ci: exclude release-proposal wfs from green_ci and exclude benchmarks on release* branches

.github/workflows/release-proposal-dispatch.yml

@@ -45,6 +45,31 @@ jobs:
       crates_branch: ${{ steps.normalize.outputs.crates_branch }}
       count: ${{ steps.normalize.outputs.count }}
     steps:
+      - name: Exclude from Green CI
+        env:
+          DATADOG_SITE: datadoghq.com
+          DATADOG_API_KEY: ${{ secrets.DATADOG_API_KEY }}
+        run: |
+          # Download the pinned, checksum-verified datadog-ci binary instead of
+          # `npm install -g`, so no third-party install-time code runs with the
+          # Datadog API key in its environment.
+          URL="https://github.com/DataDog/datadog-ci/releases/download/v5.21.0/datadog-ci_linux-x64"
+          OUTPUT="datadog-ci"
+          EXPECTED_CHECKSUM="be4a6473fc451fec967ff277df3856060814b9a54d707d055a9c1542ae2869f0"
+
+          echo "Downloading datadog-ci from $URL"
+          curl -L --fail --retry 3 -o "$OUTPUT" "$URL"
+          chmod +x "$OUTPUT"
+
+          ACTUAL_CHECKSUM=$(sha256sum "$OUTPUT" | cut -d' ' -f1)
+          if [ "$ACTUAL_CHECKSUM" != "$EXPECTED_CHECKSUM" ]; then
+            echo "Checksum verification failed! expected=$EXPECTED_CHECKSUM actual=$ACTUAL_CHECKSUM"
+            exit 1
+          fi
+          echo "Checksum verification passed"
+
+          ./"$OUTPUT" tag --level pipeline --tags green_ci.excluded:true
+
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
       - name: Normalize and validate crate list
         id: normalize

.github/workflows/release-proposal-test.yml

@@ -16,6 +16,31 @@ jobs:
     outputs:
       upload_artifact: ${{ steps.package-crates.outputs.upload_artifact }}
     steps:
+      - name: Exclude from Green CI
+        env:
+          DATADOG_SITE: datadoghq.com
+          DATADOG_API_KEY: ${{ secrets.DATADOG_API_KEY }}
+        run: |
+          # Download the pinned, checksum-verified datadog-ci binary instead of
+          # `npm install -g`, so no third-party install-time code runs with the
+          # Datadog API key in its environment.
+          URL="https://github.com/DataDog/datadog-ci/releases/download/v5.21.0/datadog-ci_linux-x64"
+          OUTPUT="datadog-ci"
+          EXPECTED_CHECKSUM="be4a6473fc451fec967ff277df3856060814b9a54d707d055a9c1542ae2869f0"
+
+          echo "Downloading datadog-ci from $URL"
+          curl -L --fail --retry 3 -o "$OUTPUT" "$URL"
+          chmod +x "$OUTPUT"
+
+          ACTUAL_CHECKSUM=$(sha256sum "$OUTPUT" | cut -d' ' -f1)
+          if [ "$ACTUAL_CHECKSUM" != "$EXPECTED_CHECKSUM" ]; then
+            echo "Checksum verification failed! expected=$EXPECTED_CHECKSUM actual=$ACTUAL_CHECKSUM"
+            exit 1
+          fi
+          echo "Checksum verification passed"
+
+          ./"$OUTPUT" tag --level pipeline --tags green_ci.excluded:true
+
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
         with:
           fetch-depth: 0

.gitlab/benchmarks.yml

@@ -10,9 +10,9 @@ variables:
 .benchmark_run_rules: &benchmark_run_rules
   - if: '$CI_COMMIT_BRANCH =~ /^mq-working-branch-/'
     when: never
-  - if: '$CI_COMMIT_BRANCH =~ /^(release|hotfix)\//'
+  - if: '$CI_COMMIT_BRANCH =~ /^(release|hotfix)[-\/]/'
     when: never
-  - if: '$CI_EXTERNAL_PULL_REQUEST_SOURCE_BRANCH_NAME =~ /^(release|hotfix)\//'
+  - if: '$CI_EXTERNAL_PULL_REQUEST_SOURCE_BRANCH_NAME =~ /^(release|hotfix)[-\/]/'
     when: never
   - if: '$CI_COMMIT_BRANCH == "main"'
     interruptible: false