Merge branch 'main' into noueman/fix-cf-vm-dca-nil-panic

Author: NouemanKHAL

.bazelrc

@@ -108,6 +108,7 @@ common:ci --config=adms
 common:ci --config=lint
 common:ci --noexperimental_convenience_symlinks # not CI-suitable: "These symlinks are only for the user's convenience"
 common:ci --remote_download_regex=.*/test\.xml$ # force-download test.xml even under --remote_download_outputs=toplevel, so junit collection can read it locally
+common:ci --remote_download_regex=.*/test\.log$ # force-download test.log for test2json postprocessing
 
 # Project/Language configs --------------------------------------------------------------------------------------
 import %workspace%/bazel/configs/go_tests.bazelrc

.devcontainer/datadog/default/features/datadog-agent/install.sh

@@ -2,8 +2,9 @@
 set -euo pipefail
 featureDir=$(cd "$(dirname "$0")"; pwd)
 
-# Get claude from the buildimages /root/.local/bin
-# cp /root/.local/bin/claude /home/bits/.local/bin/claude
+# Install tailscale so workspace devcontainers can connect to the Headscale
+# overlay network and reach agent-sandbox private VMs
+curl -fsSL https://tailscale.com/install.sh | sh
 
 # Add bits user to the docker group. This should probably be handled by the base feature. But not working for now.
 usermod -aG docker bits

.gitattributes

@@ -1,15 +1,25 @@
+# Default to LF for all files that git identifies as text files, regardless of platform
+* text=auto eol=lf
+
+# TODO(alopezz): These exceptions, matching files that are stored with CRLF endings in
+# git, are transitional while migrating to LF as the default eol for all text files.
+*.ps1 -text
+Dockerfiles/agent/windows/amd64/Dockerfile -text
+cmd/ai_prompt_logger/Cargo.toml -text
+cmd/ai_prompt_logger/src/main.rs -text
+cmd/trace-agent/test/testsuite/testdata/trace_with_rates.json -text
+comp/core/gui/impl/views/private/images/datadog_icon_white.svg -text
+deps/msodbcsql18/LICENSE.txt -text
+devenv/answer_files/**/*.xml -text
+pkg/collector/corechecks/containers/kubelet/testdata/summary.json -text
+releasenotes/notes/*.yaml -text
+tasks/unit_tests/testdata/secret.tar.gz/*.xml -text
+
 # Set batch file line endings to CRLF so that they can be executed on Windows
 *.bat text eol=crlf
 *.cmd text eol=crlf
 *.bin binary
 
-# Set go source line endings to LF on all platforms so gofmt can be used
-*.go text=auto eol=lf
-# Same for gopatch (does not handle CRLF line endings)
-*.gopatch text eol=lf
-# Same for go workspace files (root and testdata)
-*go.work text eol=lf
-go.mod text eol=lf
 go.sum -diff -merge linguist-generated=true
 # Merge changelog entries without conflicts when multiple PRs add lines simultaneously
 CHANGELOG-AIX.md merge=union
@@ -22,19 +32,6 @@ CHANGELOG-AIX.md merge=union
 pkg/config/schema/*.yaml text eol=lf
 pkg/security/probe/constantfetch/btfhub/constants.json -diff -merge linguist-generated=true
 pkg/security/seclwin/** -diff -merge linguist-generated=true
-# CWS doc JSON is generated as LF on Linux; force LF on Windows too
-# so Bazel's byte-exact diff_test doesn't trip on core.autocrlf-rewritten CRLF.
-docs/cloud-workload-security/** text eol=lf
-# Fixtures should have LF line endings because they are checked against OCI packages built on Linux
-pkg/fleet/installer/fixtures/** text=auto eol=lf
-
-# Bazel writes LF; force LF on Windows too to avoid autocrlf churn after `bazel run` / `dda inv tidy`
-*.bazel text eol=lf
-*.bzl text eol=lf
-MODULE.bazel.lock text eol=lf
-
-# Use LF for python files that need to pass Bazel's byte-exact diff_test
-tasks/core_checks.py text eol=lf
 
 # Fix `git diff` when running on the below file formats.
 # Our windows build image uses MinGit which tries to use the astextplain diff algorithm (https://git-scm.com/docs/gitattributes#_setting_the_internal_diff_algorithm).

.github/CODEOWNERS

@@ -645,6 +645,7 @@
 /pkg/config/schema/yaml/compliance_config.yaml              @DataDog/agent-cspm @DataDog/agent-security @DataDog/fleet-automation
 /pkg/config/schema/yaml/container_image.yaml                @DataDog/container-integrations @DataDog/fleet-automation
 /pkg/config/schema/yaml/container_lifecycle.yaml            @DataDog/container-integrations @DataDog/fleet-automation
+/pkg/config/schema/yaml/network_devices.yaml                @DataDog/network-device-monitoring-core @DataDog/fleet-automation
 /pkg/config/schema/yaml/external_metrics_provider.yaml      @DataDog/container-autoscaling @DataDog/fleet-automation
 /pkg/config/schema/yaml/gpu.yaml                            @DataDog/ebpf-platform @DataDog/gpu-monitoring-agent @DataDog/fleet-automation
 /pkg/config/schema/yaml/internal_profiling.yaml             @DataDog/agent-runtimes @DataDog/fleet-automation
@@ -918,12 +919,12 @@
 /tasks/unit_tests/build_tags_tests.py   @DataDog/agent-build
 /tasks/unit_tests/libs/build/           @DataDog/agent-build
 /tasks/unit_tests/omnibus_tests.py      @DataDog/agent-build
-/tasks/unit_tests/schema_*              @DataDog/agent-configuration
+/tasks/unit_tests/schema_*              @DataDog/fleet-automation
 /tasks/unit_tests/testdata/components_src/ @DataDog/agent-runtimes
 /tasks/unit_tests/testdata/collector/   @DataDog/opentelemetry-agent
 /tasks/unit_tests/experimental_gates_tests.py @DataDog/agent-build
 /tasks/unit_tests/static_quality_gates/    @DataDog/agent-build
-/tasks/unit_tests/testdata/schema_codegen/ @DataDog/agent-configuration
+/tasks/unit_tests/testdata/schema_codegen/ @DataDog/fleet-automation
 /tasks/installer.py                     @DataDog/fleet
 /tasks/host_profiler.py                 @DataDog/opentelemetry-agent @DataDog/profiling-full-host
 /test/                                  @DataDog/agent-devx

.github/workflows/upgrade-python-patch-version.yml

@@ -73,7 +73,6 @@ jobs:
             Upgrades the Agent's embedded Python interpreter from **${{ steps.update.outputs.current_version }}** to **${{ steps.update.outputs.new_version }}** (patch version update).
             
             ### Changes
-            - Updated `omnibus/config/software/python3.rb` with new version and SHA256
             - Updated `deps/cpython/cpython.MODULE.bazel` with new version and SHA256
             - Updated `test/new-e2e/tests/agent-platform/common/agent_behaviour.go` with expected version
             - Updated `packaging/aix/lib/env.sh` with new version

.gitlab-ci.yml

@@ -174,6 +174,11 @@ default:
     max: 1 # Retry everything once on failure
     when: always
 
+# Full git history. Override the default shallow clone.
+.needs_full_git_history:
+  variables:
+    GIT_DEPTH: 0
+
 stages:
   - .pre
   - setup
@@ -375,8 +380,9 @@ variables:
   DD_PKG_GITLAB_URL: "https://artifact-gateway.us1.ddbuild.io/internal/artifact-gateway/api/v4"
   PIPELINE_KEY_ALIAS: "alias/ci_datadog-agent_pipeline-key"
 
-  # Job cloning strategy
+  # Shallow clone by default.
   GIT_STRATEGY: "fetch"
+  GIT_DEPTH: 1
   DISABLE_GIT_CACHE: true
 
   # Job stage attempts (see https://docs.gitlab.com/ee/ci/runners/configure_runners.html#job-stages-attempts)

.gitlab/.pre/ci_configuration.yml

@@ -15,6 +15,8 @@ test_gitlab_compare_to:
   image: registry.ddbuild.io/ci/datadog-agent-buildimages/linux$CI_IMAGE_LINUX_SUFFIX:$CI_IMAGE_LINUX
   tags: ["arch:amd64"]
   extends: .dd_octo_sts
+  variables:
+    GIT_DEPTH: 0  # Full history: gitlab_configuration_is_modified uses merge-base and HEAD^
   rules:
     - !reference [.except_mergequeue]
     - !reference [.on_gitlab_changes]
@@ -30,6 +32,8 @@ compute_gitlab_ci_config:
   stage: .pre
   needs: []
   tags: ["arch:arm64"]
+  variables:
+    GIT_DEPTH: 0  # Full history: computes gitlab-ci config diff against merge-base
   before_script:
     # Get main history
     - git fetch origin main
@@ -57,5 +61,7 @@ lint_github_actions_shellcheck:
         compare_to: $COMPARE_TO_BRANCH
       when: on_success
   allow_failure: true
+  variables:
+    GIT_DEPTH: 0  # Full history: linter.github-actions-shellcheck uses git merge-base
   script:
     - dda inv -- -e linter.github-actions-shellcheck

.gitlab/.pre/common/prebuild-workspace-image.yml

@@ -9,5 +9,9 @@ prebuild-workspace-image-check:
         paths:
           - .devcontainer/datadog/default/**/*
         compare_to: $COMPARE_TO_BRANCH
+  variables:
+    GIT_DEPTH: 0  # Full history: three-dot diff is from merge-base to HEAD
   script:
+    - git fetch origin "$COMPARE_TO_BRANCH"
+    - export SOURCE_REF="origin/$COMPARE_TO_BRANCH"
     - bash tools/prebuild-devcontainer-check.sh

.gitlab/.pre/setup/setup.yml

@@ -23,3 +23,4 @@ setup_agent_version:
       dotenv: build.env
   variables:
     DISABLE_GIT_CACHE: true
+    GIT_DEPTH: 0  # git describe --tags needs reachable tags

.gitlab/build/bazel/test.yml

@@ -14,17 +14,19 @@
       aud: ci-identities
   variables:
     EXTERNAL_LINKS_PATH: external_links_$CI_JOB_ID.json
-    FLAVOR: base
-    BEP_FILE: $CI_PROJECT_DIR/bazel-bep-$FLAVOR.json
+    BEP_FILE: $CI_PROJECT_DIR/bazel-bep.json
+    RESULT_JSON: test_output.json
   after_script:
-    - dda inv -- -e bazel.collect-junit --flavor=$FLAVOR --output-tgz=junit-${CI_JOB_NAME}.tgz --bep-file=$BEP_FILE || true
+    - dda inv -- -e bazel.process-test-results --bep-file=$BEP_FILE --junit-tar=junit-${CI_JOB_NAME}.tgz --result-json=$RESULT_JSON
     - !reference [.upload_junit_source]
   artifacts:
     expire_in: 2 weeks
     when: always
     paths:
+      - $RESULT_JSON
+      - test_output_unified.json
       - junit-*.tgz
-      - bazel-bep-*.json
+      - bazel-bep.json
     reports:
       annotations:
         - $EXTERNAL_LINKS_PATH
@@ -42,8 +44,10 @@ bazel:coverage:linux-amd64:
     - cp "$(bazel info output_path)/_coverage/_coverage_report.dat" "$CI_PROJECT_DIR/coverage-bazel-$CI_JOB_NAME_SLUG.out"
   artifacts:
     paths:
+      - $RESULT_JSON
+      - test_output_unified.json
       - junit-*.tgz
-      - bazel-bep-*.json
+      - bazel-bep.json
       - coverage-bazel-*.out
   variables:
     KUBERNETES_CPU_REQUEST: 16
@@ -81,8 +85,10 @@ bazel:test:macos-arm64:
     - !reference [.bazel:test:reporting, after_script]
   artifacts:
     paths:
+      - $RESULT_JSON
+      - test_output_unified.json
       - junit-*.tgz
-      - bazel-bep-*.json
+      - bazel-bep.json
       - bazel-exec.log
 
 # Windows splits the build from the Go tests, unlike the other platforms: the