Use dynamic child pipelines for CiVis test environment trigger

.gitlab-ci.yml

@@ -3,7 +3,7 @@ include:
   - local: ".gitlab/benchmarks.yml"
   - local: ".gitlab/macrobenchmarks.yml"
   - local: ".gitlab/exploration-tests.yml"
-  #  - local: ".gitlab/ci-visibility-tests.yml"
+  - local: ".gitlab/ci-visibility-tests.yml"
 
 stages:
   - build

.gitlab/ci-visibility-tests.yml

@@ -1,77 +1,44 @@
-#check-ci-visibility-label:
-#  stage: publish
-#  image: registry.ddbuild.io/images/dd-octo-sts-ci-base:2025.06-1
-#  tags: [ "arch:amd64" ]
-#  needs: [ publish-artifacts-to-s3 ]
-#  id_tokens:
-#    DDOCTOSTS_ID_TOKEN:
-#      aud: dd-octo-sts
-#  rules:
-#    # - if: '$POPULATE_CACHE'
-#    #   when: never
-#    # - if: '$CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH !~ /^(master|release\/)/'
-#    #   when: on_success
-#    - when: never
-#  before_script:
-#    - dd-octo-sts version
-#    - dd-octo-sts debug --scope DataDog/dd-trace-java --policy self.gitlab.github-access.read
-#    - dd-octo-sts token --scope DataDog/dd-trace-java --policy self.gitlab.github-access.read > github-token.txt
-#    - gh auth login --with-token < github-token.txt
-#  script:
-#    - |
-#      # Source utility functions
-#      source .gitlab/ci_visibility_utils.sh
-#      
-#      # Get PR number
-#      if ! PR_NUMBER=$(get_pr_number "${CI_COMMIT_BRANCH}"); then
-#        echo "No open PR found for branch ${CI_COMMIT_BRANCH}"
-#        exit 1
-#      fi
-#      
-#      echo "Found PR #${PR_NUMBER}"
-#      
-#      # Check if PR has the CI visibility label
-#      if pr_has_label "$PR_NUMBER" "comp: ci visibility"; then
-#        echo "PR_NUMBER=${PR_NUMBER}" > pr.env
-#        echo "PR #${PR_NUMBER} detected as CI Visibility PR"
-#        exit 0
-#      else
-#        echo "PR #${PR_NUMBER} not a CI Visibility PR, ignoring trigger"
-#        exit 1
-#      fi
-#  after_script:
-#    - dd-octo-sts revoke -t $(cat github-token.txt) || true
-#  artifacts:
-#    reports:
-#      dotenv: pr.env
-#  allow_failure: true
-#  retry:
-#    max: 2
-#    when: always
-#
-#run-ci-visibility-test-environment:
-#  stage: ci-visibility-tests
-#  needs:
-#    - job: check-ci-visibility-label
-#      artifacts: true
-#  rules:
-#    - if: '$POPULATE_CACHE'
-#      when: never
-#    - if: '$CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH !~ /^(master|release\/)/'
-#      when: on_success
-#  trigger:
-#    project: DataDog/apm-reliability/test-environment
-#    branch: main
-#    strategy: depend
-#  variables:
-#    UPSTREAM_PACKAGE_JOB: build
-#    UPSTREAM_PROJECT_ID: $CI_PROJECT_ID
-#    UPSTREAM_PROJECT_NAME: $CI_PROJECT_NAME
-#    UPSTREAM_PIPELINE_ID: $CI_PIPELINE_ID
-#    UPSTREAM_BRANCH: $CI_COMMIT_BRANCH
-#    UPSTREAM_TAG: $CI_COMMIT_TAG
-#    UPSTREAM_COMMIT_AUTHOR: $CI_COMMIT_AUTHOR
-#    UPSTREAM_COMMIT_SHORT_SHA: $CI_COMMIT_SHORT_SHA
-#    TRACER_LANG: java
-#    JAVA_TRACER_REF_TO_TEST: $CI_COMMIT_BRANCH
-#    JAVA_TRACER_PR_TO_TEST: $PR_NUMBER
+ci-visibility-tests-check:
+  stage: ci-visibility-tests
+  image: registry.ddbuild.io/images/dd-octo-sts-ci-base:2025.06-1
+  tags: [ "arch:amd64" ]
+  needs: [ publish-artifacts-to-s3 ]
+  id_tokens:
+    DDOCTOSTS_ID_TOKEN:
+      aud: dd-octo-sts
+  rules:
+    - if: '$POPULATE_CACHE'
+      when: never
+    - if: '$CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH !~ /^(master|release\/)/'
+      when: on_success
+    - when: never
+  before_script:
+    - dd-octo-sts version
+    - dd-octo-sts debug --scope DataDog/dd-trace-java --policy self.gitlab.github-access.read
+    - dd-octo-sts token --scope DataDog/dd-trace-java --policy self.gitlab.github-access.read > github-token.txt
+    - gh auth login --with-token < github-token.txt
+  script:
+    - .gitlab/ci_visibility_generate_job.sh
+  after_script:
+    - dd-octo-sts revoke -t $(cat github-token.txt) || true
+  artifacts:
+    paths:
+    - ci-visibility-test-environment.yml
+  retry:
+    max: 2
+    when: always
+
+ci-visibility-tests-trigger:
+  stage: ci-visibility-tests
+  needs: [ci-visibility-tests-check]
+  rules:
+    - if: '$POPULATE_CACHE'
+      when: never
+    - if: '$CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH !~ /^(master|release\/)/'
+      when: on_success
+    - when: never
+  trigger:
+    include:
+      - artifact: ci-visibility-test-environment.yml
+        job: ci-visibility-tests-check
+    strategy: depend

.gitlab/ci_visibility_generate_job.sh

@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+
+set -e
+
+add_dummy_job() {
+  cat <<EOF >>ci-visibility-test-environment.yml
+skip-ci-visibility-tests:
+  stage: ci-visibility-tests
+  tags: [ "arch:amd64" ]
+  script:
+    - echo "PR does not have required label - CI Visibility test environment not triggered"
+EOF
+}
+
+# Generate yml
+cat <<EOF >ci-visibility-test-environment.yml
+stages:
+  - ci-visibility-tests
+
+EOF
+
+if [ -z "$CI_COMMIT_BRANCH" ]; then
+  echo "No branch detected - skipping trigger"
+  add_dummy_job
+  exit 0
+fi
+
+echo "Performing trigger checks for ci-visibility test-environment..."
+set +e
+pr_number=$(gh pr list --repo DataDog/dd-trace-java --head "$CI_COMMIT_BRANCH" --state open --json number --jq '.[0].number' 2>&1)
+pr_number_status=$?
+set -e
+
+if [ $pr_number_status -ne 0 ]; then
+  echo "Failed to query PR (gh command failed with status $pr_number_status ) - skipping trigger"
+  add_dummy_job
+  exit 0
+fi
+if [ -z "$pr_number" ]; then
+  echo "No open PR found for branch $CI_COMMIT_BRANCH - skipping trigger"
+  add_dummy_job
+  exit 0
+fi
+
+echo "PR #${pr_number} found, checking labels..."
+set +e
+labels=$(gh pr view "$pr_number" --repo DataDog/dd-trace-java --json labels --jq '.labels[].name' 2>&1)
+labels_status=$?
+set -e
+
+if [ $labels_status -ne 0 ]; then
+  echo "Failed to query PR labels (gh command failed with status $labels_status) - skipping trigger"
+  add_dummy_job
+  exit 0
+fi
+if [ -z "$labels" ] || ! echo "$labels" | grep -q "comp: ci visibility"; then
+  echo "PR #$pr_number is not a CI Visibility PR - skipping trigger"
+  add_dummy_job
+  exit 0
+fi
+
+echo "PR #$pr_number is a CI Visibility PR - triggering test environment"
+
+cat <<EOF >>ci-visibility-test-environment.yml
+ci-visibility-test-environment:
+  stage: ci-visibility-tests
+  trigger:
+    project: DataDog/apm-reliability/test-environment
+    branch: main
+    strategy: depend
+  variables:
+    UPSTREAM_PACKAGE_JOB: build
+    UPSTREAM_PROJECT_ID: "$CI_PROJECT_ID"
+    UPSTREAM_PROJECT_NAME: "$CI_PROJECT_NAME"
+    UPSTREAM_PIPELINE_ID: "$CI_PIPELINE_ID"
+    UPSTREAM_BRANCH: "$CI_COMMIT_BRANCH"
+    UPSTREAM_TAG: "$CI_COMMIT_TAG"
+    UPSTREAM_COMMIT_AUTHOR: "$CI_COMMIT_AUTHOR"
+    UPSTREAM_COMMIT_SHORT_SHA: "$CI_COMMIT_SHORT_SHA"
+    TRACER_LANG: java
+    JAVA_TRACER_REF_TO_TEST: "$CI_COMMIT_BRANCH"
+    JAVA_TRACER_PR_TO_TEST: "$pr_number"
+EOF