v6.13.0 proposal

.agents/skills/flaky-test-fixer/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: flaky-test-fixer
+description: >-
+  Use when triaging, investigating, or fixing a suspected flaky test, intermittent
+  failure, nondeterministic CI failure, timing race, or test-order dependency in
+  dd-trace-js. Classifies infrastructure and deterministic failures before the
+  root-cause workflow.
+---
+
+# Flaky test fixer
+
+## Classify once
+
+Spend one evidence pass on the failing step, the first actionable error, and whether the test process started. Do
+not reproduce or search test code before this gate.
+
+- **Infrastructure:** the test process never ran because checkout, runner, registry, network, or credentials failed,
+  or independent evidence proves an externally owned network or service outage regardless of test-entry timing. State
+  the evidence and stop; ignore it for flaky-test work. Treat recurrence as a separate CI task only when asked.
+- **Deterministic:** the same revision and inputs consistently fail because of a version, fixture, configuration, or
+  assertion mismatch. It is not a flake; handle it in the owning change.
+- **Genuine flake:** the same test can pass and fail at the same revision with matching relevant inputs and execution
+  configuration, or evidence proves nondeterministic ordering, timing, or shared state. A green rerun is evidence only
+  when the test ran under those matching conditions in both attempts.
+- **Unknown:** evidence proves none of the above. Run one targeted reproduction or history comparison; do not promote
+  uncertainty to “flaky,” “infrastructure,” or “unrelated.”
+
+## Fix the cause
+
+1. Reproduce through the smallest real test entry point. Stress the suspected boundary and expose ordering or state;
+  repeated reruns without a sharper hypothesis are not diagnosis. For a hang, inspect the last error before the
+  leaked handle kept the process alive.
+2. Write one mechanistic sentence naming the producer, consumer, state or event, and invalid ordering or lifetime.
+  It must explain both the pass and failure. Do not design a fix before this sentence holds.
+3. Before editing, search the repository for every test with the same violated invariant and lifecycle owner.
+  Inventory, count, and list each member and exclusion; state the shared failure mechanism and lifecycle or
+  completion owner. A range is not an enumeration. Callback versus promise does not split a cohort; similar syntax
+  under a different contract does not join it.
+4. Design the proof, then trace success, error, retry, cleanup, and concurrent paths. Fix the narrowest canonical
+  owner that restores the invariant for the whole cohort without a new public/test-only surface or production work
+  added solely for tests.
+5. Apply that fix to the complete cohort. Do not substitute retries, skips, sleeps, timeout/tolerance increases,
+  filtered assertions, or broader mocks for a cause. Keep unrelated mechanisms in separate changes.
+6. Verify the original failure without the fix or with a deterministic regression when practical. List every changed
+  sibling individually in the verification plan, then run them, a targeted repeat or stress run, the complete specs,
+  and the required coverage/lint from `AGENTS.md`. Report commands, iteration counts, and unproved claims.

.github/CODEOWNERS

@@ -62,6 +62,8 @@
 /packages/dd-trace/src/lambda/ @DataDog/dd-trace-js @DataDog/serverless-aws @DataDog/apm-serverless
 /packages/dd-trace/src/azure_metadata.js @DataDog/dd-trace-js @DataDog/apm-serverless
 /packages/dd-trace/src/serverless.js @DataDog/dd-trace-js @DataDog/apm-serverless
+/packages/dd-trace/src/serverless/ @DataDog/dd-trace-js @DataDog/apm-serverless
+/packages/dd-trace/src/flush.js @DataDog/dd-trace-js @DataDog/apm-serverless @DataDog/apm-sdk-capabilities-js
 /packages/dd-trace/test/lambda/ @DataDog/dd-trace-js @DataDog/serverless-aws @DataDog/apm-serverless
 /packages/dd-trace/test/azure_metadata.spec.js @DataDog/dd-trace-js @DataDog/apm-serverless
 /packages/dd-trace/test/serverless.spec.js @DataDog/dd-trace-js @DataDog/apm-serverless
@@ -131,6 +133,7 @@
 /packages/datadog-plugin-cypress/ @DataDog/dd-trace-js @DataDog/ci-app-libraries
 /packages/datadog-plugin-playwright/ @DataDog/dd-trace-js @DataDog/ci-app-libraries
 /packages/datadog-plugin-vitest/ @DataDog/dd-trace-js @DataDog/ci-app-libraries
+/packages/datadog-plugin-nyc/ @DataDog/dd-trace-js @DataDog/ci-app-libraries
 /packages/dd-trace/src/plugins/util/git.js @DataDog/dd-trace-js @DataDog/ci-app-libraries
 /packages/dd-trace/src/plugins/ci_plugin.js @DataDog/dd-trace-js @DataDog/ci-app-libraries
 /packages/dd-trace/test/ci-visibility/ @DataDog/dd-trace-js @DataDog/ci-app-libraries
@@ -176,6 +179,24 @@
 /packages/datadog-instrumentations/src/cypress.js @DataDog/dd-trace-js @DataDog/ci-app-libraries
 /packages/datadog-instrumentations/src/playwright.js @DataDog/dd-trace-js @DataDog/ci-app-libraries
 /packages/datadog-instrumentations/src/vitest.js @DataDog/dd-trace-js @DataDog/ci-app-libraries
+/packages/datadog-instrumentations/src/vitest-main.js @DataDog/dd-trace-js @DataDog/ci-app-libraries
+/packages/datadog-instrumentations/src/vitest-main-no-worker-init.js @DataDog/dd-trace-js @DataDog/ci-app-libraries
+/packages/datadog-instrumentations/src/vitest-util.js @DataDog/dd-trace-js @DataDog/ci-app-libraries
+/packages/datadog-instrumentations/src/vitest-worker.js @DataDog/dd-trace-js @DataDog/ci-app-libraries
+/packages/datadog-instrumentations/src/cucumber-worker-threads.js @DataDog/dd-trace-js @DataDog/ci-app-libraries
+/packages/datadog-instrumentations/src/cypress-config.js @DataDog/dd-trace-js @DataDog/ci-app-libraries
+/packages/datadog-instrumentations/src/cypress-legacy-finalizers.js @DataDog/dd-trace-js @DataDog/ci-app-libraries
+/packages/datadog-instrumentations/src/playwright-browser-scripts.js @DataDog/dd-trace-js @DataDog/ci-app-libraries
+/packages/datadog-instrumentations/src/playwright-reporter.js @DataDog/dd-trace-js @DataDog/ci-app-libraries
+/packages/datadog-instrumentations/src/webdriverio.js @DataDog/dd-trace-js @DataDog/ci-app-libraries
+/packages/datadog-instrumentations/src/nyc.js @DataDog/dd-trace-js @DataDog/ci-app-libraries
+/packages/datadog-instrumentations/src/jest/coverage-backfill.js @DataDog/dd-trace-js @DataDog/ci-app-libraries
+/packages/datadog-instrumentations/test/vitest-main.spec.js @DataDog/dd-trace-js @DataDog/ci-app-libraries
+/packages/datadog-instrumentations/test/webdriverio.spec.js @DataDog/dd-trace-js @DataDog/ci-app-libraries
+/packages/datadog-instrumentations/test/nyc.spec.js @DataDog/dd-trace-js @DataDog/ci-app-libraries
+/packages/datadog-instrumentations/test/fixtures/jasmine-core.js @DataDog/dd-trace-js @DataDog/ci-app-libraries
+/packages/datadog-instrumentations/test/fixtures/mocha-regular-worker.js @DataDog/dd-trace-js @DataDog/ci-app-libraries
+/packages/datadog-instrumentations/test/fixtures/webdriverio-* @DataDog/dd-trace-js @DataDog/ci-app-libraries
 
 /integration-tests/ci-visibility/ @DataDog/dd-trace-js @DataDog/ci-app-libraries
 /integration-tests/cucumber/ @DataDog/dd-trace-js @DataDog/ci-app-libraries
@@ -326,43 +347,51 @@
 /packages/dd-trace/test/openfeature/ @DataDog/dd-trace-js @DataDog/feature-flagging-and-experimentation-sdk
 
 # CI
+/.github/actions/**/action.yml @DataDog/dd-trace-js @DataDog/lang-platform-js @dd-octo-sts
+/.github/actions/**/action.yaml @DataDog/dd-trace-js @DataDog/lang-platform-js @dd-octo-sts
 /.github/actions/upload-coverage-artifact/ @DataDog/dd-trace-js @DataDog/ci-app-libraries
+/.github/actions/upload-coverage-artifact/action.yml @DataDog/dd-trace-js @DataDog/ci-app-libraries @dd-octo-sts
+/.github/actions/upload-coverage-artifact/action.yaml @DataDog/dd-trace-js @DataDog/ci-app-libraries @dd-octo-sts
 /.github/actions/upload-junit-artifacts/ @DataDog/dd-trace-js @DataDog/ci-app-libraries
+/.github/actions/upload-junit-artifacts/action.yml @DataDog/dd-trace-js @DataDog/ci-app-libraries @dd-octo-sts
+/.github/actions/upload-junit-artifacts/action.yaml @DataDog/dd-trace-js @DataDog/ci-app-libraries @dd-octo-sts
 /.github/editorconfig-checker/ @DataDog/dd-trace-js @Datadog/lang-platform-js
 /.github/playwright/ @DataDog/dd-trace-js @DataDog/ci-app-libraries
 /.github/selenium/ @DataDog/dd-trace-js @DataDog/ci-app-libraries
 /.github/chainguard/ @DataDog/dd-trace-js @DataDog/sdlc-security
 /.github/codeql_config.yml @DataDog/dd-trace-js @DataDog/sdlc-security
-/.github/workflows/codeql-analysis.yml @DataDog/dd-trace-js @DataDog/sdlc-security
-/.github/workflows/mirror-image.yml @DataDog/dd-trace-js @Datadog/lang-platform-js
-/.github/workflows/all-green.yml @DataDog/dd-trace-js @Datadog/lang-platform-js
-/.github/workflows/audit.yml @DataDog/dd-trace-js @DataDog/lang-platform-js
-/.github/workflows/custom-node-version-dispatch.yml @DataDog/dd-trace-js @Datadog/lang-platform-js
-/.github/workflows/dependabot-automation.yml @DataDog/dd-trace-js @DataDog/lang-platform-js @DataDog/apm-sdk-capabilities-js
-/.github/workflows/flakiness.yml @DataDog/dd-trace-js @DataDog/lang-platform-js
-/.github/workflows/platform.yml @DataDog/dd-trace-js @DataDog/lang-platform-js
-/.github/workflows/project.yml @DataDog/dd-trace-js @Datadog/lang-platform-js
-/.github/workflows/release-proposal.yml @DataDog/dd-trace-js @DataDog/lang-platform-js
-/.github/workflows/release-validate.yml @DataDog/dd-trace-js @DataDog/lang-platform-js
-/.github/workflows/stale.yml @DataDog/dd-trace-js @Datadog/lang-platform-js
-/.github/workflows/update-3rdparty-licenses.yml @DataDog/dd-trace-js @DataDog/lang-platform-js
-
-/.github/workflows/apm-capabilities.yml @DataDog/dd-trace-js @DataDog/apm-sdk-capabilities-js
-/.github/workflows/eslint-rules.yml @DataDog/dd-trace-js @DataDog/apm-sdk-capabilities-js
-/.github/workflows/apm-integrations.yml @DataDog/dd-trace-js @DataDog/apm-idm-js
-/.github/workflows/aiguard.yml @DataDog/dd-trace-js @DataDog/asm-js
-/.github/workflows/appsec.yml @DataDog/dd-trace-js @DataDog/asm-js
-/.github/workflows/debugger.yml @DataDog/dd-trace-js @DataDog/debugger-nodejs
-/.github/workflows/instrumentation.yml @DataDog/dd-trace-js @DataDog/apm-idm-js
-/.github/workflows/electron.yml @DataDog/dd-trace-js @DataDog/apm-idm-js
-/.github/workflows/release.yml @DataDog/dd-trace-js @DataDog/lang-platform-js
-/.github/workflows/serverless.yml @DataDog/dd-trace-js @DataDog/serverless-aws @DataDog/apm-serverless
-/.github/workflows/llmobs.yml @DataDog/dd-trace-js @DataDog/ml-observability
-/.github/workflows/openfeature.yml @DataDog/dd-trace-js @DataDog/feature-flagging-and-experimentation-sdk
-/.github/workflows/pr-title.yml @DataDog/dd-trace-js @DataDog/lang-platform-js
-/.github/workflows/profiling.yml @DataDog/dd-trace-js @DataDog/profiling-js
-/.github/workflows/system-tests.yml @DataDog/dd-trace-js @DataDog/asm-js
-/.github/workflows/test-optimization.yml @DataDog/dd-trace-js @DataDog/ci-app-libraries
+/.github/workflows/*.yml @DataDog/dd-trace-js @DataDog/lang-platform-js @dd-octo-sts
+/.github/workflows/*.yaml @DataDog/dd-trace-js @DataDog/lang-platform-js @dd-octo-sts
+/.github/workflows/codeql-analysis.yml @DataDog/dd-trace-js @DataDog/sdlc-security @dd-octo-sts
+/.github/workflows/mirror-image.yml @DataDog/dd-trace-js @Datadog/lang-platform-js @dd-octo-sts
+/.github/workflows/all-green.yml @DataDog/dd-trace-js @Datadog/lang-platform-js @dd-octo-sts
+/.github/workflows/audit.yml @DataDog/dd-trace-js @DataDog/lang-platform-js @dd-octo-sts
+/.github/workflows/custom-node-version-dispatch.yml @DataDog/dd-trace-js @Datadog/lang-platform-js @dd-octo-sts
+/.github/workflows/dependabot-automation.yml @DataDog/dd-trace-js @DataDog/lang-platform-js @DataDog/apm-sdk-capabilities-js @dd-octo-sts
+/.github/workflows/flakiness.yml @DataDog/dd-trace-js @DataDog/lang-platform-js @dd-octo-sts
+/.github/workflows/platform.yml @DataDog/dd-trace-js @DataDog/lang-platform-js @dd-octo-sts
+/.github/workflows/project.yml @DataDog/dd-trace-js @Datadog/lang-platform-js @dd-octo-sts
+/.github/workflows/release-proposal.yml @DataDog/dd-trace-js @DataDog/lang-platform-js @dd-octo-sts
+/.github/workflows/release-validate.yml @DataDog/dd-trace-js @DataDog/lang-platform-js @dd-octo-sts
+/.github/workflows/stale.yml @DataDog/dd-trace-js @Datadog/lang-platform-js @dd-octo-sts
+/.github/workflows/update-3rdparty-licenses.yml @DataDog/dd-trace-js @DataDog/lang-platform-js @dd-octo-sts
+
+/.github/workflows/apm-capabilities.yml @DataDog/dd-trace-js @DataDog/apm-sdk-capabilities-js @dd-octo-sts
+/.github/workflows/eslint-rules.yml @DataDog/dd-trace-js @DataDog/apm-sdk-capabilities-js @dd-octo-sts
+/.github/workflows/apm-integrations.yml @DataDog/dd-trace-js @DataDog/apm-idm-js @dd-octo-sts
+/.github/workflows/aiguard.yml @DataDog/dd-trace-js @DataDog/asm-js @dd-octo-sts
+/.github/workflows/appsec.yml @DataDog/dd-trace-js @DataDog/asm-js @dd-octo-sts
+/.github/workflows/debugger.yml @DataDog/dd-trace-js @DataDog/debugger-nodejs @dd-octo-sts
+/.github/workflows/instrumentation.yml @DataDog/dd-trace-js @DataDog/apm-idm-js @dd-octo-sts
+/.github/workflows/electron.yml @DataDog/dd-trace-js @DataDog/apm-idm-js @dd-octo-sts
+/.github/workflows/release.yml @DataDog/dd-trace-js @DataDog/lang-platform-js @dd-octo-sts
+/.github/workflows/serverless.yml @DataDog/dd-trace-js @DataDog/serverless-aws @DataDog/apm-serverless @dd-octo-sts
+/.github/workflows/llmobs.yml @DataDog/dd-trace-js @DataDog/ml-observability @dd-octo-sts
+/.github/workflows/openfeature.yml @DataDog/dd-trace-js @DataDog/feature-flagging-and-experimentation-sdk @dd-octo-sts
+/.github/workflows/pr-title.yml @DataDog/dd-trace-js @DataDog/lang-platform-js @dd-octo-sts
+/.github/workflows/profiling.yml @DataDog/dd-trace-js @DataDog/profiling-js @dd-octo-sts
+/.github/workflows/system-tests.yml @DataDog/dd-trace-js @DataDog/asm-js @dd-octo-sts
+/.github/workflows/test-optimization.yml @DataDog/dd-trace-js @DataDog/ci-app-libraries @dd-octo-sts
 
 # Profiling
 /benchmark/sirun/profiler/ @DataDog/dd-trace-js @DataDog/profiling-js
@@ -380,6 +409,7 @@
 
 # Language Platform
 /* @DataDog/dd-trace-js @DataDog/lang-platform-js
+/AGENTS.md @DataDog/dd-trace-js @DataDog/lang-platform-js
 /openfeature.d.ts @DataDog/dd-trace-js @DataDog/lang-platform-js @DataDog/feature-flagging-and-experimentation-sdk
 /openfeature.js @DataDog/dd-trace-js @DataDog/lang-platform-js @DataDog/feature-flagging-and-experimentation-sdk
 
@@ -512,3 +542,21 @@
 /ext/tags.* @DataDog/dd-trace-js @DataDog/apm-idm-js @DataDog/apm-sdk-capabilities-js @DataDog/data-streams-monitoring
 /ext/types.* @DataDog/dd-trace-js @DataDog/apm-idm-js @DataDog/apm-serverless
 /packages/dd-trace/src/plugin_manager.js @DataDog/dd-trace-js @DataDog/lang-platform-js @DataDog/apm-idm-js
+
+# Automated dependency updates
+/package.json @DataDog/dd-trace-js @DataDog/lang-platform-js @dd-octo-sts
+/yarn.lock @DataDog/dd-trace-js @DataDog/lang-platform-js @dd-octo-sts
+/docs/package.json @DataDog/dd-trace-js @DataDog/apm-idm-js @DataDog/lang-platform-js @dd-octo-sts
+/docs/yarn.lock @DataDog/dd-trace-js @DataDog/apm-idm-js @DataDog/lang-platform-js @dd-octo-sts
+/.github/actions/datadog-ci/package.json @DataDog/dd-trace-js @DataDog/lang-platform-js @dd-octo-sts
+/.github/actions/datadog-ci/yarn.lock @DataDog/dd-trace-js @DataDog/lang-platform-js @dd-octo-sts
+/vendor/package.json @DataDog/dd-trace-js @DataDog/lang-platform-js @dd-octo-sts
+/vendor/package-lock.json @DataDog/dd-trace-js @DataDog/lang-platform-js @dd-octo-sts
+/packages/dd-trace/test/plugins/versions/package.json @DataDog/dd-trace-js @DataDog/apm-idm-js @dd-octo-sts
+/integration-tests/esbuild/package.json @DataDog/dd-trace-js @DataDog/apm-idm-js @dd-octo-sts
+/integration-tests/appsec/iast-esbuild-esm/package.json @DataDog/dd-trace-js @DataDog/asm-js @dd-octo-sts
+/integration-tests/appsec/iast-esbuild-cjs/package.json @DataDog/dd-trace-js @DataDog/asm-js @dd-octo-sts
+/.github/editorconfig-checker/Dockerfile @DataDog/dd-trace-js @Datadog/lang-platform-js @dd-octo-sts
+/.github/playwright/Dockerfile @DataDog/dd-trace-js @DataDog/ci-app-libraries @dd-octo-sts
+/.github/selenium/Dockerfile @DataDog/dd-trace-js @DataDog/ci-app-libraries @dd-octo-sts
+/benchmark/sirun/Dockerfile* @DataDog/dd-trace-js @DataDog/lang-platform-js @dd-octo-sts

.github/workflows/codeql-analysis.yml

@@ -45,7 +45,7 @@ jobs:
 
       - name: Initialize CodeQL
         id: init-codeql
-        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           languages: ${{ matrix.language }}
           config-file: .github/codeql_config.yml
@@ -57,7 +57,7 @@ jobs:
 
       - name: Perform CodeQL Analysis
         id: analyze
-        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           token: ${{ github.token }}
           wait-for-processing: false

.github/workflows/platform.yml

@@ -60,7 +60,14 @@ jobs:
       - run: mkdir -p /tmp/app
       - run: npm i -g pnpm
         if: matrix.manager.name == 'pnpm'
-      - run: cd /tmp/app && ${{ matrix.manager.install }} /tmp/dd-trace.tgz
+      - name: Install packed package
+        shell: bash
+        run: |
+          cd /tmp/app
+          ${{ matrix.manager.install }} /tmp/dd-trace.tgz 2>&1 | tee /tmp/package-manager-install.log
+      - name: Reject Yarn build warnings
+        if: matrix.manager.name == 'yarn-berry'
+        run: "! grep -F 'YN0007:' /tmp/package-manager-install.log"
       - run: echo "require('dd-trace').init()" >> /tmp/app/index.js
       - run: node /tmp/app
 

.github/workflows/pr-title.yml

@@ -25,7 +25,7 @@ jobs:
       - name: Checkout base revision
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ github.event.pull_request.base.sha }}
+          ref: ${{ github.sha }}
           persist-credentials: false
 
       - name: Auto-rename GitHub revert title to Conventional Commit
@@ -63,6 +63,8 @@ jobs:
             core.info(`PR title OK: ${title}`)
 
             const type = match[3]
+            if (!/^(?:feat|fix|perf|docs)$/.test(type)) return
+
             const changedFiles = await github.paginate(github.rest.pulls.listFiles, {
               ...context.repo,
               pull_number: pullRequest.number,
@@ -71,13 +73,17 @@ jobs:
             const files = []
             const { appendChangedPaths, isInternalOnly } = require('./scripts/release/changelog')
             appendChangedPaths(files, changedFiles)
-            if (/^(?:feat|fix|perf|docs)$/.test(type) && isInternalOnly(files)) {
+            if (isInternalOnly(files)) {
               core.setFailed(`PR title type "${type}" is public, but every changed file is internal. ` +
                 'Use test, bench, ci, or chore.')
             }
 
       - name: Sync labels with PR title
-        if: steps.rename.outputs.renamed != 'true'
+        if: >-
+          steps.rename.outputs.renamed != 'true' &&
+          (github.event.action == 'opened' ||
+          github.event.action == 'reopened' ||
+          (github.event.action == 'edited' && github.event.changes.title != null))
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |