Add evalya init (DataDog#24655)

* Add evalya init

* Use registry.ddbuild.io and split evalya CI jobs into validate/release stages

Addresses PR review feedback: point evalya at registry.ddbuild.io instead
of the ECR path, and slot generate-pipeline/validate-manifests/run-tests
into the validate stage with publish-metadata in release, instead of a
single dedicated evalya stage.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Gate evalya:publish-metadata to master/manual

Reuse a rules anchor so the publish job doesn't push and sign images
on every branch pipeline, matching the other signing jobs in this file.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Update .gitlab-ci.yml

Co-authored-by: NouemanKHAL <noueman.khalikine@datadoghq.com>

* Remove duplicate rules key on evalya:publish-metadata

A prior commit added the rules inline instead of the shared anchor,
leaving two rules: keys on the same job.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Add impact analysis.

* Hardcode to evalya 0.15.0 so it can be manually upgraded later

* Upgrade Evalya CI to v0.17.0

* Upgrade Evalya CI to v0.18.0

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Co-authored-by: NouemanKHAL <noueman.khalikine@datadoghq.com>

Author: 3 people

.evalya-root

@@ -0,0 +1,4 @@
+registry: registry.ddbuild.io/ci/integrations-core
+ci:
+  impact:
+    enabled: true

.evalya/gitlab-ci.yaml

@@ -0,0 +1,52 @@
+# Generated by evalya init — hidden GitLab CI templates.
+# Regenerate with `evalya init --force`. See .evalya/init.yml for config.
+variables:
+  EVALYA_IMAGE: registry.ddbuild.io/ci/evalya:${EVALYA_TAG}
+  EVALYA_TAG: v0.18.0
+.evalya:generate-pipeline:
+  image: $EVALYA_IMAGE
+  tags:
+    - arch:amd64
+  script:
+    - sh /usr/local/share/evalya/scripts/generate-pipeline.sh -l "evalya.io/ci=e2e" --build-publish-tasks
+  variables:
+    DD_METRICS_TAGS: evalya:true,evalya-stage:generate
+  artifacts:
+    paths:
+      - evalya-pipeline.yml
+      - evalya-impact-summary.txt
+
+.evalya:publish-metadata:
+  image: $EVALYA_IMAGE
+  tags:
+    - arch:amd64
+  id_tokens:
+    DDSIGN_ID_TOKEN:
+      aud: image-integrity
+  before_script:
+    - docker buildx create --driver docker-container --name evalya-builder --use || docker buildx use evalya-builder || true
+    - docker buildx inspect --bootstrap > /dev/null 2>&1 || exit 75
+  script:
+    - evalya metadata publish --push --sign --platform linux/amd64,linux/arm64 --metadata-file /tmp/evalya-meta-buildx-metadata.json --tag "${CI_COMMIT_SHORT_SHA}" --tag "${CI_COMMIT_REF_NAME}"
+  variables:
+    DD_METRICS_TAGS: evalya:true,evalya-stage:publish
+
+.evalya:run-tests:
+  variables:
+    PARENT_PIPELINE_SOURCE: $CI_PIPELINE_SOURCE
+  trigger:
+    include:
+      - artifact: evalya-pipeline.yml
+        job: evalya:generate-pipeline
+    strategy: depend
+    forward:
+      pipeline_variables: true
+
+.evalya:validate-manifests:
+  image: $EVALYA_IMAGE
+  tags:
+    - arch:amd64
+  script:
+    - evalya manifest validate-all
+  variables:
+    DD_METRICS_TAGS: evalya:true,evalya-stage:validate

.evalya/init.yml

@@ -0,0 +1,12 @@
+# evalya init configuration.
+# Regenerate with: evalya init --force
+version: v0.18.0
+registry: registry.ddbuild.io/ci/integrations-core
+ci:
+  labels:
+    - e2e
+  generateStage: validate
+  testStage: validate
+  publishStage: release
+  publishMeta: true
+  evalyaTag: v0.18.0

.gitlab-ci.yml

@@ -1,6 +1,7 @@
 include:
   - /.gitlab/software_composition_analysis.yaml
   - /.gitlab/build_agent.yaml
+  - local: .evalya/gitlab-ci.yaml
 
 variables:
   TAGGER_IMAGE: 486234852809.dkr.ecr.us-east-1.amazonaws.com/ci/integrations-core:tagger
@@ -17,6 +18,13 @@ stages:
   - release
   - notify
 
+.master-or-manual-rules: &master-or-manual-rules
+  - if: $CI_PIPELINE_SOURCE == 'schedule'
+    when: never
+  - if: $CI_COMMIT_BRANCH == 'master'
+  - when: manual
+    allow_failure: true
+
 cache: &slack-cache
   key: integrations-core-slack-cache
   paths:
@@ -111,3 +119,24 @@ tagger-image-builder:
     - docker buildx build --tag $TAGGER_IMAGE -f .gitlab/tagger/Dockerfile . --push --metadata-file ${METADATA_FILE}
     - ddsign sign $TAGGER_IMAGE --docker-metadata-file ${METADATA_FILE}
   tags: [ "arch:amd64" ]
+
+# --- BEGIN evalya (generated by evalya init) ---
+evalya:generate-pipeline:
+  extends: .evalya:generate-pipeline
+  stage: validate
+
+evalya:validate-manifests:
+  extends: .evalya:validate-manifests
+  stage: validate
+
+evalya:run-tests:
+  extends: .evalya:run-tests
+  stage: validate
+  needs:
+    - evalya:generate-pipeline
+
+evalya:publish-metadata:
+  extends: .evalya:publish-metadata
+  stage: release
+  rules: *master-or-manual-rules
+# --- END evalya ---