Merge branch 'main' into avara1986/APPSEC-60046_remove_more_iast_files

Author: avara1986

.github/workflows/build.yml

@@ -43,7 +43,7 @@ jobs:
     strategy:
       max-parallel: 4
       matrix:
-        python-version: ['3.8', '3.9', '3.10', '3.11', '3.12', '3.13']
+        python-version: ['3.8', '3.9', '3.10', '3.11', '3.12', '3.13', '3.14']
 
     steps:
       - name: Checkout

.github/workflows/build_layer.yml

@@ -2,28 +2,80 @@ name: Build Layers for system-Tests
 
 on:
   workflow_dispatch:
+  pull_request:
   push:
     branches:
       - "main"
 
 jobs:
+  get-ddtrace-run-id:
+    runs-on: ubuntu-latest
+    outputs:
+      run-id: ${{ steps.get-ddtrace-run-id.outputs.run_id }}
+    steps:
+      - name: Resolve Run ID of latest dd-trace-py build
+        id: get-ddtrace-run-id
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          RUN_ID=$(gh run list \
+            --repo DataDog/dd-trace-py \
+            --workflow build_deploy.yml \
+            --branch main \
+            --status success \
+            --limit 1 \
+            --json databaseId \
+            --jq '.[0].databaseId')
+
+          echo "run_id=$RUN_ID" >> $GITHUB_OUTPUT
+
   build:
     runs-on: ${{ matrix.arch == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
 
+    needs: get-ddtrace-run-id
+
     strategy:
       fail-fast: false
       matrix:
         arch: [arm64, amd64]
-        python_version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
+        python_version: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
 
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Build artifact name
+        id: build-artifact-name
+        run: |
+          if [ "${{ matrix.arch }}" == "amd64" ]; then
+            ARCH="x86_64"
+          else
+            ARCH="aarch64"
+          fi
+
+          VER="${{ matrix.python_version }}"
+          PY_VERSION_NO_DOT="${VER//./}"
+
+          echo "artifact_name=wheels-cp${PY_VERSION_NO_DOT}-manylinux_${ARCH}" >> $GITHUB_OUTPUT
+
+      - name: Download ddtrace Wheel
+        uses: actions/download-artifact@v4
+        with:
+          name: ${{ steps.build-artifact-name.outputs.artifact_name }}
+          repository: DataDog/dd-trace-py
+          run-id: ${{ needs.get-ddtrace-run-id.outputs.run-id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          path: ./artifacts
+
+      - name: Find ddtrace Wheel
+        id: find-ddtrace-wheel
+        run: |
+          echo "wheel_path=$(find ./artifacts -name "*.whl" | head -n 1)" >> $GITHUB_OUTPUT
+
       - name: Patch pyproject.toml
         run: |
-          echo "Patching pyproject.toml to use main branch of dd-trace-py"
-          sed -i 's|^ddtrace =.*$|ddtrace = { git = "https://github.com/DataDog/dd-trace-py.git" }|' pyproject.toml
+          echo "Patching pyproject.toml to use latest build of dd-trace-py"
+          sed -i 's|^ddtrace =.*$|ddtrace = { file = "${{ steps.find-ddtrace-wheel.outputs.wheel_path }}" }|' pyproject.toml
 
       - name: Build layer for Python ${{ matrix.python_version }} on ${{ matrix.arch }}
         run: |

.github/workflows/update-snapshots.yml

@@ -1,8 +1,7 @@
 name: update-snapshots
 
 on:
-  schedule:
-    - cron: "0 15 * * *" # every day 11am EST
+  workflow_dispatch:
 
 jobs:
   check:
@@ -47,8 +46,19 @@ jobs:
         working-directory: tests/integration
         run: yarn install
 
-      - name: Update Snapshots
+      - name: Update Snapshots (amd64)
         env:
+          ARCH: amd64
+          UPDATE_SNAPSHOTS: true
+          BUILD_LAYERS: true
+          DD_API_KEY: ${{ secrets.DD_API_KEY }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        run: ./scripts/run_integration_tests.sh
+
+      - name: Update Snapshots (arm64)
+        env:
+          ARCH: arm64
           UPDATE_SNAPSHOTS: true
           BUILD_LAYERS: true
           DD_API_KEY: ${{ secrets.DD_API_KEY }}

Dockerfile

@@ -15,6 +15,7 @@ RUN set -eux; \
       rm gcc && ln -s gcc10-gcc gcc; \
       rm g++ && ln -s gcc10-g++ g++; \
       rm cc && ln -s gcc10-cc cc; \
+      rm c++ && ln -s gcc10-c++ c++; \
     fi
 
 # Add Rust compiler which is needed to build dd-trace-py from source

README.md

@@ -6,7 +6,7 @@
 [![Slack](https://chat.datadoghq.com/badge.svg?bg=632CA6)](https://chat.datadoghq.com/)
 [![License](https://img.shields.io/badge/license-Apache--2.0-blue)](https://github.com/DataDog/datadog-lambda-python/blob/main/LICENSE)
 
-Datadog Lambda Library for Python (3.8, 3.9, 3.10, 3.11, 3.12, and 3.13) enables [enhanced Lambda metrics](https://docs.datadoghq.com/serverless/enhanced_lambda_metrics), [distributed tracing](https://docs.datadoghq.com/serverless/distributed_tracing), and [custom metric submission](https://docs.datadoghq.com/serverless/custom_metrics) from AWS Lambda functions.
+Datadog Lambda Library for Python (3.8, 3.9, 3.10, 3.11, 3.12, 3.13, and 3.14) enables [enhanced Lambda metrics](https://docs.datadoghq.com/serverless/enhanced_lambda_metrics), [distributed tracing](https://docs.datadoghq.com/serverless/distributed_tracing), and [custom metric submission](https://docs.datadoghq.com/serverless/custom_metrics) from AWS Lambda functions.
 
 ## Installation
 

ci/datasources/runtimes.yaml

@@ -47,3 +47,11 @@ runtimes:
     python_version: "3.13"
     arch: "arm64"
     image: "3.13.0"
+  - name: "python314"
+    python_version: "3.14"
+    arch: "amd64"
+    image: "3.14.0"
+  - name: "python314"
+    python_version: "3.14"
+    arch: "arm64"
+    image: "3.14.0"

ci/publish_layers.sh

@@ -23,6 +23,8 @@ AWS_CLI_PYTHON_VERSIONS=(
     "python3.12"
     "python3.13"
     "python3.13"
+    "python3.14"
+    "python3.14"
 )
 PYTHON_VERSIONS=(
     "3.8-amd64"
@@ -37,6 +39,8 @@ PYTHON_VERSIONS=(
     "3.12-arm64"
     "3.13-amd64"
     "3.13-arm64"
+    "3.14-amd64"
+    "3.14-arm64"
 )
 LAYER_PATHS=(
     ".layers/datadog_lambda_py-amd64-3.8.zip"
@@ -51,6 +55,8 @@ LAYER_PATHS=(
     ".layers/datadog_lambda_py-arm64-3.12.zip"
     ".layers/datadog_lambda_py-amd64-3.13.zip"
     ".layers/datadog_lambda_py-arm64-3.13.zip"
+    ".layers/datadog_lambda_py-amd64-3.14.zip"
+    ".layers/datadog_lambda_py-arm64-3.14.zip"
 )
 LAYERS=(
     "Datadog-Python38"
@@ -65,6 +71,8 @@ LAYERS=(
     "Datadog-Python312-ARM"
     "Datadog-Python313"
     "Datadog-Python313-ARM"
+    "Datadog-Python314"
+    "Datadog-Python314-ARM"
 )
 STAGES=('prod', 'sandbox', 'staging', 'gov-staging', 'gov-prod')
 

datadog_lambda/api.py

@@ -5,6 +5,14 @@
 
 logger = logging.getLogger(__name__)
 KMS_ENCRYPTION_CONTEXT_KEY = "LambdaFunctionName"
+SSM_FIPS_SUPPORTED_REGIONS = {
+    "us-east-1",
+    "us-east-2",
+    "us-west-1",
+    "us-west-2",
+    "ca-central-1",
+    "ca-west-1",
+}
 api_key = None
 
 
@@ -92,11 +100,18 @@ def get_api_key() -> str:
         )["SecretString"]
     elif DD_API_KEY_SSM_NAME:
         # SSM endpoints: https://docs.aws.amazon.com/general/latest/gr/ssm.html
-        fips_endpoint = (
-            f"https://ssm-fips.{LAMBDA_REGION}.amazonaws.com"
-            if config.fips_mode_enabled
-            else None
-        )
+        fips_endpoint = None
+        if config.fips_mode_enabled:
+            if LAMBDA_REGION in SSM_FIPS_SUPPORTED_REGIONS:
+                fips_endpoint = f"https://ssm-fips.{LAMBDA_REGION}.amazonaws.com"
+            else:
+                # Log warning if SSM FIPS endpoint is not supported for commercial region
+                if not config.is_gov_region:
+                    logger.warning(
+                        "FIPS mode is enabled, but '%s' does not support SSM FIPS endpoints. "
+                        "Using standard SSM endpoint.",
+                        LAMBDA_REGION,
+                    )
         ssm_client = _boto3_client("ssm", endpoint_url=fips_endpoint)
         api_key = ssm_client.get_parameter(
             Name=DD_API_KEY_SSM_NAME, WithDecryption=True

datadog_lambda/version.py

@@ -1 +1 @@
-__version__ = "8.118.0.dev0"
+__version__ = "8.119.0"

datadog_lambda/wrapper.py

@@ -46,6 +46,8 @@
     extract_http_status_code_tag,
 )
 
+logger = logging.getLogger(__name__)
+
 # ddtrace imports are also tested in
 # dd-trace-py/tests/internal/test_serverless.py please update those tests when
 # making changes to any ddtrace import.
@@ -61,8 +63,12 @@
 
     start()
 
+profiler = None
 if config.profiling_enabled:
-    from ddtrace.profiling import profiler
+    try:
+        from ddtrace.profiling import profiler
+    except Exception as e:
+        logger.error(f"Failed to initialize profiler: [{e.__class__.__name__})] {e}")
 
 if config.llmobs_enabled:
     from ddtrace.llmobs import LLMObs
@@ -75,8 +81,6 @@
     except ImportError:
         from ddtrace.debugging._uploader import LogsIntakeUploaderV1 as SignalUploader
 
-logger = logging.getLogger(__name__)
-
 DD_REQUESTS_SERVICE_NAME = "DD_REQUESTS_SERVICE_NAME"
 DD_SERVICE = "DD_SERVICE"
 
@@ -141,7 +145,7 @@ def __init__(self, func):
             self.response = None
             self.blocking_response = None
 
-            if config.profiling_enabled:
+            if config.profiling_enabled and profiler:
                 self.prof = profiler.Profiler(env=config.env, service=config.service)
 
             if config.trace_extractor:
@@ -283,7 +287,7 @@ def _before(self, event, context):
                     self.blocking_response = get_asm_blocked_response(self.event_source)
             else:
                 set_correlation_ids()
-            if config.profiling_enabled and is_new_sandbox():
+            if config.profiling_enabled and profiler and is_new_sandbox():
                 self.prof.start(stop_on_exit=False, profile_children=True)
             logger.debug("datadog_lambda_wrapper _before() done")
         except Exception as e: