Merge branch 'master' into alejandro.gonzalez/APPSEC-61873-3

Author: jandro996

.github/workflows/create-release-branch.yaml

@@ -69,7 +69,7 @@ jobs:
       contents: write
       id-token: write # required for OIDC token federation
     steps:
-      - uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
+      - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
         id: octo-sts
         with:
           scope: DataDog/dd-trace-java

.github/workflows/enforce-datadog-merge-queue.yaml

@@ -21,7 +21,7 @@ jobs:
           exit 1
       - name: Get OIDC token
         if: github.event.action == 'enqueued'
-        uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
+        uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
         id: octo-sts
         with:
           scope: DataDog/dd-trace-java

.github/workflows/run-system-tests.yaml

@@ -63,22 +63,20 @@ jobs:
     - build
     # If you change the following comment, update the pattern in the update_system_test_reference.sh script to match.
     uses: DataDog/system-tests/.github/workflows/system-tests.yml@main # system tests are pinned on release branches only
-    secrets:
-      TEST_OPTIMIZATION_API_KEY: ${{ secrets.DATADOG_API_KEY_PROD }}
     permissions:
       contents: read
       id-token: write
       packages: write
     with:
       library: java
        # If you change the following comment, update the pattern in the update_system_test_reference.sh script to match.
-      ref: main # system tests are pinned on release branches only
+      ref: "main" # system tests are pinned on release branches only
       binaries_artifact: binaries
       desired_execution_time: 900  # 15 minutes
       scenarios_groups: tracer-release
       excluded_scenarios: APM_TRACING_E2E_OTEL,APM_TRACING_E2E_SINGLE_SPAN,PROFILING  # exclude flaky scenarios
       skip_empty_scenarios: true
-      push_to_test_optimization: true
+      push_to_test_optimization: false # disabled to avoid pushing to Test Optimization while API key is transitioning to system-tests
 
   # Ensure the main job is run to completion
   check:

.github/workflows/update-gradle-dependencies.yaml

@@ -12,7 +12,7 @@ jobs:
       contents: read
       id-token: write # Required for OIDC token federation
     steps:
-      - uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
+      - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
         id: octo-sts
         with:
           scope: DataDog/dd-trace-java

.github/workflows/update-jmxfetch-submodule.yaml

@@ -12,7 +12,7 @@ jobs:
       contents: read
       id-token: write # Required for OIDC token federation
     steps:
-      - uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
+      - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
         id: octo-sts
         with:
           scope: DataDog/dd-trace-java

.github/workflows/update-smoke-test-latest-versions.yaml

@@ -12,7 +12,7 @@ jobs:
       contents: read
       id-token: write # Required for OIDC token federation
     steps:
-      - uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
+      - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
         id: octo-sts
         with:
           scope: DataDog/dd-trace-java

.gitlab-ci.yml

@@ -647,7 +647,7 @@ muzzle-dep-report:
     CI_USE_TEST_AGENT: "true"
     CI_AGENT_HOST: local-agent
   services:
-    - name: ghcr.io/datadog/dd-apm-test-agent/ddapm-test-agent:v1.33.1
+    - name: registry.ddbuild.io/images/mirror/dd-apm-test-agent/ddapm-test-agent:v1.44.0
       alias: local-agent
       variables:
         LOG_LEVEL: "DEBUG"
@@ -848,32 +848,6 @@ deploy_to_profiling_backend:
     UPSTREAM_BRANCH: $CI_COMMIT_BRANCH
     UPSTREAM_TAG: $CI_COMMIT_TAG
 
-trigger_tibco_tests:
-  stage: tests
-  needs: [ build ]
-  rules:
-    - if: '$POPULATE_CACHE'
-      when: never
-    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
-      when: on_success
-    - if: '$CI_COMMIT_TAG =~ /^v.*/'
-      when: on_success
-    - when: manual
-      allow_failure: true
-  trigger:
-    project: DataDog/tibco-testing
-    branch: main
-    strategy: depend
-  variables:
-    UPSTREAM_PACKAGE_JOB: $BUILD_JOB_NAME
-    UPSTREAM_PACKAGE_JOB_ID: $BUILD_JOB_ID
-    UPSTREAM_PROJECT_ID: $CI_PROJECT_ID
-    UPSTREAM_PROJECT_NAME: $CI_PROJECT_NAME
-    UPSTREAM_PIPELINE_ID: $CI_PIPELINE_ID
-    UPSTREAM_BRANCH: $CI_COMMIT_BRANCH
-    UPSTREAM_TAG: $CI_COMMIT_TAG
-    FORCE_TRIGGER: $FORCE_TRIGGER
-
 deploy_to_di_backend:manual:
   stage: publish
   needs: [ build ]
@@ -1071,7 +1045,7 @@ publishing-gate:
 
 configure_system_tests:
   variables:
-    SYSTEM_TESTS_REF: main # system tests are pinned on release branches only
+    SYSTEM_TESTS_REF: "main" # system tests are pinned on release branches only
     SYSTEM_TESTS_SCENARIOS_GROUPS: "simple_onboarding,simple_onboarding_profiling,simple_onboarding_appsec,docker-ssi,lib-injection"
 
 create_key:

.gitlab/benchmarks/bp-runner.fail-on-breach.yml

@@ -1,4 +1,17 @@
-# Thresholds set based on guidance in https://datadoghq.atlassian.net/wiki/x/LgI1LgE#How-to-choose-thresholds-for-pre-release-gates%3F
+# Auto-generated SLO Thresholds
+# Generated: 2026-03-31
+#
+# Generation Strategy: tight
+#   Formula: CI_bound / (1 ± T) (T = 10.0%)
+#
+# SLO Checking:
+#   - BREACH: 90% CI boundary crosses threshold
+#   - WARNING: 90% CI boundary crosses warning_threshold (constant)
+#
+# DO NOT EDIT MANUALLY - Regenerate using:
+#   benchmark_analyzer generate slos --help
+#
+# link to documentation on autogenerated thresholds https://github.com/DataDog/relenv-benchmark-analyzer/blob/main/README.md#generate-slo-thresholds
 
 experiments:
   - name: Run SLO breach check
@@ -18,7 +31,7 @@ experiments:
           # https://benchmarking.us1.prod.dog/trends?projectId=4&branch=master&trendsTab=per_scenario&scenario=normal_operation%2Fonly-tracing&trendsType=scenario
           - name: normal_operation/only-tracing
             thresholds:
-              - agg_http_req_duration_p50 < 2.6 ms
+              - agg_http_req_duration_p50 < 2.526 ms
               - agg_http_req_duration_p99 < 8.5 ms
           # https://benchmarking.us1.prod.dog/trends?projectId=4&branch=master&trendsTab=per_scenario&scenario=normal_operation%2Fotel-latest&trendsType=scenario
           - name: normal_operation/otel-latest

.gitlab/one-pipeline.locked.yml

@@ -1,4 +1,4 @@
 # DO NOT EDIT THIS FILE MANUALLY
 # This file is auto-generated by automation.
 include:
-  - remote: https://gitlab-templates.ddbuild.io/libdatadog/one-pipeline/ca/9cf7d7609ff62e4723c9cbc061ca2a25345ce5d6055b9acad9a13dbf736261f0/one-pipeline.yml
+  - remote: https://gitlab-templates.ddbuild.io/libdatadog/one-pipeline/ca/4667b01c6ae983f92ecf106e110ced3dac798b229cf2a0539c58aa22e95a99d5/one-pipeline.yml

ARCHITECTURE.md

@@ -54,7 +54,7 @@ to `.classdata` to prevent unintended loading. See [`docs/how_to_work_with_gradl
   utilities. Visible to all classloaders, so instrumentation advice and helpers can use them directly.
   See [`docs/bootstrap_design_guidelines.md`](docs/bootstrap_design_guidelines.md).
 
-- **`agent-builder/`** — ByteBuddy integration layer. Class transformer pipeline:
+- **`agent-installer/`** — Product installers and ByteBuddy integration layer. Class transformer pipeline:
   `DDClassFileTransformer` intercepts every class load, `GlobalIgnoresMatcher` applies early
   filtering, `CombiningMatcher` evaluates instrumentation matchers, `SplittingTransformer`
   applies matched transformations. The `ignored_class_name.trie` is a compiled trie built at