Merge remote-tracking branch 'origin/master' into bdu/register-mappings

Author: bric3

.github/workflows/run-system-tests.yaml

@@ -63,8 +63,6 @@ jobs:
     - build
     # If you change the following comment, update the pattern in the update_system_test_reference.sh script to match.
     uses: DataDog/system-tests/.github/workflows/system-tests.yml@main # system tests are pinned on release branches only
-    secrets:
-      TEST_OPTIMIZATION_API_KEY: ${{ secrets.DATADOG_API_KEY_PROD }}
     permissions:
       contents: read
       id-token: write
@@ -78,7 +76,7 @@ jobs:
       scenarios_groups: tracer-release
       excluded_scenarios: APM_TRACING_E2E_OTEL,APM_TRACING_E2E_SINGLE_SPAN,PROFILING  # exclude flaky scenarios
       skip_empty_scenarios: true
-      push_to_test_optimization: true
+      push_to_test_optimization: false # disabled to avoid pushing to Test Optimization while API key is transitioning to system-tests
 
   # Ensure the main job is run to completion
   check:

.gitlab/benchmarks/bp-runner.fail-on-breach.yml

@@ -2,7 +2,7 @@
 # Generated: 2026-03-31
 #
 # Generation Strategy: tight
-#   Formula: CI_bound / (1 ± T) (T = 5.0%)
+#   Formula: CI_bound / (1 ± T) (T = 10.0%)
 #
 # SLO Checking:
 #   - BREACH: 90% CI boundary crosses threshold
@@ -11,7 +11,7 @@
 # DO NOT EDIT MANUALLY - Regenerate using:
 #   benchmark_analyzer generate slos --help
 #
-# Thresholds set based on guidance in https://datadoghq.atlassian.net/wiki/x/LgI1LgE#How-to-choose-thresholds-for-pre-release-gates%3F
+# link to documentation on autogenerated thresholds https://github.com/DataDog/relenv-benchmark-analyzer/blob/main/README.md#generate-slo-thresholds
 
 experiments:
   - name: Run SLO breach check
@@ -31,7 +31,7 @@ experiments:
           # https://benchmarking.us1.prod.dog/trends?projectId=4&branch=master&trendsTab=per_scenario&scenario=normal_operation%2Fonly-tracing&trendsType=scenario
           - name: normal_operation/only-tracing
             thresholds:
-              - agg_http_req_duration_p50 < 2.128 ms
+              - agg_http_req_duration_p50 < 2.526 ms
               - agg_http_req_duration_p99 < 8.5 ms
           # https://benchmarking.us1.prod.dog/trends?projectId=4&branch=master&trendsTab=per_scenario&scenario=normal_operation%2Fotel-latest&trendsType=scenario
           - name: normal_operation/otel-latest

.gitlab/one-pipeline.locked.yml

@@ -1,4 +1,4 @@
 # DO NOT EDIT THIS FILE MANUALLY
 # This file is auto-generated by automation.
 include:
-  - remote: https://gitlab-templates.ddbuild.io/libdatadog/one-pipeline/ca/9cf7d7609ff62e4723c9cbc061ca2a25345ce5d6055b9acad9a13dbf736261f0/one-pipeline.yml
+  - remote: https://gitlab-templates.ddbuild.io/libdatadog/one-pipeline/ca/4667b01c6ae983f92ecf106e110ced3dac798b229cf2a0539c58aa22e95a99d5/one-pipeline.yml

ARCHITECTURE.md

@@ -54,7 +54,7 @@ to `.classdata` to prevent unintended loading. See [`docs/how_to_work_with_gradl
   utilities. Visible to all classloaders, so instrumentation advice and helpers can use them directly.
   See [`docs/bootstrap_design_guidelines.md`](docs/bootstrap_design_guidelines.md).
 
-- **`agent-builder/`** — ByteBuddy integration layer. Class transformer pipeline:
+- **`agent-installer/`** — Product installers and ByteBuddy integration layer. Class transformer pipeline:
   `DDClassFileTransformer` intercepts every class load, `GlobalIgnoresMatcher` applies early
   filtering, `CombiningMatcher` evaluates instrumentation matchers, `SplittingTransformer`
   applies matched transformations. The `ignored_class_name.trie` is a compiled trie built at

buildSrc/src/main/kotlin/dd-trace-java.configure-tests.gradle.kts

@@ -46,6 +46,9 @@ tasks.withType<Test>().configureEach {
   // Use a task-specific user prefs directory
   systemProperty("java.util.prefs.userRoot", layout.buildDirectory.dir("tmp/userPrefs/$name").get().asFile.absolutePath)
 
+  // Enable JUnit 5 auto-detection so ConfigInversionExtension (STRICT mode) is loaded automatically
+  systemProperty("junit.jupiter.extensions.autodetection.enabled", "true")
+
   // Split up tests that want to run forked in their own separate JVM for generated tasks
   if (name.startsWith("forkedTest") || name.endsWith("ForkedTest")) {
     setExcludes(emptyList())

communication/src/main/java/datadog/communication/http/OkHttpUtils.java

@@ -15,6 +15,7 @@
 import java.net.InetSocketAddress;
 import java.net.Proxy;
 import java.nio.ByteBuffer;
+import java.util.Arrays;
 import java.util.Collections;
 import java.util.List;
 import java.util.Map;
@@ -27,6 +28,7 @@
 import okhttp3.HttpUrl;
 import okhttp3.MediaType;
 import okhttp3.OkHttpClient;
+import okhttp3.Protocol;
 import okhttp3.Request;
 import okhttp3.RequestBody;
 import okhttp3.Response;
@@ -62,7 +64,7 @@ public static OkHttpClient buildHttpClient(final HttpUrl url, final long timeout
   }
 
   public static OkHttpClient buildHttpClient(
-      final boolean isHttp,
+      final boolean isPlainHttp,
       final String unixDomainSocketPath,
       final String namedPipe,
       final long timeoutMillis) {
@@ -71,7 +73,30 @@ public static OkHttpClient buildHttpClient(
         Config.get().isJdkSocketEnabled(),
         namedPipe,
         null,
-        isHttp,
+        isPlainHttp,
+        false,
+        null,
+        null,
+        null,
+        null,
+        null,
+        null,
+        timeoutMillis,
+        Config.get().isAgentConfiguredUsingDefault());
+  }
+
+  public static OkHttpClient buildHttp2Client(
+      final boolean isPlainHttp,
+      final String unixDomainSocketPath,
+      final String namedPipe,
+      final long timeoutMillis) {
+    return buildHttpClient(
+        unixDomainSocketPath,
+        Config.get().isJdkSocketEnabled(),
+        namedPipe,
+        null,
+        isPlainHttp,
+        true,
         null,
         null,
         null,
@@ -99,6 +124,7 @@ public static OkHttpClient buildHttpClient(
         config.getAgentNamedPipe(),
         dispatcher,
         isPlainHttp(url),
+        false,
         retryOnConnectionFailure,
         maxRunningRequests,
         proxyHost,
@@ -116,7 +142,8 @@ private static OkHttpClient buildHttpClient(
       final boolean useJdkUnixDomainSocket,
       final String namedPipe,
       final Dispatcher dispatcher,
-      final boolean isHttp,
+      final boolean isPlainHttp,
+      final boolean isHttp2,
       final Boolean retryOnConnectionFailure,
       final Integer maxRunningRequests,
       final String proxyHost,
@@ -159,11 +186,19 @@ private static OkHttpClient buildHttpClient(
       log.debug("Using NamedPipe as http transport");
     }
 
-    if (isHttp) {
+    if (isPlainHttp) {
       // force clear text when using http to avoid failures for JVMs without TLS
       builder.connectionSpecs(Collections.singletonList(ConnectionSpec.CLEARTEXT));
     }
 
+    if (isHttp2) {
+      if (isPlainHttp) {
+        builder.protocols(Collections.singletonList(Protocol.H2_PRIOR_KNOWLEDGE));
+      } else {
+        builder.protocols(Arrays.asList(Protocol.HTTP_2, Protocol.HTTP_1_1));
+      }
+    }
+
     if (retryOnConnectionFailure != null) {
       builder.retryOnConnectionFailure(retryOnConnectionFailure);
     }