fix(ci): unbreak the python downstream gate and lint

The python job selected scenarios with a negative-lookahead regex
(python(?!.*_3\.15$).*), but the matcher is Go's RE2 which rejects lookahead,
so list-scenarios errored and the entire Python gate was skipped on push CI.

Add an -exclude flag to cmd/list-scenarios (RE2, unanchored) and a matching
test_scenarios_exclude input to test.yml, then have ci.yml run 'python.*'
excluding the wheel-only scenarios that can't run against PyPI ddtrace: every
*_3.15, python_live_heap_3.14 (persistent live-heap unreleased), and the
python_downstream_gate index dir.

Also fix ruff: drop a stray blank line in the live_heap main.py import blocks
(I001) and ignore EM101/SIM105 for the exceptions scenarios, whose deliberate
string-literal raise + try/except/pass is the profiled workload.

Author: vlad-scherbich

.github/workflows/ci.yml

@@ -58,8 +58,14 @@ jobs:
   python:
     uses: ./.github/workflows/test.yml
     with:
-      # 3.15 migration scenarios require DDTRACE_INSTALL_URL (downstream only).
-      test_scenarios: 'python(?!.*_3\.15$).*'
+      test_scenarios: 'python.*'
+      # Wheel-only scenarios need DDTRACE_INSTALL_URL (dd-trace-py downstream
+      # gate), so they can't run here against PyPI ddtrace: every *_3.15, plus
+      # python_live_heap_3.14 (persistent live-heap is not in a release yet).
+      # python_downstream_gate is an index README, not a runnable scenario.
+      # Go's regexp is RE2 (no negative lookahead), so this is an explicit
+      # exclude rather than a lookahead baked into test_scenarios.
+      test_scenarios_exclude: '_3\.15$|^python_live_heap_3\.14$|^python_downstream_gate$'
     secrets: inherit
   full_host:
     uses: ./.github/workflows/test.yml

.github/workflows/test.yml

@@ -9,6 +9,11 @@ on:
         required: false
         type: string
         default: '.*'
+      test_scenarios_exclude:
+        description: 'A regexp dropping scenarios matched by test_scenarios (RE2, unanchored)'
+        required: false
+        type: string
+        default: ''
       ddtrace_install_url:
         description: 'URL to a ddtrace install script (e.g. from S3 builds)'
         required: false
@@ -35,7 +40,7 @@ jobs:
         #   - free local-daemon layer caching: buildBaseImages runs once per chunk,
         #     and the chunk's scenarios reuse the built base image.
         run: |
-          matrix=$(go run ./cmd/list-scenarios -pattern '${{ inputs.test_scenarios }}' -chunk-size 3)
+          matrix=$(go run ./cmd/list-scenarios -pattern '${{ inputs.test_scenarios }}' -exclude '${{ inputs.test_scenarios_exclude }}' -chunk-size 3)
           echo "scenarios=$matrix" >> "$GITHUB_OUTPUT"
 
   docker-scenarios:

cmd/list-scenarios/main.go

@@ -13,6 +13,7 @@
 // Usage:
 //
 //	go run ./cmd/list-scenarios -pattern 'python.*' -chunk-size 3
+//	go run ./cmd/list-scenarios -pattern 'python.*' -exclude '_3\.15$' -chunk-size 3
 package main
 
 import (
@@ -39,7 +40,7 @@ type matrixEntry struct {
 	Names string `json:"names"`
 }
 
-func run(pattern, scenariosDir string, chunkSize int) ([]matrixEntry, error) {
+func run(pattern, exclude, scenariosDir string, chunkSize int) ([]matrixEntry, error) {
 	// Anchor the user pattern so e.g. "python" doesn't accidentally match
 	// "python_basic_idle_3.10". The non-capturing group preserves precedence of
 	// any alternation inside the user pattern.
@@ -48,21 +49,38 @@ func run(pattern, scenariosDir string, chunkSize int) ([]matrixEntry, error) {
 		return nil, fmt.Errorf("invalid -pattern: %w", err)
 	}
 
+	// Optional exclusion, applied to names that matched -pattern. Unlike
+	// -pattern this is NOT anchored, so a suffix like `_3\.15$` drops every
+	// name ending in that version. Go's regexp is RE2 (no lookahead), so
+	// "match python but not the wheel-only variants" must be expressed as a
+	// separate exclude rather than a negative lookahead in -pattern.
+	var excludeRe *regexp.Regexp
+	if exclude != "" {
+		excludeRe, err = regexp.Compile(exclude)
+		if err != nil {
+			return nil, fmt.Errorf("invalid -exclude: %w", err)
+		}
+	}
+
 	entries, err := os.ReadDir(scenariosDir)
 	if err != nil {
 		return nil, fmt.Errorf("read %s: %w", scenariosDir, err)
 	}
 
 	var names []string
 	for _, e := range entries {
-		if e.IsDir() && re.MatchString(e.Name()) {
-			names = append(names, e.Name())
+		if !e.IsDir() || !re.MatchString(e.Name()) {
+			continue
+		}
+		if excludeRe != nil && excludeRe.MatchString(e.Name()) {
+			continue
 		}
+		names = append(names, e.Name())
 	}
 	sort.Strings(names)
 
 	if len(names) == 0 {
-		return nil, fmt.Errorf("no scenarios matched pattern %q in %s", pattern, scenariosDir)
+		return nil, fmt.Errorf("no scenarios matched pattern %q (exclude %q) in %s", pattern, exclude, scenariosDir)
 	}
 
 	// Pack into chunks of at most chunkSize, preserving sorted order.
@@ -88,6 +106,7 @@ func run(pattern, scenariosDir string, chunkSize int) ([]matrixEntry, error) {
 
 func main() {
 	pattern := flag.String("pattern", "", "regex selecting scenario directory names (anchored as ^pattern$)")
+	exclude := flag.String("exclude", "", "regex dropping matched names (unanchored, RE2); e.g. '_3\\.15$'")
 	scenariosDir := flag.String("scenarios-dir", "scenarios", "path to the scenarios directory")
 	chunkSize := flag.Int("chunk-size", 3, "max scenarios per matrix entry")
 	flag.Parse()
@@ -103,7 +122,7 @@ func main() {
 	}
 
 	abs, _ := filepath.Abs(*scenariosDir)
-	out, err := run(*pattern, *scenariosDir, *chunkSize)
+	out, err := run(*pattern, *exclude, *scenariosDir, *chunkSize)
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "error: %v (resolved scenarios dir: %s)\n", err, abs)
 		os.Exit(1)

cmd/list-scenarios/main_test.go

@@ -6,6 +6,7 @@ import (
 	"path/filepath"
 	"reflect"
 	"regexp"
+	"strings"
 	"testing"
 )
 
@@ -37,7 +38,7 @@ func TestRun_ChunksAlphabetically(t *testing.T) {
 		"node_heap", // must be filtered out by the pattern
 	})
 
-	got, err := run("python.*", root, 3)
+	got, err := run("python.*", "", root, 3)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -62,7 +63,7 @@ func TestRun_ChunksAlphabetically(t *testing.T) {
 func TestRun_SingleChunkWhenSmall(t *testing.T) {
 	root := mkScenarios(t, []string{"dotnet_wall", "dotnet_alloc"})
 
-	got, err := run("dotnet.*", root, 3)
+	got, err := run("dotnet.*", "", root, 3)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -87,7 +88,7 @@ func TestRun_AnchoringRejectsSubstringMatches(t *testing.T) {
 		"python_cpu_sleep_sync_3.12",
 	})
 
-	got, err := run("python_cpu", root, 3)
+	got, err := run("python_cpu", "", root, 3)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -101,7 +102,7 @@ func TestRun_ExactChunkSizeBoundary(t *testing.T) {
 	root := mkScenarios(t, []string{
 		"a", "b", "c", "d", "e", "f",
 	})
-	got, err := run(".*", root, 3)
+	got, err := run(".*", "", root, 3)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -113,10 +114,46 @@ func TestRun_ExactChunkSizeBoundary(t *testing.T) {
 	}
 }
 
+func TestRun_ExcludeDropsMatchedNames(t *testing.T) {
+	// Mirrors the CI python gate: run everything python except the wheel-only
+	// variants (every *_3.15 plus python_live_heap_3.14).
+	root := mkScenarios(t, []string{
+		"python_cpu",
+		"python_lock_3.14",
+		"python_lock_3.15",
+		"python_mem_domain_3.14",
+		"python_mem_domain_3.15",
+		"python_live_heap_3.14",
+		"python_live_heap_3.15",
+	})
+
+	got, err := run("python.*", `_3\.15$|^python_live_heap_3\.14$`, root, 3)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var names []string
+	for _, e := range got {
+		names = append(names, e.Names)
+	}
+	joined := strings.Join(names, ", ")
+	want := "python_cpu, python_lock_3.14, python_mem_domain_3.14"
+	if joined != want {
+		t.Fatalf("excluded set wrong:\n got %q\nwant %q", joined, want)
+	}
+}
+
+func TestRun_InvalidExcludeIsError(t *testing.T) {
+	root := mkScenarios(t, []string{"python_cpu"})
+	if _, err := run("python.*", "[invalid", root, 3); err == nil {
+		t.Fatal("expected error on invalid exclude regex")
+	}
+}
+
 func TestRun_NoMatchIsError(t *testing.T) {
 	root := mkScenarios(t, []string{"python_cpu"})
 
-	_, err := run("ruby.*", root, 3)
+	_, err := run("ruby.*", "", root, 3)
 	if err == nil {
 		t.Fatal("expected error when no scenarios match")
 	}
@@ -125,7 +162,7 @@ func TestRun_NoMatchIsError(t *testing.T) {
 func TestRun_InvalidPatternIsError(t *testing.T) {
 	root := mkScenarios(t, []string{"python_cpu"})
 
-	if _, err := run("[invalid", root, 3); err == nil {
+	if _, err := run("[invalid", "", root, 3); err == nil {
 		t.Fatal("expected error on invalid regex")
 	}
 }
@@ -140,7 +177,7 @@ func TestRun_RegexMatchesIntendedDirAndOnlyThat(t *testing.T) {
 		"python_cpu_sleep_sync_3.12",
 		"python_basic_idle_3.11",
 	})
-	got, err := run("python.*", root, 3)
+	got, err := run("python.*", "", root, 3)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -175,7 +212,7 @@ func TestRun_RegexMatchesIntendedDirAndOnlyThat(t *testing.T) {
 // verifies it round-trips to the expected shape.
 func TestRun_OutputIsValidJSON(t *testing.T) {
 	root := mkScenarios(t, []string{"a", "b", "c", "d"})
-	got, err := run(".*", root, 3)
+	got, err := run(".*", "", root, 3)
 	if err != nil {
 		t.Fatal(err)
 	}

pyproject.toml

@@ -50,6 +50,10 @@ ignore = [
 "**/__init__.py" = ["D104"]        # missing docstring in public package
 "**/test_*.py" = ["S101", "D"]     # allow assert in tests, skip docstrings
 "**/tests/**/*.py" = ["S101", "D"] # allow assert in tests, skip docstrings
+# The exceptions scenario deliberately raises + swallows an exception as its
+# profiled workload; the explicit string-literal raise and try/except/pass are
+# the point of the test, not style smells.
+"scenarios/python_exceptions_*/main.py" = ["EM101", "SIM105"]
 
 [tool.ruff.lint.pydocstyle]
 convention = "google"

scenarios/python_live_heap_3.14/main.py

@@ -3,7 +3,6 @@
 
 from ddtrace.profiling import Profiler
 
-
 # Allocations are held at module scope so they stay live for the whole process
 # and therefore appear in every live-heap snapshot the profiler exports.
 LIVE: list = []

scenarios/python_live_heap_3.15/main.py

@@ -3,7 +3,6 @@
 
 from ddtrace.profiling import Profiler
 
-
 # Allocations are held at module scope so they stay live for the whole process
 # and therefore appear in every live-heap snapshot the profiler exports.
 LIVE: list = []