feat(ci): enable performance SLO change tracking (#3397)

* feat: add dd-octo-sts trust policy for SLO change tracking

* feat: update check-slo-breaches job to use dd-octo-sts for GitHub access

* add newline to trust policy

* fix: broaden trust policy scope to support manual runs on any branch

* add bp-runner.fail-on-breach.yml from benchmarking-platform@php/laravel-realworld

https://github.com/DataDog/benchmarking-platform/blob/0ea2e52f470659e175d13b66d8ad850587f5b5a5/bp-runner.fail-on-breach.yml

* feat: update check-slo-breaches to use a template

* trigger pipeline

* trigger pipeline

Author: igoragoli

.github/chainguard/gitlab-ci-slo-change-tracking.sts.yaml

@@ -0,0 +1,6 @@
+issuer: https://gitlab.ddbuild.io
+
+subject_pattern: "project_path:DataDog/apm-reliability/dd-trace-php:ref_type:(branch|tag):ref:.*"
+
+permissions:
+  contents: read

.gitlab/benchmarks.yml

@@ -1,4 +1,6 @@
 include:
+  - project: 'DataDog/benchmarking-platform-tools'
+    file: 'images/templates/gitlab/check-slo-breaches.template.yml'
   - project: 'DataDog/benchmarking-platform-tools'
     file: 'images/templates/gitlab/notify-slo-breaches.template.yml'
 
@@ -184,20 +186,20 @@ macrobenchmarks:
       - PHP_VERSION: "8.1"
 
 check-slo-breaches:
+  extends: .check-slo-breaches
   stage: gate
   needs: ["macrobenchmarks"]
   when: on_success
-  tags: ["arch:amd64"]
-  image: registry.ddbuild.io/images/benchmarking-platform-tools-ubuntu:latest
-  script:
-    - cd platform && (git init && git remote add origin https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.ddbuild.io/DataDog/benchmarking-platform && git pull origin php/laravel-realworld)
-    - bp-runner bp-runner.fail-on-breach.yml --debug
   artifacts:
     name: "artifacts"
     when: always
     paths:
       - platform/artifacts/
     expire_in: 3 months
+  variables:
+    DDOCTOSTS_POLICY: "gitlab-ci-slo-change-tracking"
+    ARTIFACTS_DIR: "platform/artifacts"
+    SLO_FILE: ".gitlab/bp-runner.fail-on-breach.yml"
 
 notify-slo-breaches:
   extends: .notify-slo-breaches

.gitlab/bp-runner.fail-on-breach.yml

@@ -0,0 +1,18 @@
+# Measurements from https://benchmarking.us1.prod.dog/benchmarks?ciJobDateStart=1747127110844&ciJobDateEnd=1749719110844&projectId=6&benchmarkGroupPipelineId=67338785&benchmarkGroupSha=2dadafbe59e2e4a5f6894054f8a847b5181e1f8f&benchmarkId=14597014
+
+# Thresholds set based on guidance in https://datadoghq.atlassian.net/wiki/spaces/APMINT/pages/5070193198/How+to+set+up+pre-release+performance+quality+gates#How-to-choose-thresholds-for-pre-release-gates%3F
+
+experiments:
+  - name: Run SLO breach check
+    steps:
+      - name: SLO breach check
+        run: fail_on_breach
+        warning_range: 5
+        scenarios:
+          - name: normal_operation/only-tracing/-8_1
+            thresholds:
+              - agg_http_req_duration_p50 < 30 ms
+          - name: high_load/only-tracing/-8_1
+            thresholds:
+              - throughput > 112.32 op/s
+