From 2fb05fc57f312a0250f7b64504aefb17dbb793b8 Mon Sep 17 00:00:00 2001 From: Sarah Chen Date: Wed, 24 Jun 2026 14:54:20 -0400 Subject: [PATCH 1/7] Disable build cache for release artifacts --- .gitlab-ci.yml | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 1937d97cc70..7ddbc0f9919 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -261,6 +261,7 @@ default: fi - export GRADLE_OPTS="-Dorg.gradle.jvmargs='-Xms$GRADLE_MEMORY_MIN -Xmx$GRADLE_MEMORY_MAX -XX:ErrorFile=/tmp/hs_err_pid%p.log -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/tmp'" - export GRADLE_ARGS=" --build-cache --stacktrace --no-daemon --parallel --max-workers=$GRADLE_WORKERS" + - export RELEASE_GRADLE_ARGS=" --no-build-cache --rerun-tasks --stacktrace --no-daemon --parallel --max-workers=$GRADLE_WORKERS" - *normalize_node_index # GitLab's cache helper restores .gradle as root, but we run as non-root-user (uid 1001), # and Gradle does `chmod 700 .gradle` on startup which requires user ownership. @@ -337,7 +338,13 @@ build: script: - if [ $CI_PIPELINE_SOURCE == "schedule" ] ; then ./gradlew resolveAndLockAll --write-locks $GRADLE_ARGS; fi - ./gradlew --version - - ./gradlew clean :dd-java-agent:shadowJar :dd-java-agent:check :dd-trace-api:jar :dd-trace-ot:shadowJar -PskipTests -x spotlessCheck $GRADLE_ARGS + - | + if [ -n "$CI_COMMIT_TAG" ]; then + echo "=== RELEASE BUILD: assembling agent jar with build cache disabled ===" + ./gradlew clean :dd-java-agent:shadowJar :dd-java-agent:check :dd-trace-api:jar :dd-trace-ot:shadowJar -PskipTests -x spotlessCheck $RELEASE_GRADLE_ARGS + else + ./gradlew clean :dd-java-agent:shadowJar :dd-java-agent:check :dd-trace-api:jar :dd-trace-ot:shadowJar -PskipTests -x spotlessCheck $GRADLE_ARGS + fi - echo UPSTREAM_TRACER_VERSION=$(java -jar workspace/dd-java-agent/build/libs/*.jar) >> upstream.env - echo "BUILD_JOB_NAME=$CI_JOB_NAME" >> build.env - echo "BUILD_JOB_ID=$CI_JOB_ID" >> build.env @@ -1245,7 +1252,13 @@ deploy_to_maven_central: - export MAVEN_CENTRAL_PASSWORD=$(aws ssm get-parameter --region us-east-1 --name ci.dd-trace-java.central_password --with-decryption --query "Parameter.Value" --out text) - export GPG_PRIVATE_KEY=$(aws ssm get-parameter --region us-east-1 --name ci.dd-trace-java.signing.gpg_private_key --with-decryption --query "Parameter.Value" --out text) - export GPG_PASSWORD=$(aws ssm get-parameter --region us-east-1 --name ci.dd-trace-java.signing.gpg_passphrase --with-decryption --query "Parameter.Value" --out text) - - ./gradlew -PbuildInfo.build.number=$CI_JOB_ID publishToSonatype closeSonatypeStagingRepository -PskipTests $GRADLE_ARGS + - | + if [ -n "$CI_COMMIT_TAG" ]; then + echo "=== RELEASE BUILD: publishing artifacts with build cache disabled ===" + ./gradlew -PbuildInfo.build.number=$CI_JOB_ID publishToSonatype closeSonatypeStagingRepository -PskipTests $RELEASE_GRADLE_ARGS + else + ./gradlew -PbuildInfo.build.number=$CI_JOB_ID publishToSonatype closeSonatypeStagingRepository -PskipTests $GRADLE_ARGS + fi artifacts: paths: - 'workspace/dd-java-agent/build/libs/*.jar' From 16b49163c91439bdef569bb28e03ce48718ba917 Mon Sep 17 00:00:00 2001 From: Sarah Chen Date: Wed, 24 Jun 2026 16:01:33 -0400 Subject: [PATCH 2/7] Re-organize --- .gitlab-ci.yml | 24 +++++++++--------------- 1 file changed, 9 insertions(+), 15 deletions(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 7ddbc0f9919..e550f4d3e89 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -261,7 +261,7 @@ default: fi - export GRADLE_OPTS="-Dorg.gradle.jvmargs='-Xms$GRADLE_MEMORY_MIN -Xmx$GRADLE_MEMORY_MAX -XX:ErrorFile=/tmp/hs_err_pid%p.log -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/tmp'" - export GRADLE_ARGS=" --build-cache --stacktrace --no-daemon --parallel --max-workers=$GRADLE_WORKERS" - - export RELEASE_GRADLE_ARGS=" --no-build-cache --rerun-tasks --stacktrace --no-daemon --parallel --max-workers=$GRADLE_WORKERS" + - "export RELEASE_GRADLE_ARGS=${CI_COMMIT_TAG:+${GRADLE_ARGS/--build-cache/--no-build-cache --rerun-tasks}}" - *normalize_node_index # GitLab's cache helper restores .gradle as root, but we run as non-root-user (uid 1001), # and Gradle does `chmod 700 .gradle` on startup which requires user ownership. @@ -338,13 +338,10 @@ build: script: - if [ $CI_PIPELINE_SOURCE == "schedule" ] ; then ./gradlew resolveAndLockAll --write-locks $GRADLE_ARGS; fi - ./gradlew --version - - | - if [ -n "$CI_COMMIT_TAG" ]; then - echo "=== RELEASE BUILD: assembling agent jar with build cache disabled ===" - ./gradlew clean :dd-java-agent:shadowJar :dd-java-agent:check :dd-trace-api:jar :dd-trace-ot:shadowJar -PskipTests -x spotlessCheck $RELEASE_GRADLE_ARGS - else - ./gradlew clean :dd-java-agent:shadowJar :dd-java-agent:check :dd-trace-api:jar :dd-trace-ot:shadowJar -PskipTests -x spotlessCheck $GRADLE_ARGS - fi + - "EFFECTIVE_GRADLE_ARGS=${RELEASE_GRADLE_ARGS:-$GRADLE_ARGS}" + - 'if [ -n "$CI_COMMIT_TAG" ]; then echo "=== Release build: assembling agent jar with build cache disabled ==="; fi' + - echo "EFFECTIVE_GRADLE_ARGS=$EFFECTIVE_GRADLE_ARGS" + - ./gradlew clean :dd-java-agent:shadowJar :dd-java-agent:check :dd-trace-api:jar :dd-trace-ot:shadowJar -PskipTests -x spotlessCheck $EFFECTIVE_GRADLE_ARGS - echo UPSTREAM_TRACER_VERSION=$(java -jar workspace/dd-java-agent/build/libs/*.jar) >> upstream.env - echo "BUILD_JOB_NAME=$CI_JOB_NAME" >> build.env - echo "BUILD_JOB_ID=$CI_JOB_ID" >> build.env @@ -1252,13 +1249,10 @@ deploy_to_maven_central: - export MAVEN_CENTRAL_PASSWORD=$(aws ssm get-parameter --region us-east-1 --name ci.dd-trace-java.central_password --with-decryption --query "Parameter.Value" --out text) - export GPG_PRIVATE_KEY=$(aws ssm get-parameter --region us-east-1 --name ci.dd-trace-java.signing.gpg_private_key --with-decryption --query "Parameter.Value" --out text) - export GPG_PASSWORD=$(aws ssm get-parameter --region us-east-1 --name ci.dd-trace-java.signing.gpg_passphrase --with-decryption --query "Parameter.Value" --out text) - - | - if [ -n "$CI_COMMIT_TAG" ]; then - echo "=== RELEASE BUILD: publishing artifacts with build cache disabled ===" - ./gradlew -PbuildInfo.build.number=$CI_JOB_ID publishToSonatype closeSonatypeStagingRepository -PskipTests $RELEASE_GRADLE_ARGS - else - ./gradlew -PbuildInfo.build.number=$CI_JOB_ID publishToSonatype closeSonatypeStagingRepository -PskipTests $GRADLE_ARGS - fi + - "EFFECTIVE_GRADLE_ARGS=${RELEASE_GRADLE_ARGS:-$GRADLE_ARGS}" + - 'if [ -n "$CI_COMMIT_TAG" ]; then echo "=== Release build: publishing artifacts with build cache disabled ==="; fi' + - echo "EFFECTIVE_GRADLE_ARGS=$EFFECTIVE_GRADLE_ARGS" + - ./gradlew -PbuildInfo.build.number=$CI_JOB_ID publishToSonatype closeSonatypeStagingRepository -PskipTests $EFFECTIVE_GRADLE_ARGS artifacts: paths: - 'workspace/dd-java-agent/build/libs/*.jar' From 89eccf64d13f497389799037627b7bcb39e961ea Mon Sep 17 00:00:00 2001 From: Sarah Chen Date: Wed, 24 Jun 2026 16:25:33 -0400 Subject: [PATCH 3/7] Remove unnecessary log lines --- .gitlab-ci.yml | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index e550f4d3e89..ad7252c5d4e 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -338,10 +338,8 @@ build: script: - if [ $CI_PIPELINE_SOURCE == "schedule" ] ; then ./gradlew resolveAndLockAll --write-locks $GRADLE_ARGS; fi - ./gradlew --version - - "EFFECTIVE_GRADLE_ARGS=${RELEASE_GRADLE_ARGS:-$GRADLE_ARGS}" - - 'if [ -n "$CI_COMMIT_TAG" ]; then echo "=== Release build: assembling agent jar with build cache disabled ==="; fi' - - echo "EFFECTIVE_GRADLE_ARGS=$EFFECTIVE_GRADLE_ARGS" - - ./gradlew clean :dd-java-agent:shadowJar :dd-java-agent:check :dd-trace-api:jar :dd-trace-ot:shadowJar -PskipTests -x spotlessCheck $EFFECTIVE_GRADLE_ARGS + - 'if [ -n "$CI_COMMIT_TAG" ]; then echo "=== RELEASE BUILD: assembling agent jar with build cache disabled ==="; fi' + - './gradlew clean :dd-java-agent:shadowJar :dd-java-agent:check :dd-trace-api:jar :dd-trace-ot:shadowJar -PskipTests -x spotlessCheck ${RELEASE_GRADLE_ARGS:-$GRADLE_ARGS}' - echo UPSTREAM_TRACER_VERSION=$(java -jar workspace/dd-java-agent/build/libs/*.jar) >> upstream.env - echo "BUILD_JOB_NAME=$CI_JOB_NAME" >> build.env - echo "BUILD_JOB_ID=$CI_JOB_ID" >> build.env @@ -1249,10 +1247,8 @@ deploy_to_maven_central: - export MAVEN_CENTRAL_PASSWORD=$(aws ssm get-parameter --region us-east-1 --name ci.dd-trace-java.central_password --with-decryption --query "Parameter.Value" --out text) - export GPG_PRIVATE_KEY=$(aws ssm get-parameter --region us-east-1 --name ci.dd-trace-java.signing.gpg_private_key --with-decryption --query "Parameter.Value" --out text) - export GPG_PASSWORD=$(aws ssm get-parameter --region us-east-1 --name ci.dd-trace-java.signing.gpg_passphrase --with-decryption --query "Parameter.Value" --out text) - - "EFFECTIVE_GRADLE_ARGS=${RELEASE_GRADLE_ARGS:-$GRADLE_ARGS}" - - 'if [ -n "$CI_COMMIT_TAG" ]; then echo "=== Release build: publishing artifacts with build cache disabled ==="; fi' - - echo "EFFECTIVE_GRADLE_ARGS=$EFFECTIVE_GRADLE_ARGS" - - ./gradlew -PbuildInfo.build.number=$CI_JOB_ID publishToSonatype closeSonatypeStagingRepository -PskipTests $EFFECTIVE_GRADLE_ARGS + - 'if [ -n "$CI_COMMIT_TAG" ]; then echo "=== RELEASE BUILD: publishing artifacts with build cache disabled ==="; fi' + - './gradlew -PbuildInfo.build.number=$CI_JOB_ID publishToSonatype closeSonatypeStagingRepository -PskipTests ${RELEASE_GRADLE_ARGS:-$GRADLE_ARGS}' artifacts: paths: - 'workspace/dd-java-agent/build/libs/*.jar' From 5cb7a6fe38918efac09bc8f566d42674d06f28ee Mon Sep 17 00:00:00 2001 From: Sarah Chen Date: Thu, 25 Jun 2026 14:23:19 -0400 Subject: [PATCH 4/7] Clean up and address review comments --- .gitlab-ci.yml | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index ad7252c5d4e..5421fcd1086 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -261,7 +261,6 @@ default: fi - export GRADLE_OPTS="-Dorg.gradle.jvmargs='-Xms$GRADLE_MEMORY_MIN -Xmx$GRADLE_MEMORY_MAX -XX:ErrorFile=/tmp/hs_err_pid%p.log -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/tmp'" - export GRADLE_ARGS=" --build-cache --stacktrace --no-daemon --parallel --max-workers=$GRADLE_WORKERS" - - "export RELEASE_GRADLE_ARGS=${CI_COMMIT_TAG:+${GRADLE_ARGS/--build-cache/--no-build-cache --rerun-tasks}}" - *normalize_node_index # GitLab's cache helper restores .gradle as root, but we run as non-root-user (uid 1001), # and Gradle does `chmod 700 .gradle` on startup which requires user ownership. @@ -338,8 +337,8 @@ build: script: - if [ $CI_PIPELINE_SOURCE == "schedule" ] ; then ./gradlew resolveAndLockAll --write-locks $GRADLE_ARGS; fi - ./gradlew --version - - 'if [ -n "$CI_COMMIT_TAG" ]; then echo "=== RELEASE BUILD: assembling agent jar with build cache disabled ==="; fi' - - './gradlew clean :dd-java-agent:shadowJar :dd-java-agent:check :dd-trace-api:jar :dd-trace-ot:shadowJar -PskipTests -x spotlessCheck ${RELEASE_GRADLE_ARGS:-$GRADLE_ARGS}' + - if [ -n "$CI_COMMIT_TAG" ]; then GRADLE_ARGS=${GRADLE_ARGS/--build-cache/--no-build-cache}; echo "=== RELEASE BUILD - assembling agent jar with build cache disabled ==="; fi + - ./gradlew clean :dd-java-agent:shadowJar :dd-java-agent:check :dd-trace-api:jar :dd-trace-ot:shadowJar -PskipTests -x spotlessCheck $GRADLE_ARGS - echo UPSTREAM_TRACER_VERSION=$(java -jar workspace/dd-java-agent/build/libs/*.jar) >> upstream.env - echo "BUILD_JOB_NAME=$CI_JOB_NAME" >> build.env - echo "BUILD_JOB_ID=$CI_JOB_ID" >> build.env @@ -1247,8 +1246,7 @@ deploy_to_maven_central: - export MAVEN_CENTRAL_PASSWORD=$(aws ssm get-parameter --region us-east-1 --name ci.dd-trace-java.central_password --with-decryption --query "Parameter.Value" --out text) - export GPG_PRIVATE_KEY=$(aws ssm get-parameter --region us-east-1 --name ci.dd-trace-java.signing.gpg_private_key --with-decryption --query "Parameter.Value" --out text) - export GPG_PASSWORD=$(aws ssm get-parameter --region us-east-1 --name ci.dd-trace-java.signing.gpg_passphrase --with-decryption --query "Parameter.Value" --out text) - - 'if [ -n "$CI_COMMIT_TAG" ]; then echo "=== RELEASE BUILD: publishing artifacts with build cache disabled ==="; fi' - - './gradlew -PbuildInfo.build.number=$CI_JOB_ID publishToSonatype closeSonatypeStagingRepository -PskipTests ${RELEASE_GRADLE_ARGS:-$GRADLE_ARGS}' + - ./gradlew -PbuildInfo.build.number=$CI_JOB_ID publishToSonatype closeSonatypeStagingRepository -PskipTests $GRADLE_ARGS artifacts: paths: - 'workspace/dd-java-agent/build/libs/*.jar' From 4d032181a117899a5d3802071f181177111568d2 Mon Sep 17 00:00:00 2001 From: Sarah Chen Date: Thu, 25 Jun 2026 15:02:05 -0400 Subject: [PATCH 5/7] Use custom gradle settings --- .gitlab-ci.yml | 2 +- .gitlab/release-build-cache.init.gradle | 12 ++++++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) create mode 100644 .gitlab/release-build-cache.init.gradle diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 5421fcd1086..3a46d50622a 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -337,7 +337,7 @@ build: script: - if [ $CI_PIPELINE_SOURCE == "schedule" ] ; then ./gradlew resolveAndLockAll --write-locks $GRADLE_ARGS; fi - ./gradlew --version - - if [ -n "$CI_COMMIT_TAG" ]; then GRADLE_ARGS=${GRADLE_ARGS/--build-cache/--no-build-cache}; echo "=== RELEASE BUILD - assembling agent jar with build cache disabled ==="; fi + - if [ -n "$CI_COMMIT_TAG" ]; then GRADLE_ARGS="$GRADLE_ARGS -I .gitlab/release-build-cache.init.gradle"; echo "=== RELEASE BUILD - assembling agent jar with build cache reads disabled but results pushed to cache for downstream jobs ==="; fi - ./gradlew clean :dd-java-agent:shadowJar :dd-java-agent:check :dd-trace-api:jar :dd-trace-ot:shadowJar -PskipTests -x spotlessCheck $GRADLE_ARGS - echo UPSTREAM_TRACER_VERSION=$(java -jar workspace/dd-java-agent/build/libs/*.jar) >> upstream.env - echo "BUILD_JOB_NAME=$CI_JOB_NAME" >> build.env diff --git a/.gitlab/release-build-cache.init.gradle b/.gitlab/release-build-cache.init.gradle new file mode 100644 index 00000000000..729b1a32d4f --- /dev/null +++ b/.gitlab/release-build-cache.init.gradle @@ -0,0 +1,12 @@ +// Used during release builds to disable build cache reads while keeping writes enabled. +// +// This ensures the release agent jar is assembled via fresh task execution while still +// pushing results to the build cache where downstream jobs (e.g. `deploy_to_maven_central`) +// pull from. Pushing the freshly built jar to this cache is necessary to ensure the same +// release binary is published across all platforms. +gradle.settingsEvaluated { settings -> + settings.buildCache.remote { + pull = false + push = true + } +} From dee36d3eab95da30df2a3ce558829fa1e4acf3f9 Mon Sep 17 00:00:00 2001 From: Sarah Chen Date: Thu, 25 Jun 2026 17:31:18 -0400 Subject: [PATCH 6/7] Add temporary info param --- .gitlab-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 3a46d50622a..380f4214d15 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -260,7 +260,7 @@ default: ln -s "$(pwd)/.mvn/caches/equo" "$HOME/.m2/repository/dev/equo" fi - export GRADLE_OPTS="-Dorg.gradle.jvmargs='-Xms$GRADLE_MEMORY_MIN -Xmx$GRADLE_MEMORY_MAX -XX:ErrorFile=/tmp/hs_err_pid%p.log -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/tmp'" - - export GRADLE_ARGS=" --build-cache --stacktrace --no-daemon --parallel --max-workers=$GRADLE_WORKERS" + - export GRADLE_ARGS=" --info --build-cache --stacktrace --no-daemon --parallel --max-workers=$GRADLE_WORKERS" - *normalize_node_index # GitLab's cache helper restores .gradle as root, but we run as non-root-user (uid 1001), # and Gradle does `chmod 700 .gradle` on startup which requires user ownership. From 8c8d5d722af6767f2d2e18d50ebaf6f1ff6acd9e Mon Sep 17 00:00:00 2001 From: Sarah Chen Date: Thu, 25 Jun 2026 17:59:07 -0400 Subject: [PATCH 7/7] Fix gradle file --- .gitlab/release-build-cache.init.gradle | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.gitlab/release-build-cache.init.gradle b/.gitlab/release-build-cache.init.gradle index 729b1a32d4f..b81d90b809c 100644 --- a/.gitlab/release-build-cache.init.gradle +++ b/.gitlab/release-build-cache.init.gradle @@ -5,8 +5,7 @@ // pull from. Pushing the freshly built jar to this cache is necessary to ensure the same // release binary is published across all platforms. gradle.settingsEvaluated { settings -> - settings.buildCache.remote { + settings.buildCache.remote?.with { pull = false - push = true } }