max-workers=4
 
       - name: Perform CodeQL Analysis and upload results to GitHub Security tab
-        uses: github/codeql-action/analyze@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0
+        uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
 
   trivy:
     name: Analyze changes with Trivy
@@ -60,7 +60,7 @@ jobs:
           submodules: 'recursive'
 
       - name: Cache Gradle dependencies
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: |
             ~/.gradle/caches
@@ -102,7 +102,7 @@ jobs:
           TRIVY_JAVA_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-java-db,public.ecr.aws/aquasecurity/trivy-java-db
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0
+        uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
         if: always()
         with:
           sarif_file: 'trivy-results.sarif'

.github/workflows/run-system-tests.yaml

@@ -30,7 +30,7 @@ jobs:
           fetch-depth: 0
 
       - name: Cache Gradle dependencies
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: |
             ~/.gradle/caches
@@ -63,8 +63,6 @@ jobs:
     - build
     # If you change the following comment, update the pattern in the update_system_test_reference.sh script to match.
     uses: DataDog/system-tests/.github/workflows/system-tests.yml@main # system tests are pinned on release branches only
-    secrets:
-      TEST_OPTIMIZATION_API_KEY: ${{ secrets.DATADOG_API_KEY_PROD }}
     permissions:
       contents: read
       id-token: write
@@ -78,7 +76,7 @@ jobs:
       scenarios_groups: tracer-release
       excluded_scenarios: APM_TRACING_E2E_OTEL,APM_TRACING_E2E_SINGLE_SPAN,PROFILING  # exclude flaky scenarios
       skip_empty_scenarios: true
-      push_to_test_optimization: true
+      push_to_test_optimization: false # disabled to avoid pushing to Test Optimization while API key is transitioning to system-tests
 
   # Ensure the main job is run to completion
   check:

.gitlab-ci.yml

@@ -52,6 +52,10 @@ variables:
     description: "Enable flaky tests"
     value: "false"
 
+  # One pipeline injection package size ratchet
+  OCI_PACKAGE_MAX_SIZE_BYTES: 40_000_000
+  LIB_INJECTION_IMAGE_MAX_SIZE_BYTES: 40_000_000
+
 # trigger new commit cancel
 workflow:
   auto_cancel:

.gitlab/TagInitializationErrors.java

@@ -0,0 +1,114 @@
+import org.w3c.dom.Element;
+import javax.xml.XMLConstants;
+import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.transform.OutputKeys;
+import javax.xml.transform.TransformerFactory;
+import javax.xml.transform.dom.DOMSource;
+import javax.xml.transform.stream.StreamResult;
+import java.io.File;
+import java.nio.file.Files;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+
+/// Tags intermediate `initializationError` retries with `dd_tags[test.final_status]=skip`.
+///
+/// Gradle generates synthetic "initializationError" testcases in JUnit reports for setup methods.
+/// When a setup is retried and eventually succeeds, multiple testcases are created, with only the
+/// last one passing. All intermediate attempts are marked skip so Test Optimization is not misled.
+///
+/// For any suite with multiple `initializationError` test cases (when retries occurred), all entries
+/// but the last one are tagged by this script with `dd_tags[test.final_status]=skip`. The last
+/// entry is left unmodified, allowing **Test Optimization** to apply its default status inference based
+/// on the actual outcome. Files with only one (or zero) `initializationError` test cases are left unmodified.
+///
+/// Before:
+/// 
+/// ```
+/// <testcase name="initializationError" />
+/// ```
+/// 
+/// After:
+/// 
+/// ```
+/// <testcase name="initializationError">
+///   <properties>
+///     <property name="dd_tags[test.final_status]" value="skip" /> 
+///   </properties>
+/// </testcase>
+/// ```
+/// 
+/// Usage (Java 25): `java TagInitializationErrors.java junit-report.xml`
+
+class TagInitializationErrors {
+  public static void main(String[] args) throws Exception {
+    if (args.length == 0) {
+      System.err.println("Usage: java TagInitializationErrors.java <xml-file>");
+      System.exit(1);
+    }
+    var xmlFile = new File(args[0]);
+    if (!xmlFile.exists()) {
+      System.err.println("File not found: " + xmlFile);
+      System.exit(1);
+    }
+    var dbf = DocumentBuilderFactory.newInstance();
+    dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+    dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+    dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
+    dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+    dbf.setExpandEntityReferences(false);
+    var doc = dbf.newDocumentBuilder().parse(xmlFile);
+    var testcases = doc.getElementsByTagName("testcase");
+    Map<String, List<Element>> byClassname = new LinkedHashMap<>();
+    for (int i = 0; i < testcases.getLength(); i++) {
+      var e = (Element) testcases.item(i);
+      if ("initializationError".equals(e.getAttribute("name"))) {
+        byClassname.computeIfAbsent(e.getAttribute("classname"), k -> new ArrayList<>()).add(e);
+      }
+    }
+    boolean modified = false;
+    for (var group : byClassname.values()) {
+      if (group.size() <= 1) continue;
+      for (int i = 0; i < group.size() - 1; i++) {
+        var testcase = group.get(i);
+        var existingProperties = testcase.getElementsByTagName("properties");
+        if (existingProperties.getLength() > 0) {
+          var props = (Element) existingProperties.item(0);
+          var existingProps = props.getElementsByTagName("property");
+          boolean alreadyTagged = false;
+          for (int j = 0; j < existingProps.getLength(); j++) {
+            if ("dd_tags[test.final_status]".equals(((Element) existingProps.item(j)).getAttribute("name"))) {
+              alreadyTagged = true;
+              break;
+            }
+          }
+          if (alreadyTagged) continue;
+          var property = doc.createElement("property");
+          property.setAttribute("name", "dd_tags[test.final_status]");
+          property.setAttribute("value", "skip");
+          props.appendChild(property);
+        } else {
+          var properties = doc.createElement("properties");
+          var property = doc.createElement("property");
+          property.setAttribute("name", "dd_tags[test.final_status]");
+          property.setAttribute("value", "skip");
+          properties.appendChild(property);
+          testcase.appendChild(properties);
+        }
+        modified = true;
+      }
+    }
+    if (!modified) return;
+    var tmpFile = File.createTempFile("TagInitializationErrors", ".xml", xmlFile.getParentFile());
+    try {
+      var transformer = TransformerFactory.newInstance().newTransformer();
+      transformer.setOutputProperty(OutputKeys.ENCODING, "UTF-8");
+      transformer.transform(new DOMSource(doc), new StreamResult(tmpFile));
+      Files.move(tmpFile.toPath(), xmlFile.toPath(), java.nio.file.StandardCopyOption.REPLACE_EXISTING);
+    } catch (Exception e) {
+      tmpFile.delete();
+      throw e;
+    }
+  }
+}

.gitlab/benchmarks/bp-runner.fail-on-breach.yml

@@ -2,7 +2,7 @@
 # Generated: 2026-03-31
 #
 # Generation Strategy: tight
-#   Formula: CI_bound / (1 ± T) (T = 5.0%)
+#   Formula: CI_bound / (1 ± T) (T = 10.0%)
 #
 # SLO Checking:
 #   - BREACH: 90% CI boundary crosses threshold
@@ -11,7 +11,7 @@
 # DO NOT EDIT MANUALLY - Regenerate using:
 #   benchmark_analyzer generate slos --help
 #
-# Thresholds set based on guidance in https://datadoghq.atlassian.net/wiki/x/LgI1LgE#How-to-choose-thresholds-for-pre-release-gates%3F
+# link to documentation on autogenerated thresholds https://github.com/DataDog/relenv-benchmark-analyzer/blob/main/README.md#generate-slo-thresholds
 
 experiments:
   - name: Run SLO breach check
@@ -31,7 +31,7 @@ experiments:
           # https://benchmarking.us1.prod.dog/trends?projectId=4&branch=master&trendsTab=per_scenario&scenario=normal_operation%2Fonly-tracing&trendsType=scenario
           - name: normal_operation/only-tracing
             thresholds:
-              - agg_http_req_duration_p50 < 2.128 ms
+              - agg_http_req_duration_p50 < 2.526 ms
               - agg_http_req_duration_p99 < 8.5 ms
           # https://benchmarking.us1.prod.dog/trends?projectId=4&branch=master&trendsTab=per_scenario&scenario=normal_operation%2Fotel-latest&trendsType=scenario
           - name: normal_operation/otel-latest

.gitlab/collect_results.sh

@@ -90,6 +90,9 @@ do
     echo " (non-stable test names detected)"
   fi
 
+  echo "Add dd_tags[test.final_status] property on retried synthetics testcase initializationErrors"
+  $JAVA_25_HOME/bin/java "$(dirname "$0")/TagInitializationErrors.java" "$TARGET_DIR/$AGGREGATED_FILE_NAME"
+
   echo "Add dd_tags[test.final_status] property to each testcase on $TARGET_DIR/$AGGREGATED_FILE_NAME"
   xsl_file="$(dirname "$0")/add_final_status.xsl"
   tmp_file="$(mktemp)"

.gitlab/one-pipeline.locked.yml

@@ -1,4 +1,4 @@
 # DO NOT EDIT THIS FILE MANUALLY
 # This file is auto-generated by automation.
 include:
-  - remote: https://gitlab-templates.ddbuild.io/libdatadog/one-pipeline/ca/9cf7d7609ff62e4723c9cbc061ca2a25345ce5d6055b9acad9a13dbf736261f0/one-pipeline.yml
+  - remote: https://gitlab-templates.ddbuild.io/libdatadog/one-pipeline/ca/4667b01c6ae983f92ecf106e110ced3dac798b229cf2a0539c58aa22e95a99d5/one-pipeline.yml