.gitlab-ci.yml

stages:
  - package
  - tests
  - system-tests
  - fuzz
  - shared-pipeline
  - benchmarks
  - release

variables:
  # Benchmark trigger jobs forward $BP_EXTERNAL_S3_URL to downstream pipelines so
  # an external orchestrator can override the S3 destination of benchmark results.
  # Defaulted to empty here so an unset value forwards as "" rather than a literal.
  BP_EXTERNAL_S3_URL: ""
  REPO_LANG: python # "python" is used everywhere rather than "py"
  REPO_NOTIFICATION_CHANNEL: "#apm-python-release"
  RELEASE_ALLOW_TEST_FAILURES: false
  RELEASE_ALLOW_BENCHMARK_FAILURES: false
  # VPA Template configuration
  DD_VPA_TEMPLATE: "vpa-template-cpu-p70-10percent-2x-oom-min-cap"
  # CI_DEBUG_SERVICES: "true"
  # Automatically managed, use scripts/update-system-tests-version to update
  SYSTEM_TESTS_REF: "77e6da9b53639436525bf7bfb076723e18e102c3"

  # Profiling native build image (built from dd/images/dd-trace-py/profiling_native)
  PROFILING_NATIVE_IMAGE: "registry.ddbuild.io/dd-trace-py:v103334885-be1888c-profiling_native"
  # Repository URL for CI Visibility
  DD_GIT_REPOSITORY_URL: "https://github.com/DataDog/dd-trace-py.git"

  # One pipeline injection package size ratchet
  OCI_PACKAGE_MAX_SIZE_BYTES: 80_000_000
  LIB_INJECTION_IMAGE_MAX_SIZE_BYTES: 100_000_000

default:
  interruptible: true


.is_main: $CI_COMMIT_REF_NAME == "main"
.is_release: $CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+(rc[0-9]+)?$/
.is_non_rc_release: $CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+$/
.is_release_branch: $CI_COMMIT_BRANCH =~ /^[0-9]+\.[0-9]+$/
.is_gh_merge_queue: $CI_COMMIT_BRANCH =~ /^gh-readonly-queue\/.*$/
.is_devflow_merge_queue: $CI_COMMIT_BRANCH =~ /^mq-working-branch-.*$/

# trigger new commit cancel
workflow:
  auto_cancel:
    on_new_commit: interruptible
  rules:
    - if: !reference [.is_main]
      auto_cancel:
        on_new_commit: none
    - if: !reference [.is_release_branch]
      variables:
        DD_GIT_REPOSITORY_URL: "https://github.com/DataDog/dd-trace-py-release.git"
      auto_cancel:
        on_new_commit: none
    - when: always

include:
  - local: ".gitlab/ci-templates.yml" # Reusable templates (setup_ci_deps, etc.)
  - local: ".gitlab/one-pipeline.locked.yml"
  - local: ".gitlab/services.yml" # Include early so others can use the definitions
  - local: ".gitlab/package.yml"
  - local: ".gitlab/release.yml"
  - local: ".gitlab/testrunner.yml"
  - local: ".gitlab/debugging-exploration.yml"
  - local: ".gitlab/multi-os-tests.yml"
  - local: ".gitlab/benchmarks/serverless.yml"
  - local: ".gitlab/native.yml"
  - local: ".gitlab/system-tests.yml"
  - local: ".gitlab/fuzz.yml"
  - local: ".gitlab/config-registry.yml"

"pipeline variables":
  stage: .pre
  tags: [ "arch:amd64" ]
  script:
    - |
      echo "CURRENT_YEAR=$(date +%Y)" >> pipeline_variables.env
      echo "CURRENT_MONTH=$(date +%-m)" >> pipeline_variables.env
      echo "CURRENT_WEEK=$(date +%-V)" >> pipeline_variables.env
      echo "CURRENT_BIWEEK=$(( $(date +%-V) / 2 ))" >> pipeline_variables.env
      cat pipeline_variables.env
  artifacts:
    reports:
      dotenv: pipeline_variables.env

tests-gen:
  stage: tests
  extends: .testrunner
  variables:
    UNPIN_DEPENDENCIES: "${UNPIN_DEPENDENCIES:-}"
    NIGHTLY_BUILD: "${NIGHTLY_BUILD:-}"
  id_tokens:
    DDOCTOSTS_ID_TOKEN:
      aud: dd-octo-sts
  script:
    - |
      echo "UNPIN_DEPENDENCIES: ${UNPIN_DEPENDENCIES:-}"
      echo "NIGHTLY_BUILD: ${NIGHTLY_BUILD:-}"
    - |
      if [ -z ${GH_TOKEN} ]
      then
        # Use dd-octo-sts to get GitHub token
        export GH_TOKEN=$(dd-octo-sts token --scope DataDog/dd-trace-py --policy gitlab.github-access.read)
      fi
    - scripts/gen_gitlab_config.py --verbose
  needs: []
  artifacts:
    paths:
      - .gitlab/tests-gen.yml
      - .gitlab/benchmarks/microbenchmarks-gen.yml
      - .gitlab/benchmarks/bp-runner.microbenchmarks.fail-on-breach.yml

run-tests-trigger:
 stage: tests
 needs: [ tests-gen ]
 variables:
   UNPIN_DEPENDENCIES: "${UNPIN_DEPENDENCIES:-}"
   NIGHTLY_BUILD: "${NIGHTLY_BUILD:-}"
 # Allow the child job to fail if explicitly asked
 rules:
   - if: $RELEASE_ALLOW_TEST_FAILURES == "true"
     allow_failure: true
   - allow_failure: false
 trigger:
   include:
     - artifact: .gitlab/tests-gen.yml
       job: tests-gen
   strategy: depend

serverless lambda tests:
  stage: tests
  trigger:
    project: DataDog/datadog-lambda-python
    strategy: depend
    branch: main
  needs:
    - job: "upload serverless"
  variables:
    UPSTREAM_PIPELINE_ID: $CI_PIPELINE_ID
    UPSTREAM_PROJECT_URL: $CI_PROJECT_URL
    UPSTREAM_COMMIT_BRANCH: $CI_COMMIT_BRANCH
    UPSTREAM_COMMIT_AUTHOR: $CI_COMMIT_AUTHOR
    UPSTREAM_COMMIT_TITLE: $CI_COMMIT_TITLE
    UPSTREAM_COMMIT_TAG: $CI_COMMIT_TAG
    UPSTREAM_PROJECT_NAME: $CI_PROJECT_NAME
    UPSTREAM_GITLAB_USER_LOGIN: $GITLAB_USER_LOGIN
    UPSTREAM_GITLAB_USER_EMAIL: $GITLAB_USER_EMAIL
    SKIP_E2E_TESTS: "true"

# Validate the ast-grep rule's test suite in .sg/tests
"ast-grep rules":
  extends: .testrunner
  stage: tests
  needs: []
  script:
  script:
    - |
      echo -e "\e[0Ksection_start:`date +%s`:sg_test[collapsed=true]\r\e[0KValidate ast-grep rules"
      scripts/lint sg-test
      echo -e "\e[0Ksection_end:`date +%s`:sg_test\r\e[0K"
    - |
      echo -e "\e[0Ksection_start:`date +%s`:sg_scan[collapsed=true]\r\e[0Kast-grep scan"
      scripts/lint sg
      echo -e "\e[0Ksection_end:`date +%s`:sg_scan\r\e[0K"

microbenchmarks:
  stage: benchmarks
  needs:
    - job: tests-gen
    - job: "build linux"
      parallel:
        matrix:
          - ARCH_TAG: "amd64"
            PYTHON_TAG: "cp39-cp39"
            IMAGE_TAG: "v113741238-d2b8243-manylinux2014_x86_64"
  rules:
    # Allow failures if explicitly asked
    - if: $RELEASE_ALLOW_BENCHMARK_FAILURES == "true"
      allow_failure: true
    - allow_failure: false
  trigger:
    include:
      - artifact: .gitlab/benchmarks/microbenchmarks-gen.yml
        job: tests-gen
    strategy: depend
  variables:
    PARENT_PIPELINE_ID: $CI_PIPELINE_ID
    # Disable VPA for benchmarks
    DD_DISABLE_VPA: true
    # Forward the external S3 destination override to the benchmark child pipeline.
    BP_EXTERNAL_S3_URL: $BP_EXTERNAL_S3_URL

apm-sdk-benchmarks:
  stage: benchmarks
  when: manual
  allow_failure: true
  needs:
    - job: "upload all"
  trigger:
    project: DataDog/apm-reliability/apm-sdks-benchmarks
    branch: main
  variables:
    TARGET_REF: $CI_PIPELINE_ID

macrobenchmarks:
  stage: benchmarks
  needs:
    - job: "build linux"
      parallel:
        matrix:
          - ARCH_TAG: "amd64"
            PYTHON_TAG: "cp39-cp39"
            IMAGE_TAG: "v113741238-d2b8243-manylinux2014_x86_64"
  trigger:
    include: .gitlab/benchmarks/macrobenchmarks.yml
  variables:
    PARENT_PIPELINE_ID: $CI_PIPELINE_ID
    # Disable VPA for benchmarks
    DD_DISABLE_VPA: true
    # Forward the external S3 destination override to the benchmark child pipeline.
    BP_EXTERNAL_S3_URL: $BP_EXTERNAL_S3_URL
  allow_failure: false
  rules:
    # Always run on nightly schedule or API triggered pipelines
    - if: $NIGHTLY_BUILD == "true"
      when: always
    # Allow failures if explicitly asked
    - if: $RELEASE_ALLOW_BENCHMARK_FAILURES == "true"
      allow_failure: true
    # Always run on tagged releases and release branches
    - if: $CI_COMMIT_BRANCH =~ /^[0-9]+\.[0-9]+$/
      when: always
    - if: !reference [.is_release]
      when: always
    # Otherwise, run manually
    - when: manual
      allow_failure: true

check_new_flaky_tests:
  stage: tests
  needs: ["run-tests-trigger"]
  extends: .testrunner
  script:
    - export DD_SITE=datadoghq.com
    - export DD_API_KEY=$(aws ssm get-parameter --region us-east-1 --name ci.${CI_PROJECT_NAME}.dd-api-key-qualitygate --with-decryption --query "Parameter.Value" --out text)
    - export DD_APP_KEY=$(aws ssm get-parameter --region us-east-1 --name ci.${CI_PROJECT_NAME}.dd-app-key-qualitygate --with-decryption --query "Parameter.Value" --out text)
    - datadog-ci gate evaluate
  rules:
    - if: !reference [.is_main]
      when: never
    - if: !reference [.is_release]
      when: never
    - if: !reference [.is_release_branch]
      when: never
    - if: !reference [.is_gh_merge_queue]
      when: never
    - if: !reference [.is_devflow_merge_queue]
      when: never
    - when: on_success

codeql-scan:
  timeout: 30m
  stage: tests
  needs: []
  image:
    name: registry.ddbuild.io/images/code-scanning:v76675231-865a08a-default
  tags: [ "arch:amd64" ]
  id_tokens:
    DDOCTOSTS_ID_TOKEN:
      aud: dd-octo-sts
  rules:
    - if: !reference [.is_release]
      when: never
    - if: $NIGHTLY_BUILD == "true"
      when: never
    - when: on_success
  variables:
    AWS_REGION: us-east-1
    BASE_REF: main
    GOMAXPROCS: 10
    KUBERNETES_CPU_REQUEST: 10
    KUBERNETES_CPU_LIMIT: 10
    KUBERNETES_MEMORY_REQUEST: 96Gi
    KUBERNETES_MEMORY_LIMIT: 96Gi
    CI_PROJECT_NAMESPACE: DataDog
    CODEQL: /usr/local/codeql/codeql
    CODEQL_DB: /tmp/dd-trace-py.codeql
    PYTHON_CUSTOM_QLPACK: /tmp/codescanning/qlpacks/python/codeql-suites/python-code-scanning.qls
    DB_CONFIGS: --threads 8 --ram 96000 --language=python --quiet
    SCAN_CONFIGS: --format sarifv2.1.0 --threads 8 --ram 96000 --no-tuple-counting --quiet
    UPLOAD_CONFIGS: -upload_sarif=true
  script:
    - ./scripts/codeql_scan.sh

requirements_json_test:
  rules:
    - when: on_success
  variables:
    REQUIREMENTS_BLOCK_JSON_PATH: ".gitlab/requirements_block.json"
    REQUIREMENTS_ALLOW_JSON_PATH: ".gitlab/requirements_allow.json"

check_requirements_lockfiles:
  stage: tests
  needs: []
  extends: .testrunner
  variables:
    # DD_DISABLE_VPA is required: without it VPA overrides KUBERNETES_MEMORY_*
    # (see "overridden by VPA" in runner logs) and clamps the build container
    # down to ~4 GiB based on its learned model. compile-and-prune-test-
    # requirements pip-compiles every riot lockfile sequentially and peaks
    # above that when resolving the full venv matrix (including 3.15 venvs),
    # causing OOMKilled (exit 137).
    DD_DISABLE_VPA: "true"
    KUBERNETES_MEMORY_REQUEST: "8Gi"
    KUBERNETES_MEMORY_LIMIT: "8Gi"
  script:
    - pip install toml==0.10.2 pyyaml==6.0.2
    - scripts/compile-and-prune-test-requirements
    - scripts/check-diff '.riot/requirements/' 'Mismatches found between .riot/requirements/*.txt and riotfile.py. Run scripts/compile-and-prune-test-requirements and commit the result.'
    - python scripts/requirements_to_csv.py
    - scripts/check-diff 'requirements.csv' 'Tracer dependency requirements in requirements.csv is out of date. Run `python scripts/requirements_to_csv.py` and commit the result.'

check_ci_dependencies:
  stage: tests
  needs: []
  extends: .testrunner
  script:
    - scripts/check-ci-dependencies

codeowners:
  stage: tests
  needs: []
  tags: ["arch:amd64"]
  image: registry.ddbuild.io/images/mirror/ubuntu:25.04
  script:
    # Validate that each file entry only exists once in CODEOWNERS to prevent confusion about ownership.
    # The file is evaluated from top to bottom where the last match wins, so duplicate entries can lead to unexpected owners being assigned.
    # Normalize patterns before checking for duplicates:
    #   - Remove trailing slashes (tests/tracer and tests/tracer/ are equivalent)
    #   - Remove leading ./ (./path and path are equivalent)
    #   - Collapse multiple consecutive slashes (path//file becomes path/file)
    - |
        # All non-comment/empty lines from .github/CODEOWNERS
        awk '!/^#|^$/ {print $1}' .github/CODEOWNERS | \
          # Remove any leading `./` in the line
          sed 's|^\./||' | \
          # Remove any duplicate `/`, e.g. `//` -> `/`
          sed -E 's|/+|/|g' | \
          # Remove any trailing `/`
          sed 's:/*$::' | \
          # Sort and return only duplicate entries
          sort | uniq -d > /tmp/duplicate_codeowners.txt
        if [ -s /tmp/duplicate_codeowners.txt ]; then
            echo "Duplicate entries found in .github/CODEOWNERS for patterns (after normalization):"
            cat /tmp/duplicate_codeowners.txt | sed 's/^/  - /'
            echo ""
            echo "Each file pattern should only be listed once to ensure clear ownership."
            echo "Normalization applied: removed trailing slashes, leading './', and collapsed multiple slashes."
            echo "Please remove duplicates from .github/CODEOWNERS."
            exit 1
        fi
    - apt-get update && apt install ca-certificates git wget curl -y
    - wget https://github.com/hmarr/codeowners/releases/download/v1.2.1/codeowners_1.2.1_linux_amd64.tar.gz
    - tar -xvzf codeowners_1.2.1_linux_amd64.tar.gz
    - git diff-tree --no-commit-id --name-only -r $CI_COMMIT_SHA > /tmp/changed_all.txt
    # Filter to only files that exist on disk (deleted files cause codeowners to crash)
    - |
      > /tmp/changed_files.txt
      while IFS= read -r f; do
        [ -f "$f" ] && echo "$f" >> /tmp/changed_files.txt
      done < /tmp/changed_all.txt
    - |
      if [ -s /tmp/changed_files.txt ]; then
        echo '```' > codeowners.txt
        xargs ./codeowners < /tmp/changed_files.txt | tee -a codeowners.txt
        echo '```' >> codeowners.txt
      fi
    - .gitlab/scripts/post-pr-comment.sh "Codeowners resolved as" codeowners.txt

detect_circular_imports:
  stage: tests
  needs: []
  extends: .testrunner
  rules:
    - if: $RELEASE_ALLOW_TEST_FAILURES == "true"
      allow_failure: true
    - allow_failure: false
  script:
    - pip install uv
    - cd ..
    # Keep copies of PR scripts so they survive the git checkout main below
    - cp dd-trace-py/scripts/import-analysis/cycles.py cycles.py
    - cp dd-trace-py/.gitlab/scripts/post-pr-comment.sh post-pr-comment.sh
    - uv run --script cycles.py analyze --root dd-trace-py/ddtrace cycles-pr.json
    - cat cycles-pr.json
    - cd dd-trace-py && git checkout main && cd ..
    # Analyse main branch ddtrace using the PR version of cycles.py (has uv metadata)
    - uv run --script cycles.py analyze --root dd-trace-py/ddtrace cycles-base.json
    - cat cycles-base.json
    - |
      set +e
      uv run --script cycles.py compare cycles-base.json cycles-pr.json > cycles_report.txt
      COMPARE_EXIT=$?
      set -e
    - cat cycles_report.txt
    - ./post-pr-comment.sh "Circular import analysis" cycles_report.txt
    - exit $COMPARE_EXIT


"summarize failures":
  stage: .post
  extends: .testrunner
  rules:
    - if: !reference [.is_main]
      when: on_failure
      allow_failure: true
    - if: !reference [.is_release]
      when: on_failure
      allow_failure: true
    - if: !reference [.is_release_branch]
      when: on_failure
      allow_failure: true
    - if: !reference [.is_gh_merge_queue]
      when: on_failure
      allow_failure: true
    - if: !reference [.is_devflow_merge_queue]
      when: on_failure
      allow_failure: true
    - when: manual
      allow_failure: true
  dependencies: []
  timeout: 30m
  retry: 0
  variables:
    CI_FAILURE_LOGS_DIR: "$CI_PROJECT_DIR/ci-failure-logs"
  before_script:
    - !reference [.testrunner, before_script]
  script:
    - .gitlab/scripts/summarize_failures.py
  after_script: []
  artifacts:
    when: always
    paths:
      - ci-failure-logs/
      - summary.md
      - claude.stdout.log
    expire_in: 1 month


package-oci:
  needs:
    - job: "package version"
      artifacts: true
    - job: "build linux"
      artifacts: true
    - job: "download_dependency_wheels"
      artifacts: true

promote-oci-to-prod:
  stage: release
  rules:
    - if: !reference [.is_non_rc_release]
      when: on_success
    - when: never
  needs:
    - job: release_pypi_prod
    - job: package-oci
      artifacts: true
    - job: oci-internal-publish
      artifacts: true

promote-oci-to-prod-beta:
  stage: release
  needs:
    - job: package-oci
      artifacts: true
    - job: oci-internal-publish
      artifacts: true

promote-oci-to-staging:
  stage: release
  needs:
    - job: package-oci
      artifacts: true
    - job: oci-internal-publish
      artifacts: true

publish-lib-init-pinned-tags:
  stage: release
  rules:
    - if: !reference [.is_non_rc_release]
      when: on_success
    - when: never
  needs:
    - job: release_pypi_prod
    - job: create-multiarch-lib-injection-image
    - job: generate-lib-init-pinned-tag-values
      artifacts: true

configure_system_tests:
  needs: []
  variables:
    SYSTEM_TESTS_SCENARIOS_GROUPS: "simple_onboarding,simple_onboarding_profiling,simple_onboarding_appsec,docker-ssi,lib-injection"

system_tests:
  needs: ["configure_system_tests", "oci-internal-test-publish", "kubernetes-injection-test-ecr-publish"]

deploy_to_reliability_env:
  needs: []
  rules:
    # Always deploy on main nightly builds
    - if: $NIGHTLY_BUILD == "true" && $CI_COMMIT_REF_NAME == "main"
      when: always
    # Original rules from one-pipeline.yml
    - if: $CI_PIPELINE_SOURCE == "schedule"
      when: on_success
    - when: manual
      allow_failure: true

deploy_to_di_backend:manual:
  stage: shared-pipeline
  rules:
    - when: manual
      allow_failure: true
  trigger:
    project: DataDog/debugger-demos
    branch: main
  variables:
    UPSTREAM_PROJECT_ID: $CI_PROJECT_ID
    UPSTREAM_PROJECT_NAME: $CI_PROJECT_NAME
    UPSTREAM_COMMIT_SHORT_SHA: $CI_COMMIT_SHORT_SHA
    UPSTREAM_PIPELINE_ID: $CI_PIPELINE_ID
    UPSTREAM_COMMIT_AUTHOR: $CI_COMMIT_AUTHOR
    UPSTREAM_TAG: $CI_COMMIT_TAG
    UPSTREAM_PACKAGE_JOB: build

# Trigger profiling correctness tests with just-built wheels.
# Runs the prof-correctness test suite (Python scenarios) against the wheels
# uploaded to S3 for this commit.
prof-correctness:
  stage: shared-pipeline
  image: registry.ddbuild.io/images/dd-octo-sts-ci-base:2025.06-1
  tags: ["arch:amd64"]
  needs:
    - job: "upload all"
  allow_failure: true
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"
    - if: $CI_COMMIT_REF_NAME == "main"
    - changes:
        - .gitlab-ci.yml
        - ddtrace/internal/datadog/profiling/**/*
        - ddtrace/profiling/**/*
        - src/native/**/*
    - when: manual
      allow_failure: true
  id_tokens:
    DDOCTOSTS_ID_TOKEN:
      aud: dd-octo-sts
  script:
    - |
      if [ -z "${GH_TOKEN:-}" ]; then
        export GH_TOKEN=$(dd-octo-sts token --scope DataDog/prof-correctness --policy dd-trace-py.gitlab.trigger-ci)
      fi
    - |
      echo "Triggering prof-correctness for commit ${CI_COMMIT_SHA}"
      # Trigger pipeline, but do not wait for the job to complete
      gh workflow run downstream-python.yml \
        --repo DataDog/prof-correctness \
        -f dd_trace_py_commit_sha="${CI_COMMIT_SHA}"

lib_injection_tests:
  # tests for sitecustomize safety that intentionally run outside of riot to simulate a fresh system
  needs: []
  stage: tests
  tags: [ "arch:amd64" ]
  image: registry.ddbuild.io/dd-trace-py:v106957811-b912d74-lib_injection@sha256:d381042ec0c5d8ba617453feec7ccdffefca8ef0e3011d980728fe1a7a9425eb
  script: |
    echo -e "\e[0Ksection_start:`date +%s`:info[collapsed=true]\r\e[0KPython versions"
    pyenv --version
    pyenv versions --bare
    echo -e "\e[0Ksection_end:`date +%s`:info\r\e[0K"

    for python_version in $(pyenv versions --bare); do
      echo -e "\e[0Ksection_start:`date +%s`:test_${python_version}[collapsed=true]\r\e[0KTesting with Python ${python_version}"
      pyenv global "${python_version}"
      pyenv exec python --version
      pyenv exec python lib-injection/sources/sitecustomize.py
      echo -e "\e[0Ksection_end:`date +%s`:test_${python_version}\r\e[0K"
    done

# Profiling native tests with sanitizers
# Uses dedicated profiling-native image with Python, Rust, valgrind, and clang pre-installed
# Image built from: dd/images/dd-trace-py/profiling_native
# Only runs when profiling-related files change
.profiling_native_base:
  needs: []
  stage: tests
  tags: [ "arch:amd64" ]
  image: ${PROFILING_NATIVE_IMAGE}
  timeout: 15m
  variables:
    CMAKE_BUILD_PARALLEL_LEVEL: "12"
    CARGO_BUILD_JOBS: "12"
  before_script:
    - ulimit -c unlimited
    - git config --global --add safe.directory ${CI_PROJECT_DIR}
    - export PYENV_VERSION=${PYTHON_VERSION}
  script:
    - python --version
    # All profiling tests use EXPECT_EXIT (death tests) which fork child processes.
    # LSAN's signal handler in forked children conflicts with gtest, causing spurious crashes.
    # Disable leak detection for "safety" - Valgrind jobs already cover leak detection.
    - if [ "${SANITIZER}" == "safety" ]; then export ASAN_OPTIONS=detect_leaks=0; fi
    - ./ddtrace/internal/datadog/profiling/build_standalone.sh --${SANITIZER} RelWithDebInfo stack_test

# Run on PRs where files in the native Profiling build graph changed.
# build_standalone.sh compiles Rust (setup.py build_rust) then builds C++ tests
# via CMake, so Rust, C/C++, Cython, and CMake files should all trigger it.
# Extension-based patterns keep Python and docs out automatically; non-extension
# build files (CMakeLists.txt, .sh, .supp) are listed separately.
profiling_native:
  extends: .profiling_native_base
  retry: 2
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"
    - if: $CI_COMMIT_REF_NAME == "main"
    - changes:
        - .gitlab-ci.yml
        # Native source files by extension (C, C++, Cython, CMake modules)
        - ddtrace/internal/datadog/profiling/**/*.cpp
        - ddtrace/internal/datadog/profiling/**/*.cc
        - ddtrace/internal/datadog/profiling/**/*.h
        - ddtrace/internal/datadog/profiling/**/*.hpp
        - ddtrace/internal/datadog/profiling/**/*.pyx
        - ddtrace/internal/datadog/profiling/**/*.cmake
        - ddtrace/profiling/**/*.cpp
        - ddtrace/profiling/**/*.cc
        - ddtrace/profiling/**/*.h
        - ddtrace/profiling/**/*.hpp
        - ddtrace/profiling/**/*.pyx
        # Build/test config files (not matchable by extension alone)
        - ddtrace/internal/datadog/profiling/**/CMakeLists.txt
        - ddtrace/internal/datadog/profiling/**/*.sh
        - ddtrace/internal/datadog/profiling/**/*.supp
        - ddtrace/profiling/**/CMakeLists.txt
        # Rust source (build_standalone.sh compiles Rust first; CMake links
        # against generated FFI headers from src/native/target/.../include/)
        - src/native/**/*.rs
        - src/native/**/*.toml
        - src/native/**/Cargo.lock
        # Top-level build config
        - setup.py
        - pyproject.toml
  parallel:
    matrix:
      - PYTHON_VERSION: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
        SANITIZER: ["safety", "thread", ""]
      # Valgrind on subset only: ASAN/LSAN (in "safety") already cover leaks, buffer overflows,
      # and use-after-free. Valgrind's main added value is detecting uninitialized memory usage,
      # which is worth checking on a few versions without the slowdown on all runs.
      # If needed, please add more versions to the list.
      - PYTHON_VERSION: ["3.12", "3.14"]
        SANITIZER: ["valgrind"]

test-dd-sts:
  stage: tests
  needs: []
  tags: ["arch:amd64"]
  when: manual
  allow_failure: true
  image: registry.ddbuild.io/images/mirror/ubuntu:24.04
  id_tokens:
    DD_STS_OIDC_TOKEN:
      aud: rapid-seceng-sit
  script:
    - apt-get update && apt-get install -y curl
    - 'curl -s -o /dev/null -w "API key request http status code: %{http_code}\n" -H "Authorization: Bearer ${DD_STS_OIDC_TOKEN}" "https://dd-sts.us1.ddbuild.io/sts/datadog/exchange?policy=dd-trace-py-gitlab"'
    - 'curl -s -o /dev/null -w "APP key request http status code: %{http_code}\n" -H "Authorization: Bearer ${DD_STS_OIDC_TOKEN}" "https://dd-sts.us1.ddbuild.io/sts/datadog/exchange?policy=dd-trace-py-gitlab-app-key"'