[mhdatie]

What Does This Do

Makes TracerVersionPlugin detect release branches when the repository is checked out as a detached HEAD, as GitLab does for every pipeline.

git rev-parse --abbrev-ref HEAD returns HEAD on a detached checkout. When that happens, the plugin now uses GitLab's CI_COMMIT_BRANCH as the branch name. Local builds on a named branch are unchanged.

Two integration tests are added:

• should increment patch on release branch checked out as detached HEAD in GitLab: detached on release/v1.52.x past v1.52.1 with CI_COMMIT_BRANCH set, expects 1.52.2-SNAPSHOT. Without the fix it gets 1.53.0-SNAPSHOT.
• should use exact version on tag checked out as detached HEAD in GitLab: tag pipelines are detached and only set CI_COMMIT_TAG, expects the exact tag version 1.52.1.

Motivation

Release branch pipelines produce artifacts with the next minor version instead of the next patch. With a detached HEAD, the release/v check fails, so the plugin runs git describe without --first-parent and calls nextMinorVersion().

The existing release branch tests use git switch -c release/v1.52.x and never detach, so they don't cover the CI case.

Reproducing with recent S3 uploads

publish-artifacts-to-s3 uploads each pipeline's jar to the public dd-trace-java-builds bucket. The embedded version shows the bug without running the jar:

curl -sSfO https://s3.us-east-1.amazonaws.com/dd-trace-java-builds/145172115/dd-java-agent.jar
unzip -p dd-java-agent.jar dd-java-agent.version
unzip -p dd-java-agent.jar META-INF/MANIFEST.MF | grep Implementation-Version

S3 path	git describe --first-parent	Embedded version	Expected
145172115/ (release/v1.67.x, Oct 16 2026)	v1.67.1-3-g6c1e5f9089	1.68.0-SNAPSHOT~6c1e5f9089	1.67.2-SNAPSHOT
release/v1.67.x/ (latest for branch)	v1.67.1-3-g6c1e5f9089	1.68.0-SNAPSHOT~6c1e5f9089	1.67.2-SNAPSHOT
release/v1.66.x/ (Sep 8 2026)	v1.66.0-1-g9751b1d447	1.67.0-SNAPSHOT~9751b1d447	1.66.1-SNAPSHOT

Other ways to reproduce

• GitLab job trace: in the build job of a release branch pipeline (e.g. 145172115), the Gradle output shows Tracer build version: 1.68.0-SNAPSHOT. The Incrementing minor / Incrementing patch… lines are logger.info and only print with --info.
• Locally, detached HEAD:

  git checkout --detach origin/release/v1.67.x
  ./gradlew help --info | grep -E "Incrementing|Tracer build version"
  # Incrementing minor
  # Tracer build version: 1.68.0-SNAPSHOT
  CI_COMMIT_BRANCH=release/v1.67.x ./gradlew help --info | grep -E "Incrementing|Tracer build version"
  # with this PR: Incrementing patch because release branch : release/v1.67.x / 1.67.2-SNAPSHOT

• Integration test: revert the plugin change and run the new detached HEAD test. It fails with expected: "1.52.2-SNAPSHOT" but was: "1.53.0-SNAPSHOT".

Additional Notes

• buildSrc tests are disabled unless -PrunBuildSrcTests is set (or run from IntelliJ). Without it, :test is SKIPPED and the build still reports success. To run:

  cd buildSrc && ../gradlew :test -PrunBuildSrcTests --tests 'datadog.gradle.plugin.version.TracerVersionIntegrationTest'

  All 15 tests pass locally.
• The new tests use unsetEnv because buildSrc tests also run in GitLab, where the real CI_COMMIT_BRANCH would otherwise leak into them.
• Build-only change. No effect on the tracer at runtime.

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
  Use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Update public documentation with any new configuration flags or behaviors
• Once approved, use merge queue to merge the PR

Jira ticket: APMLP-2109

🤖 Generated with Claude Code

[mhdatie]

It would be nice to have this for next release due next week, otherwise I can cherry pick this into either the existing 67.x release branch or the upcoming 68.x after its release to verify what gets uploaded to S3 from the build job.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T19:43:10.877143Z	f3051d1	Manual request
🔒 Security Review	✅ Completed 2026-10-23T19:46:02.751216Z	f3051d1	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mhdatie]

@codex review

[dougqh]

Approving. It's a small, correct fix for a real bug, and the S3 table plus the unzip -p … dd-java-agent.version commands make it easy to verify.

What I checked:

• The fallback only applies when git rev-parse --abbrev-ref HEAD returns HEAD and CI_COMMIT_BRANCH is non-blank. The same branch value drives both --first-parent and the patch-vs-minor choice, and named-branch builds are unchanged.
• Each pipeline type still behaves: tag pipelines are exact (HEAD is on the tag), MR pipelines fall back to the next minor as before, and GitHub merge-queue pipelines are skipped in .gitlab-ci.yml.
• providerFactory.environmentVariable is a tracked configuration-cache input.
• No existing test detaches HEAD, so CI's real CI_COMMIT_BRANCH can't flip any of them on a release/v* pipeline.
• Scope: released artifacts come from tag pipelines and were already correct. The affected builds are release-branch snapshots, which support hands to customers to verify fixes and which reported a future version to telemetry. tag: no release notes fits.

Two non-blocking suggestions inline.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: f3051d1ad6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: f3051d1ad6

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[datadog-datadog-prod-us1]

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 59.98% (-0.01%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 60ab6cd | Docs | Give us feedback!}

[datadog-datadog-prod-us1]

More details

The GitLab branch fallback supplies the release branch to both first-parent tag lookup and patch-version selection, correcting detached-checkout snapshot versions while preserving named-branch and exact-tag behavior.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit f3051d1}

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	13.99 s	13.95 s	[-0.4%; +1.0%] (no difference)
startup:insecure-bank:tracing:Agent	12.87 s	13.01 s	[-1.7%; -0.4%] (maybe better)
startup:petclinic:appsec:Agent	17.18 s	17.03 s	[+0.1%; +1.7%] (maybe worse)
startup:petclinic:iast:Agent	17.06 s	17.01 s	[-0.5%; +1.1%] (no difference)
startup:petclinic:profiling:Agent	16.66 s	17.04 s	[-3.6%; -0.9%] (maybe better)
startup:petclinic:sca:Agent	16.56 s	16.77 s	[-5.8%; +3.3%] (no difference)
startup:petclinic:tracing:Agent	15.72 s	16.10 s	[-6.5%; +1.9%] (no difference)

Commit: 60ab6cd9 · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[dd-octo-sts]

/merge

[gh-worker-devflow-routing-ef8351]

View all feedbacks in Devflow UI.

2026-10-26 18:19:48 UTC ℹ️ Start processing command /merge

---

2026-10-26 18:19:52 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 1h (p90).

---

2026-10-26 19:47:18 UTC ℹ️ MergeQueue: This merge request was merged