Make dd-trace-java.muzzle reports additional JVM data in test task inputs

[bric3]

What Does This Do

Improve the muzzle directive using coreJdk(version) fingerprinting in Gradle. This API takes either a JDK version or the Gradle daemon JVM if no version is specified coreJdk(). Now this tracks the actual Java major version, vendor and full runtime/VM versions, while previous it only recored the major version if any.

muzzle {
  pass {
    coreJdk("25")
  }
}

To be more precise, the directive above creates a muzzle-AssertPass-core-jdk task, running in a worker on the selected JDK 25. It expects the instrumentation's Muzzle checks to succeed with that JDK's platform classes available. With this change, a different JDK vendor or patch/build invalidates the cached result, if the actual JDK install remains the same the result can be reused.

Motivation

A JDK patch/build or vendor change should invalidate cached core-JDK checks, even when the requested Java major version stays the same.

Related to the S3 build cache in #12604.

Additional Notes

Use reported JVM metadata, without hashing JDK binaries.

Verified with Gradle on JDK 21: switching coreJdk("25") from Corretto 25.0.3 to 25.0.4 changes the cache key and runs the check on the selected JDK.

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
  Use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Update public documentation with any new configuration flags or behaviors
• Once approved, use merge queue to merge the PR

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	14.81 s	14.71 s	[-0.1%; +1.5%] (no difference)
startup:insecure-bank:tracing:Agent	13.60 s	13.73 s	[-1.6%; -0.2%] (maybe better)
startup:petclinic:appsec:Agent	17.70 s	17.51 s	[+0.3%; +1.9%] (maybe worse)
startup:petclinic:iast:Agent	17.32 s	17.60 s	[-2.5%; -0.7%] (maybe better)
startup:petclinic:profiling:Agent	17.57 s	17.38 s	[-0.1%; +2.3%] (no difference)
startup:petclinic:sca:Agent	17.67 s	17.47 s	[+0.3%; +2.0%] (maybe worse)
startup:petclinic:tracing:Agent	16.23 s	16.58 s	[-6.6%; +2.3%] (no difference)

Commit: 0c935616 · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-24T16:21:20.690427Z	aa5d804	Draft marked ready
🔒 Security Review	✅ Completed 2026-09-24T16:18:06.364799Z	aa5d804	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: aa5d8047e8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[datadog-datadog-prod-us1-2]

More details

The selected Java launcher supplies both the cache identity and the worker executable. Daemon JVM identity applies only to core-JDK checks.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit aa5d804 · @DataDog review to ask questions}

[sarahchen6]

LGTM

[bric3]

/merge

[gh-worker-devflow-routing-ef8351]

View all feedbacks in Devflow UI.

2026-09-25 09:44:45 UTC ℹ️ Start processing command /merge

---

2026-09-25 09:44:50 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 1h (p90).

---

2026-09-25 10:58:34 UTC ℹ️ MergeQueue: This merge request was merged