Merge remote-tracking branch 'origin/main' into vlad/native-heap-gotter-cdylib-build-pr-a

Author: vlad-scherbich

.claude/skills/circular-import-analysis/SKILL.md

@@ -41,9 +41,10 @@ To read the results:
 cat cycles.json   # raw JSON array of cycles
 ```
 
-Each entry is an array of module names forming the cycle, e.g.:
+Each entry has the full set of modules in the tangled component (`nodes`) and one
+concrete simple cycle through it (`cycle`), e.g.:
 ```json
-["ddtrace", "ddtrace.internal.datastreams", "ddtrace"]
+{"nodes": ["ddtrace", "ddtrace.internal.datastreams"], "cycle": ["ddtrace", "ddtrace.internal.datastreams", "ddtrace"]}
 ```
 
 Clean up afterwards:

.github/CODEOWNERS

@@ -31,7 +31,9 @@ tests/telemetry                     @DataDog/apm-python
 # Guild
 # Root level config files
 conftest.py                         @DataDog/python-guild
+docker-compose.base.yml             @DataDog/python-guild
 docker-compose.gpu.yml              @DataDog/python-guild
+docker-compose.podman.yml           @DataDog/python-guild
 docker-compose.yml                  @DataDog/python-guild
 repository.datadog.yml              @DataDog/python-guild
 sgconfig.yml                        @DataDog/python-guild

.github/workflows/build_deploy.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - main
+      - staging
       - '[0-9].[0-9]*'
       - '[0-9].x'
       # special branches used to test this workflow

.github/workflows/generate-package-versions.yml

@@ -117,6 +117,7 @@ jobs:
         uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
         with:
           token: ${{ steps.octo-sts.outputs.token }}
+          sign-commits: true
           branch: "upgrade-latest-${{ env.VENV_NAME }}-version"
           commit-message: "Update package version"
           delete-branch: true

.github/workflows/system-tests.yml

@@ -95,11 +95,11 @@ jobs:
   serverless-system-tests:
     needs: [serverless-system-tests-build-layer]
     # Automatically managed, use scripts/update-system-tests-version to update
-    uses: DataDog/system-tests/.github/workflows/system-tests.yml@579b7f34d7b1f5982a7003bcd65a5e0b14cd1b61
+    uses: DataDog/system-tests/.github/workflows/system-tests.yml@4be985b2a08121eb586d8e37e03e89e2407ba2a2
     secrets: inherit
     with:
       library: python_lambda
-      ref: '579b7f34d7b1f5982a7003bcd65a5e0b14cd1b61'
+      ref: '4be985b2a08121eb586d8e37e03e89e2407ba2a2'
       binaries_artifact: serverless_system_tests_binaries
       scenarios_groups: lambda_end_to_end
       skip_empty_scenarios: true
@@ -126,22 +126,22 @@ jobs:
     if: github.event_name != 'schedule' || github.event.repository.fork == false
     needs: [integration-frameworks-combine-wheels]
     # Automatically managed, use scripts/update-system-tests-version to update
-    uses: DataDog/system-tests/.github/workflows/system-tests.yml@579b7f34d7b1f5982a7003bcd65a5e0b14cd1b61
+    uses: DataDog/system-tests/.github/workflows/system-tests.yml@4be985b2a08121eb586d8e37e03e89e2407ba2a2
     secrets: inherit
     with:
       library: python
-      ref: '579b7f34d7b1f5982a7003bcd65a5e0b14cd1b61'
+      ref: '4be985b2a08121eb586d8e37e03e89e2407ba2a2'
       scenarios: INTEGRATION_FRAMEWORKS
       binaries_artifact: integration-frameworks-wheels
       push_to_test_optimization: true
 
   tracer-release:
     needs:
       - download-s3-wheels
-    uses: DataDog/system-tests/.github/workflows/system-tests.yml@579b7f34d7b1f5982a7003bcd65a5e0b14cd1b61
+    uses: DataDog/system-tests/.github/workflows/system-tests.yml@4be985b2a08121eb586d8e37e03e89e2407ba2a2
     with:
       library: python
-      ref: '579b7f34d7b1f5982a7003bcd65a5e0b14cd1b61'
+      ref: '4be985b2a08121eb586d8e37e03e89e2407ba2a2'
       binaries_artifact: wheels-manylinux_x86_64
       desired_execution_time: 900
       scenarios_groups: tracer-release

.github/workflows/update-package-version.yml

@@ -137,6 +137,7 @@ jobs:
         uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
         with:
           token: ${{ steps.octo-sts.outputs.token }}
+          sign-commits: true
           branch: "upgrade-latest-${{ inputs.package_name }}-version"
           commit-message: "Update package version"
           delete-branch: true

.gitlab-ci.yml

@@ -18,12 +18,14 @@ variables:
   DD_VPA_TEMPLATE: "vpa-template-cpu-p70-10percent-2x-oom-min-cap"
   # CI_DEBUG_SERVICES: "true"
   # Automatically managed, use scripts/update-system-tests-version to update
-  SYSTEM_TESTS_REF: "579b7f34d7b1f5982a7003bcd65a5e0b14cd1b61"
+  SYSTEM_TESTS_REF: "4be985b2a08121eb586d8e37e03e89e2407ba2a2"
 
   # Profiling native build image (built from dd/images/dd-trace-py/profiling_native)
   PROFILING_NATIVE_IMAGE: "registry.ddbuild.io/dd-trace-py:v103334885-be1888c-profiling_native"
   # Repository URL for CI Visibility
   DD_GIT_REPOSITORY_URL: "https://github.com/DataDog/dd-trace-py.git"
+  # General purpose CI image (built from dd/images/dd-trace-py/ci-utils)
+  CI_UTILS_IMAGE: "registry.ddbuild.io/dd-trace-py:v129724447-ccf4260-ci-utils@sha256:3ff0b19510872d740ee4bd3bddde9bb47567ccac7b6e4684bafb6b2bdaf62247"
 
   # One pipeline injection package size ratchet
   OCI_PACKAGE_MAX_SIZE_BYTES: 80_000_000
@@ -338,7 +340,7 @@ codeowners:
   stage: tests
   needs: []
   tags: ["arch:amd64"]
-  image: registry.ddbuild.io/images/mirror/ubuntu:25.04
+  image: ${CI_UTILS_IMAGE}
   script:
     # Validate that each file entry only exists once in CODEOWNERS to prevent confusion about ownership.
     # The file is evaluated from top to bottom where the last match wins, so duplicate entries can lead to unexpected owners being assigned.
@@ -366,9 +368,7 @@ codeowners:
             echo "Please remove duplicates from .github/CODEOWNERS."
             exit 1
         fi
-    - apt-get update && apt install ca-certificates git wget curl -y
-    - wget https://github.com/hmarr/codeowners/releases/download/v1.2.1/codeowners_1.2.1_linux_amd64.tar.gz
-    - tar -xvzf codeowners_1.2.1_linux_amd64.tar.gz
+    - git config --global --add safe.directory "${CI_PROJECT_DIR}"
     - git diff-tree --no-commit-id --name-only -r $CI_COMMIT_SHA > /tmp/changed_all.txt
     # Filter to only files that exist on disk (deleted files cause codeowners to crash)
     - |
@@ -379,7 +379,7 @@ codeowners:
     - |
       if [ -s /tmp/changed_files.txt ]; then
         echo '```' > codeowners.txt
-        xargs ./codeowners < /tmp/changed_files.txt | tee -a codeowners.txt
+        xargs codeowners < /tmp/changed_files.txt | tee -a codeowners.txt
         echo '```' >> codeowners.txt
       fi
     - .gitlab/scripts/post-pr-comment.sh "Codeowners resolved as" codeowners.txt
@@ -674,6 +674,12 @@ configure_system_tests:
 system_tests:
   needs: ["configure_system_tests", "oci-internal-test-publish", "kubernetes-injection-test-ecr-publish"]
 
+# The reliability environment installs commit-scoped wheels from the CI index.
+deploy_to_reliability_env:
+  needs:
+    - job: "upload all"
+      artifacts: false
+
 # Clear the one-pipeline publishing-gate's `needs: []` so it falls back to
 # stage-based ordering and waits for all prior stages before publishing.
 publishing-gate:

.gitlab/benchmarks/bp-runner.microbenchmarks.fail-on-breach.template.yml

@@ -797,49 +797,49 @@ experiments:
           # telemetryaddmetric
           - name: telemetryaddmetric-1-count-metric-1-times
             thresholds:
-              - execution_time < 0.02 ms
+              - execution_time < 0.005 ms
           - name: telemetryaddmetric-1-count-metrics-100-times
             thresholds:
               - execution_time < 0.22 ms
           - name: telemetryaddmetric-1-distribution-metric-1-times
             thresholds:
-              - execution_time < 0.02 ms
+              - execution_time < 0.005 ms
           - name: telemetryaddmetric-1-distribution-metrics-100-times
             thresholds:
-              - execution_time < 0.23 ms
+              - execution_time < 0.22 ms
           - name: telemetryaddmetric-1-gauge-metric-1-times
             thresholds:
-              - execution_time < 0.02 ms
+              - execution_time < 0.005 ms
           - name: telemetryaddmetric-1-gauge-metrics-100-times
             thresholds:
-              - execution_time < 0.19 ms
+              - execution_time < 0.22 ms
           - name: telemetryaddmetric-1-rate-metric-1-times
             thresholds:
-              - execution_time < 0.02 ms
+              - execution_time < 0.005 ms
           - name: telemetryaddmetric-1-rate-metrics-100-times
             thresholds:
-              - execution_time < 0.25 ms
+              - execution_time < 0.22 ms
           - name: telemetryaddmetric-100-count-metrics-100-times
             thresholds:
               - execution_time < 22.0 ms
           - name: telemetryaddmetric-100-distribution-metrics-100-times
             thresholds:
-              - execution_time < 2.55 ms
+              - execution_time < 2.30 ms
           - name: telemetryaddmetric-100-gauge-metrics-100-times
             thresholds:
-              - execution_time < 1.85 ms
+              - execution_time < 2.25 ms
           - name: telemetryaddmetric-100-rate-metrics-100-times
             thresholds:
-              - execution_time < 2.55 ms
-          - name: telemetryaddmetric-flush-1-metric
+              - execution_time < 2.25 ms
+          - name: telemetryaddmetric-record-1-metric
             thresholds:
-              - execution_time < 0.02 ms
-          - name: telemetryaddmetric-flush-100-metrics
+              - execution_time < 0.006 ms
+          - name: telemetryaddmetric-record-100-metrics
             thresholds:
-              - execution_time < 0.25 ms
-          - name: telemetryaddmetric-flush-1000-metrics
+              - execution_time < 0.23 ms
+          - name: telemetryaddmetric-record-1000-metrics
             thresholds:
-              - execution_time < 2.50 ms
+              - execution_time < 2.30 ms
 
           # telemetrydependencies
           - name: telemetrydependencies-first-50-deps-sca-off
@@ -871,7 +871,7 @@ experiments:
               - execution_time < 3.00 ms
           - name: forktime-configured
             thresholds:
-              - execution_time < 17 ms
+              - execution_time < 22 ms
 
           # rand
           - name: rand-rand64bits

.gitlab/benchmarks/microbenchmarks.yml

@@ -16,7 +16,6 @@ variables:
   BENCHMARKING_IMAGE_REGISTRY: 486234852809.dkr.ecr.us-east-1.amazonaws.com
   MICROBENCHMARKS_CI_IMAGE: $BENCHMARKING_IMAGE_REGISTRY/ci/benchmarking-platform:dd-trace-py
   PACKAGE_IMAGE: registry.ddbuild.io/images/mirror/pypa/manylinux2014_x86_64:2025-04-12-5990e2d
-  GITHUB_CLI_IMAGE: registry.ddbuild.io/images/dd-octo-sts-ci-base:2025.06-1
   BENCHMARKING_BRANCH: dd-trace-py
   BENCHMARKING_COMMIT_SHA: dbe21f0dd0f8274c31a006d0482f6836e86446c4
 
@@ -94,7 +93,7 @@ variables:
     PIP_CACHE_DIR: "${CI_PROJECT_DIR}/.cache/pip"
 
 baseline:detect:
-  image: $GITHUB_CLI_IMAGE
+  image: ${CI_UTILS_IMAGE}
   tags: [ "arch:amd64" ]
   stage: build
   id_tokens:
@@ -132,6 +131,12 @@ baseline:build:
   variables:
     CMAKE_BUILD_PARALLEL_LEVEL: 12
     CARGO_BUILD_JOBS: 12
+    KUBERNETES_CPU_REQUEST: "6"
+    KUBERNETES_MEMORY_REQUEST: "10Gi"
+    KUBERNETES_MEMORY_LIMIT: "10Gi"
+    # DD_DISABLE_VPA is required: without it VPA overrides KUBERNETES_MEMORY_*
+    # and clamps the build container, causing OOMKills during parallel compilation.
+    DD_DISABLE_VPA: "true"
   script: |
     CACHED_WHL=$(ls *.whl | head -n 1) 2>/dev/null || echo ""
     if [ ! -f "${CACHED_WHL}" ];

.gitlab/multi-os-tests.yml

@@ -39,7 +39,6 @@ os tests macos:
   image: "486234852809.dkr.ecr.us-east-1.amazonaws.com/ci/ci-platform-machine-images/tart-vm:dd-trace-py-sonoma-latest"
   tags: ["macos:tart"]
   needs: [ "build macos arm64" ]
-  allow_failure: true
   variables:
     WHEEL_PATTERN: "macosx*arm64.whl"
     PLATFORM: "macOS"