Merge branch 'master' into alexeyk/update-spotless-8.9.0

Author: AlexeyKuznetsov-DD

.github/workflows/README.md

@@ -34,6 +34,7 @@ _Trigger:_ When creating or updating a pull request, or when new commits are pus
 
 _Actions:_
 
+* Clean up the tool labels (`Bits AI`, `campaigner-automated-change`) by removing them from both the pull request and the repository.
 * Detect AI-generated pull requests then apply the `tag: ai generated` label.
 * Check the pull request did not introduce unexpected labels.
 

.github/workflows/check-pull-request-labels.yaml

@@ -22,8 +22,8 @@ jobs:
         with:
           scope: DataDog/dd-trace-java
           policy: self.check-pull-request-labels
-      - name: Flag AI-generated pull requests
-        id: flag_ai_generated
+      - name: Clean up tool labels
+        id: clean_up_labels
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # 9.0.0
         with:
           github-token: ${{ steps.generate-token.outputs.token }}
@@ -35,101 +35,102 @@ jobs:
             const prNumber = context.payload.pull_request.number
             const owner = context.repo.owner
             const repo = context.repo.repo
-            const aiGeneratedLabel = 'tag: ai generated'
-            let isAiGenerated = false
-            let labelsStale = false
-
-            /*
-             * Check for 'Bits AI' label and remove it.
-             */
-            const bitsAiLabel = 'Bits AI'
+            // Labels applied by external tooling that are never allowed on a pull request
+            const toolLabels = [
+              'Bits AI',                    // Applied by the Bits AI tooling
+              'campaigner-automated-change' // Applied by the Campaigner tooling
+            ]
             const prLabels = context.payload.pull_request.labels.map(l => l.name)
-            if (prLabels.includes(bitsAiLabel)) {
-              isAiGenerated = true
+            const cleanedLabels = toolLabels.filter(label => prLabels.includes(label))
+            for (const label of cleanedLabels) {
               // Remove label from the PR
               try {
                 await github.rest.issues.removeLabel({
                   owner, repo,
                   issue_number: prNumber,
-                  name: bitsAiLabel
+                  name: label
                 })
               } catch (e) {
-                core.warning(`Could not remove '${bitsAiLabel}' label from PR: ${e.message}`)
+                core.warning(`Could not remove '${label}' label from PR: ${e.message}`)
               }
-              labelsStale = true
-              // Delete label from the repository
+              // Delete label from the repository as the tooling applying it also recreates it
               try {
-                await github.rest.issues.deleteLabel({ owner, repo, name: bitsAiLabel })
+                await github.rest.issues.deleteLabel({ owner, repo, name: label })
               } catch (e) {
-                core.warning(`Could not delete '${bitsAiLabel}' label from repo: ${e.message}`)
+                core.warning(`Could not delete '${label}' label from repo: ${e.message}`)
               }
             }
+            core.setOutput('cleaned_labels', JSON.stringify(cleanedLabels))
 
-            /*
-             * Inspect commits for AI authorship signals.
-             */
+      - name: Flag AI-generated pull requests
+        id: flag_ai_generated
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # 9.0.0
+        env:
+          CLEANED_LABELS: ${{ steps.clean_up_labels.outputs.cleaned_labels }}
+        with:
+          github-token: ${{ steps.generate-token.outputs.token }}
+          script: |
+            // Skip draft pull requests
+            if (context.payload.pull_request.draft) {
+              return
+            }
+            const prNumber = context.payload.pull_request.number
+            const owner = context.repo.owner
+            const repo = context.repo.repo
+            // Skip if the PR is already labeled as AI-generated
+            const aiGeneratedLabel = 'tag: ai generated'
             if (context.payload.pull_request.labels.some(l => l.name === aiGeneratedLabel)) {
               core.info(`PR #${prNumber} is already labeled as AI-generated, skipping commit scan.`)
-              core.setOutput('labels_stale', String(labelsStale))
               return
             }
-            const aiRegex = /\b(anthropic|chatgpt|codex|copilot|cursor|openai)\b/i
-            const commits = await github.paginate(github.rest.pulls.listCommits, {
-              owner, repo,
-              pull_number: prNumber,
-              per_page: 100
-            })
-            for (const { commit } of commits) {
-              const authorName = commit.author?.name ?? ''
-              const authorEmail = commit.author?.email ?? ''
-              const committerName = commit.committer?.name ?? ''
-              const committerEmail = commit.committer?.email ?? ''
-              // Extract Co-authored-by trailer lines from commit message
-              const coAuthors = (commit.message ?? '').split('\n')
-                .filter(line => /^co-authored-by:/i.test(line.trim()))
-              const fieldsToCheck = [authorName, authorEmail]
-              // Skip GitHub's generic noreply for committer
-              if (committerEmail !== 'noreply@github.com') {
-                fieldsToCheck.push(committerName, committerEmail)
-              }
-              fieldsToCheck.push(...coAuthors)
-              if (fieldsToCheck.some(field => aiRegex.test(field))) {
-                isAiGenerated = true
-                break
+            // The cleaned up 'Bits AI' label flags an AI-generated pull request
+            let isAiGenerated = JSON.parse(process.env.CLEANED_LABELS || '[]').includes('Bits AI')
+            // Inspect commits for AI authorship signals
+            if (!isAiGenerated) {
+              const aiRegex = /\b(anthropic|chatgpt|codex|copilot|cursor|openai)\b/i
+              const commits = await github.paginate(github.rest.pulls.listCommits, {
+                owner, repo,
+                pull_number: prNumber,
+                per_page: 100
+              })
+              for (const { commit } of commits) {
+                const authorName = commit.author?.name ?? ''
+                const authorEmail = commit.author?.email ?? ''
+                const committerName = commit.committer?.name ?? ''
+                const committerEmail = commit.committer?.email ?? ''
+                // Extract Co-authored-by trailer lines from commit message
+                const coAuthors = (commit.message ?? '').split('\n')
+                  .filter(line => /^co-authored-by:/i.test(line.trim()))
+                const fieldsToCheck = [authorName, authorEmail]
+                // Skip GitHub's generic noreply for committer
+                if (committerEmail !== 'noreply@github.com') {
+                  fieldsToCheck.push(committerName, committerEmail)
+                }
+                fieldsToCheck.push(...coAuthors)
+                if (fieldsToCheck.some(field => aiRegex.test(field))) {
+                  isAiGenerated = true
+                  break
+                }
               }
             }
-
-            /*
-             * Add 'tag: ai generated' label if AI-generated.
-             */
+            // Add 'tag: ai generated' label if AI-generated
             if (isAiGenerated) {
-              // Re-fetch labels only if they were modified above (Bits AI removal)
-              let currentLabels
-              if (labelsStale) {
-                const { data: currentPr } = await github.rest.pulls.get({ owner, repo, pull_number: prNumber })
-                currentLabels = currentPr.labels.map(l => l.name)
-              } else {
-                currentLabels = context.payload.pull_request.labels.map(l => l.name)
-              }
-              if (!currentLabels.includes(aiGeneratedLabel)) {
-                try {
-                  await github.rest.issues.addLabels({
-                    owner, repo,
-                    issue_number: prNumber,
-                    labels: [aiGeneratedLabel]
-                  })
-                  core.info(`Added '${aiGeneratedLabel}' label to PR #${prNumber}`)
-                } catch (e) {
-                  core.setFailed(`Could not add '${aiGeneratedLabel}' label to PR #${prNumber}: ${e.message}`)
-                }
+              try {
+                await github.rest.issues.addLabels({
+                  owner, repo,
+                  issue_number: prNumber,
+                  labels: [aiGeneratedLabel]
+                })
+                core.info(`Added '${aiGeneratedLabel}' label to PR #${prNumber}`)
+              } catch (e) {
+                core.setFailed(`Could not add '${aiGeneratedLabel}' label to PR #${prNumber}: ${e.message}`)
               }
             }
-            core.setOutput('labels_stale', String(labelsStale))
 
       - name: Check pull request labels
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # 9.0.0
         env:
-          LABELS_STALE: ${{ steps.flag_ai_generated.outputs.labels_stale }}
+          CLEANED_LABELS: ${{ steps.clean_up_labels.outputs.cleaned_labels }}
         with:
           github-token: ${{ steps.generate-token.outputs.token }}
           script: |
@@ -143,19 +144,12 @@ jobs:
               'comp:',
               'inst:',
               'tag:',
-              'mergequeue-status:',
-              'team:',
               'performance:',  // To refactor to 'ci: ' in the future
               'run-tests:'     // Unused since GitLab migration
             ]
-            // Exact-match labels that don't fit a category prefix (e.g. labels applied
-            // by external automation tooling).
-            const exactAllowlist = [
-              'campaigner-automated-change'
-            ]
-            // Re-fetch labels only if the previous step modified them (ex: "Bits AI" removal)
+            // Re-fetch labels only if the clean up step removed some of them
             let prLabels
-            if (process.env.LABELS_STALE === 'true') {
+            if (JSON.parse(process.env.CLEANED_LABELS || '[]').length > 0) {
               const { data: currentPr } = await github.rest.pulls.get({
                 owner: context.repo.owner,
                 repo: context.repo.repo,
@@ -168,10 +162,7 @@ jobs:
             // Look for invalid labels
             const invalidLabels = prLabels
               .map(label => label.name)
-              .filter(label =>
-                !exactAllowlist.includes(label) &&
-                validCategories.every(prefix => !label.startsWith(prefix))
-              )
+              .filter(label => validCategories.every(prefix => !label.startsWith(prefix)))
             const hasInvalidLabels = invalidLabels.length > 0
             // Get existing comments to check for blocking comment
             const comments = await github.rest.issues.listComments({

dd-java-agent/agent-debugger/src/main/java/com/datadog/debugger/probe/LogProbe.java

@@ -725,7 +725,7 @@ private void addFilteredCaptureExpressions(
   }
 
   private void processCaptureExpressions(CapturedContext context, LogStatus logStatus) {
-    if (captureExpressions == null) {
+    if (captureExpressions == null || !logStatus.shouldSend()) {
       return;
     }
     for (CaptureExpression captureExpression : captureExpressions) {

dd-java-agent/agent-debugger/src/test/java/com/datadog/debugger/agent/CapturedSnapshotTest.java

@@ -3020,6 +3020,31 @@ public void captureExpressionsWithNullCondition() throws IOException, URISyntaxE
     assertEquals("Cannot dereference field: fld", evaluationErrors.get(0).getMessage());
   }
 
+  @Test
+  public void captureExpressionsWithRejectingCondition() throws IOException, URISyntaxException {
+    final String CLASS_NAME = "CapturedSnapshot08";
+    LogProbe probe =
+        createProbeBuilder(PROBE_ID, CLASS_NAME, "doit", null)
+            .evaluateAt(MethodLocation.EXIT)
+            .captureSnapshot(false)
+            .when(new ProbeCondition(DSL.when(DSL.eq(DSL.value(1), DSL.value(2))), "1 == 2"))
+            .template("plain log", Collections.emptyList())
+            .captureExpressions(
+                Collections.singletonList(
+                    new LogProbe.CaptureExpression(
+                        "unknown_symbol",
+                        new ValueScript(ref("doesNotExist"), "doesNotExist"),
+                        null)))
+            .build();
+    TestSnapshotListener listener = installProbes(probe);
+    Class<?> testClass = compileAndLoadClass(CLASS_NAME);
+    for (int i = 0; i < 5; i++) {
+      int result = Reflect.onClass(testClass).call("main", "1").get();
+      assertEquals(3, result);
+    }
+    assertEquals(0, listener.snapshots.size());
+  }
+
   @Test
   public void captureExpressionsPrimitives() throws IOException, URISyntaxException {
     final String CLASS_NAME = "CapturedSnapshot08";

dd-java-agent/agent-debugger/src/test/java/com/datadog/debugger/probe/LogProbeTest.java

@@ -5,12 +5,16 @@
 import static java.lang.String.format;
 import static java.lang.Thread.currentThread;
 import static java.util.Collections.emptyList;
+import static java.util.Collections.singletonList;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.Mockito.mock;
 
 import com.datadog.debugger.agent.DebuggerAgentHelper;
+import com.datadog.debugger.el.DSL;
+import com.datadog.debugger.el.ProbeCondition;
+import com.datadog.debugger.el.ValueScript;
 import com.datadog.debugger.probe.LogProbe.Builder;
 import com.datadog.debugger.probe.LogProbe.LogStatus;
 import com.datadog.debugger.sink.DebuggerSink;
@@ -19,6 +23,7 @@
 import datadog.context.ContextScope;
 import datadog.trace.api.Config;
 import datadog.trace.api.IdGenerationStrategy;
+import datadog.trace.api.sampling.ConstantSampler;
 import datadog.trace.bootstrap.debugger.CapturedContext;
 import datadog.trace.bootstrap.debugger.EvaluationError;
 import datadog.trace.bootstrap.debugger.MethodLocation;
@@ -342,6 +347,49 @@ public void fillSnapshot_shouldSend_evalErrors() {
         "errorExit", snapshot.getCaptures().getReturn().getCapturedThrowable().getMessage());
   }
 
+  @Test
+  public void captureExpressionsInActiveDebugSession() {
+    DebuggerAgentHelper.injectSink(new DebuggerSink(getConfig(), mock(ProbeStatusSink.class)));
+    TracerAPI tracer =
+        CoreTracer.builder().idGenerationStrategy(IdGenerationStrategy.fromName("random")).build();
+    AgentTracer.registerIfAbsent(tracer);
+    AgentSpan span = tracer.startSpan("log probe capture expression testing", "test span");
+    try (ContextScope scope = tracer.activateManualSpan(span)) {
+      span.setTag(Tags.PROPAGATED_DEBUG, DEBUG_SESSION_ID + ":1");
+      // the probe sampler always rejects: the active session decision must still win
+      ProbeRateLimiter.setSamplerSupplier(rate -> new ConstantSampler(false));
+      LogProbe logProbe =
+          createLog("log line")
+              .probeId(ProbeId.newId())
+              .evaluateAt(MethodLocation.EXIT)
+              .tags(format("session_id:%s", DEBUG_SESSION_ID))
+              .when(new ProbeCondition(DSL.when(DSL.eq(DSL.value(1), DSL.value(1))), "1 == 1"))
+              .captureExpressions(
+                  singletonList(
+                      new LogProbe.CaptureExpression(
+                          "greeting", new ValueScript(DSL.value("hello"), "'hello'"), null)))
+              .build();
+      logProbe.initSamplers();
+      CapturedContext entryContext = capturedContext(span, logProbe);
+      CapturedContext exitContext = capturedContext(span, logProbe);
+      logProbe.evaluate(entryContext, new LogStatus(logProbe), MethodLocation.ENTRY, false);
+      logProbe.evaluate(exitContext, new LogStatus(logProbe), MethodLocation.EXIT, false);
+      Snapshot snapshot = new Snapshot(currentThread(), logProbe, 3);
+      assertTrue(logProbe.fillSnapshot(entryContext, exitContext, emptyList(), snapshot));
+      assertEquals(
+          "hello",
+          snapshot
+              .getCaptures()
+              .getReturn()
+              .getCaptureExpressions()
+              .get("greeting")
+              .getValue()
+              .toString());
+    } finally {
+      ProbeRateLimiter.setSamplerSupplier(null);
+    }
+  }
+
   private Builder createLog(String template) {
     return LogProbe.builder()
         .language(LANGUAGE)

dd-smoke-tests/springboot-tomcat/build.gradle

@@ -9,7 +9,7 @@ description = 'SpringBoot Tomcat Smoke Tests.'
 
 def serverName = 'tomcat'
 def serverModule = 'tomcat-9'
-def serverVersion = '9.0.117'
+def serverVersion = '9.0.120'
 def serverExtension = 'zip'
 
 repositories {

dd-smoke-tests/springboot-tomcat/gradle.lockfile

@@ -115,5 +115,5 @@ org.spockframework:spock-core:2.4-groovy-3.0=testCompileClasspath,testRuntimeCla
 org.tabletest:tabletest-junit:1.2.2=testCompileClasspath,testRuntimeClasspath
 org.tabletest:tabletest-parser:1.2.1=testCompileClasspath,testRuntimeClasspath
 org.xmlresolver:xmlresolver:5.3.3=spotbugs
-tomcat:tomcat-9:9.0.117=serverFile
+tomcat:tomcat-9:9.0.120=serverFile
 empty=annotationProcessor,runtimeClasspath,spotbugsPlugins,testAnnotationProcessor