[nodejs] test(debugger): enable the snapshot correlation tests

[watson]

Motivation

Coordinated snapshot sampling for Node.js (DEBUG-5831, DataDog/dd-trace-js#10677) needs the snapshot correlation tests from #7425 to run for Node.js. Node.js only supports line probes, and the Node.js weblogs don't have the correlation endpoints yet.

Important

This PR builds on #7425, which adds the tests, probe files and line-map keys extended here. #7425's branch is far behind main, so its CI fails on unrelated, outdated infrastructure: Debian security mirrors, the Go toolchain required by dd-trace-go dev, and capabilities.yml. So this PR's base is watson/correlation-tests-rebased-onto-main: #7425's two commits rebased onto main, with conflicts resolved by keeping main's side and adding #7425's new entries, plus one fix on top: #7425's using System.Runtime.CompilerServices; moved every line of the .NET DebuggerController.cs down by one, which broke all .NET line probes, so the base fully qualifies the MethodImpl attributes instead. It also includes #7572's approved commit (accepting the flat dd.trace_id key that .NET sends), which the .NET enablement in #7425 needs to pass. Once #7425 is updated or merged, this PR gets retargeted.

Changes

• Add /debugger/correlation and /debugger/correlation/loop/:count to the Node.js Express, TypeScript Express and Fastify weblogs, mirroring the Go endpoints:
  • correlationLeaf, correlationMiddle and correlation return about 0, 400 and 800ms into the request, using real async sleeps, so trace context also crosses awaits.
  • The loop sleeps 1s per iteration, and its body and sibling lines are probed.
  • All three files keep identical line numbers.
  • The additions avoid everything the IAST rewriter instruments (+, +=, template literals and some string methods) and respond with constant strings. The debugger scenarios run with IAST enabled, and when the rewriter rewrites a file, Dynamic Instrumentation places line probes in it two lines too early. An earlier revision used template literals, which broke the line probes of the existing debugger tests too.
• In test_debugger_snapshot_correlation.py, both test classes read their probes through a small shared base class. For Node.js, it points each method probe at the line its method returns on, the same approach as the Node.js-only method-to-line conversions in the condition-error tests.
• Add the Node.js line-map entries: Correlation (178), CorrelationMiddle (184), CorrelationLeaf (188), CorrelationLoopBody (194) and CorrelationLoopSibling (197). The new routes move CaptureTimeout from 157 to 159 and Budgets from 163 to 165.
• In manifests/nodejs.yml, enable Test_Debugger_Coordinated_Sampling and test_per_span_budget from >=6.21.0 || ^5.132.0, the next release, which should ship feat(debugger): coordinate snapshot sampling per trace dd-trace-js#10677. The two Test_Debugger_Snapshot_Correlation_Fields tests stay missing_feature. The runtime_id one can be enabled once feat(debugger): include runtime_id in snapshot payloads dd-trace-js#10678 ships.
• Refresh base-images.lock.json and the Node.js entries of the image mirror files, because the fixture changes alter the express4, express4-typescript, express5 and fastify base-image hashes. The images are published.
  • The mirror lock on main is also behind for the PHP base images updated in fix(php): profiling marker checks #7658. Those entries are left alone here.

Testing

Docker wasn't available locally. Instead, the real express/debugger/index.js routes ran under dd-trace-js with a fake agent, replaying both scenarios with the same probes (line probes on 178/184/188 at 1 snapshot/s, 30 sequential requests; loop probes with default sampling and /loop/3), with IAST enabled as in CI:

dd-trace-js	/debugger/correlation ×30	/debugger/correlation/loop/3
DataDog/dd-trace-js#10677	15 traces with snapshots: 15 full chains, 0 partial	body: 1 snapshot, sibling: 1 snapshot
master	15 traces with snapshots: 15 full chains, 0 partial	body: 3 snapshots, sibling: 1 snapshot

Warning

For Node.js, Test_Debugger_Coordinated_Sampling passes without coordinated sampling too. Each request takes nearly the same time (about 840ms), and every probe has the same 1 snapshot/s limit, so each probe sees the same time since its own last snapshot. Independent per-probe sampling then stays in lockstep and emits whole chains anyway. Making it discriminating would need the probes' sampling to drift apart, for example different snapshotsPerSecond per probe, or one probe also hit outside the chain. DataDog/dd-trace-js#10677's own integration test does the latter. I left that for the RFC owner to decide rather than changing the shared test here. test_per_span_budget does discriminate.

With IAST enabled and disabled, a snapshot probe on each mapped Node.js line (20, 159, 165, 178, 184, 188, 194 and 197) pauses on exactly that line.

Checks:

• ./format.sh --check: mypy, import policy, ruff, yamlfmt, yamllint, the manifest parser and shellcheck pass. The Node.js linter step needs Docker, so I ran ESLint from the Express and Fastify weblog setups directly on their debugger/index.js: both pass.
• express4-typescript/debugger/index.ts type-checks with tsc --strict against a minimal Express type stub, since the weblog's dependencies aren't installed locally.

Expected CI failures:

• test_db_integrations_sql.py fails on the dev weblogs of several libraries. This is unrelated: Do not report irrelevant test to Test Optim #7987, which is based on main, fails the same way.
• Until feat(debugger): coordinate snapshot sampling per trace dd-trace-js#10677 merges: CI runs the Node.js dev weblogs with dd-trace-js master, whose 7.0.0-pre version already counts as >=6.21.0. So test_per_span_budget fails on dev until the feature is on master. This is the documented flow for unmerged library changes in docs/edit/enable-test.md: enable the test for the next version, merge the library change, then re-run this PR.

Before merging

• feat(debugger): coordinate snapshot sampling per trace dd-trace-js#10677 is merged, and CI is re-run.
• test(debugger): add snapshot-correlation gate and Go weblog endpoints #7425 is updated or merged, and this PR is retargeted.

Workflow

1. ⚠️ Create your PR as draft ⚠️
2. Work on you PR until the CI passes
3. Mark it as ready for review
   • Test logic is modified? -> Get a review from RFC owner.
   • Framework is modified, or non obvious usage of it -> get a review from R&P team

🚀 Once your PR is reviewed and the CI green, you can merge it!

🛟 #apm-shared-testing 🛟

Reviewer checklist

• Anything but tests/ or manifests/ is modified ? I have the approval from R&P team
• A docker base image is modified?
  • the relevant build-XXX-image label is present
• A scenario is added, removed or renamed?
  • Get a review from R&P team

🤖 Generated with Claude Code

[github-actions]

CODEOWNERS have been resolved as:

manifests/nodejs.yml                                                    @DataDog/system-tests-reviewers
mirror_images.lock.yaml                                                 @DataDog/system-tests-core
mirror_images.yaml                                                      @DataDog/system-tests-core
tests/debugger/test_debugger_snapshot_correlation.py                    @DataDog/debugger
tests/debugger/utils.py                                                 @DataDog/debugger
utils/build/docker/base-images.lock.json                                @DataDog/system-tests-reviewers
utils/build/docker/nodejs/express/debugger/index.js                     @DataDog/system-tests-reviewers
utils/build/docker/nodejs/express4-typescript/debugger/index.ts         @DataDog/system-tests-reviewers
utils/build/docker/nodejs/fastify/debugger/index.js                     @DataDog/system-tests-reviewers

[datadog-datadog-us1-prod]

🎉 All green!

❄️ No new flaky tests detected

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 3d3ef41 | Docs | View more details | Give us feedback!}