Merge branch 'main' into aiuto/ocln

Author: aiuto

.agents/skills/create-pr/SKILL.md

@@ -22,7 +22,7 @@ Create a pull request for the current branch following the Datadog Agent contrib
    DEFAULT_BRANCH=$(git rev-parse --abbrev-ref origin/HEAD | sed 's|^origin/||')
    codex review --base "$DEFAULT_BRANCH"
    ```
-   Show the review output to the user. If codex is not installed, skip this step silently.
+   `codex review` is an LLM-based review and can take several minutes — do not bound it with a short Bash `timeout`, and do not let it get killed mid-run. Run it with `run_in_background: true` and wait for completion (or pass a generous `timeout`, e.g. the Bash tool max of 600000ms). If it's still running when you check back, keep waiting rather than treating it as done or skipping it, up to that 10-minute ceiling — if it still hasn't finished by then, note that to the user and proceed without it rather than stalling PR creation indefinitely. Show the review output to the user. If codex is not installed, skip this step silently.
 6. **Push the branch** to origin if needed
 7. **Open the PR**: By default, open as **Draft** using `gh pr create --draft`. If `$ARGUMENTS` contains `--real`, open as a regular (non-draft) PR instead (omit the `--draft` flag). Remove `--real` from `$ARGUMENTS` before processing remaining arguments as labels.
 8. **PR title**: Use [conventional commits](https://www.conventionalcommits.org/en/v1.0.0/) format, prefixed with the general area of change. Examples:

.agents/skills/locate-config-setting/SKILL.md

@@ -97,5 +97,5 @@ dda inv -- schema.locate '.*proxy'
 ## Related
 
 - The task lives in `tasks/schema/locate.py` (registered in `tasks/schema/__init__.py`).
-- Schema source: `pkg/config/schema/yaml/`. To regenerate it, see `dda inv schema.generate`.
+- Schema source: `pkg/config/schema/yaml/`.
 - To **add** a new config field (not just locate one), use the `create-config-field` skill.

.bazelignore

@@ -6,4 +6,4 @@
 # inside of arm64 Linux containers.
 bazel-datadog-agent/
 bazel-testlogs/
-hard-coded-generation/
+hard-coded-generation

.cursor/rules/go_module_bazel_migration.mdc

@@ -18,7 +18,7 @@ alwaysApply: false
    bazel test //path/to/module/...
    ```
 
-4. **Verify `//...`** still works after migration — intermediate BUILD files that reference external repos for local modules trigger the `bazelify_go_work` / `go_deps` `@rules_go` visibility bug.
+4. **Verify `//...`** still works after migration.
 
 ## Custom `//go:build` tags and `_GAZELLE_BUILD_TAGS`
 
@@ -62,8 +62,8 @@ Proto source-only trees (`pkg/proto/datadog`, `pkg/proto/protodep`) still need `
 
 ## `gazelle:ignore` vs `gazelle:exclude`
 
-- `gazelle:exclude` — stops Gazelle AND affects `bazelify_go_work` filtering of `go.work` entries for `go_deps`.
-- `gazelle:ignore` — only stops Gazelle from generating/updating targets in that directory. Safe for stub BUILD files at intermediate unmigrated packages.
+- `gazelle:exclude <pattern>` — a directory match stops Gazelle from recursing into it, whereas a file match excludes it from managed rules,
+- `gazelle:ignore` — stops Gazelle from modifying its containing BUILD.bazel file.
 
 ## Known issue: `go_deps` external repo `@rules_go` visibility
 

.devcontainer/datadog/default/devcontainer.json

@@ -21,6 +21,6 @@
     "-v",
     "/sys/kernel/debug:/sys/kernel/debug",
     "-v",
-    "/etc/os-release:/etc/os-release",
-  ],
+    "/etc/os-release:/etc/os-release"
+  ]
 }

.github/CODEOWNERS

@@ -445,6 +445,7 @@
 /comp/autoscaling/datadogclient @DataDog/container-integrations
 /comp/connectivitychecker @DataDog/fleet
 /comp/dataobs/queryactions @DataDog/data-observability
+/comp/dataplane/preflightmode @DataDog/agent-data-plane
 /comp/etw @DataDog/windows-products
 /comp/filterlist @DataDog/agent-metric-pipelines
 /comp/fleetstatus @DataDog/fleet
@@ -961,6 +962,7 @@
 /test/new-e2e/tests/agent-platform/common/agent_integration.go @DataDog/agent-integrations
 /test/new-e2e/tests/agent-platform/tests/macos*      @DataDog/windows-products
 /test/new-e2e/tests/agent-runtimes            @DataDog/agent-runtimes
+/test/new-e2e/tests/agent-data-plane          @DataDog/agent-data-plane
 /test/new-e2e/tests/agent-configuration       @DataDog/fleet-automation
 /test/new-e2e/tests/agent-health              @DataDog/fleet-remediation
 /test/new-e2e/tests/agent-metric-pipelines    @DataDog/agent-metric-pipelines

.github/workflows/upgrade-python-patch-version.yml

@@ -89,4 +89,4 @@ jobs:
             ### Describe how you validated your changes
             CI is considered enough to validate changes.
           team-reviewers: agent-integrations
-          labels: team/agent-integrations,changelog/no-changelog,ask-review
+          labels: team/agent-integrations,changelog/no-changelog

.gitlab-ci.yml

@@ -121,6 +121,9 @@
 
   # E2E framework
   - test/e2e-framework/components/activedirectory/**/*
+  - test/e2e-framework/components/os/scripts/setup-ssh.ps1
+  - test/e2e-framework/components/os/windows*
+  - test/e2e-framework/scenarios/aws/ec2/os_win.go
 
 # Process manager
 .windows_path_4: &windows_path_4
@@ -307,9 +310,9 @@ variables:
   CI_IMAGE_RPM_ARM64_SUFFIX: ""
   CI_IMAGE_RPM_ARMHF: v126430166-27084be1
   CI_IMAGE_RPM_ARMHF_SUFFIX: ""
-  CI_IMAGE_WIN_LTSC2022_X64: v126430166-27084be1
+  CI_IMAGE_WIN_LTSC2022_X64: v127592905-6a747366
   CI_IMAGE_WIN_LTSC2022_X64_SUFFIX: ""
-  CI_IMAGE_WIN_LTSC2025_X64: v126430166-27084be1
+  CI_IMAGE_WIN_LTSC2025_X64: v127592905-6a747366
   CI_IMAGE_WIN_LTSC2025_X64_SUFFIX: ""
 
   DATADOG_AGENT_EMBEDDED_PATH: /opt/datadog-agent/embedded
@@ -1142,6 +1145,20 @@ workflow:
         - pkg/discovery/**/*
       compare_to: $COMPARE_TO_BRANCH
 
+.on_adp_preflight_mode_or_e2e_changes:
+  - !reference [.on_e2e_main_release_or_rc]
+  - changes:
+      paths:
+        - comp/dataplane/preflightmode/**/*
+        - test/new-e2e/tests/agent-data-plane/**/*
+        # Preflight mode's eligibility gate lives in the config layer, not in the component:
+        # sanitizeDataPlaneConfig decides whether data_plane.enabled stays at its default
+        # source, which is what makes the pre-flight run at all.
+        - pkg/config/setup/config.go
+        # The pre-flight has nothing to run if ADP stops being packaged.
+        - deps/agent_data_plane/**/*
+      compare_to: $COMPARE_TO_BRANCH
+
 .on_amp_or_e2e_changes:
   - !reference [.on_e2e_main_release_or_rc]
   - changes:

.gitlab/JOBOWNERS

@@ -229,8 +229,9 @@ new-e2e-ndm-netflow*                    @DataDog/ndm-integrations
 new-e2e-ndm-snmp*                       @DataDog/network-device-monitoring-core
 new-e2e-ha-agent*                       @DataDog/network-device-monitoring-core
 # --- Pipelines (metrics / logs / traces) ---
-new-e2e-amp                             @DataDog/agent-metric-pipelines
+new-e2e-adp*                            @DataDog/agent-data-plane
 new-e2e-amp-adp                         @DataDog/agent-data-plane
+new-e2e-amp                             @DataDog/agent-metric-pipelines
 new-e2e-alp*                            @DataDog/agent-log-pipelines
 new-e2e-apm*                            @DataDog/agent-apm
 # --- Security ---

.gitlab/build/bazel/test.yml

@@ -36,7 +36,7 @@ bazel:coverage:linux-amd64:
   extends: [.bazel:test:reporting, .bazel:runner:linux-amd64, .bazel:test]
   script:
     - !reference [.bazel:test:reporting:ci_links]
-    - bazel coverage --config=go --config=gorace --config=dd-agent-go-tests-only --jobs=$KUBERNETES_CPU_REQUEST --build_tests_only --keep_going --remote_download_outputs=toplevel --build_event_json_file=$BEP_FILE //...
+    - bazel coverage --config=go --config=gorace --config=dd-agent-go-tests-only --jobs=$KUBERNETES_CPU_REQUEST --build_tests_only --keep_going --remote_download_outputs=toplevel --build_event_json_file=$BEP_FILE //... -- -//test/new-e2e/...
   after_script:
     - !reference [.bazel:test:reporting, after_script]
     - cp "$(bazel info output_path)/_coverage/_coverage_report.dat" "$CI_PROJECT_DIR/coverage-bazel-$CI_JOB_NAME_SLUG.out"
@@ -52,20 +52,20 @@ bazel:test:linux-amd64:
   extends: [.bazel:test:reporting, .bazel:runner:linux-amd64, .bazel:test]
   script:
     - !reference [.bazel:test:reporting:ci_links]
-    - bazel test --config=gorace --jobs=$KUBERNETES_CPU_REQUEST --keep_going --remote_download_outputs=toplevel --build_event_json_file=$BEP_FILE //...
+    - bazel test --config=gorace --jobs=$KUBERNETES_CPU_REQUEST --keep_going --remote_download_outputs=toplevel --build_event_json_file=$BEP_FILE //... -- -//test/new-e2e/...
 
 bazel:test:linux-arm64:
   extends: [.bazel:test:reporting, .bazel:runner:linux-arm64, .bazel:test]
   script:
     - !reference [.bazel:test:reporting:ci_links]
-    - bazel test --config=gorace --jobs=$KUBERNETES_CPU_REQUEST --keep_going --remote_download_outputs=toplevel --build_event_json_file=$BEP_FILE //...
+    - bazel test --config=gorace --jobs=$KUBERNETES_CPU_REQUEST --keep_going --remote_download_outputs=toplevel --build_event_json_file=$BEP_FILE //... -- -//test/new-e2e/...
 
 bazel:test:macos-amd64:
   extends: [.bazel:test:reporting, .bazel:runner:macos-amd64, .bazel:test]
   script:
     - !reference [.install_python_dependencies]
     - !reference [.bazel:test:reporting:ci_links]
-    - bazel test --config=gorace --keep_going --remote_download_outputs=toplevel --build_event_json_file=$BEP_FILE //...
+    - bazel test --config=gorace --keep_going --remote_download_outputs=toplevel --build_event_json_file=$BEP_FILE //... -- -//test/new-e2e/...
   after_script:
     - !reference [.install_python_dependencies]
     - !reference [.bazel:test:reporting, after_script]
@@ -75,7 +75,7 @@ bazel:test:macos-arm64:
   script:
     - !reference [.install_python_dependencies]
     - !reference [.bazel:test:reporting:ci_links]
-    - bazel test --config=gorace --keep_going --remote_download_outputs=toplevel --build_event_json_file=$BEP_FILE --execution_log_compact_file=$CI_PROJECT_DIR/bazel-exec.log //...
+    - bazel test --config=gorace --keep_going --remote_download_outputs=toplevel --build_event_json_file=$BEP_FILE --execution_log_compact_file=$CI_PROJECT_DIR/bazel-exec.log //... -- -//test/new-e2e/...
   after_script:
     - !reference [.install_python_dependencies]
     - !reference [.bazel:test:reporting, after_script]
@@ -94,13 +94,16 @@ bazel:test:windows-amd64:
   variables:
     POWERSHELL_SCRIPT: >-
       bazel test --config=gorace --config=no-dd-agent-go-tests --keep_going //... --
+      -//test/new-e2e/...
       -//bazel/rules/dd_packaging/...
       -//packages/agent/linux/...
 
 bazel:test:windows-amd64:go:
   extends: [.bazel:runner:windows-amd64, .bazel:test]
   variables:
     POWERSHELL_SCRIPT: >-
-      bazel test --config=gorace --config=dd-agent-go-tests-only --build_tests_only --keep_going //... --
+      bazel test --config=gorace --config=dd-agent-go-tests-only --build_tests_only --keep_going
+      //... --
+      -//test/new-e2e/...
       -//bazel/rules/dd_packaging/...
       -//packages/agent/linux/...