Validate scheduled builds with refreshed dependency locks by bric3 · Pull Request #12392 · DataDog/dd-trace-java

bric3 · 2026-09-03T09:43:52Z

What Does This Do

Refreshes dependency locks in validate_build for scheduled pipelines, matching the lock refresh performed by build before rebuilding JARs for comparison.

Also, when compareToReferenceJar fails, the reference and candidate JARs will be published as job job artifacts for inspection.

Motivation

Scheduled pipelines refresh dependency locks in build before producing the reference JARs. But validate_build did not had that step, so it rebuilt candidates from the committed lockfiles which can lead to a different dependency ordering.

This became visible after the version catalog requested dd-instrument-java:0.0.5 while the dd-trace-ot lockfile still declared 0.0.4.
Both build and validate_build jobs resolved to 0.0.5 (the jar content was correct), but the different lock file changed dependency input ordering.

dd-instrument-java is relocated, and its entries appeared at different positions in the dd-trace-ot Shadow JAR. While the content was identical, the jar itself had different hash on the different jobs.

To prevent that on scheduled pipelines validate_build now applies the same scheduled lock refresh as the build job. Allowing to build jars using the same dependency resolution order.

@@ relocated classes @@
- stale positions:     2680..2768
+ reference positions: 1681..1769
  89 entries under ddtrot/dd/instrument/{asm,classinject,classmatch,fieldinject,glue,utils}

@@ relocated directories @@
- stale positions:     3065..3072
+ reference positions: 2996..3003
  8 directory entries under ddtrot/dd/instrument/

Contributor Checklist

Format the title according to the contribution guidelines
Assign the type: and (comp: or inst:) labels in addition to any other useful labels
Avoid using close, fix, or any linking keywords when referencing an issue
Use solves instead, and assign the PR milestone to the issue
Update the CODEOWNERS file on source file addition, migration, or deletion
Update public documentation with any new configuration flags or behaviors
Once approved, use merge queue to merge the PR

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

dd-octo-sts · 2026-09-03T10:09:36Z

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	14.00 s	13.94 s	[-0.4%; +1.2%] (no difference)
startup:insecure-bank:tracing:Agent	12.96 s	13.01 s	[-1.0%; +0.2%] (no difference)
startup:petclinic:appsec:Agent	16.97 s	16.64 s	[+0.9%; +3.0%] (maybe worse)
startup:petclinic:iast:Agent	16.83 s	17.00 s	[-1.8%; -0.2%] (maybe better)
startup:petclinic:profiling:Agent	16.59 s	16.71 s	[-1.6%; +0.2%] (no difference)
startup:petclinic:sca:Agent	16.95 s	16.09 s	[+0.9%; +9.8%] (maybe worse)
startup:petclinic:tracing:Agent	15.60 s	16.19 s	[-7.7%; +0.4%] (no difference)

Commit: f6a4a50b · CI Pipeline · Benchmarking Platform UI

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

chatgpt-codex-connector · 2026-09-03T12:06:58Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-03T12:08:52.441476Z	`cd311bd`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

datadog-prod-us1-3

More details

The scheduled validation now refreshes dependency locks in the same way as the reference build. The failure path puts both JAR sets in the existing job artifact directory.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Datadog Autotest · Commit cd311bd · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}

AlexeyKuznetsov-DD

Approving, but curious why we are not just excluding lock files from SHA?

bric3 · 2026-09-03T16:43:34Z

@AlexeyKuznetsov-DD the lock files do not end up in the jar;) They however help gradle to resolve dependencies.

bric3 · 2026-09-03T19:19:26Z

/merge

gh-worker-devflow-routing-ef8351 · 2026-09-03T19:19:31Z

View all feedbacks in Devflow UI.

2026-09-03 19:19:31 UTC ℹ️ Start processing command /merge

2026-09-03 19:19:42 UTC ℹ️ MergeQueue: Pull request is not mergeable yet

It will be processed automatically as soon as GitHub reports it as mergeable. View in MergeQueue UI.

Run /code blockers to see what is blocking it.
Run /remove to cancel it.

2026-09-04 00:06:22 UTC ⚠️ MergeQueue: This merge request was unqueued

devflow unqueued this merge request: It did not become mergeable within the expected time

AlexeyKuznetsov-DD · 2026-09-03T19:26:09Z

/code blockers

gh-worker-devflow-routing-ef8351 · 2026-09-03T19:26:12Z

View all feedbacks in Devflow UI.

2026-09-03 19:26:12 UTC ℹ️ Start processing command /code blockers

2026-09-03 19:26:12 UTC ℹ️ Devflow:

Checking merge blockers for #12392...

2026-09-03 19:26:15 UTC ℹ️ Devflow: /code blockers

Detected 2 merge blocker(s) to address:

🔴 Blocking

Required check Check system tests success has not reported
Hint: Ensure the workflow that produces this check is triggered.

🟠 Pending

Required check dd-gitlab/default-pipeline is running

AlexeyKuznetsov-DD · 2026-09-03T19:28:31Z

+    # Scheduled builds refresh dependency locks before creating the reference artifacts.
+    # Refresh them here as well so the candidate uses the same dependency resolution.
+    - if [ $CI_PIPELINE_SOURCE == "schedule" ] ; then ./gradlew resolveAndLockAll --write-locks $GRADLE_ARGS; fi


After some thought I think, maybe just remove dependencies updates in nightly build?
I do not see any value of that. We have a weekly job that correctly update dependencies by checking 48h cooldown, and we do not have this logic in nightly build.
WDYT?

I tend to agree, but wouldn't that complicate the gitlab file?

I think it should simplify it :)

Let's do that in a follow-up PR.

AlexeyKuznetsov-DD · 2026-09-03T19:53:01Z

+    # Scheduled builds refresh dependency locks before creating the reference artifacts.
+    # Refresh them here as well so the candidate uses the same dependency resolution.
+    - if [ $CI_PIPELINE_SOURCE == "schedule" ] ; then ./gradlew resolveAndLockAll --write-locks $GRADLE_ARGS; fi


I think it should simplify it :)

bric3 · 2026-09-04T11:18:10Z

/merge

gh-worker-devflow-routing-ef8351 · 2026-09-04T11:18:14Z

View all feedbacks in Devflow UI.

2026-09-04 11:18:14 UTC ℹ️ Start processing command /merge
Use /merge -c to cancel this operation!

2026-09-04 11:18:24 UTC ℹ️ MergeQueue: Pull request is not mergeable yet

It will be processed automatically as soon as GitHub reports it as mergeable. View in MergeQueue UI.

Run /code blockers to see what is blocking it.
Run /remove to cancel it.

Use /merge -c to cancel this operation!

⏳ Waiting for pull request to become mergeable

fix: align dd-trace-ot dependency lock

d5b4fac

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

bric3 added type: bug fix Bug fix tag: no release notes Changes to exclude from release notes comp: tooling Build & Tooling comp: opentracing OpenTracing tag: ai generated Largely based on code generated by an AI or LLM labels Sep 3, 2026

This comment has been minimized.

Sign in to view

fix: refresh locks during scheduled validation

c9f2f99

bric3 changed the title ~~Align dd-trace-ot dependency lock with dd-instrument-java~~ Validate scheduled builds with refreshed dependency locks Sep 3, 2026

fix: keep comparison artifacts with reports

cd311bd

bric3 marked this pull request as ready for review September 3, 2026 12:06

bric3 requested review from a team as code owners September 3, 2026 12:06

bric3 requested review from amarziali and erikayasuda and removed request for a team September 3, 2026 12:06

datadog-prod-us1-3 Bot reviewed Sep 3, 2026

View reviewed changes

AlexeyKuznetsov-DD approved these changes Sep 3, 2026

View reviewed changes

Merge branch 'master' into fix/dd-trace-ot-shadow-order

ea9594e

AlexeyKuznetsov-DD reviewed Sep 3, 2026

View reviewed changes

AlexeyKuznetsov-DD approved these changes Sep 3, 2026

View reviewed changes

Merge branch 'master' into fix/dd-trace-ot-shadow-order

f6a4a50

Uh oh!

Conversation

bric3 commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Does This Do

Motivation

Contributor Checklist

Uh oh!

This comment has been minimized.

dd-octo-sts Bot commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🟢 Java Benchmark SLOs — All performance SLOs passed

Uh oh!

chatgpt-codex-connector Bot commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

datadog-prod-us1-3 Bot left a comment

Choose a reason for hiding this comment

Uh oh!

AlexeyKuznetsov-DD left a comment

Choose a reason for hiding this comment

Uh oh!

bric3 commented Sep 3, 2026

Uh oh!

bric3 commented Sep 3, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 Bot commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

AlexeyKuznetsov-DD commented Sep 3, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 Bot commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔴 Blocking

🟠 Pending

Uh oh!

AlexeyKuznetsov-DD Sep 3, 2026

Choose a reason for hiding this comment

Uh oh!

bric3 Sep 3, 2026

Choose a reason for hiding this comment

Uh oh!

AlexeyKuznetsov-DD Sep 3, 2026

Choose a reason for hiding this comment

Uh oh!

bric3 Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

AlexeyKuznetsov-DD Sep 3, 2026

Choose a reason for hiding this comment

Uh oh!

bric3 commented Sep 4, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

bric3 commented Sep 3, 2026 •

edited

Loading

dd-octo-sts Bot commented Sep 3, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Sep 3, 2026 •

edited

Loading

gh-worker-devflow-routing-ef8351 Bot commented Sep 3, 2026 •

edited

Loading

gh-worker-devflow-routing-ef8351 Bot commented Sep 3, 2026 •

edited

Loading

gh-worker-devflow-routing-ef8351 Bot commented Sep 4, 2026 •

edited

Loading