Merge branch 'master' of github.com:DataDog/dd-trace-php into leiyks-use-rust-span-in-tracer

Author: bwoebi

.github/chainguard/gitlab-ci-aggregate-versions.sts.yaml

@@ -2,12 +2,6 @@ issuer: https://gitlab.ddbuild.io
 
 subject_pattern: "project_path:DataDog/apm-reliability/dd-trace-php:ref_type:(branch|tag):ref:.*"
 
-claim_pattern:
-  project_path: "DataDog/apm-reliability/dd-trace-php"
-  ref: ".*"
-  ref_type: "(branch|tag)"
-  pipeline_source: "(push|schedule)"
-
 permissions:
   actions: write
   contents: write

.github/chainguard/gitlab-ci-publish-release.sts.yaml

@@ -0,0 +1,6 @@
+issuer: https://gitlab.ddbuild.io
+
+subject_pattern: "project_path:DataDog/apm-reliability/dd-trace-php:ref_type:tag:ref:ddtrace-.*"
+
+permissions:
+  contents: write 

.gitlab/generate-package.php

@@ -85,6 +85,7 @@
   - notify
   - verify
   - shared-pipeline # OCI packaging
+  - pre-release
   - release
 
 variables:
@@ -1403,6 +1404,33 @@
     UPSTREAM_BRANCH: $CI_COMMIT_REF_NAME
     UPSTREAM_COMMIT_SHA: $CI_COMMIT_SHA
 
+"generate github token":
+  stage: pre-release
+  image: registry.ddbuild.io/images/dd-octo-sts-ci-base:2025.06-1
+  tags: [ "arch:amd64" ]
+  only:
+    refs:
+      - /^ddtrace-.*$/
+  id_tokens:
+    DDOCTOSTS_ID_TOKEN:
+      aud: dd-octo-sts
+  script:
+    - echo "Generating GitHub token for release..."
+    - dd-octo-sts debug --scope DataDog/dd-trace-php --policy gitlab-ci-publish-release
+    - dd-octo-sts token --scope DataDog/dd-trace-php --policy gitlab-ci-publish-release > github_token.txt
+    # Verify token works
+    - export GITHUB_TOKEN=$(cat github_token.txt)
+    - 'curl -f -H "Authorization: token $GITHUB_TOKEN" https://api.github.com/repos/DataDog/dd-trace-php | jq -r .name'
+    - echo "Token generated and verified successfully"
+  artifacts:
+    paths:
+      - github_token.txt
+    expire_in: 1 hour
+    when: on_success
+  variables:
+    # Prevent token from appearing in logs
+    GITHUB_TOKEN: "[MASKED]"
+
 "publish release to github":
   stage: release
   image: registry.ddbuild.io/images/mirror/php:8.2-cli
@@ -1411,6 +1439,8 @@
     refs:
       - /^ddtrace-.*$/
   needs:
+    - job: "generate github token"
+      artifacts: true
     - job: "datadog-setup.php"
       artifacts: true
     - job: "package extension windows"
@@ -1420,5 +1450,12 @@
       artifacts: true
 <?php endforeach; ?>
   script:
-    - if [ -z ${GITHUB_RELEASE_PAT} ]; then export GITHUB_RELEASE_PAT=$(aws ssm get-parameter --region us-east-1 --name ci.$CI_PROJECT_NAME.gh_token --with-decryption --query "Parameter.Value" --out text); fi
-    - php tooling/bin/create_release.php packages
+    - echo "Using pre-generated GitHub token for release..."
+    - export GITHUB_RELEASE_PAT=$(cat github_token.txt)
+    - php tooling/ci/create_release.php packages
+  after_script:
+    # Clean up token file (token will expire automatically in 1 hour)
+    - rm -f github_token.txt
+  variables:
+    # Prevent token from appearing in logs
+    GITHUB_RELEASE_PAT: "[MASKED]"

components-rs/Cargo.toml

@@ -12,7 +12,6 @@ ddcommon = { path = "../libdatadog/ddcommon", features = ["cgroup_testing"] }
 ddcommon-ffi = { path = "../libdatadog/ddcommon-ffi", default-features = false }
 ddtelemetry = { path = "../libdatadog/ddtelemetry" }
 ddtelemetry-ffi = { path = "../libdatadog/ddtelemetry-ffi", default-features = false }
-data-pipeline-ffi = { path = "../libdatadog/data-pipeline-ffi", default-features = false }
 datadog-live-debugger = { path = "../libdatadog/datadog-live-debugger" }
 datadog-live-debugger-ffi = { path = "../libdatadog/datadog-live-debugger-ffi", default-features = false }
 datadog-ipc = { path = "../libdatadog/datadog-ipc" }

ext/distributed_tracing_headers.c

@@ -655,7 +655,7 @@ void ddtrace_apply_distributed_tracing_result(ddtrace_distributed_tracing_result
         if (DDTRACE_G(tracestate)) {
             zend_string_release(DDTRACE_G(tracestate));
         }
-        DDTRACE_G(tracestate) = result->tracestate;  
+        DDTRACE_G(tracestate) = result->tracestate;
         zend_hash_destroy(&DDTRACE_G(baggage));
         DDTRACE_G(baggage) = result->baggage;
         zend_string *key;
@@ -675,6 +675,15 @@ void ddtrace_apply_distributed_tracing_result(ddtrace_distributed_tracing_result
     result->meta_tags.pDestructor = NULL; // we moved values directly
     zend_hash_destroy(&result->meta_tags);
 
+    if (result->trace_id.low || result->trace_id.high || result->priority_sampling != DDTRACE_PRIORITY_SAMPLING_UNKNOWN) {
+        if (span) {
+            ZVAL_LONG(&zv, result->priority_sampling);
+            ddtrace_assign_variable(&span->property_propagated_sampling_priority, &zv);
+        } else {
+            DDTRACE_G(propagated_priority_sampling) = result->priority_sampling;
+        }
+    }
+
     if (result->priority_sampling != DDTRACE_PRIORITY_SAMPLING_UNKNOWN) {
         bool reset_decision_maker = result->conflicting_sampling_priority || !zend_hash_str_exists(root_meta, ZEND_STRL("_dd.p.dm"));
         if (reset_decision_maker) {
@@ -687,11 +696,8 @@ void ddtrace_apply_distributed_tracing_result(ddtrace_distributed_tracing_result
             }
         }
         if (!span) {
-            DDTRACE_G(propagated_priority_sampling) = DDTRACE_G(default_priority_sampling) = result->priority_sampling;
+            DDTRACE_G(default_priority_sampling) = result->priority_sampling;
         } else {
-            ZVAL_LONG(&zv, result->priority_sampling);
-            ddtrace_assign_variable(&span->property_propagated_sampling_priority, &zv);
-
             ddtrace_set_priority_sampling_on_span(span, result->priority_sampling, DD_MECHANISM_DEFAULT);
         }
     }

ext/priority_sampling/priority_sampling.c

@@ -15,6 +15,10 @@
 #include "components/log/log.h"
 #include "agent_info.h"
 
+/* Sampling constants */
+const uint64_t KNUTH_FACTOR = 1111111111111111111ULL;
+const uint64_t MAX_TRACE_ID = ~0ULL;  // 2^64-1 - This represents the maximum value of a Trace ID
+
 ZEND_EXTERN_MODULE_GLOBALS(ddtrace);
 
 void ddtrace_try_read_agent_rate(void) {
@@ -210,8 +214,8 @@ static ddtrace_rule_result dd_decide_on_open_span_sampling(ddtrace_root_span_dat
     ddtrace_rule_result result = root->sampling_rule;
     do {
         ddtrace_span_data *span = SPANDATA(span_props);
-
-        ddtrace_rule_result new_result = dd_match_rules(span, &root->span == span && !root->parent_id, result.rule);
+        bool is_root = &root->span == span && (!root->parent_id || zval_get_long(&root->property_propagated_sampling_priority) == DDTRACE_PRIORITY_SAMPLING_UNKNOWN);
+        ddtrace_rule_result new_result = dd_match_rules(span, is_root, result.rule);
         if (new_result.rule != INT32_MAX) {
             result = new_result;
         }
@@ -230,7 +234,7 @@ static void dd_decide_on_sampling(ddtrace_root_span_data *span) {
     double sample_rate = 0;
     bool explicit_rule = true;
 
-    if (is_trace_root) {
+    if (is_trace_root || zval_get_long(&span->property_propagated_sampling_priority) == DDTRACE_PRIORITY_SAMPLING_UNKNOWN) {
         // when we sample, we need to fetch the env first
         ddtrace_check_agent_info_env();
 
@@ -295,7 +299,7 @@ static void dd_decide_on_sampling(ddtrace_root_span_data *span) {
     }
 
     // this must be stable on re-evaluation
-    bool sampling = (double)span->trace_id.low < sample_rate * (double)~0ULL;
+    bool sampling = (span->trace_id.low * KNUTH_FACTOR) <= (sample_rate * MAX_TRACE_ID);
     bool limited = false;
     if (result.mechanism != DD_MECHANISM_MANUAL && ddtrace_limiter_active() && sampling) {
         if (span->trace_is_limited == DD_TRACE_LIMIT_UNCHECKED) {