.gitlab-ci.yml

---

# Condition mixins for simplification of rules, needed in the include rules so must be defined first
.if_run_all_e2e_tests: &if_run_all_e2e_tests
  if: $RUN_E2E_TESTS == "on"

.if_triggered_pipeline: &if_triggered_pipeline
  if: $CI_PIPELINE_SOURCE == "trigger" || $CI_PIPELINE_SOURCE == "pipeline"

.if_main_branch: &if_main_branch
  if: $CI_COMMIT_BRANCH == "main"

.if_release_branch: &if_release_branch
  if: $CI_COMMIT_BRANCH =~ /^[0-9]+\.[0-9]+\.x$/

.if_mergequeue: &if_mergequeue
  if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/

.if_deploy: &if_deploy
  if: $DEPLOY_AGENT == "true" || $DDR_WORKFLOW_ID != null

# Windows-specific Go source files, pkg/, and cmd/ (27 paths), need to be splitted because Gitlab has a limit to 50 paths in a single rule
.windows_path: &windows_path
  # Windows-specific Go source files (by filename convention)
  - "**/*_windows.go"

  # Windows-specific packages in pkg/
  - pkg/util/winutil/**/*
  - pkg/windowsdriver/**/*
  - pkg/util/pdhutil/**/*
  - pkg/util/crashreport/**/*
  - pkg/collector/corechecks/system/wincrashdetect/**/*
  - pkg/collector/corechecks/system/windowscertificate/**/*
  - pkg/collector/corechecks/system/winkmem/**/*
  - pkg/collector/corechecks/system/winproc/**/*
  - pkg/collector/corechecks/net/wlan/**/*
  - pkg/logs/launchers/windowsevent/**/*
  - pkg/logs/tailers/windowsevent/**/*
  - pkg/logs/util/windowsevent/**/*
  - pkg/network/driver/**/*

  # Global packages likely to impact windows
  - pkg/config/**/*

  # cmd/
  - cmd/agent/**/*
  - cmd/process-agent/**/*
  - cmd/security-agent/**/*
  - cmd/otel-agent/**/*
  - cmd/privateactionrunner/**/*
  - cmd/system-probe/**/*
  - cmd/trace-agent/**/*
  - cmd/installer/**/*
  - cmd/systray/**/*
  - cmd/otel-agent/**/*

# Bazel build system paths - single source of truth for all Bazel-related change detection.
# Covers MODULE.bazel, MODULE.bazel.lock, BUILD.bazel, REPO.bazel, .bazelrc, .bazelversion.
.bazel_paths: &bazel_paths
  - "*.bazel*"
  - deps/**/*
  - bazel/**/*

# Windows-specific comp/, tools, omnibus, containers, tasks, and cross-cutting paths
.windows_path_2: &windows_path_2
  # Windows-specific comp/ components
  - comp/systray/**/*
  - comp/updater/**/*
  - comp/checks/agentcrashdetect/**/*
  - comp/checks/windowseventlog/**/*
  - comp/checks/winregistry/**/*
  - comp/metadata/hostsysteminfo/**/*
  - comp/trace/etwtracer/**/*
  - comp/etw/**/*
  - comp/notableevents/**/*
  - comp/publishermetadatacache/**/*
  - comp/softwareinventory/**/*

  # MSI installer and Windows tooling
  - tools/windows/**/*

  # Build/packaging
  - omnibus/**/*
  - packages/**/*
  - rtloader/**/*

  # Windows containers
  - Dockerfiles/agent/windows/**/*
  - Dockerfiles/agent/entrypoint.ps1
  - Dockerfiles/agent/entrypoint.d.windows/**/*

  # Chocolatey package
  - chocolatey/**/*

  # Build and release tasks
  - tasks/msi.py
  - tasks/winbuild.py
  - tasks/winbuildscripts/**/*
  - tasks/windows_resources.py
  - tasks/systray.py

  # Cross-cutting: these affect all platforms including Windows
  - release.json
  - .gitlab-ci.yml
  - .gitlab/**/*

# Windows-specific e2e tests
.windows_path_3: &windows_path_3
  - test/new-e2e/tests/fleet/**/* # cross platform tests
  - test/new-e2e/tests/installer/windows/**/*
  - test/new-e2e/tests/windows/**/*
  - test/new-e2e/tests/sysprobe-functional/**/*
  - test/new-e2e/tests/process/**/*

include:
  - local: .adms/**/*.yaml
  - local: .gitlab/.pre/**.yml
  - local: .gitlab/build/**.yml
  - local: .gitlab/deploy/**.yml
  - local: .gitlab/test/**.yml
  - local: .gitlab/.post/**.yml
  # Windows jobs - set SKIP_WINDOWS=true to exclude all Windows-related jobs
  - local: .gitlab/windows/**.yml
    rules:
      - if: $SKIP_WINDOWS == "true"
        when: never
      - <<: *if_main_branch
      - <<: *if_release_branch
      - <<: *if_triggered_pipeline
      - <<: *if_mergequeue
      - <<: *if_deploy
      - <<: *if_run_all_e2e_tests
      # - !reference [.except_skip_windows] Should be the rule but it is not working so we need to explicitly write the rule. See https://gitlab.com/gitlab-org/gitlab/-/issues/434157
      - changes:
          paths: *windows_path
          compare_to: main
      - changes:
          paths: *windows_path_2
          compare_to: main
      - changes:
          paths: *windows_path_3
          compare_to: main
      - changes:
          paths: *bazel_paths
          compare_to: main
      - when: never

default:
  retry:
    max: 1 # Retry everything once on failure
    when: always

stages:
  - .pre
  - setup
  - maintenance_jobs
  - deps_build
  - deps_fetch
  - lint
  - source_test
  - source_test_stats
  - software_composition_analysis
  - binary_build
  - package_deps_build
  - kernel_matrix_testing_prepare
  - kernel_matrix_testing_system_probe
  - kernel_matrix_testing_security_agent
  - kernel_matrix_testing_cleanup
  - integration_test
  - benchmarks
  - package_build
  - packaging
  - pkg_metrics
  - container_build
  - container_scan
  - scan
  - check_deploy
  - dev_container_deploy
  - deploy_packages
  - choco_build
  - install_script_deploy
  - internal_image_deploy
  - e2e_deploy
  - install_script_testing
  - e2e_pre_test
  - e2e_init
  - e2e
  - e2e_k8s
  - e2e_install_packages
  - functional_test
  - trigger_distribution
  - dynamic_test
  - junit_upload
  - internal_kubernetes_deploy
  - post_rc_build
  - check_merge
  - .post

variables:
  # Special variable that allows us to set the pipeline to compute the code coverage of the e2e tests. It will impact several jobs so that
  # the agent is build with a special flag that allow computing code coverage of the binary when it is running.
  E2E_COVERAGE_PIPELINE: false
  # Directory in which we execute the omnibus build.
  # For an unknown reason, it does not go well with
  # a ruby dependency if we build directly into $CI_PROJECT_DIR/.omnibus
  OMNIBUS_BASE_DIR: /omnibus
  # Directory in which we put the artifacts after the build
  # Must be in $CI_PROJECT_DIR
  OMNIBUS_PACKAGE_DIR: $CI_PROJECT_DIR/omnibus/pkg/
  # Directory in which we put the SUSE artifacts after the SUSE build
  # Must be in $CI_PROJECT_DIR
  # RPM builds and SUSE RPM builds create artifacts with the same name.
  # To differentiate them, we put them in different folders. That also
  # avoids accidentally overwriting files when downloading artifacts from
  # both RPM and SUSE rpm jobs.
  OMNIBUS_PACKAGE_DIR_SUSE: $CI_PROJECT_DIR/omnibus/suse/pkg
  DD_AGENT_TESTING_DIR: $CI_PROJECT_DIR/test/new-e2e/tests
  STATIC_BINARIES_DIR: bin/static
  DOGSTATSD_BINARIES_DIR: bin/dogstatsd
  AGENT_BINARIES_DIR: bin/agent
  CLUSTER_AGENT_BINARIES_DIR: bin/datadog-cluster-agent
  SECRET_GENERIC_CONNECTOR_BINARIES_DIR: bin/secret-generic-connector
  CWS_INSTRUMENTATION_BINARIES_DIR: bin/cws-instrumentation
  CLUSTER_AGENT_CLOUDFOUNDRY_BINARIES_DIR: bin/datadog-cluster-agent-cloudfoundry
  SYSTEM_PROBE_BINARIES_DIR: bin/system-probe
  DEB_S3_BUCKET: apt.datad0g.com
  RPM_S3_BUCKET: yum.datad0g.com
  MACOS_S3_BUCKET: dd-agent-macostesting
  WIN_S3_BUCKET: dd-agent-mstesting
  PROCESS_S3_BUCKET: datad0g-process-agent
  BUCKET_BRANCH: dev # path inside the staging s3 buckets to release to: 'dev', 'nightly', 'oldnightly', 'beta' or 'stable'
  DEB_TESTING_S3_BUCKET: apttesting.datad0g.com
  RPM_TESTING_S3_BUCKET: yumtesting.datad0g.com
  # note the name is TEST_KEYS_URL, not TESTING_KEYS_URL;
  # this is because TESTING_KEYS_URL is a variable used by the install script,
  # and we don't want to modify its behavior inadvertently
  TEST_KEYS_URL: apttesting.datad0g.com/test-keys
  INSTALLER_TESTING_S3_BUCKET: installtesting.datad0g.com
  WINDOWS_TESTING_S3_BUCKET: pipelines/A7/$CI_PIPELINE_ID
  WINDOWS_BUILDS_S3_BUCKET: $WIN_S3_BUCKET/builds
  WINDOWS_POWERSHELL_DIR: $CI_PROJECT_DIR/signed_scripts
  DEB_RPM_TESTING_BUCKET_BRANCH: testing # branch of the DEB_TESTING_S3_BUCKET and RPM_TESTING_S3_BUCKET repos to release to, 'testing'
  S3_CP_OPTIONS: --no-progress --region us-east-1 --sse AES256
  S3_CP_CMD: aws s3 cp $S3_CP_OPTIONS
  S3_ARTIFACTS_URI: s3://dd-ci-artefacts-build-stable/$CI_PROJECT_NAME/$CI_PIPELINE_ID
  S3_PROJECT_ARTIFACTS_URI: s3://dd-ci-artefacts-build-stable/$CI_PROJECT_NAME
  S3_PERMANENT_ARTIFACTS_URI: s3://dd-ci-persistent-artefacts-build-stable/$CI_PROJECT_NAME
  S3_SBOM_STORAGE_URI: s3://sbom-root-us1-ddbuild-io/$CI_PROJECT_NAME/$CI_PIPELINE_ID
  S3_RELEASE_ARTIFACTS_URI: s3://dd-release-artifacts/$CI_PROJECT_NAME/$CI_PIPELINE_ID
  S3_RELEASE_INSTALLER_ARTIFACTS_URI: s3://dd-release-artifacts/datadog-installer/$CI_PIPELINE_ID
  ## comment out both lines below (S3_OMNIBUS_CACHE_BUCKET and USE_S3_CACHING) to allow
  ## build to succeed with S3 caching disabled.
  S3_OMNIBUS_CACHE_BUCKET: dd-ci-datadog-agent-omnibus-cache-build-stable
  S3_OMNIBUS_GIT_CACHE_BUCKET: dd-ci-datadog-agent-omnibus-git-cache-build-stable
  # This value is not used on windows, a specific value is provided to
  # our build containers in the windows build jobs
  OMNIBUS_GIT_CACHE_DIR: /tmp/omnibus-git-cache
  ## comment out the line below to disable integration wheels cache
  INTEGRATION_WHEELS_CACHE_BUCKET: dd-agent-omnibus
  S3_DD_AGENT_OMNIBUS_LLVM_URI: s3://dd-agent-omnibus/llvm
  S3_DD_AGENT_OMNIBUS_BTFS_URI: s3://dd-agent-omnibus/btfs
  S3_DD_AGENT_OMNIBUS_JAVA_URI: s3://dd-agent-omnibus/openjdk
  BTFHUB_ARCHIVE_BRANCH: main
  COMPARE_TO_BRANCH: main
  GENERAL_ARTIFACTS_CACHE_BUCKET_URL: https://dd-agent-omnibus.s3.amazonaws.com
  S3_DSD6_URI: s3://dsd6-staging

  # Build images versions
  # To use images from datadog-agent-buildimages dev branches, set the corresponding
  # SUFFIX variable to
  CI_IMAGE_BTF_GEN: v109491709-17310930
  CI_IMAGE_BTF_GEN_SUFFIX: ""
  CI_IMAGE_DOCKER_X64: v109491709-17310930
  CI_IMAGE_DOCKER_X64_SUFFIX: ""
  CI_IMAGE_DOCKER_ARM64: v109491709-17310930
  CI_IMAGE_DOCKER_ARM64_SUFFIX: ""
  CI_IMAGE_GITLAB_AGENT_DEPLOY: v109491709-17310930
  CI_IMAGE_GITLAB_AGENT_DEPLOY_SUFFIX: ""
  CI_IMAGE_LINUX: v109491709-17310930
  CI_IMAGE_LINUX_SUFFIX: ""
  CI_IMAGE_RPM_X64: v109491709-17310930
  CI_IMAGE_RPM_X64_SUFFIX: ""
  CI_IMAGE_RPM_ARM64: v109491709-17310930
  CI_IMAGE_RPM_ARM64_SUFFIX: ""
  CI_IMAGE_RPM_ARMHF: v109491709-17310930
  CI_IMAGE_RPM_ARMHF_SUFFIX: ""
  CI_IMAGE_WIN_LTSC2022_X64: v107034079-0ba6ff53
  CI_IMAGE_WIN_LTSC2022_X64_SUFFIX: ""
  CI_IMAGE_WIN_LTSC2025_X64: v107034079-0ba6ff53
  CI_IMAGE_WIN_LTSC2025_X64_SUFFIX: ""

  DATADOG_AGENT_EMBEDDED_PATH: /opt/datadog-agent/embedded
  DEB_GPG_KEY_ID: c0962c7d
  DEB_GPG_KEY_NAME: "Datadog, Inc. APT key"
  RPM_GPG_KEY_ID: b01082d3
  RPM_GPG_KEY_NAME: "Datadog, Inc. RPM key"
  # note the unusual ID for a GPG key:
  # it's the path of a Vault key to be used with gpg-vault
  # (https://github.com/DataDog/dd-source/tree/main/domains/seceng/sit/apps/artifact-security/vault-gpg-client/gpg-vault)
  GPG_TEST_KEY_ID: crypto/k8s/keys/k8s_gitlab-runner-datadog-agent_datadog-agent_testing_signing-key
  DOCKER_REGISTRY_URL: docker.io
  KITCHEN_INFRASTRUCTURE_FLAKES_RETRY: 2
  CLANG_LLVM_VER: 12.0.1
  CLANG_BUILD_VERSION: "v60409452-ee70de70"
  KERNEL_MATRIX_TESTING_X86_AMI_ID: "ami-05b3973acf5422348"
  KERNEL_MATRIX_TESTING_ARM_AMI_ID: "ami-0b5f838a19d37fc61"
  RUN_E2E_TESTS: "auto" # Should be "off", "auto" or "on" it will change the trigger condition for new-e2e tests on branch != main
  RUN_KMT_TESTS: "auto" # Should be "auto" or "on". "on" forces all Kernel Matrix Testing jobs to run.
  RUN_UNIT_TESTS: "auto" # Should be "auto", "on", "off" it will change the trigger condition for unit tests on branch != main
  # skip known flaky tests by default
  GO_TEST_SKIP_FLAKE: "true"

  # Start aws ssm variables
  # They must be defined as environment variables in the GitLab CI/CD settings, to ease rotation if needed
  API_KEY_ORG2: ci.datadog-agent.datadog_api_key_org2 # agent-devx
  CHANGELOG_COMMIT_SHA: ci.datadog-agent.gitlab_changelog_commit_sha # agent-devx
  CHOCOLATEY_API_KEY: ci.datadog-agent.chocolatey_api_key # windows-products
  CODECOV_TOKEN: ci.datadog-agent.codecov_token # agent-devx
  CRC_PULL_SECRET: ci.datadog-agent.crc-pull-secret # container-integrations
  DOCKER_REGISTRY_LOGIN: ci.datadog-agent.docker_hub_login # container-integrations
  DOCKER_REGISTRY_PWD: ci.datadog-agent.docker_hub_pwd # container-integrations
  VCPKG_BLOB_SAS_URL: ci.datadog-agent-buildimages.vcpkg_blob_sas_url # windows-products
  WINGET_PAT: ci.datadog-agent.winget_pat # windows-products
  # End aws ssm variables

  # Start vault variables
  AGENT_API_KEY_ORG2: agent-api-key-org-2 # agent-devx
  AGENT_APP_KEY_ORG2: agent-app-key-org-2 # agent-devx
  AGENT_QA_E2E: agent-qa-e2e # agent-devx
  ATLASSIAN_WRITE: atlassian-write # agent-devx
  CODECOV: codecov # agent-devx
  DOCKER_REGISTRY_RO: dockerhub-readonly # agent-delivery
  DYNAMIC_TESTS_BREAKGLASS: dynamic-tests-breakglass # agent-devx
  E2E_AZURE: e2e-azure # agent-devx
  E2E_GCP: e2e-gcp # agent-devx
  INSTALL_SCRIPT_API_KEY_ORG2: install-script-api-key-org-2 # agent-devx
  MACOS_APPLE_APPLICATION_SIGNING: apple-application-signing # agent-delivery
  MACOS_APPLE_DEVELOPER_ACCOUNT: apple-developer-account # agent-delivery
  MACOS_APPLE_INSTALLER_SIGNING: apple-installer-signing # agent-delivery
  MACOS_KEYCHAIN_PWD: ci-keychain # agent-delivery
  SLACK_AGENT: slack-agent-ci # agent-devx
  SMP_ACCOUNT: smp # single-machine-performance
  VIRUS_TOTAL: virus-total # windows-products
  # End vault variables

  # dda configuration variables
  DDA_CLIENT_TOKEN: dda-feature-flags-client-token # agent-devx
  DDA_FEATURE_FLAGS_CI_VAULT_KEY_MACOS: token
  DDA_FEATURE_FLAGS_CI_VAULT_PATH_MACOS: aws/arn:aws:iam::486234852809:role/ci-datadog-agent/$DDA_CLIENT_TOKEN
  DDA_FEATURE_FLAGS_CI_SSM_KEY_WINDOWS: ci.datadog-agent.dda-feature-flags-client-token
  DDA_FEATURE_FLAGS_CI_VAULT_KEY: token
  DDA_FEATURE_FLAGS_CI_VAULT_PATH: k8s/gitlab-runner-datadog-agent/datadog-agent/$DDA_CLIENT_TOKEN

  DD_PKG_VERSION: "latest"
  DD_PKG_GITLAB_URL: "https://artifact-gateway.us1.ddbuild.io/internal/artifact-gateway/api/v4"
  PIPELINE_KEY_ALIAS: "alias/ci_datadog-agent_pipeline-key"

  # Job cloning strategy
  GIT_STRATEGY: "s3"

  # Job stage attempts (see https://docs.gitlab.com/ee/ci/runners/configure_runners.html#job-stages-attempts)
  ARTIFACT_DOWNLOAD_ATTEMPTS: 2
  EXECUTOR_JOB_SECTION_ATTEMPTS: 2
  GET_SOURCES_ATTEMPTS: 2
  RESTORE_CACHE_ATTEMPTS: 2
  # Feature flags
  FF_CLEAN_UP_FAILED_CACHE_EXTRACT: true # Delete corrupted caches, see https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/4565
  FF_SCRIPT_SECTIONS: 1 # Prevent multiline scripts log collapsing, see https://gitlab.com/gitlab-org/gitlab-runner/-/issues/3392
  FF_KUBERNETES_HONOR_ENTRYPOINT: true # Honor the entrypoint in the Docker image when running Kubernetes jobs
  FF_TIMESTAMPS: true
  FF_USE_FASTZIP: true
  FF_USE_WINDOWS_JOB_OBJECT: true # Prevent orphaned processes from holding file handles, see https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/4525
  CACHE_COMPRESSION_LEVEL: slowest
  # Force python to print to stdout immediately, otherwise gitlab sections might not be displayed properly and we can miss some logs
  PYTHONUNBUFFERED: 1

  SKIP_WINDOWS: "false"

#
# Condition mixins for simplification of rules
#

.if_not_main_branch: &if_not_main_branch
  if: $CI_COMMIT_BRANCH != "main"

.if_deploy_stable: &if_deploy_stable
  if: ($DEPLOY_AGENT == "true" || $DDR_WORKFLOW_ID != null) && $BUCKET_BRANCH == "stable"

.if_deploy_installer_stable: &if_deploy_installer_stable
  if: ($DEPLOY_INSTALLER == "true" || $DDR_WORKFLOW_ID != null) && $BUCKET_BRANCH == "stable"

.if_tagged_commit: &if_tagged_commit
  if: $CI_COMMIT_TAG != null

.if_not_stable_or_beta_repo_branch: &if_not_stable_or_beta_repo_branch
  if: $BUCKET_BRANCH != "beta" && $BUCKET_BRANCH != "stable"

.if_not_nightly_or_dev_repo_branch: &if_not_nightly_or_dev_repo_branch
  if: $BUCKET_BRANCH != "nightly" && $BUCKET_BRANCH != "oldnightly" && $BUCKET_BRANCH != "dev"

# CI_PIPELINE_SOURCE can be set to "trigger" or "pipeline" depending on how the trigger was done.
# See https://docs.gitlab.com/ee/ci/triggers/index.html#configure-cicd-jobs-to-run-in-triggered-pipelines.

# Rule to trigger all builds conditionally.
# By default:
# - on main and deploy pipelines, all builds are run
# - on branch pipelines, only a subset of build jobs are run (the ARM and MacOS jobs are not run).
# RUN_ALL_BUILDS can be set to true to force all build jobs to be run on a branch pipeline.
# RUN_ALL_BUILDS has no effect on main/deploy pipelines: they always run all builds (as some jobs
# on main and deploy pipelines depend on jobs that are only run if we run all builds).
.if_run_all_builds: &if_run_all_builds
  if: $CI_COMMIT_BRANCH == "main" || $DEPLOY_AGENT == "true" || $RUN_ALL_BUILDS == "true" || $DDR_WORKFLOW_ID != null

.if_not_run_all_builds: &if_not_run_all_builds
  if: $CI_COMMIT_BRANCH != "main" && $DEPLOY_AGENT != "true" && $RUN_ALL_BUILDS != "true" && $DDR_WORKFLOW_ID == null

# Rule to trigger test setup, run, and cleanup.
# By default:
# - on main and deploy pipelines, installer tests are run
# - on branch pipelines, installer tests are run on a subset of the OSes we test
# RUN_E2E_TESTS can be set to on to force all the installer tests to be run on a branch pipeline.
# RUN_E2E_TESTS can be set to false to force installer tests to not run on main/deploy pipelines.
.if_installer_tests: &if_installer_tests
  if: ($CI_COMMIT_BRANCH == "main"  || $DEPLOY_AGENT == "true" || $RUN_E2E_TESTS == "on" || $DDR_WORKFLOW_ID != null) && $RUN_E2E_TESTS != "off"


# When RUN_E2E_TESTS is set to "auto". We do not enforce a behavior for the tests.
# The behavior of each test will be defined by its rules.
# For example for new-e2e tests created by each team, here is an example of such rules: https://github.com/DataDog/datadog-agent/blob/ba7079d92077ab5898378594dcafb9cd88a77e57/.gitlab-ci.yml#L1160-L1167
# For the installer tests when RUN_E2E_TESTS is set to "auto", we run a subset of tests on branch pipelines and all the tests on main.
.if_auto_e2e_tests: &if_auto_e2e_tests
  if: $RUN_E2E_TESTS == "auto"

.if_disable_e2e_tests: &if_disable_e2e_tests
  if: $RUN_E2E_TESTS == "off"

# Enable forcing all KMT tests to run
.if_run_all_kmt_tests: &if_run_all_kmt_tests
  if: $RUN_KMT_TESTS == 'on'

.if_disable_unit_tests: &if_disable_unit_tests
  if: $RUN_UNIT_TESTS == "off"

.if_run_all_unit_tests: &if_run_all_unit_tests
  if: $RUN_UNIT_TESTS == "on"

# Schedule on main branch come from conductor, pipeline source is `pipeline`, we use the conductor env variable for identification
.if_scheduled_main: &if_scheduled_main
  if: $DDR_WORKFLOW_ID != null && $CI_COMMIT_BRANCH == "main"

.fakeintake_paths: &fakeintake_paths
  paths:
    - "test/fakeintake/**/*"
    - .gitlab/build/binary_build/fakeintake.yml
    - .gitlab/deploy/container_build/fakeintake.yml
    - .gitlab/deploy/dev_container_deploy/fakeintake.yml

# Paths that impact the final build artifacts (rpm, deb, docker images, etc.)
# Used to conditionally skip expensive tests like SMP when only non-artifact files change
# like documentation, CI config, e2e tests.
.on_smp_trigger_paths: &on_smp_trigger_paths
  paths:
    # agent source code
    - go.mod
    - go.sum
    - cmd/**/*
    - comp/**/*
    - internal/**/*
    - pkg/**/*
    - rtloader/**/*
    # Build system
    - tasks/**/*.py
    - omnibus/**/*
    - release.json
    # SMP regression detector experiments
    - test/regression/**/*
    # Containers
    - Dockerfiles/**/*

.if_coverage_pipeline: &if_coverage_pipeline
  if: $E2E_COVERAGE_PIPELINE == "true"

.on_build_changes: &on_build_changes
  changes:
    paths:
      - omnibus/**/*
      - pkg/config/config_template.yaml
      - pkg/config/system-probe_template.yaml
    compare_to: $COMPARE_TO_BRANCH

#
# Workflow rules
# Rules used to define whether a pipeline should run, and with which variables
#
workflow:
  rules:
    - <<: *if_triggered_pipeline
    - <<: *if_main_branch
      variables:
        BAZEL_CACHE_POLICY_SUFFIX: "-push"
        GO_TEST_SKIP_FLAKE: "false"
    - <<: *if_release_branch
    - <<: *if_deploy
    - <<: *if_run_all_e2e_tests
    - !reference [.if_deploy_installer]
    - <<: *if_mergequeue
    - changes:
        paths: *windows_path
        compare_to: main
      variables:
        SKIP_WINDOWS: "false"
    - changes:
        paths: *windows_path_2
        compare_to: main
      variables:
        SKIP_WINDOWS: "false"
    - changes:
        paths: *windows_path_3
        compare_to: main
      variables:
        SKIP_WINDOWS: "false"
    - changes:
        paths: *bazel_paths
        compare_to: main
      variables:
        SKIP_WINDOWS: "false"
    - if: $CI_COMMIT_TAG == null
      variables:
        SKIP_WINDOWS: "true"

#
# List of rule blocks used in the pipeline
# Any job in the pipeline either runs (with when: on_success) in all pipelines, or follows one of the below rule blocks.
#

.except_mergequeue:
  - <<: *if_mergequeue
    when: never

.on_mergequeue:
  - <<: *if_mergequeue
    when: on_success

.manual:
  - !reference [.except_mergequeue]
  - when: manual
    allow_failure: true

.on_main:
  - <<: *if_main_branch

.on_main_manual:
  - <<: *if_main_branch
    when: manual
    allow_failure: true

.on_main_always:
  - <<: *if_main_branch
    when: always

.on_deploy:
  - <<: *if_deploy

.on_deploy_manual:
  - <<: *if_deploy
    when: manual
    allow_failure: true

.on_deploy_success:
  - <<: *if_deploy
    when: on_success

.on_deploy_failure:
  - <<: *if_deploy
    when: on_failure

# rule to trigger job for internal image deployment if deploy is set, or if there are changes to the internal image
# deployment config file or manually if not
.on_deploy_internal_or_internal_image_change_or_manual:
  - !reference [.except_mergequeue]
  - <<: *if_deploy
    variables:
      RELEASE_PROD: "true"
  - changes:
      paths:
        - .gitlab/deploy/internal_image_deploy/internal_image_deploy.yml
        - Dockerfiles/**/*
      compare_to: $COMPARE_TO_BRANCH
    variables:
      RELEASE_PROD: "false"
  - when: manual
    allow_failure: true
    variables:
      RELEASE_PROD: "false"

.on_deploy_nightly_repo_branch:
  - <<: *if_not_nightly_or_dev_repo_branch
    when: never
  - <<: *if_deploy

.on_deploy_stable_or_beta_repo_branch:
  - !reference [.except_mergequeue]
  - <<: *if_not_stable_or_beta_repo_branch
    when: manual
    allow_failure: true
  - <<: *if_deploy

# Alternative of the above to have an agent-release-management trigger
# for stable branches in case of failure in any previous job
.on_deploy_stable_on_failure:
  - <<: *if_deploy_stable
    when: on_failure

# Alternative of the above to have an agent-release-management trigger
# for stable branches in case of failure in any previous job
.on_deploy_installer_stable_on_failure:
  - <<: *if_deploy_installer_stable
    when: on_failure

.except_deploy:
  - <<: *if_deploy
    when: never

.except_skip_windows:
  - if: $SKIP_WINDOWS == "true"
    when: never

.except_no_tests_no_deploy:
  - if: $DEPLOY_AGENT == "false" && $DDR_WORKFLOW_ID == null && $RUN_E2E_TESTS == "off"
    when: manual
    allow_failure: true

.on_main_or_release_branch:
  - <<: *if_main_branch
  - <<: *if_release_branch

.not_on_release_branch_or_tagged_commit:
  - <<: *if_release_branch
    when: never
  - <<: *if_tagged_commit
    when: never

.only_main:
  - <<: *if_not_main_branch
    when: never

.except_main_release_or_mq:
  - <<: *if_main_branch
    when: never
  - <<: *if_release_branch
    when: never
  - !reference [.except_mergequeue]

.on_dev_branches:
  - !reference [.except_main_release_or_mq]
  - <<: *if_tagged_commit
    when: never

.on_dev_branches_with_artifact_changes:
  - !reference [.on_dev_branches]
  - changes:
      <<: *on_smp_trigger_paths
      compare_to: $COMPARE_TO_BRANCH
  - changes:
      paths: *bazel_paths
      compare_to: $COMPARE_TO_BRANCH

.on_dev_branches_with_artifact_changes_manual:
  - !reference [.on_dev_branches]
  - changes:
      <<: *on_smp_trigger_paths
      compare_to: $COMPARE_TO_BRANCH
    when: manual
    allow_failure: true
  - changes:
      paths: *bazel_paths
      compare_to: $COMPARE_TO_BRANCH
    when: manual
    allow_failure: true


.on_main_or_release_branch_or_deploy_always:
  - <<: *if_deploy
    when: always
  - <<: *if_main_branch
    when: always
  - <<: *if_release_branch
    when: always

.on_main_or_release_branch_or_deploy_manual:
  - <<: *if_deploy
    when: manual
    allow_failure: true
  - <<: *if_main_branch
    when: manual
    allow_failure: true
  - <<: *if_release_branch
    when: manual
    allow_failure: true

.on_all_builds:
  - !reference [.except_mergequeue]
  - <<: *if_run_all_builds
  - <<: *on_build_changes

.on_all_install_script_tests:
  - !reference [.except_mergequeue]
  - <<: *if_disable_e2e_tests
    when: never
  - <<: *if_installer_tests
  - <<: *on_build_changes

# Specific rules for each e2e test type
.on_install_script_tests:
  - !reference [.except_mergequeue]
  - <<: *if_disable_e2e_tests
    when: never
  - <<: *if_installer_tests
  - <<: *on_build_changes
  - changes:
      paths:
        - test/new-e2e/tests/agent-platform/tests/install_script*
        - test/e2e-framework/**/*

.on_ddot_tests:
  - !reference [.except_mergequeue]
  - <<: *if_disable_e2e_tests
    when: never
  - <<: *if_installer_tests
  - <<: *on_build_changes
  - changes:
      paths:
        - test/new-e2e/tests/agent-platform/tests/ddot*
        - test/e2e-framework/**/*

.on_step_by_step_tests:
  - !reference [.except_mergequeue]
  - <<: *if_disable_e2e_tests
    when: never
  - <<: *if_installer_tests
  - <<: *on_build_changes
  - changes:
      paths:
        - test/new-e2e/tests/agent-platform/tests/step_by_step*
        - test/e2e-framework/**/*

.on_upgrade_tests:
  - !reference [.except_mergequeue]
  - <<: *if_disable_e2e_tests
    when: never
  - <<: *if_installer_tests
  - <<: *on_build_changes
  - changes:
      paths:
        - test/new-e2e/tests/agent-platform/tests/upgrade*
        - test/e2e-framework/**/*

.on_persisting_integrations_tests:
  - !reference [.except_mergequeue]
  - <<: *if_disable_e2e_tests
    when: never
  - <<: *if_installer_tests
  - <<: *on_build_changes
  - changes:
      paths:
        - test/new-e2e/tests/agent-platform/tests/persisting_integrations*
        - test/e2e-framework/**/*

.on_rpm_tests:
  - !reference [.except_mergequeue]
  - <<: *if_disable_e2e_tests
    when: never
  - <<: *if_installer_tests
  - <<: *on_build_changes
  - changes:
      paths:
        - test/new-e2e/tests/agent-platform/tests/rpm*
        - test/e2e-framework/**/*

.on_package_signing_tests:
  - !reference [.except_mergequeue]
  - <<: *if_disable_e2e_tests
    when: never
  - <<: *if_installer_tests
  - <<: *on_build_changes
  - changes:
      paths:
        - test/new-e2e/tests/agent-platform/tests/package_signing*
        - test/e2e-framework/**/*

.security_agent_change_paths: &security_agent_change_paths
  - pkg/ebpf/**/*
  - pkg/security/**/*
  - pkg/eventmonitor/**/*
  - .gitlab/test/kernel_matrix_testing/security_agent.yml
  - .gitlab/test/kernel_matrix_testing/common.yml
  - .gitlab/build/source_test/ebpf.yml
  - test/new-e2e/tests/cws/**/*
  - test/new-e2e/system-probe/**/*
  - test/new-e2e/scenarios/system-probe/**/*
  - test/e2e-framework/testing/runner/**/*
  - test/e2e-framework/testing/utils/**/*
  - test/e2e-framework/scenarios/aws/microVMs/**/*
  - tasks/security_agent.py
  - tasks/kmt.py
  - tasks/kernel_matrix_testing/*

.on_security_agent_changes_or_manual:
  - <<: *if_main_branch
    allow_failure: true
  - !reference [.except_mergequeue]
  - <<: *if_run_all_kmt_tests
  - changes:
      paths: *security_agent_change_paths
      compare_to: $COMPARE_TO_BRANCH
  - when: manual
    allow_failure: true

.if_windows_installer_changes: &if_windows_installer_changes
  changes:
    paths:
      - tools/windows/DatadogAgentInstaller/**/*
      - .gitlab/windows/test/e2e_install_packages/windows.yml
      - test/new-e2e/tests/windows/install-test/**/*
      - test/new-e2e/tests/windows/domain-test/**/*
      - tasks/msi.py
      - omnibus/python-scripts/**/*
      - omnibus/lib/**/*
      - omnibus/config/projects/agent.rb
      - omnibus/config/software/**/*
      - omnibus/config/templates/**/*
      - release.json
    compare_to: $COMPARE_TO_BRANCH

.except_windows_installer_changes:
  - <<: *if_windows_installer_changes
    when: never

.system_probe_change_paths: &system_probe_change_paths
  - cmd/system-probe/**/*
  - pkg/collector/corechecks/ebpf/**/*
  - pkg/discovery/**/*
  - pkg/ebpf/**/*
  - pkg/network/**/*
  - pkg/process/monitor/*
  - pkg/security/**/*
  - pkg/util/kernel/**/*
  - pkg/dyninst/**/*
  - pkg/gpu/**/*
  - .gitlab/test/kernel_matrix_testing/system_probe.yml
  - .gitlab/test/kernel_matrix_testing/common.yml
  - .gitlab/build/source_test/ebpf.yml
  - test/new-e2e/system-probe/**/*
  - test/new-e2e/scenarios/system-probe/**/*
  - test/e2e-framework/testing/runner/**/*
  - test/e2e-framework/testing/utils/**/*
  - test/e2e-framework/scenarios/aws/microVMs/**/*
  - tasks/system_probe.py
  - tasks/kmt.py
  - tasks/kernel_matrix_testing/*

.on_system_probe_or_e2e_changes_or_manual:
  - <<: *if_main_branch
  - !reference [.except_mergequeue]
  - <<: *if_run_all_kmt_tests
  - changes:
      paths: *system_probe_change_paths
      compare_to: $COMPARE_TO_BRANCH
  - when: manual
    allow_failure: true

# New E2E related rules

.on_e2e_main_release_or_rc: # This rule is used as a base for all new-e2e rules
  - <<: *if_disable_e2e_tests
    when: never
  - !reference [.except_mergequeue]
  - <<: *if_run_all_e2e_tests
    when: on_success
  - <<: *if_main_branch
    when: on_success
  - <<: *if_release_branch
    when: on_success
  - if: $CI_COMMIT_TAG =~ /^[0-9]+\.[0-9]+\.[0-9]+-rc\.[0-9]+$/
    when: on_success
  - changes:
      paths:
        - .gitlab/test/e2e/e2e.yml
        - test/e2e-framework/**/*
        - test/new-e2e/go.mod
        - flakes.yaml
        - release.json
      compare_to: $COMPARE_TO_BRANCH

.except_e2e_main_release_or_rc: # This rule is to not trigger dynamic test evaluation when we force all e2e tests to run
  - <<: *if_disable_e2e_tests
    when: never
  - !reference [.except_mergequeue]
  - <<: *if_run_all_e2e_tests
    when: never
  - <<: *if_main_branch
    when: never
  - <<: *if_release_branch
    when: never
  - if: $CI_COMMIT_TAG =~ /^[0-9]+\.[0-9]+\.[0-9]+-rc\.[0-9]+$/
    when: never
  - changes:
      paths:
        - .gitlab/test/e2e/e2e.yml
        - test/e2e-framework/testing/**/*
        - test/new-e2e/go.mod
        - flakes.yaml
        - release.json
      compare_to: $COMPARE_TO_BRANCH
    when: never

.dynamic_tests:
  - changes:
      paths:
        - pkg/**/*
        - cmd/**/*
        - comp/**/*
      compare_to: $COMPARE_TO_BRANCH
    when: on_success

.on_e2e_or_windows_installer_changes:
  - !reference [.on_e2e_main_release_or_rc]
  - <<: *if_windows_installer_changes
    when: on_success

.on_e2e_or_fakeintake_changes_or_manual:
  - !reference [.on_e2e_main_release_or_rc]
  - changes:
      <<: *fakeintake_paths
      compare_to: $COMPARE_TO_BRANCH
    variables:
      FAKEINTAKE_IMAGE_OVERRIDE: "public.ecr.aws/datadog/fakeintake:v$CI_COMMIT_SHORT_SHA"
    when: on_success
  - changes:
      paths:
        - test/new-e2e/test-infra-definition/*
      compare_to: $COMPARE_TO_BRANCH
    when: on_success
  - when: manual
    allow_failure: true

.on_container_or_e2e_changes:
  - !reference [.on_e2e_main_release_or_rc]
  - changes:
      paths:
        - comp/core/tagger/**/*
        - comp/core/workloadmeta/**/*
        - comp/core/autodiscovery/listeners/**/*
        - comp/core/autodiscovery/providers/**/*
        - comp/forwarder/defaultforwarder/**/*
        - comp/serializer/**/*
        - pkg/aggregator/*/**
        - comp/languagedetection/**/*
        - pkg/clusteragent/admission/mutate/**/*
        - pkg/clusteragent/languagedetection/**/*
        - pkg/collector/corechecks/cluster/**/*
        - pkg/collector/corechecks/containers/**/*
        - pkg/collector/corechecks/containerimage/**/*
        - pkg/collector/corechecks/containerlifecycle/**/*
        - pkg/collector/corechecks/sbom/**/*
        - pkg/sbom/**/*
        - pkg/util/clusteragent/**/*
        - pkg/util/containerd/**/*
        - pkg/util/containers/**/*
        - pkg/util/docker/**/*
        - pkg/util/ecs/**/*
        - pkg/util/kubernetes/**/*
        - pkg/util/cgroups/**/*
        - pkg/util/trivy/**/*
        - test/new-e2e/tests/containers/**/*
        - test/new-e2e/go.mod
      compare_to: $COMPARE_TO_BRANCH
    when: on_success

.on_rc_or_e2e_changes:
  - !reference [.on_e2e_main_release_or_rc]
  - changes:
      paths:
        - pkg/config/remote/**/*
        - comp/remote-config/**/*
        - test/new-e2e/tests/remote-config/**/*
      compare_to: $COMPARE_TO_BRANCH

.on_arun_or_e2e_changes:
  - !reference [.on_e2e_main_release_or_rc]
  - changes:
      paths:
        - cmd/**/*
        - pkg/**/*
        - comp/**/*
        - test/new-e2e/tests/agent-runtimes/**/*
      compare_to: $COMPARE_TO_BRANCH

.on_acfg_or_e2e_changes:
  - !reference [.on_e2e_main_release_or_rc]
  - changes:
      paths:
        - cmd/**/*
        - pkg/**/*
        - comp/**/*
        - test/new-e2e/tests/agent-configuration//**/*
      compare_to: $COMPARE_TO_BRANCH

.on_subcommands_or_e2e_changes:
  - !reference [.on_e2e_main_release_or_rc]
  - changes:
      paths:
        - cmd/**/*
        - pkg/**/*
        - comp/**/*
        - test/new-e2e/tests/agent-subcommands/**/*
      compare_to: $COMPARE_TO_BRANCH

.on_language-detection_or_e2e_changes:
  - !reference [.on_e2e_main_release_or_rc]
  - changes:
      paths:
        - test/new-e2e/tests/language-detection/**/*
        - cmd/process-agent/**/*
        - comp/process/**/*
        - pkg/process/**/*
        - comp/core/workloadmeta/collectors/internal/process/**/*
        - comp/core/workloadmeta/collectors/internal/remote/processcollector/**/*
      compare_to: $COMPARE_TO_BRANCH

.on_npm_or_e2e_changes:
  - !reference [.on_e2e_main_release_or_rc]
  - changes:
      paths:
        # TODO: Add paths that should trigger tests for npm
        - pkg/network/**/*
        - test/new-e2e/tests/npm/**/*
      compare_to: $COMPARE_TO_BRANCH

.on_discovery_or_e2e_changes:
  - !reference [.on_e2e_main_release_or_rc]
  - changes:
      paths:
        - cmd/agent/dist/conf.d/discovery.d/*
        - comp/core/autodiscovery/providers/process_log.go
        - test/new-e2e/tests/discovery/**/*
        - pkg/collector/corechecks/discovery/**/*
        - pkg/discovery/**/*
      compare_to: $COMPARE_TO_BRANCH

.on_amp_or_e2e_changes:
  - !reference [.on_e2e_main_release_or_rc]
  - changes:
      paths:
        - test/new-e2e/tests/agent-metric-pipelines/**/*
        - cmd/agent/subcommands/dogstatsd*/*
        - cmd/dogstatsd/**/*
        - comp/agent/jmxlogger/**/*
        - comp/aggregator/**/*
        - comp/collector/**/*
        - comp/core/agenttelemetry/**/*
        - comp/dogstatsd/**/*
        - comp/forwarder/**/*
        - comp/serializer/**/*
        - pkg/aggregator/**/*
        - pkg/collector/**/*
        - pkg/commonchecks/**/*
        - pkg/jmxfetch/**/*
        - pkg/metrics/**/*
        - pkg/persistentcache/**/*
        - pkg/serializer/**/*
        - rtloader/**/*
      compare_to: $COMPARE_TO_BRANCH

.on_alp_or_e2e_changes:
  - !reference [.on_e2e_main_release_or_rc]
  - changes:
      paths:
        - test/new-e2e/tests/agent-log-pipelines/**/*
        - cmd/agent/subcommands/streamlogs/*
        - comp/core/agenttelemetry/**/*
        - comp/core/autodiscovery/providers/config_reader*.go
        - comp/core/autodiscovery/providers/file*.go
        - comp/logs/**/*
        - pkg/logs/**/*
      compare_to: $COMPARE_TO_BRANCH

.on_cws_or_e2e_changes:
  - !reference [.on_e2e_main_release_or_rc]
  - changes:
      paths: *security_agent_change_paths
      compare_to: $COMPARE_TO_BRANCH

.on_process_or_e2e_changes:
  - !reference [.on_e2e_main_release_or_rc]
  - changes:
      paths:
        - test/new-e2e/tests/process/**/*
        - cmd/process-agent/**/*
        - comp/process/**/*
        - pkg/process/**/*
        - pkg/config/setup/process.go
      compare_to: $COMPARE_TO_BRANCH

.on_orchestrator_or_e2e_changes:
  - !reference [.on_e2e_main_release_or_rc]
  - changes:
      paths:
        - comp/forwarder/defaultforwarder/**/*
        - pkg/collector/corechecks/cluster/orchestrator/**/*
        - pkg/collector/corechecks/orchestrator/**/*
        - test/new-e2e/tests/orchestrator/**/*
      compare_to: $COMPARE_TO_BRANCH

.on_apm_or_e2e_changes:
  - !reference [.on_e2e_main_release_or_rc]
  - changes:
      paths:
        - pkg/trace/**/*
        - cmd/trace-agent/**/*
        - comp/trace/**/*
        - test/new-e2e/tests/apm/**/*
        - test/new-e2e/go.mod
      compare_to: $COMPARE_TO_BRANCH
    when: on_success

.on_installer_or_e2e_changes:
  - !reference [.on_e2e_main_release_or_rc]
  - changes:
      paths:
        - .gitlab/deploy/**/*
        - .gitlab/test/e2e_install_packages/**/*
        - .gitlab/test/e2e/e2e.yml
        - omnibus/config/**/*
        - pkg/fleet/**/*
        - cmd/installer/**/*
        - test/new-e2e/tests/fleet/**/*
        - test/new-e2e/tests/installer/**/*
        - tasks/installer.py
        - tools/windows/DatadogAgentInstaller/**/*
      compare_to: $COMPARE_TO_BRANCH
    when: on_success

.on_ndm_netflow_or_e2e_changes:
  - !reference [.on_e2e_main_release_or_rc]
  - changes:
      paths:
        - comp/netflow/**/*
        - test/new-e2e/tests/ndm/netflow/**/*
        - test/new-e2e/go.mod
      compare_to: $COMPARE_TO_BRANCH
    when: on_success

.on_ndm_snmp_or_e2e_changes:
  - !reference [.on_e2e_main_release_or_rc]
  - changes:
      paths:
        - pkg/collector/corechecks/snmp/**/*
        - test/new-e2e/tests/ndm/snmp/**/*
        - test/new-e2e/go.mod
      compare_to: $COMPARE_TO_BRANCH
    when: on_success
  - when: manual
    allow_failure: true

.on_ha_agent_or_e2e_changes:
  - !reference [.on_e2e_main_release_or_rc]
  - changes:
      paths:
        - comp/haagent/**/*
        - pkg/aggregator/**/*
        - test/new-e2e/tests/ha-agent/**/*
        - test/new-e2e/go.mod
      compare_to: $COMPARE_TO_BRANCH
    when: on_success

.on_netpath_or_e2e_changes:
  - !reference [.on_e2e_main_release_or_rc]
  - changes:
      paths:
        - cmd/system-probe/modules/traceroute.go
        - pkg/collector/corechecks/networkpath/**/*
        - pkg/networkpath/**/*
        - comp/networkpath/**/*
        - test/new-e2e/tests/netpath/**/*
        - test/new-e2e/go.mod
      compare_to: $COMPARE_TO_BRANCH
    when: on_success

.on_otel_or_e2e_changes:
  - !reference [.on_e2e_main_release_or_rc]
  - changes:
      paths:
        - cmd/otel-agent/**/*
        - comp/core/tagger/**/*
        - comp/otelcol/**/*
        - pkg/config/setup/otlp.go
        - pkg/trace/api/otlp.go
        - pkg/trace/otel/stats/otel_util.go
        - pkg/trace/otel/traceutil/otel_util.go
        - pkg/trace/transform/transform.go
        - test/new-e2e/tests/otel/**/*
      compare_to: $COMPARE_TO_BRANCH
    when: on_success

.on_otel_components_changes:
  - !reference [.except_mergequeue]
  - !reference [.on_main]
  - changes:
      paths:
        - cmd/otel-agent/**/*
        - comp/otelcol/**/*
      compare_to: $COMPARE_TO_BRANCH
    when: on_success

.on_ssi_or_e2e_changes:
  - !reference [.on_e2e_main_release_or_rc]
  - changes:
      paths:
        - pkg/clusteragent/admission/mutate/autoinstrumentation/**/*
        - pkg/clusteragent/admission/mutate/common/**/*
        - pkg/clusteragent/admission/mutate/config/**/*
        - pkg/clusteragent/admission/mutate/tagsfromlabels/**/*
        - pkg/clusteragent/admission/common/**/*
        - pkg/clusteragent/admission/controllers/webhook/**/*
        - comp/core/workloadmeta/collectors/internal/kubeapiserver/**/*
        - comp/languagedetection/**/*
        - pkg/ssi/**/*
        - test/new-e2e/tests/ssi/**/*
      compare_to: $COMPARE_TO_BRANCH

.on_windows_service_or_e2e_changes:
  - !reference [.on_e2e_main_release_or_rc]
  - changes:
      paths:
        - cmd/agent/**/*
        - cmd/installer/**/*
        - cmd/process-agent/**/*
        - cmd/security-agent/**/*
        - cmd/system-probe/**/*
        - cmd/trace-agent/**/*
        - pkg/util/winutil/servicemain/**/*
        - pkg/util/winutil/messagestrings/**/*
        - tasks/windows_resources.py
        - test/new-e2e/tests/windows/service-test/**/*
      compare_to: $COMPARE_TO_BRANCH
    when: on_success

.on_windows_certificate_or_e2e_changes:
  - !reference [.on_e2e_main_release_or_rc]
  - changes:
      paths:
        - test/new-e2e/tests/windows/windows-certificate/**/*
        - pkg/collector/corechecks/system/windowscertificate/**/*
      compare_to: $COMPARE_TO_BRANCH
    when: on_success

.on_windows_fips_compliance_or_e2e_changes:
  - !reference [.on_e2e_main_release_or_rc]
  - <<: *on_build_changes
    when: on_success
  - changes:
      paths:
        - test/new-e2e/tests/fips-compliance/**/*
      compare_to: $COMPARE_TO_BRANCH
    when: on_success

.on_trace_agent_changes_or_manual:
  - !reference [.except_mergequeue]
  - changes:
      paths:
        - pkg/trace/**/*
        - .gitlab/test/benchmarks/*
      compare_to: $COMPARE_TO_BRANCH
    when: on_success
  - when: manual
    allow_failure: true

.on_cspm_or_e2e_changes:
  - !reference [.on_e2e_main_release_or_rc]
  - changes:
      paths:
        - pkg/security/**/*
        - test/new-e2e/tests/cspm/**/* #TODO: Add other paths that should trigger the execution of CSPM e2e tests
      compare_to: $COMPARE_TO_BRANCH
    when: on_success

.on_sbom_or_e2e_changes:
  - !reference [.on_e2e_main_release_or_rc]
  - changes:
      paths:
        - pkg/sbom/**/*
        - test/new-e2e/tests/sbom/**/*
      compare_to: $COMPARE_TO_BRANCH
    when: on_success

.on_windows_systemprobe_or_e2e_changes:
  - !reference [.on_e2e_main_release_or_rc]
  - changes:
      paths:
        - pkg/discovery/module/*
        - pkg/network/**/*
        - pkg/process/monitor/*
        - pkg/util/kernel/**/*
        - test/new-e2e/tests/sysprobe-functional/**/*
      compare_to: $COMPARE_TO_BRANCH
    when: on_success

.on_windows_security_or_e2e_changes:
  - !reference [.on_e2e_main_release_or_rc]
  - changes:
      paths:
        - pkg/security/**/*
        - pkg/eventmonitor/**/*
        - test/new-e2e/tests/security-agent-functional/**/*
      compare_to: $COMPARE_TO_BRANCH
    when: on_success

.on_healthplatform_or_e2e_changes:
  - !reference [.on_e2e_main_release_or_rc]
  - changes:
      paths:
        - comp/healthplatform/**/*
        - test/new-e2e/tests/agent-health/**/*
      compare_to: $COMPARE_TO_BRANCH
    when: on_success

.on_privateactionrunner_or_e2e_changes:
  - !reference [.on_e2e_main_release_or_rc]
  - changes:
      paths:
        - cmd/privateactionrunner/**/*
        - comp/privateactionrunner/**/*
        - pkg/privateactionrunner/**/*
        - pkg/config/setup/privateactionrunner.go
        - pkg/proto/datadog/privateactionrunner/**/*
        - pkg/proto/pbgo/privateactionrunner/**/*
        - test/new-e2e/tests/privateactionrunner/**/*
      compare_to: $COMPARE_TO_BRANCH
    when: on_success

.on_scheduled_main:
  - <<: *if_scheduled_main
    when: always

.on_scheduled_main_on_success:
  - <<: *if_scheduled_main
    when: on_success

.on_scheduled_main_or_release_branch:
  - if: $DDR_WORKFLOW_ID != null && ($CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH =~ /^[0-9]+\.[0-9]+\.x$/)
    when: always

.on_main_or_rc_and_no_skip_e2e:
  - <<: *if_disable_e2e_tests
    when: never
  - <<: *if_release_branch
    when: on_success
  - if: $CI_COMMIT_TAG =~ /^[0-9]+\.[0-9]+\.[0-9]+-rc\.[0-9]+$/
    when: on_success
  - <<: *if_main_branch
    when: on_success

.except_disable_unit_tests:
  - <<: *if_disable_unit_tests
    when: never

.except_disable_e2e_tests:
  - <<: *if_disable_e2e_tests
    when: never

.on_macos_files_change:
  - !reference [.except_mergequeue] # The prerequisites are not run in the mergequeue pipeline so we need to skip this rule
  - changes:
      paths:
        - comp/core/gui/guiimpl/systray/**/*
        - "**/*.m"
      compare_to: $COMPARE_TO_BRANCH

.on_macos_change:
  - !reference [.except_mergequeue] # The prerequisites are not run in the mergequeue pipeline so we need to skip this rule
  - changes:
      paths:
        - omnibus/**/*
        - .gitlab-ci.yml
        - release.json
        - .gitlab/build/package_build/**/*
      compare_to: $COMPARE_TO_BRANCH
  - changes:
      paths: *bazel_paths
      compare_to: $COMPARE_TO_BRANCH

.on_go-version_change:
  - !reference [.except_mergequeue] # The prerequisites are not run in the mergequeue pipeline so we need to skip this rule
  - changes:
      paths:
        - .go-version
      compare_to: $COMPARE_TO_BRANCH

.on_fakeintake_changes:
  - changes:
      <<: *fakeintake_paths
      compare_to: $COMPARE_TO_BRANCH

.on_fakeintake_changes_on_main:
  - changes:
      <<: *fakeintake_paths
    <<: *if_main_branch

.fast_on_dev_branch_only:
  - <<: *if_main_branch
    variables:
      FAST_TESTS: "false"
      # Push coverage cache on main branch
      COVERAGE_CACHE_FLAG: "--push-coverage-cache"
  - <<: *if_release_branch
    variables:
      FAST_TESTS: "false"
      COVERAGE_CACHE_FLAG: ""
  - <<: *if_tagged_commit
    variables:
      FAST_TESTS: "false"
      COVERAGE_CACHE_FLAG: ""
  - <<: *if_triggered_pipeline
    variables:
      FAST_TESTS: "false"
      COVERAGE_CACHE_FLAG: ""
  - <<: *if_run_all_unit_tests
    variables:
      FAST_TESTS: "false"
      COVERAGE_CACHE_FLAG: ""
  - variables:
      FAST_TESTS: "true"
      # Pull coverage cache on dev branches
      COVERAGE_CACHE_FLAG: "--pull-coverage-cache"

.on_gitlab_changes:
  changes:
    paths:
      - .gitlab-ci.yml
      - .gitlab/**/*
      - .gitlab/**/.*
    compare_to: $COMPARE_TO_BRANCH

.on_gitlab_changes_or_mergequeue_or_main:
  - !reference [.on_gitlab_changes]
  - !reference [.on_mergequeue]
  - !reference [.on_main]

.on_invoke_tasks_changes:
  - <<: *if_main_branch
  - changes:
      paths:
        - tasks/**/*
        - .gitlab-ci.yml # A buildimage bump can also affect the invoke tasks
      compare_to: $COMPARE_TO_BRANCH

.on_gpu_or_e2e_changes:
  - !reference [.on_e2e_main_release_or_rc]
  - changes:
      paths:
        - pkg/gpu/**/*
        - pkg/ebpf/**/*
        - pkg/util/kernel/**/*
        - test/new-e2e/tests/gpu/**/*
        - pkg/collector/corechecks/gpu/**/*
        - comp/core/workloadmeta/collectors/internal/nvml/**/*
        - comp/core/autodiscovery/listeners/staticconfig.go
      compare_to: $COMPARE_TO_BRANCH

.on_gpu_integration_tests:
  - !reference [.on_scheduled_main]
  - !reference [.manual]
  # Run on GPU-related changes
  - changes:
      paths:
        - pkg/gpu/**/*
        - pkg/collector/corechecks/gpu/**/*
        - comp/core/workloadmeta/collectors/internal/nvml/**/*
        - .gitlab/build/source_test/linux.yml
      compare_to: $COMPARE_TO_BRANCH
    when: on_success

.on_installer_systemd_changes:
  - <<: *if_main_branch
  - !reference [.except_mergequeue]
  - changes:
      paths:
        - pkg/fleet/installer/packages/embedded/tmpl/**/*.service
      compare_to: $COMPARE_TO_BRANCH
  - when: manual
    allow_failure: true

.on_releasenotes_changes:
  - <<: *if_main_branch
  - !reference [.except_mergequeue]
  - changes:
      paths:
        - releasenotes/notes/**/*.yaml
        - releasenotes-dca/notes/**/*.yaml
      compare_to: $COMPARE_TO_BRANCH
  - when: manual
    allow_failure: true

.except_coverage_pipeline:
  - <<: *if_coverage_pipeline
    when: never

.on_coverage_pipeline:
  - <<: *if_coverage_pipeline
    when: on_success
.always_on_coverage_pipeline:
  - <<: *if_coverage_pipeline
    when: always

# This is used to setup utils to report custom datadog-ci spans
.setup-datadog-ci-sections:
  - |
    if [ -z "$DATADOG_API_KEY" ]; then
      DATADOG_API_KEY="$("$CI_PROJECT_DIR"/tools/ci/fetch_secret.sh "$AGENT_API_KEY_ORG2" token)" || exit $?; export DATADOG_API_KEY
    fi
  - |
    # Start a custom datadog span
    # datadog-ci-start-section <name>
    datadog-ci-start-section()
    {
      export sectionname="$1"
      if [ -z "$sectionname" ]; then
        echo "datadog-ci-end-section: name is required as first argument" >& 2
        return 1
      fi
      export datestart="$(date '+%s%N' | cut -b1-13)"
    }
    # Finish and send the span to Datadog
    # datadog-ci-end-section [--end-time <timestamp>] [--category <category>] <name>
    datadog-ci-end-section()
    {
      if [ "$1" = "--end-time" ]; then
        shift
        dateend="$1"
        shift
      else
        dateend="$(date '+%s%N' | cut -b1-13)"
      fi
      if [ "$1" = "--category" ]; then
        shift
        category="--tags agent-category:$1"
        shift
      fi
      name="$1"
      if [ -z "$name" ]; then
        echo "datadog-ci-end-section: name is required as first argument" >& 2
        return 1
      fi
      if [ "$name" != "$sectionname" ]; then
        echo "datadog-ci-end-section: name does not match the last section name (got $name but was $sectionname)" >& 2
        return 1
      fi
      if [ -z "$datestart" ]; then
        echo "datadog-ci-end-section: datadog-ci-start-section was not called" >& 2
        return 1
      fi
      datadog-ci trace span --name "$name" --start-time "$datestart" --end-time "$dateend" --tags agent-custom-span:true $category
      if [ "$?" -ne 0 ]; then
        # Don't fail the job for that
        echo "WARNING: datadog-ci trace span failed" >& 2
      fi
      export datestart=
      export sectionname=
    }

.retry_only_infra_failure:
  retry:
    max: 2
    exit_codes:
      - 42
    when:
      - runner_system_failure
      - stuck_or_timeout_failure
      - unknown_failure
      - api_failure
      - scheduler_failure
      - stale_schedule
      - data_integrity_failure