ci: disable appsec_iast_propagation benchmarks (#15279)

.github/CODEOWNERS

@@ -41,12 +41,16 @@ ddtrace/internal/_file_queue.py     @DataDog/python-guild
 ddtrace/internal/_unpatched.py      @DataDog/python-guild
 ddtrace/internal/compat.py          @DataDog/python-guild  @DataDog/apm-core-python
 ddtrace/internal/endpoints.py       @DataDog/python-guild  @DataDog/asm-python
-ddtrace/settings/config.py          @DataDog/python-guild  @DataDog/apm-sdk-capabilities-python
+ddtrace/internal/settings/_config.py          @DataDog/python-guild  @DataDog/apm-sdk-capabilities-python
 docs/                               @DataDog/python-guild
 tests/utils.py                      @DataDog/python-guild
 tests/suitespec.yml                 @DataDog/python-guild  @DataDog/apm-core-python
+tests/contrib/suitespec.yml         @DataDog/python-guild
+tests/contrib/flask/app.py         @DataDog/python-guild
+tests/contrib/django/django1_app/urls.py @DataDog/python-guild
 tests/suitespec.py                  @DataDog/python-guild  @DataDog/apm-core-python
 scripts/bump_ddtrace.py             @DataDog/python-guild
+tests/smoke_test.py                 @DataDog/python-guild
 
 # Core / Language Platform
 tests/internal                      @DataDog/apm-core-python
@@ -95,7 +99,7 @@ tests/snapshots/test_selenium_*                       @DataDog/ci-app-libraries
 
 # Debugger
 ddtrace/debugging/                  @DataDog/debugger-python
-ddtrace/settings/dynamic_instrumentation.py     @DataDog/debugger-python
+ddtrace/internal/settings/dynamic_instrumentation.py     @DataDog/debugger-python
 ddtrace/internal/injection.py       @DataDog/debugger-python @DataDog/apm-core-python
 ddtrace/internal/wrapping.py        @DataDog/debugger-python @DataDog/apm-core-python
 ddtrace/internal/module.py          @DataDog/debugger-python @DataDog/apm-core-python
@@ -114,7 +118,7 @@ benchmarks/bm/iast_utils*           @DataDog/asm-python
 benchmarks/bm/iast_fixtures*        @DataDog/asm-python
 benchmarks/base/aspects_benchmarks_generate.py @DataDog/asm-python
 ddtrace/appsec/                     @DataDog/asm-python
-ddtrace/settings/asm.py             @DataDog/asm-python
+ddtrace/internal/settings/asm.py             @DataDog/asm-python
 ddtrace/contrib/internal/subprocess/         @DataDog/asm-python
 ddtrace/contrib/internal/flask_login/        @DataDog/asm-python
 ddtrace/contrib/internal/webbrowser          @DataDog/asm-python
@@ -125,13 +129,12 @@ ddtrace/internal/iast/              @DataDog/asm-python
 tests/appsec/                       @DataDog/asm-python
 tests/contrib/subprocess            @DataDog/asm-python
 tests/snapshots/tests*appsec*.json  @DataDog/asm-python
-tests/contrib/*/test*appsec*.py     @DataDog/asm-python
-tests/contrib/*/test*iast*.py  @DataDog/asm-python
 scripts/iast/*                      @DataDog/asm-python
 
+
 # Profiling
 ddtrace/profiling                   @DataDog/profiling-python
-ddtrace/settings/profiling.py       @DataDog/profiling-python
+ddtrace/internal/settings/profiling.py       @DataDog/profiling-python
 ddtrace/internal/datadog/profiling  @DataDog/profiling-python
 tests/profiling                     @DataDog/profiling-python
 tests/profiling_v2                  @DataDog/profiling-python
@@ -207,15 +210,15 @@ ddtrace/opentracer/                                @DataDog/apm-sdk-capabilities
 ddtrace/propagation/                               @DataDog/apm-sdk-capabilities-python
 ddtrace/openfeature/                              @DataDog/asm-python @DataDog/apm-core-python
 tests/openfeature/                                @DataDog/asm-python @DataDog/apm-core-python
-ddtrace/settings/_opentelemetry.py                 @DataDog/apm-sdk-capabilities-python
+ddtrace/internal/settings/_opentelemetry.py                 @DataDog/apm-sdk-capabilities-python
 
 ddtrace/internal/sampling.py                       @DataDog/apm-sdk-capabilities-python
 ddtrace/internal/tracemethods.py                   @DataDog/apm-sdk-capabilities-python
 ddtrace/internal/metrics.py                        @DataDog/apm-sdk-capabilities-python
 ddtrace/internal/rate_limiter.py                   @DataDog/apm-sdk-capabilities-python
 ddtrace/runtime/                                   @DataDog/apm-sdk-capabilities-python
 ddtrace/internal/runtime/                          @DataDog/apm-sdk-capabilities-python
-ddtrace/settings/_otel_remapper.py                 @DataDog/apm-sdk-capabilities-python
+ddtrace/internal/settings/_otel_remapper.py                 @DataDog/apm-sdk-capabilities-python
 tests/integration/test_priority_sampling.py        @DataDog/apm-sdk-capabilities-python
 tests/integration/test_propagation.py              @DataDog/apm-sdk-capabilities-python
 tests/runtime/                                     @DataDog/apm-sdk-capabilities-python
@@ -240,7 +243,7 @@ tests/contrib/azure_functions                               @DataDog/serverless
 tests/contrib/azure_functions_eventhubs                     @DataDog/serverless @DataDog/apm-serverless
 tests/contrib/azure_functions_servicebus                    @DataDog/serverless @DataDog/apm-serverless
 tests/contrib/azure_servicebus                              @DataDog/serverless @DataDog/apm-serverless
-tests/internal/test_serverless.py                           @DataDog/apm-core-python @DataDog/apm-serverless
+tests/internal/test_serverless.py                           @DataDog/apm-core-python @DataDog/apm-serverless @DataDog/asm-python
 tests/snapshots/tests.contrib.aws_lambda.*.                 @DataDog/apm-serverless
 tests/snapshots/tests.contrib.azure_eventhubs.*             @DataDog/serverless @DataDog/apm-serverless
 tests/snapshots/tests.contrib.azure_functions.*             @DataDog/serverless @DataDog/apm-serverless
@@ -251,3 +254,8 @@ tests/snapshots/tests.contrib.azure_servicebus.*            @DataDog/serverless
 # Data Streams Monitoring
 ddtrace/internal/datastreams        @DataDog/data-streams-monitoring
 tests/datastreams                   @DataDog/data-streams-monitoring
+
+# ASM (order matters)
+tests/**/*appsec*               @DataDog/asm-python
+tests/**/*iast*                 @DataDog/asm-python
+tests/tracer/test_propagation.py        @DataDog/apm-sdk-capabilities-python @DataDog/asm-python

.github/workflows/build_deploy.yml

@@ -69,8 +69,8 @@ jobs:
     needs: [ "compute_version" ]
     uses: ./.github/workflows/build_python_3.yml
     with:
-      cibw_build: 'cp38* cp39* cp310* cp311* cp312* cp313* cp314*'
-      cibw_skip: 'cp38-win_arm64 cp39-win_arm64 cp310-win_arm64 cp314t*'
+      cibw_build: 'cp39* cp310* cp311* cp312* cp313* cp314*'
+      cibw_skip: 'cp39-win_arm64 cp310-win_arm64 cp314t* *_i686'
       library_version: ${{ needs.compute_version.outputs.library_version }}
 
   build_sdist:
@@ -93,7 +93,8 @@ jobs:
       - name: Build sdist
         run: |
           pip install "setuptools_scm[toml]>=4" "cython" "cmake>=3.24.2,<3.28" "setuptools-rust"
-          python setup.py sdist
+          # Disable cython extensions to avoid compiling .pyx files
+          DD_CYTHONIZE=0 python setup.py sdist
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: source-dist
@@ -110,6 +111,17 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
+
+      - name: Enable sccache
+        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad  # 0.0.9
+
+      - name: Add addtional GHA cache-related env vars
+        uses: actions/github-script@v7
+        with:
+          script: |
+            core.exportVariable('ACTIONS_CACHE_URL', process.env['ACTIONS_CACHE_URL'])
+            core.exportVariable('ACTIONS_RUNTIME_URL', process.env['ACTIONS_RUNTIME_URL'])
+
       - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: source-dist
@@ -127,6 +139,10 @@ jobs:
       - name: Install source package
         env:
           CMAKE_BUILD_PARALLEL_LEVEL: 12
+          CARGO_BUILD_JOBS: 12
+          SCCACHE_GHA_ENABLED: true
+          SCCACHE_CACHE_SIZE: 1G
+          DD_USE_SCCACHE: 1
         run: pip install dist/*.tar.gz
 
       - name: Test the source package

.github/workflows/build_python_3.yml

@@ -83,52 +83,26 @@ jobs:
       fail-fast: false
       matrix:
         include: ${{ fromJson(needs.build-wheels-matrix.outputs.include) }}
-    env:
-      SETUPTOOLS_SCM_PRETEND_VERSION_FOR_DDTRACE: ${{ needs.compute_version.outputs.library_version }}
-      CIBW_SKIP: ${{ inputs.cibw_skip }}
-      CIBW_PRERELEASE_PYTHONS: ${{ inputs.cibw_prerelease_pythons }}
-      CIBW_MANYLINUX_X86_64_IMAGE: manylinux2014
-      CIBW_MANYLINUX_AARCH64_IMAGE: manylinux2014
-      CIBW_MUSLLINUX_I686_IMAGE: ghcr.io/datadog/dd-trace-py/pypa_musllinux_1_2_i686:latest
-      CIBW_BEFORE_ALL_WINDOWS: ${{ matrix.os == 'windows-latest' && 'rustup target add i686-pc-windows-msvc' || (matrix.os == 'windows-11-arm' && 'rustup target add aarch64-pc-windows-msvc') }}
-      CIBW_BEFORE_ALL_MACOS: rustup target add aarch64-apple-darwin
-      CIBW_BEFORE_ALL_LINUX: |
-        if [[ "$(uname -m)-$(uname -i)-$(uname -o | tr '[:upper:]' '[:lower:]')-$(ldd --version 2>&1 | head -n 1 | awk '{print $1}')" != "i686-unknown-linux-musl" ]]; then
-          curl -sSf https://sh.rustup.rs | sh -s -- -y;
-        fi
-      CIBW_ENVIRONMENT_LINUX: PATH=$HOME/.cargo/bin:$PATH CMAKE_BUILD_PARALLEL_LEVEL=24 CMAKE_ARGS="-DNATIVE_TESTING=OFF" SETUPTOOLS_SCM_PRETEND_VERSION_FOR_DDTRACE=${{ needs.compute_version.outputs.library_version }}
-      # SYSTEM_VERSION_COMPAT is a workaround for versioning issue, a.k.a.
-      # `platform.mac_ver()` reports incorrect MacOS version at 11.0
-      # See: https://stackoverflow.com/a/65402241
-      CIBW_ENVIRONMENT_MACOS: CMAKE_BUILD_PARALLEL_LEVEL=24 SYSTEM_VERSION_COMPAT=0 CMAKE_ARGS="-DNATIVE_TESTING=OFF" SETUPTOOLS_SCM_PRETEND_VERSION_FOR_DDTRACE=${{ needs.compute_version.outputs.library_version }}
-      CIBW_ENVIRONMENT_WINDOWS: SETUPTOOLS_SCM_PRETEND_VERSION_FOR_DDTRACE=${{ needs.compute_version.outputs.library_version }}
-      # cibuildwheel repair will copy anything's under /output directory from the
-      # build container to the host machine. This is a bit hacky way, but seems
-      # to be the only way getting debug symbols out from the container while
-      # we don't mess up with RECORD file.
-      CIBW_REPAIR_WHEEL_COMMAND_LINUX: |
-        mkdir -p /output/debugwheelhouse &&
-        python scripts/extract_debug_symbols.py {wheel} --output-dir /output/debugwheelhouse &&
-        python scripts/zip_filter.py {wheel} \*.c \*.cpp \*.cc \*.h \*.hpp \*.pyx \*.md &&
-        mkdir ./tempwheelhouse &&
-        unzip -l {wheel} | grep '\.so' &&
-        auditwheel repair -w ./tempwheelhouse {wheel} &&
-        mv ./tempwheelhouse/*.whl {dest_dir} &&
-        rm -rf ./tempwheelhouse
-      CIBW_REPAIR_WHEEL_COMMAND_MACOS: |
-        mkdir -p ./debugwheelhouse &&
-        python scripts/extract_debug_symbols.py {wheel} --output-dir ./debugwheelhouse &&
-        python scripts/zip_filter.py {wheel} \*.c \*.cpp \*.cc \*.h \*.hpp \*.pyx \*.md &&
-        MACOSX_DEPLOYMENT_TARGET=12.7 delocate-wheel --require-archs {delocate_archs} -w {dest_dir} -v {wheel}
-      CIBW_REPAIR_WHEEL_COMMAND_WINDOWS: python scripts/zip_filter.py "{wheel}" "*.c" "*.cpp" "*.cc" "*.h" "*.hpp" "*.pyx" "*.md" && mv "{wheel}" "{dest_dir}"
-      CIBW_TEST_COMMAND: "python {project}/tests/smoke_test.py"
-
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
           fetch-depth: 0
 
+      - name: Enable sccache
+        if: runner.os != 'Windows'
+        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad  # 0.0.9
+        with:
+          disable_annotations: true
+
+      - name: Add addtional GHA cache-related env vars
+        uses: actions/github-script@v7
+        if: runner.os != 'Windows'
+        with:
+          script: |
+            core.exportVariable('ACTIONS_CACHE_URL', process.env['ACTIONS_CACHE_URL'])
+            core.exportVariable('ACTIONS_RUNTIME_URL', process.env['ACTIONS_RUNTIME_URL'])
+
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         name: Install Python
         with:
@@ -144,7 +118,76 @@ jobs:
         uses: pypa/cibuildwheel@c923d83ad9c1bc00211c5041d0c3f73294ff88f6 # v3.1.4
         with:
           only: ${{ matrix.only }}
-
+        env:
+          SETUPTOOLS_SCM_PRETEND_VERSION_FOR_DDTRACE: ${{ needs.compute_version.outputs.library_version }}
+          CIBW_SKIP: ${{ inputs.cibw_skip }}
+          CIBW_PRERELEASE_PYTHONS: ${{ inputs.cibw_prerelease_pythons }}
+          CIBW_MANYLINUX_X86_64_IMAGE: manylinux2014
+          CIBW_MANYLINUX_AARCH64_IMAGE: manylinux2014
+          CIBW_MUSLLINUX_I686_IMAGE: ghcr.io/datadog/dd-trace-py/pypa_musllinux_1_2_i686:latest
+          CIBW_BEFORE_ALL_WINDOWS: ${{ matrix.os == 'windows-latest' && 'rustup target add i686-pc-windows-msvc' || (matrix.os == 'windows-11-arm' && 'rustup target add aarch64-pc-windows-msvc') }}
+          CIBW_BEFORE_ALL_MACOS: rustup target add aarch64-apple-darwin
+          CIBW_BEFORE_ALL_LINUX: |
+            if [[ "$(uname -m)-$(uname -i)-$(uname -o | tr '[:upper:]' '[:lower:]')-$(ldd --version 2>&1 | head -n 1 | awk '{print $1}')" != "i686-unknown-linux-musl" ]]; then
+              curl -sSf https://sh.rustup.rs | sh -s -- -y;
+            fi
+          CIBW_ENVIRONMENT_LINUX: >
+            PATH=$HOME/.cargo/bin:$PATH
+            CARGO_BUILD_JOBS=24
+            CMAKE_BUILD_PARALLEL_LEVEL=24
+            CMAKE_ARGS="-DNATIVE_TESTING=OFF"
+            SETUPTOOLS_SCM_PRETEND_VERSION_FOR_DDTRACE=${{ needs.compute_version.outputs.library_version }}
+            SCCACHE_GHA_ENABLED=true
+            SCCACHE_DIR=/host/${{ env.SCCACHE_DIR }}
+            SCCACHE_PATH=/host/${{ env.SCCACHE_PATH }}
+            SCCACHE_CACHE_SIZE=1G
+            ACTIONS_RUNTIME_TOKEN=${{ env.ACTIONS_RUNTIME_TOKEN }}
+            ACTIONS_RUNTIME_URL=${{ env.ACTIONS_RUNTIME_URL }}
+            ACTIONS_RESULTS_URL=${{ env.ACTIONS_RESULTS_URL }}
+            ACTIONS_CACHE_URL=${{ env.ACTIONS_CACHE_URL }}
+            ACTIONS_CACHE_SERVICE_V2=${{ env.ACTIONS_CACHE_SERVICE_V2 }}
+            DD_USE_SCCACHE=1
+          # SYSTEM_VERSION_COMPAT is a workaround for versioning issue, a.k.a.
+          # `platform.mac_ver()` reports incorrect MacOS version at 11.0
+          # See: https://stackoverflow.com/a/65402241
+          CIBW_ENVIRONMENT_MACOS: >
+            CMAKE_BUILD_PARALLEL_LEVEL=24
+            CARGO_BUILD_JOBS=24
+            SYSTEM_VERSION_COMPAT=0
+            CMAKE_ARGS="-DNATIVE_TESTING=OFF"
+            SETUPTOOLS_SCM_PRETEND_VERSION_FOR_DDTRACE=${{ needs.compute_version.outputs.library_version }}
+            SCCACHE_GHA_ENABLED=true
+            SCCACHE_CACHE_SIZE=1G
+            ACTIONS_RUNTIME_TOKEN=${{ env.ACTIONS_RUNTIME_TOKEN }}
+            ACTIONS_RUNTIME_URL=${{ env.ACTIONS_RUNTIME_URL }}
+            ACTIONS_RESULTS_URL=${{ env.ACTIONS_RESULTS_URL }}
+            ACTIONS_CACHE_URL=${{ env.ACTIONS_CACHE_URL }}
+            ACTIONS_CACHE_SERVICE_V2=${{ env.ACTIONS_CACHE_SERVICE_V2 }}
+            DD_USE_SCCACHE=1
+          CIBW_ENVIRONMENT_WINDOWS: >
+            SETUPTOOLS_SCM_PRETEND_VERSION_FOR_DDTRACE=${{ needs.compute_version.outputs.library_version }}
+          # cibuildwheel repair will copy anything's under /output directory from the
+          # build container to the host machine. This is a bit hacky way, but seems
+          # to be the only way getting debug symbols out from the container while
+          # we don't mess up with RECORD file.
+          CIBW_REPAIR_WHEEL_COMMAND_LINUX: |
+            mkdir -p /output/debugwheelhouse &&
+            python scripts/extract_debug_symbols.py {wheel} --output-dir /output/debugwheelhouse &&
+            python scripts/zip_filter.py {wheel} \*.c \*.cpp \*.cc \*.h \*.hpp \*.pyx \*.md &&
+            mkdir ./tempwheelhouse &&
+            unzip -l {wheel} | grep '\.so' &&
+            auditwheel repair -w ./tempwheelhouse {wheel} &&
+            mv ./tempwheelhouse/*.whl {dest_dir} &&
+            rm -rf ./tempwheelhouse
+          CIBW_REPAIR_WHEEL_COMMAND_MACOS: |
+            mkdir -p ./debugwheelhouse &&
+            python scripts/extract_debug_symbols.py {wheel} --output-dir ./debugwheelhouse &&
+            python scripts/zip_filter.py {wheel} \*.c \*.cpp \*.cc \*.h \*.hpp \*.pyx \*.md &&
+            MACOSX_DEPLOYMENT_TARGET=12.7 delocate-wheel --require-archs {delocate_archs} -w {dest_dir} -v {wheel}
+          CIBW_REPAIR_WHEEL_COMMAND_WINDOWS: python scripts/zip_filter.py "{wheel}" "*.c" "*.cpp" "*.cc" "*.h" "*.hpp" "*.pyx" "*.md" && mv "{wheel}" "{dest_dir}"
+          CIBW_BEFORE_TEST_LINUX: /host/${{ env.SCCACHE_PATH }} --show-stats
+          CIBW_BEFORE_TEST_MACOS: ${{ env.SCCACHE_PATH }} --show-stats
+          CIBW_TEST_COMMAND: "python {project}/tests/smoke_test.py"
       - name: Validate wheel RECORD files
         shell: bash
         run: |

.github/workflows/django-overhead-profile.yml

@@ -13,18 +13,10 @@ on:
 jobs:
   django-overhead-profile:
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        include:
-          - suffix: "-v1"
-            stack_v2: "0"
-          - suffix: "-v2"
-            stack_v2: "1"
     env:
       PREFIX: ${{ github.workspace }}/prefix
       DD_CODE_ORIGIN_FOR_SPANS_ENABLED: "1"
       DD_PROFILING_ENABLED: "1"
-      DD_PROFILING_STACK_V2_ENABLED: ${{ matrix.stack_v2 }}
       DD_PROFILING_OUTPUT_PPROF: ${{ github.workspace }}/prefix/artifacts/ddtrace_profile
       DD_EXCEPTION_REPLAY_ENABLED: "1"
     defaults:
@@ -50,5 +42,5 @@ jobs:
 
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: django-overhead-profile${{ matrix.suffix }}
+          name: django-overhead-profile
           path: ${{ github.workspace }}/prefix/artifacts

.github/workflows/system-tests.yml

@@ -45,7 +45,7 @@ jobs:
           persist-credentials: false
           repository: 'DataDog/system-tests'
           # Automatically managed, use scripts/update-system-tests-version to update
-          ref: '38b9edcd63a1158f1a51e0430770052341b9cfdb'
+          ref: '6d02d86d456377cca26e10adb80249d0ee5108fb'
 
       - name: Download wheels to binaries directory
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
@@ -90,7 +90,7 @@ jobs:
           persist-credentials: false
           repository: 'DataDog/system-tests'
           # Automatically managed, use scripts/update-system-tests-version to update
-          ref: '38b9edcd63a1158f1a51e0430770052341b9cfdb'
+          ref: '6d02d86d456377cca26e10adb80249d0ee5108fb'
 
       - name: Build runner
         uses: ./.github/actions/install_runner
@@ -275,7 +275,7 @@ jobs:
           persist-credentials: false
           repository: 'DataDog/system-tests'
           # Automatically managed, use scripts/update-system-tests-version to update
-          ref: '38b9edcd63a1158f1a51e0430770052341b9cfdb'
+          ref: '6d02d86d456377cca26e10adb80249d0ee5108fb'
       - name: Download wheels to binaries directory
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:

.github/workflows/unit_tests.yml

@@ -16,7 +16,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
         # Keep this in sync with hatch.toml
-        python-version: ["3.8", "3.10", "3.12", "3.14"]
+        python-version: ["3.10", "3.12", "3.14"]
 
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

.gitlab-ci.yml

@@ -14,7 +14,7 @@ variables:
   DD_VPA_TEMPLATE: "vpa-template-cpu-p70-10percent-2x-oom-min-cap"
   # CI_DEBUG_SERVICES: "true"
   # Automatically managed, use scripts/update-system-tests-version to update
-  SYSTEM_TESTS_REF: "38b9edcd63a1158f1a51e0430770052341b9cfdb"
+  SYSTEM_TESTS_REF: "6d02d86d456377cca26e10adb80249d0ee5108fb"
 
 default:
   interruptible: true