Add Datadog code coverage upload (#3702)

* Add Datadog code coverage upload alongside Codecov

Add datadog-ci coverage upload steps to the "appsec code coverage" CI job
to run side-by-side with existing Codecov uploads. Both LCOV reports
(extension and helper) are uploaded to Datadog for coverage parity validation.

Also adds code-coverage.datadog.yml mirroring codecov.yml ignore paths and
PR gate thresholds.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Fix datadog-ci install path: use /tmp instead of /usr/local/bin

The CI runner doesn't have write permissions to /usr/local/bin.
Write the binary to /tmp instead.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Fix datadog-ci version: v2.48.0 → v5.9.1

The coverage upload command is not available in v2.48.0. Updating to
v5.9.1 which includes the coverage plugin.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Bob Weinand <bob.weinand@datadoghq.com>

Author: 3 people

.gitlab/generate-appsec.php

@@ -429,6 +429,24 @@
       echo "Uploading helper coverage to codecov"
       cd "$CI_PROJECT_DIR"
       codecov -t "$CODECOV_TOKEN" -n appsec-helper -v -f appsec/build/coverage-helper.lcov
+    - |
+      echo "Uploading coverage to Datadog"
+      cd "$CI_PROJECT_DIR"
+
+      DATADOG_API_KEY=$(vault kv get --format=json kv/k8s/gitlab-runner/dd-trace-php/datadoghq-api-key | jq -r .data.data.key)
+      export DATADOG_API_KEY
+      export DD_SITE="datadoghq.com"
+
+      # Install datadog-ci
+      DATADOG_CI_VERSION="v5.9.1"
+      curl -L --fail "https://github.com/DataDog/datadog-ci/releases/download/${DATADOG_CI_VERSION}/datadog-ci_linux-x64" --output "/tmp/datadog-ci"
+      chmod +x /tmp/datadog-ci
+
+      echo "Uploading extension coverage to Datadog"
+      /tmp/datadog-ci coverage upload --format=lcov appsec/build/coverage-ext.lcov || true
+
+      echo "Uploading helper coverage to Datadog"
+      /tmp/datadog-ci coverage upload --format=lcov appsec/build/coverage-helper.lcov || true
 
 
 "push appsec images":

code-coverage.datadog.yml

@@ -0,0 +1,12 @@
+schema-version: v1
+ignore:
+  - "appsec/build/"
+  - "appsec/tests/"
+  - "appsec/third_party/"
+gates:
+  - type: total_coverage_percentage
+    config:
+      threshold: auto
+  - type: patch_coverage_percentage
+    config:
+      threshold: 90