DataDog · rochdev · May 13, 2026 · May 8, 2026 · May 8, 2026 · May 8, 2026
@@ -4,4 +4,12 @@ coverage:
   precision: 2
   status:
     project: off
-    patch: off
+    patch:
+      default:
+        target: 95%
+        if_not_found: success
+        if_ci_failed: success
+        # PRs against `vN.x` release branches are typically backports / cherry-picks
+        # where the patch coverage is decided in the source PR; only enforce on master.
+        branches:
+          - master
@@ -32,6 +32,7 @@
 /packages/dd-trace/src/lambda/ @DataDog/serverless-aws @DataDog/apm-serverless
 /packages/dd-trace/test/lambda/ @DataDog/serverless-aws @DataDog/apm-serverless
 /packages/dd-trace/test/azure_metadata.spec.js @DataDog/apm-serverless
+/packages/dd-trace/test/serverless.spec.js @DataDog/apm-serverless
 /packages/dd-trace/test/plugins/util/inferred_proxy.spec.js @DataDog/serverless-aws @DataDog/apm-serverless
 
 # IDM
@@ -43,6 +44,7 @@
 /benchmark/sirun/plugin-net/ @DataDog/apm-idm-js
 /benchmark/sirun/plugin-q/ @DataDog/apm-idm-js
 
+/integration-tests/electron/ @DataDog/apm-idm-js
 /integration-tests/esbuild/ @DataDog/apm-idm-js
 /integration-tests/webpack/ @DataDog/apm-idm-js
 /integration-tests/pino.spec.js @DataDog/apm-idm-js
@@ -53,6 +55,7 @@
 /packages/datadog-webpack @DataDog/apm-idm-js
 /packages/datadog-plugin-*/ @DataDog/apm-idm-js
 /packages/datadog-instrumentations/ @DataDog/apm-idm-js
+/packages/dd-trace/src/exporters/electron/ @DataDog/apm-idm-js
 /packages/dd-trace/src/plugins/ @DataDog/apm-idm-js
 /packages/dd-trace/test/plugins/ @DataDog/apm-idm-js
 /packages/dd-trace/src/service-naming/ @DataDog/apm-idm-js
@@ -121,6 +124,7 @@
 /integration-tests/vitest/ @DataDog/ci-app-libraries
 /integration-tests/vitest.config.mjs @DataDog/ci-app-libraries
 /integration-tests/ci-visibility-intake.js @DataDog/ci-app-libraries
+/integration-tests/ci-visibility-intake.spec.js @DataDog/ci-app-libraries
 /integration-tests/CODEOWNERS @DataDog/ci-app-libraries
 /integration-tests/config-jest-multiproject.js @DataDog/ci-app-libraries
 /integration-tests/config-jest.js @DataDog/ci-app-libraries
@@ -236,7 +240,13 @@
 /.github/actions/push_to_test_optimization/ @DataDog/ci-app-libraries
 /.github/actions/upload-node-reports/action.yml @Datadog/lang-platform-js
 /.github/chainguard @DataDog/sdlc-security
+/.github/codeql_config.yml @DataDog/sdlc-security
+/.github/workflows/codeql-analysis.yml @DataDog/sdlc-security
 /.github/workflows/mirror-image.yml @Datadog/lang-platform-js
+/.github/workflows/all-green.yml @Datadog/lang-platform-js
+/.github/workflows/custom-node-version-dispatch.yml @Datadog/lang-platform-js
+/.github/workflows/project.yml @Datadog/lang-platform-js
+/.github/workflows/stale.yml @Datadog/lang-platform-js
 /scripts/check-no-mcr-images.js @Datadog/lang-platform-js
 
 /.github/workflows/apm-capabilities.yml @DataDog/apm-sdk-capabilities-js
@@ -245,6 +255,7 @@
 /.github/workflows/appsec.yml @DataDog/asm-js
 /.github/workflows/debugger.yml @DataDog/debugger-nodejs
 /.github/workflows/instrumentation.yml @DataDog/apm-idm-js
+/.github/workflows/electron.yml @DataDog/apm-idm-js
 /.github/workflows/serverless.yml @DataDog/serverless-aws @DataDog/apm-serverless
 /.github/workflows/llmobs.yml @DataDog/ml-observability
 /.github/workflows/profiling.yml @DataDog/profiling-js

@@ -23,12 +23,13 @@ runs:
       run: echo "version=$NODE_VERSION" >> "$GITHUB_OUTPUT"
 
     # Cache a tiny file containing the exact Node.js version resolved by a previous run.
-    # Key rotates every 20 minutes (epoch / 1200) so patches are picked up regularly.
-    # On cache hit, install the cached patch and skip the manifest lookup.
+    # Key rotates every 60 minutes (epoch / 3600), capping setup-node manifest API
+    # calls at one per (os, arch, major) per hour. On cache hit, install the cached
+    # patch directly and skip the manifest lookup.
     - name: Compute cache key
       id: cache-key
       shell: bash
-      run: echo "block=$(( $(date -u +%s) / 1200 ))" >> "$GITHUB_OUTPUT"
+      run: echo "block=$(( $(date -u +%s) / 3600 ))" >> "$GITHUB_OUTPUT"
     - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       id: node-version-cache
       with:
@@ -50,7 +51,7 @@ runs:
         check-latest: ${{ steps.cached.outputs.version == '' }}
         registry-url: ${{ inputs.registry-url || 'https://registry.npmjs.org' }}
 
-    # Persist the resolved version so subsequent runs within this 20-minute window can reuse it.
+    # Persist the resolved version so subsequent runs within this 60-minute window can reuse it.
     - name: Save resolved version
       if: steps.node-version-cache.outputs.cache-hit != 'true'
       shell: bash

@@ -0,0 +1,11 @@
+issuer: https://token.actions.githubusercontent.com
+
+subject_pattern: 'repo:DataDog/dd-trace-js:(ref:refs/heads/master|pull_request)'
+
+claim_pattern:
+  event_name: (push|pull_request|schedule)
+  job_workflow_ref: DataDog/dd-trace-js/\.github/workflows/all-green\.yml@.*
+
+permissions:
+  actions: write
+  contents: read
@@ -0,0 +1,12 @@
+issuer: https://token.actions.githubusercontent.com
+
+subject_pattern: 'repo:DataDog/dd-trace-js:(ref:refs/heads/(master|mq-working-branch-master-.*)|pull_request)'
+
+claim_pattern:
+  event_name: (push|pull_request)
+  job_workflow_ref: DataDog/dd-trace-js/\.github/workflows/codeql-analysis\.yml@.*
+
+permissions:
+  contents: read
+  actions: read
+  security_events: write
@@ -0,0 +1,11 @@
+issuer: https://token.actions.githubusercontent.com
+
+subject: repo:DataDog/dd-trace-js:ref:refs/heads/master
+
+claim_pattern:
+  event_name: workflow_dispatch
+  ref: refs/heads/master
+  job_workflow_ref: DataDog/dd-trace-js/\.github/workflows/custom-node-version-dispatch\.yml@refs/heads/master
+
+permissions:
+  actions: write
@@ -0,0 +1,10 @@
+issuer: https://token.actions.githubusercontent.com
+
+subject_pattern: 'repo:DataDog/dd-trace-js:(ref:refs/heads/(master|mq-working-branch-master-.*)|pull_request)'
+
+claim_pattern:
+  event_name: (push|pull_request)
+  job_workflow_ref: DataDog/dd-trace-js/\.github/workflows/project\.yml@.*
+
+permissions:
+  pull_requests: write
@@ -0,0 +1,11 @@
+issuer: https://token.actions.githubusercontent.com
+
+subject: repo:DataDog/dd-trace-js:ref:refs/heads/master
+
+claim_pattern:
+  event_name: schedule
+  ref: refs/heads/master
+  job_workflow_ref: DataDog/dd-trace-js/\.github/workflows/stale\.yml@refs/heads/master
+
+permissions:
+  pull_requests: write
@@ -15,9 +15,13 @@ jobs:
   all-green:
     runs-on: ubuntu-latest
     permissions:
-      actions: write
-      contents: read
+      id-token: write
     steps:
+      - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
+        id: octo-sts
+        with:
+          scope: DataDog/dd-trace-js
+          policy: all-green
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           sparse-checkout-cone-mode: false
@@ -32,6 +36,6 @@ jobs:
         env:
           DELAY: ${{ github.run_attempt == 1 && '5' || '0' }} # 5 minutes on first attempt, no delay on reruns
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number }}
-          GITHUB_TOKEN: ${{ github.token }}
+          GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }}
           POLLING_INTERVAL: 1
           RETRIES: 30
@@ -334,8 +334,6 @@ jobs:
       matrix:
         node-version: [eol]
         range:
-          # - '^2.6.12' skipping due to bug with couchbase integration that is blocking CI.
-          # TODO: diagnose and fix failures. Link to bug issue: https://github.com/DataDog/dd-trace-js/issues/6400
           - "^3.0.7"
           - ">=4.0.0 <4.2.0"
         include:
@@ -442,6 +440,31 @@ jobs:
         with:
           dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
 
+  electron:
+    runs-on: ubuntu-latest
+    env:
+      PLUGINS: electron
+    steps:
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: ./.github/actions/testagent/start
+      - uses: ./.github/actions/node/latest
+      - uses: ./.github/actions/install
+      # Ubuntu 24.04 tightened AppArmor defaults and now blocks unprivileged user
+      # namespaces, which Electron's Chromium sandbox requires to run. Setting
+      # this to 0 re-enables them for the duration of the job.
+      - run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+      - run: |
+          sudo apt-get update
+          # Xvfb provides a virtual X display so Electron (a GUI app) can start
+          # on the headless CI runner without a physical screen.
+          sudo apt-get install -y xvfb
+          # Launch the virtual display on screen :99 with a 24-bit 1024×768
+          # framebuffer. Output is discarded; the & backgrounds it so the step
+          # does not block.
+          Xvfb :99 -screen 0 1024x768x24 > /dev/null 2>&1 &
+      # Point Electron at the virtual display started above.
+      - run: DISPLAY=:99 yarn test:plugins:ci
+
   express:
     runs-on: ubuntu-latest
     env:

@@ -1,14 +1,3 @@
-# For most projects, this workflow file will not need changing; you simply need
-# to commit it to your repository.
-#
-# You may wish to alter this file to override the set of languages analyzed,
-# or to provide custom queries or build logic.
-#
-# ******** NOTE ********
-# We have attempted to detect the languages in your repository. Please check
-# the `language` matrix defined below to confirm you have the correct set of
-# supported CodeQL languages.
-#
 name: "CodeQL"
 
 on:
@@ -18,13 +7,23 @@ on:
     # The branches below must be a subset of the branches above
     branches: [master]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref == 'refs/heads/master' && github.run_id || github.ref }}
+  cancel-in-progress: true
+
 jobs:
+  # dd-octo-sts is used for checkout and init to reduce GITHUB_TOKEN rate-limit
+  # consumption. The official analyze action uploads SARIF with github.token
+  # (security-events: write) so GitHub derives the correct analysis_key from the
+  # workflow context — raw API uploads always get "(default)" which the PR
+  # Security tab does not recognise. wait-for-processing is disabled on the
+  # action to avoid spending github.token budget on status polls; processing
+  # completion is checked in a separate step using the dd-octo-sts token.
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
     permissions:
-      actions: read
-      contents: read
+      id-token: write
       security-events: write
 
     strategy:
@@ -33,22 +32,57 @@ jobs:
         language: ["javascript"]
 
     steps:
+      - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
+        id: octo-sts
+        with:
+          scope: DataDog/dd-trace-js
+          policy: codeql-analysis
+
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          token: ${{ steps.octo-sts.outputs.token }}
 
-      # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
+        id: init-codeql
+        uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
         with:
           languages: ${{ matrix.language }}
           config-file: .github/codeql_config.yml
+          token: ${{ steps.octo-sts.outputs.token }}
           # If you wish to specify custom queries, you can do so here or in a config file.
           # By default, queries listed here will override any specified in a config file.
           # Prefix the list here with "+" to use these queries and those in the config file.
           # queries: ./path/to/local/query, your-org/your-repo/queries@main
 
-      - name: Autobuild
-        uses: github/codeql-action/autobuild@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
-
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
+        id: analyze
+        uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+        with:
+          token: ${{ github.token }}
+          wait-for-processing: false
+
+      - name: Wait for SARIF processing
+        env:
+          TOKEN: ${{ steps.octo-sts.outputs.token }}
+          SARIF_ID: ${{ steps.analyze.outputs.sarif-id }}
+        run: |
+          # Poll every 10s (30x = 5 min total), matching the official action's
+          # timeout but halving the API calls vs its default 5s interval.
+          for i in $(seq 1 30); do
+            RESULT=$(curl -sf \
+              -H "Authorization: Bearer $TOKEN" \
+              -H "Accept: application/vnd.github+json" \
+              -H "X-GitHub-Api-Version: 2022-11-28" \
+              "https://api.github.com/repos/$GITHUB_REPOSITORY/code-scanning/sarifs/$SARIF_ID")
+            STATUS=$(echo "$RESULT" | jq -r '.processing_status')
+            echo "Processing status: $STATUS"
+            if [ "$STATUS" = "complete" ]; then exit 0; fi
+            if [ "$STATUS" = "failed" ]; then
+              echo "$RESULT" | jq -r '.errors // empty'
+              exit 1
+            fi
+            sleep 10
+          done
+          echo "SARIF processing did not complete within 5 minutes"
+          exit 1
@@ -44,8 +44,7 @@ on:
         type: boolean
 
 permissions:
-  actions: write
-  contents: read
+  id-token: write
 
 env:
   BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
@@ -65,8 +64,13 @@ jobs:
           - profiling
     runs-on: ubuntu-latest
     steps:
+      - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
+        id: octo-sts
+        with:
+          scope: DataDog/dd-trace-js
+          policy: custom-node-version-dispatch
       - name: Trigger ${{matrix.workflow }} workflow
         if: ${{ inputs[matrix.workflow] }}
         run: gh workflow run ${{matrix.workflow}}.yml --repo ${{ github.repository }} --ref ${{ env.BRANCH_NAME }} -f latest-version=${{ inputs.node-version }}
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
@@ -0,0 +1,39 @@
+name: Electron
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+  schedule:
+    - cron: 0 4 * * *
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
+env:
+  MOCHA_OPTIONS: ${{ github.ref == 'refs/heads/master' && '--retries 1' || '' }}
+
+jobs:
+  macos:
+    runs-on: macos-latest
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: ./.github/actions/node/latest
+      - uses: ./.github/actions/install
+      - run: yarn test:integration:electron
+
+  ubuntu:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: ./.github/actions/node/latest
+      - uses: ./.github/actions/install
+      # Electron needs a display even for headless (show: false) windows.
+      # xvfb-run provides a virtual framebuffer so the test can run without a physical display.
+      - run: xvfb-run --auto-servernum yarn test:integration:electron