v5.111.0 proposal

.agents/skills/apm-integrations/references/orchestrion.md

@@ -208,6 +208,95 @@ For integrations wrapping multiple methods, create a separate plugin class per m
 - `ctx.error` — thrown error (on error)
 - `ctx.currentStore` — set by `startSpan` in `bindStart`
 
+## Propagating Synchronous Errors From `bindStart`
+
+Subscribers on the prefix `:start` channel and `bindStore` transforms **cannot
+propagate a synchronous throw** to the caller of an orchestrion-wrapped
+function. Both are wrapped in `try { ... } catch (err) { process.nextTick(() =>
+triggerUncaughtException(err)); ... }` by Node's `diagnostics_channel` (see
+`lib/diagnostics_channel.js`'s `wrapStoreRun` and `publish`). The error
+surfaces async as an uncaught exception, **after** the wrapped fn has already
+run and the call has returned normally.
+
+The wrapper's own catch block, however, **does** rethrow:
+
+```js
+return ch.start.runStores(__apm$ctx, () => {
+  try {
+    const result = __apm$traced();
+    __apm$ctx.result = result;
+    return result;
+  } catch (err) {
+    __apm$ctx.error = err;
+    ch.error.publish(__apm$ctx);
+    throw err;                  // <- propagates the wrapped fn's error to the caller
+  } finally {
+    ch.end.publish(__apm$ctx);
+  }
+});
+```
+
+When a contract requires `assert.throws(() => wrapped(...))`-style synchronous
+propagation from a `:start` observer (the canonical case is AppSec WAF's
+`abortController.abort()` model), use the **Proxy-on-arguments pattern**:
+
+```js
+bindStart (ctx) {
+  // ... normal setup, span creation ...
+  const abortController = new AbortController()
+  if (startCh.hasSubscribers) {
+    startCh.publish({ abortController, args })       // subscribers run sync
+    if (abortController.signal.aborted) {
+      // ctx.arguments is the SAME array reference the wrapper spreads into
+      // the wrapped fn (__apm$wrapped.apply(this, ctx.arguments)). Replace
+      // arguments[0] with a Proxy whose getters throw AbortError. The
+      // wrapped fn's first property access (typically a destructure of args)
+      // triggers the trap → the wrapper's catch+rethrow propagates AbortError
+      // to the caller. Span lifecycle still completes via end.publish.
+      ctx.arguments[0] = new Proxy({}, {
+        get () { throw new AbortError('Aborted') },
+        has () { throw new AbortError('Aborted') },
+      })
+      ctx.ddAborted = true
+      return ctx.currentStore
+    }
+  }
+  // ... rest of bindStart ...
+}
+
+error (ctx) {
+  if (ctx.ddAborted) return                          // abort != error tag
+  // ... regular error handling ...
+}
+```
+
+Reference implementation: `packages/datadog-plugin-graphql/src/execute.js`
+(`apm:graphql:execute:start` contract).
+
+Why this works:
+- `ctx.arguments` and the rewriter's `__apm$arguments` are the same array
+  reference (confirmed by capturing the rewriter output: `const __apm$traced
+  = () => __apm$wrapped.apply(this, __apm$arguments)`).
+- The wrapped fn's body almost always touches `arguments[0]` on the first
+  statement (destructure, property read, validation). Any read triggers the
+  Proxy trap.
+- The orchestrion wrapper's `catch { ...; throw err }` propagates the thrown
+  error synchronously to the caller — confirmed in the rewriter template
+  (vendor's `code-transformer/index.js`, `wrapSync` function).
+- `:end` still fires in `finally`, so the plugin's `end(ctx)` runs as usual
+  and the span lifecycle completes cleanly. Combined with an `error(ctx)`
+  that no-ops when `ctx.ddAborted`, the span finishes with `error === 0`
+  (matches the abort contract).
+
+When NOT to use this:
+- If you control the wrapped fn (e.g., it's a method you can wrap with
+  shimmer on top of orchestrion), do that — clearer and avoids the
+  Proxy indirection.
+- If the wrapped fn might catch its own errors before they escape (some
+  user-resolver patterns do this), the AbortError won't propagate. Verify
+  the wrapped fn does NOT have a top-level `try/catch` around the
+  property access that triggers the trap.
+
 ## Common Issues
 
 ### Wrong filePath

.github/CODEOWNERS

@@ -146,6 +146,11 @@
 /integration-tests/vitest/ @DataDog/ci-app-libraries
 /integration-tests/vitest.config.mjs @DataDog/ci-app-libraries
 /integration-tests/vitest.second-project.config.mjs @DataDog/ci-app-libraries
+/integration-tests/vitest.typecheck.config.mjs @DataDog/ci-app-libraries
+/integration-tests/tsconfig.typecheck.json @DataDog/ci-app-libraries
+/integration-tests/tsconfig.typecheck-fail.json @DataDog/ci-app-libraries
+/integration-tests/tsconfig.typecheck-test-management-fail.json @DataDog/ci-app-libraries
+/integration-tests/tsconfig.typecheck-test-management-file-fail.json @DataDog/ci-app-libraries
 /integration-tests/ci-visibility-intake.js @DataDog/ci-app-libraries
 /integration-tests/ci-visibility-intake.spec.js @DataDog/ci-app-libraries
 /integration-tests/CODEOWNERS @DataDog/ci-app-libraries

.github/actions/coverage/action.yml

@@ -1,9 +1,13 @@
 name: coverage
-description: Verify coverage output and upload it to Codecov and Datadog.
+description: >-
+  Verify a job's coverage output and stash it as an artifact. All Green collects every
+  `coverage-*` artifact, merges them per integration, and uploads the groups to Codecov and
+  Datadog — so a commit sends ~100 grouped reports instead of one per matrix cell, which kept
+  Codecov from silently dropping uploads past its per-commit ceiling.
 
 inputs:
   flags:
-    description: "Codecov flags value"
+    description: "Coverage flags — the grouping key All Green folds matrix cells by"
     required: false
   report-dir:
     description: "Coverage report directory (defaults to 'coverage')"
@@ -12,19 +16,13 @@ inputs:
 runs:
   using: composite
   steps:
-    # Retry once on failure to work around transient issues (e.g. flaky
-    # Codecov upload network calls).
-    - id: attempt
-      uses: ./.github/actions/coverage/upload
-      continue-on-error: true
-      with:
-        flags: ${{ inputs.flags }}
-        report-dir: ${{ inputs.report-dir }}
-    - if: steps.attempt.outcome == 'failure'
+    - name: Verify coverage output
       shell: bash
-      run: sleep 60
-    - if: steps.attempt.outcome == 'failure'
-      uses: ./.github/actions/coverage/upload
+      run: node scripts/verify-coverage.js --flags "${{ inputs.flags }}"
+
+    - name: Upload coverage artifact
+      if: always()
+      uses: ./.github/actions/upload-coverage-artifact
       with:
         flags: ${{ inputs.flags }}
         report-dir: ${{ inputs.report-dir }}

.github/actions/install/branch-diff/action.yml

@@ -7,7 +7,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+    - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.npm
         key: ${{ github.workflow }}-branch-diff-3.1.1

.github/actions/node/setup/action.yml

@@ -27,8 +27,10 @@ runs:
         }
         case "$VERSION" in
           eol)         version=16 ;;
-          oldest)      oldest_major=$(awk '/"node"/{match($0,/[0-9]+/);print substr($0,RSTART,RLENGTH);exit}' package.json)
-                      version=$(node_version "$oldest_major") ;;
+          # Pinned to 18 rather than derived from package.json engines.node: CI keeps testing the
+          # oldest version we still exercise (18) even though the shipped engines floor is now >=22.
+          # See the Widen engines.node for CI step below, which restores >=18 on the 18/20 legs.
+          oldest)      version=$(node_version 18) ;;
           maintenance) version=$(node_version 20) ;;
           active)      version=$(node_version 24) ;;
           latest)      version=${LATEST_VERSION:-$(node_version 26)}
@@ -44,6 +46,22 @@ runs:
         node-version: ${{ steps.node-version.outputs.version }}
         registry-url: ${{ inputs.registry-url || 'https://registry.npmjs.org' }}
 
+    # The shipped package.json pins engines.node to the supported runtime range, but CI keeps
+    # running the full suite on Node 18/20. Widen the field to >=18 for this checkout so the
+    # runtime guard and the withVersions test helper don't bail and silently skip those jobs.
+    # Gate on the major so this never runs on the ancient runtimes the guardrails-unsupported
+    # job installs (those must keep seeing the shipped >=22 so the guard aborts), and so the
+    # script is only ever parsed by a Node version new enough to run it.
+    - name: Widen engines.node for CI
+      shell: bash
+      run: |
+        MAJOR=$(node -e "process.stdout.write(String(parseInt(process.versions.node)))")
+        if [ "$MAJOR" = "18" ] || [ "$MAJOR" = "20" ]; then
+          node scripts/ci/widen-engines-for-ci.js
+        else
+          echo "Leaving engines.node unchanged on Node $(node -v) (only widened on Node 18/20)."
+        fi
+
     # Persist the resolved version so subsequent runs within this 60-minute window can reuse it.
     - name: Save resolved version
       if: steps.node-version-cache.outputs.cache-hit != 'true'

.github/actions/upload-coverage-artifact/action.yml

@@ -1,9 +1,9 @@
 name: Upload Coverage Artifact
-description: Upload coverage report as a GitHub Actions artifact for later collection
+description: Upload a job's LCOV report as a GitHub Actions artifact for All Green to collect and group.
 
 inputs:
   flags:
-    description: Coverage flags — used as artifact identifier and passed to Datadog on upload
+    description: Coverage flags — the grouping key All Green folds matrix cells by
     required: true
   report-dir:
     description: Coverage report directory
@@ -13,26 +13,38 @@ inputs:
 runs:
   using: composite
   steps:
+    # The reports live at `<report-dir>/node-<version>-<label>/{lcov.info,coverage-final.json}`, one
+    # level below `report-dir`, so the presence check has to recurse — a top-level-only probe finds
+    # nothing and silently skips the upload, which is what starved the Datadog coverage upload.
+    # Both formats ship: Codecov reads branch/function coverage from the istanbul JSON, Datadog from
+    # the lcov.
     - id: check
       shell: bash
       run: |
-        count=$(find "${{ inputs.report-dir }}" -maxdepth 1 -type f 2>/dev/null | wc -l | tr -d ' ')
-        echo "has_files=$([ "$count" -gt 0 ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
-    - if: steps.check.outputs.has_files == 'true'
+        count=$(find "${{ inputs.report-dir }}" \( -name lcov.info -o -name coverage-final.json \) -type f 2>/dev/null | wc -l | tr -d ' ')
+        echo "has_coverage=$([ "$count" -gt 0 ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+    # The artifact name carries the grouping flag plus a per-cell suffix (`__<job>-<matrix-index>`)
+    # so matrix cells that share a flag — cypress varies `spec` outside its flag — upload distinct
+    # artifacts instead of clobbering each other under one name.
+    - if: github.actor != 'dependabot[bot]' && steps.check.outputs.has_coverage == 'true'
       id: upload
       continue-on-error: true
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
-        name: coverage-${{ inputs.flags }}
-        path: ${{ inputs.report-dir }}
+        name: coverage-${{ inputs.flags }}__${{ github.job }}-${{ strategy.job-index }}
+        path: |
+          ${{ inputs.report-dir }}/**/lcov.info
+          ${{ inputs.report-dir }}/**/coverage-final.json
         retention-days: 1
-    - if: steps.check.outputs.has_files == 'true' && steps.upload.outcome == 'failure'
+    - if: github.actor != 'dependabot[bot]' && steps.check.outputs.has_coverage == 'true' && steps.upload.outcome == 'failure'
       shell: bash
       run: sleep 10
-    - if: steps.check.outputs.has_files == 'true' && steps.upload.outcome == 'failure'
+    - if: github.actor != 'dependabot[bot]' && steps.check.outputs.has_coverage == 'true' && steps.upload.outcome == 'failure'
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
-        name: coverage-${{ inputs.flags }}
-        path: ${{ inputs.report-dir }}
-        overwrite: true
+        name: coverage-${{ inputs.flags }}__${{ github.job }}-${{ strategy.job-index }}
+        path: |
+          ${{ inputs.report-dir }}/**/lcov.info
+          ${{ inputs.report-dir }}/**/coverage-final.json
         retention-days: 1
+        overwrite: true

.github/chainguard/self.github.release.push-tags.sts.yaml

@@ -4,9 +4,9 @@ subject: repo:DataDog/dd-trace-js:environment:npm
 
 claim_pattern:
   event_name: (push|workflow_dispatch)
-  ref: refs/heads/(v[345]\.x|master)
+  ref: refs/heads/(v[3456]\.x|master)
   repository: DataDog/dd-trace-js
-  job_workflow_ref: DataDog/dd-trace-js/\.github/workflows/release\.yml@refs/heads/(v[345]\.x|master)
+  job_workflow_ref: DataDog/dd-trace-js/\.github/workflows/release\.yml@refs/heads/(v[3456]\.x|master)
 
 permissions:
   contents: write

.github/workflows/all-green.yml

@@ -40,6 +40,12 @@ jobs:
           GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }}
           POLLING_INTERVAL: 1
           RETRIES: 20
+      # Sort every downloaded per-cell `coverage-*` artifact into one directory per integration under
+      # `coverage-upload/<group>/{lcov,json}/`. The reports are not merged here — both backends merge
+      # same-flag uploads server-side — so each cell's report passes through byte-for-byte. Codecov
+      # gets the istanbul JSON (carries branch/function coverage), Datadog gets the lcov.
+      - if: "!cancelled()"
+        run: node scripts/group-coverage.mjs
       - if: "!cancelled()"
         uses: ./.github/actions/dd-sts-api-key
         id: dd-sts
@@ -49,7 +55,54 @@ jobs:
         run: datadog-ci junit upload --service dd-trace-js-tests --auto-discovery junit-results
         env:
           DD_API_KEY: ${{ steps.dd-sts.outputs.api_key }}
+      # One Datadog upload per integration, flagged with the integration name so coverage is
+      # attributable in the Datadog UI the same way the Codecov flags attribute it. Datadog reads the
+      # lcov reports; it does not ingest istanbul's JSON.
       - if: "!cancelled()"
-        run: datadog-ci coverage upload coverage-results
+        run: |
+          set -o pipefail
+          shopt -s nullglob
+          # shellcheck disable=SC2016 # the inner shell must expand "$1", not the template.
+          printf '%s\0' coverage-upload/*/lcov/ | xargs -0 -r -P 10 -I {} \
+            bash -c 'datadog-ci coverage upload "$1" --flags "$(basename "$(dirname "$1")")"' _ {}
         env:
           DD_API_KEY: ${{ steps.dd-sts.outputs.api_key }}
+      # One Codecov upload per integration via the CLI directly — the codecov-action would re-validate
+      # and re-download the uploader once per group (~100×). Codecov reads branch/function coverage
+      # from the istanbul JSON, so the upload points at each group's `json/` subdirectory.
+      # `master-coverage` is the flag `.codecov.yml` gates `codecov/patch` on; attach it only on PRs
+      # targeting master so release-branch PRs auto-pass. The SHA/branch/PR are passed explicitly
+      # because All Green checks out the merge ref, not the head the other workflows reported coverage
+      # for. No token: the repo uploads tokenless (a Codecov token would have to be an org secret,
+      # which forks can't read).
+      - if: "!cancelled()"
+        run: |
+          commit_args=(--sha "$HEAD_SHA" --branch "$HEAD_BRANCH")
+          upload_args=(--sha "$HEAD_SHA")
+          if [ -n "$PR_NUMBER" ]; then
+            commit_args+=(--pr "$PR_NUMBER")
+            upload_args+=(--pr "$PR_NUMBER")
+          fi
+          master_flag=()
+          if [ "$GITHUB_EVENT_NAME" = "pull_request" ] && [ "$BASE_REF" = "master" ]; then
+            master_flag=(-F master-coverage)
+          fi
+          shopt -s nullglob
+          groups=(coverage-upload/*/json/)
+          [ ${#groups[@]} -gt 0 ] || exit 0
+          pip install --quiet codecov-cli
+          # create-commit and create-report set up the report once and must finish before any upload;
+          # only the do-upload fan-out is safe to parallelize.
+          codecovcli create-commit "${commit_args[@]}"
+          codecovcli create-report --sha "$HEAD_SHA"
+          set -o pipefail
+          # shellcheck disable=SC2016 # the inner shell must expand "$@"/"$dir", not the template.
+          printf '%s\0' "${groups[@]}" | xargs -0 -r -P 10 -I {} \
+            bash -c 'dir="$1"; shift; codecovcli do-upload "$@" --dir "$dir" -F "$(basename "$(dirname "$dir")")"' \
+              _ {} "${upload_args[@]}" "${master_flag[@]}"
+        env:
+          GITHUB_EVENT_NAME: ${{ github.event_name }}
+          BASE_REF: ${{ github.base_ref }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          HEAD_BRANCH: ${{ github.head_ref || github.ref_name }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}

.github/workflows/project.yml

@@ -19,7 +19,7 @@ jobs:
       - uses: ./.github/actions/node/latest
       - name: actionlint
         id: actionlint
-        uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8 # v2.1.2
+        uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2.2.0
         with:
           matcher: true
           fail-on-error: true