From 98e461777b37567da20821d6884b154ea5b35943 Mon Sep 17 00:00:00 2001
From: Munir Abdinur <munir.abdinur@datadoghq.com>
Date: Thu, 1 Oct 2026 14:18:10 -0400
Subject: [PATCH 1/3] ci: scope system tests to affected changes

---
 .gitlab-ci.yml | 154 ++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 151 insertions(+), 3 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index b57af135572..f3e330191c8 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -52,6 +52,7 @@ default:
 .is_release_branch: $CI_COMMIT_BRANCH =~ /^[0-9]+\.[0-9]+$/
 .is_gh_merge_queue: $CI_COMMIT_BRANCH =~ /^gh-readonly-queue\/.*$/
 .is_devflow_merge_queue: $CI_COMMIT_BRANCH =~ /^mq-working-branch-.*$/
+.run_all_tests: '$FULL_TEST_SUITE == "true" || $NIGHTLY_BUILD == "true" || $CI_PIPELINE_SOURCE == "schedule" || $CI_COMMIT_REF_NAME == "main" || $CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+(rc[0-9]+)?$/ || $CI_COMMIT_BRANCH =~ /^[0-9]+\.[0-9]+$/ || $CI_COMMIT_BRANCH =~ /^gh-readonly-queue\/.*$/ || $CI_COMMIT_BRANCH =~ /^mq-working-branch-.*$/'
 
 # trigger new commit cancel
 workflow:
@@ -878,12 +879,159 @@ package-oci:
       # 3.15 cell is when: never until the python image is mirrored
       optional: true
 
+.system_test_config_changes: &system_test_config_changes
+  - .gitlab-ci.yml
+  - .gitlab/system-tests.yml
+
+.onboarding_system_test_changes: &onboarding_system_test_changes
+  - ddtrace/_monkey.py
+  - ddtrace/auto.py
+  - ddtrace/bootstrap/**/*
+  - ddtrace/commands/ddtrace_run.py
+  - ddtrace/internal/telemetry/**/*
+  - lib-injection/**/*
+  - tests/lib_injection/**/*
+  - tests/telemetry/**/*
+
+.profiling_system_test_changes: &profiling_system_test_changes
+  - ddtrace/internal/datadog/profiling/**/*
+  - ddtrace/internal/settings/profiling.py
+  - ddtrace/internal/settings/profiling.pyi
+  - ddtrace/profiling/**/*
+  - tests/profiling/**/*
+
+.appsec_system_test_changes: &appsec_system_test_changes
+  - ddtrace/appsec/**/*
+  - ddtrace/internal/_libddwaf_platform.py
+  - ddtrace/internal/appsec/**/*
+  - ddtrace/internal/iast/**/*
+  - ddtrace/internal/settings/appsec_telemetry.py
+  - ddtrace/internal/settings/asm.py
+  - tests/appsec/**/*
+
+.injection_system_test_changes: &injection_system_test_changes
+  - lib-injection/**/*
+  - tests/lib_injection/**/*
+
+.system_tests_onboarding_rules:
+  rules:
+    - if: '$SKIP_SHARED_PIPELINE == "true" || $DANGEROUSLY_SKIP_SHARED_PIPELINE_TESTS == "true"'
+      when: never
+    - if: !reference [.run_all_tests]
+    - changes: *system_test_config_changes
+    - changes: *onboarding_system_test_changes
+    - when: never
+
+.system_tests_profiling_rules:
+  rules:
+    - if: '$SKIP_SHARED_PIPELINE == "true" || $DANGEROUSLY_SKIP_SHARED_PIPELINE_TESTS == "true"'
+      when: never
+    - if: !reference [.run_all_tests]
+    - changes: *system_test_config_changes
+    - changes: *profiling_system_test_changes
+    - when: never
+
+.system_tests_appsec_rules:
+  rules:
+    - if: '$SKIP_SHARED_PIPELINE == "true" || $DANGEROUSLY_SKIP_SHARED_PIPELINE_TESTS == "true"'
+      when: never
+    - if: !reference [.run_all_tests]
+    - changes: *system_test_config_changes
+    - changes: *appsec_system_test_changes
+    - when: never
+
+.system_tests_injection_rules:
+  rules:
+    - if: '$SKIP_SHARED_PIPELINE == "true" || $DANGEROUSLY_SKIP_SHARED_PIPELINE_TESTS == "true"'
+      when: never
+    - if: !reference [.run_all_tests]
+    - changes: *system_test_config_changes
+    - changes: *injection_system_test_changes
+    - when: never
+
 configure_system_tests:
-  variables:
-    SYSTEM_TESTS_SCENARIOS_GROUPS: "simple_onboarding,simple_onboarding_profiling,simple_onboarding_appsec,docker-ssi,lib-injection"
+  rules:
+    - when: never
 
 system_tests:
-  needs: ["configure_system_tests", "oci-internal-test-publish", "kubernetes-injection-test-ecr-publish"]
+  rules:
+    - when: never
+
+configure_system_tests_onboarding:
+  extends:
+    - configure_system_tests
+    - .system_tests_onboarding_rules
+  needs: []
+  variables:
+    SYSTEM_TESTS_SCENARIOS_GROUPS: "simple_onboarding"
+
+system_tests_onboarding:
+  extends:
+    - system_tests
+    - .system_tests_onboarding_rules
+  needs: ["configure_system_tests_onboarding", "oci-internal-test-publish"]
+  trigger:
+    include:
+      - artifact: system_tests_pipeline.yml
+        job: configure_system_tests_onboarding
+    strategy: depend
+
+configure_system_tests_profiling:
+  extends:
+    - configure_system_tests
+    - .system_tests_profiling_rules
+  needs: []
+  variables:
+    SYSTEM_TESTS_SCENARIOS_GROUPS: "simple_onboarding_profiling"
+
+system_tests_profiling:
+  extends:
+    - system_tests
+    - .system_tests_profiling_rules
+  needs: ["configure_system_tests_profiling", "oci-internal-test-publish"]
+  trigger:
+    include:
+      - artifact: system_tests_pipeline.yml
+        job: configure_system_tests_profiling
+    strategy: depend
+
+configure_system_tests_appsec:
+  extends:
+    - configure_system_tests
+    - .system_tests_appsec_rules
+  needs: []
+  variables:
+    SYSTEM_TESTS_SCENARIOS_GROUPS: "simple_onboarding_appsec"
+
+system_tests_appsec:
+  extends:
+    - system_tests
+    - .system_tests_appsec_rules
+  needs: ["configure_system_tests_appsec", "oci-internal-test-publish"]
+  trigger:
+    include:
+      - artifact: system_tests_pipeline.yml
+        job: configure_system_tests_appsec
+    strategy: depend
+
+configure_system_tests_injection:
+  extends:
+    - configure_system_tests
+    - .system_tests_injection_rules
+  needs: []
+  variables:
+    SYSTEM_TESTS_SCENARIOS_GROUPS: "docker-ssi,lib-injection"
+
+system_tests_injection:
+  extends:
+    - system_tests
+    - .system_tests_injection_rules
+  needs: ["configure_system_tests_injection", "oci-internal-test-publish", "kubernetes-injection-test-ecr-publish"]
+  trigger:
+    include:
+      - artifact: system_tests_pipeline.yml
+        job: configure_system_tests_injection
+    strategy: depend
 
 # The reliability environment installs commit-scoped wheels from the CI index.
 deploy_to_reliability_env:

From 05e6a9aa90f45a3a1921afd844934206b9be0d09 Mon Sep 17 00:00:00 2001
From: Munir Abdinur <munir.abdinur@datadoghq.com>
Date: Thu, 1 Oct 2026 14:19:06 -0400
Subject: [PATCH 2/3] ci: scope serverless jobs to related changes

---
 .gitlab-ci.yml                    |  1 +
 .gitlab/benchmarks/serverless.yml | 16 +++++++++++++++-
 .gitlab/package.yml               | 31 ++++++++++++++++++++++++++++---
 3 files changed, 44 insertions(+), 4 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index f3e330191c8..078c97f8cc0 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -157,6 +157,7 @@ run-tests-trigger:
    strategy: depend
 
 serverless lambda tests:
+  extends: .serverless_rules
   stage: tests
   trigger:
     project: DataDog/datadog-lambda-python
diff --git a/.gitlab/benchmarks/serverless.yml b/.gitlab/benchmarks/serverless.yml
index 2823bbbc227..46a36a42eff 100644
--- a/.gitlab/benchmarks/serverless.yml
+++ b/.gitlab/benchmarks/serverless.yml
@@ -2,6 +2,18 @@ variables:
   SLS_CI_IMAGE: registry.ddbuild.io/ci/serverless-tools:1
   SLS_CI_BRANCH: v1.3.0
 
+.serverless_benchmark_changes: &serverless_benchmark_changes
+  - .gitlab-ci.yml
+  - .gitlab/benchmarks/serverless.yml
+  - .gitlab/package.yml
+  - .gitlab/scripts/build-wheel.sh
+  - .gitlab/validate-ddtrace-package.py
+  - setup.py
+  - pyproject.toml
+  - ddtrace/internal/serverless/**/*
+  - ddtrace/contrib/internal/aws_lambda/**/*
+  - tests/contrib/aws_lambda/**/*
+
 benchmark-serverless:
   stage: benchmarks
   trigger:
@@ -13,7 +25,9 @@ benchmark-serverless:
   rules:
     - if: $RELEASE_ALLOW_BENCHMARK_FAILURES == "true"
       allow_failure: true
-    - allow_failure: false
+    - if: !reference [.run_all_tests]
+    - changes: *serverless_benchmark_changes
+    - when: never
   variables:
     DD_TAGS: "SLS_CI_BRANCH:$SLS_CI_BRANCH"
     UPSTREAM_PIPELINE_ID: $CI_PIPELINE_ID
diff --git a/.gitlab/package.yml b/.gitlab/package.yml
index ea431feab30..766e09a0426 100644
--- a/.gitlab/package.yml
+++ b/.gitlab/package.yml
@@ -29,6 +29,25 @@ variables:
   - "v133965508-8f84bce-manylinux2014_x86_64"
   - "v133965497-8f84bce-musllinux_1_2_x86_64"
 
+.serverless_changes: &serverless_changes
+  - .gitlab-ci.yml
+  - .gitlab/benchmarks/serverless.yml
+  - .gitlab/package.yml
+  - .gitlab/scripts/build-wheel.sh
+  - .gitlab/validate-ddtrace-package.py
+  - setup.py
+  - pyproject.toml
+  - ddtrace/internal/serverless/**/*
+  - ddtrace/contrib/internal/aws_lambda/**/*
+  - tests/contrib/aws_lambda/**/*
+
+.serverless_rules:
+  rules:
+    - if: $RELEASE_ALLOW_BENCHMARK_FAILURES == "true"
+    - if: !reference [.run_all_tests]
+    - changes: *serverless_changes
+    - when: never
+
 .build_base:
   stage: package
   variables:
@@ -145,7 +164,9 @@ variables:
     - .gitlab/scripts/build-wheel.sh
 
 "build linux serverless":
-  extends: "build linux"
+  extends:
+    - "build linux"
+    - .serverless_rules
   parallel:
     matrix:
       - ARCH_TAG: "amd64"
@@ -316,7 +337,9 @@ variables:
 
 # Only the limited artifacts needed by downstream serverless jobs
 "upload serverless":
-  extends: .upload_wheels_base
+  extends:
+    - .upload_wheels_base
+    - .serverless_rules
   needs:
     - job: "build linux serverless"
       artifacts: true
@@ -568,7 +591,9 @@ download_dependency_wheels:
     - .gitlab/validate-ddtrace-package.py pywheels
 
 "ddtrace package serverless":
-  extends: .package_base
+  extends:
+    - .package_base
+    - .serverless_rules
   needs:
     - "build linux serverless"
     - "package version"

From 97239fb17ce97a3c23698c656f57dfcafb8c9303 Mon Sep 17 00:00:00 2001
From: Munir Abdinur <munir.abdinur@datadoghq.com>
Date: Thu, 1 Oct 2026 14:22:34 -0400
Subject: [PATCH 3/3] ci: scope low-churn compatibility jobs

---
 .gitlab-ci.yml                    | 12 +++++++--
 .gitlab/debugging-exploration.yml | 22 +++++++---------
 .gitlab/multi-os-tests.yml        | 33 +++++++++++++++++++++--
 .gitlab/native.yml                | 44 +++++++++++++++++++++++++++++++
 .gitlab/package.yml               | 23 ++++++++++++++++
 5 files changed, 118 insertions(+), 16 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 078c97f8cc0..55fd8416c30 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -698,6 +698,8 @@ prof-correctness:
     - job: "upload all"
   timeout: 60m
   rules:
+    - if: !reference [.is_gh_merge_queue]
+    - if: !reference [.is_devflow_merge_queue]
     - if: $CI_PIPELINE_SOURCE == "schedule"
     - if: $CI_COMMIT_REF_NAME == "main"
     # Bare rules:changes is true for web/API/tag pipelines; require a push.
@@ -760,6 +762,13 @@ lib_injection_tests:
   stage: tests
   tags: [ "arch:amd64" ]
   image: registry.ddbuild.io/dd-trace-py:v106957811-b912d74-lib_injection@sha256:d381042ec0c5d8ba617453feec7ccdffefca8ef0e3011d980728fe1a7a9425eb
+  rules:
+    - if: !reference [.run_all_tests]
+    - changes:
+        - .gitlab-ci.yml
+        - lib-injection/**/*
+        - tests/lib_injection/**/*
+    - when: never
   script: |
     echo -e "\e[0Ksection_start:`date +%s`:info[collapsed=true]\r\e[0KPython versions"
     pyenv --version
@@ -809,8 +818,7 @@ profiling_native:
     - .profiling_native_base
     - .retry_on_all_failure
   rules:
-    - if: $CI_PIPELINE_SOURCE == "schedule"
-    - if: $CI_COMMIT_REF_NAME == "main"
+    - if: !reference [.run_all_tests]
     - changes:
         - .gitlab-ci.yml
         # Native source files by extension (C, C++, Cython, CMake modules)
diff --git a/.gitlab/debugging-exploration.yml b/.gitlab/debugging-exploration.yml
index 01446d3a1fe..2f56aa33323 100644
--- a/.gitlab/debugging-exploration.yml
+++ b/.gitlab/debugging-exploration.yml
@@ -50,6 +50,16 @@
     DD_DEBUGGER_EXPL_STATUS_MESSAGES: 1
     PYTEST_PLUGINS: "exploration"
     PYTHONPATH: "${CI_PROJECT_DIR}/tests/debugging/exploration/pytest"
+  rules:
+    - if: '$RELEASE_ALLOW_TEST_FAILURES == "true" && ($CI_COMMIT_BRANCH =~ /^gh-readonly-queue\/.*$/ || $CI_COMMIT_BRANCH =~ /^mq-working-branch-.*$/)'
+      allow_failure: true
+    - if: !reference [.is_gh_merge_queue]
+    - if: !reference [.is_devflow_merge_queue]
+    - if: $RELEASE_ALLOW_TEST_FAILURES == "true"
+      changes: *exploration_changes
+      allow_failure: true
+    - changes: *exploration_changes
+    - when: never
   before_script:
     - !reference [.testrunner, before_script]
     # Install only the wheel matching the running Python version. All 6 per-version
@@ -66,12 +76,6 @@
   extends:
     - ".debugging/exploration"
     - ".exploration_needs_build_linux_amd64"
-  rules:
-    - if: $RELEASE_ALLOW_TEST_FAILURES == "true"
-      changes: *exploration_changes
-      allow_failure: true
-    - changes: *exploration_changes
-    - when: never
   variables:
     BOTO3_TAG: "1.38.44"
     DD_DEBUGGER_EXPL_INCLUDE: "boto3"
@@ -88,12 +92,6 @@
   extends:
     - ".debugging/exploration"
     - ".exploration_needs_build_linux_amd64"
-  rules:
-    - if: $RELEASE_ALLOW_TEST_FAILURES == "true"
-      changes: *exploration_changes
-      allow_failure: true
-    - changes: *exploration_changes
-    - when: never
   variables:
     BOTO3_TAG: "1.38.44"
     DD_DEBUGGER_EXPL_INCLUDE: "botocore"
diff --git a/.gitlab/multi-os-tests.yml b/.gitlab/multi-os-tests.yml
index 2ec01017c30..61593cbed3e 100644
--- a/.gitlab/multi-os-tests.yml
+++ b/.gitlab/multi-os-tests.yml
@@ -1,9 +1,38 @@
-# Multi-OS Test Suite
-# Tests the application across Ubuntu, macOS, and Windows with multiple Python versions
+.multi_os_changes: &multi_os_changes
+  - .gitlab-ci.yml
+  - .gitlab/multi-os-tests.yml
+  - .gitlab/package.yml
+  - .gitlab/requirements/multi-os-tests.txt
+  - .gitlab/scripts/build-wheel.sh
+  - .gitlab/scripts/build-wheel-windows.sh
+  - .gitlab/scripts/multi-os-tests.ps1
+  - .gitlab/scripts/multi-os-tests.sh
+  - setup.py
+  - pyproject.toml
+  - ddtrace/**/*.c
+  - ddtrace/**/*.cc
+  - ddtrace/**/*.cpp
+  - ddtrace/**/*.h
+  - ddtrace/**/*.hpp
+  - ddtrace/**/*.pxd
+  - ddtrace/**/*.pyx
+  - ddtrace/appsec/**/*
+  - ddtrace/internal/_libddwaf_platform.py
+  - ddtrace/internal/appsec/**/*
+  - ddtrace/internal/iast/**/*
+  - ddtrace/internal/settings/appsec_telemetry.py
+  - ddtrace/internal/settings/asm.py
+  - src/native/**/*
+  - src/native_heap_gotter/**/*
+  - tests/appsec/**/*
 
 .multi_os_test_base:
   stage: tests
   extends: .retry_on_all_failure
+  rules:
+    - if: !reference [.run_all_tests]
+    - changes: *multi_os_changes
+    - when: never
   variables:
     DD_IAST_ENABLED: "false"
     DD_REMOTE_CONFIGURATION_ENABLED: "false"
diff --git a/.gitlab/native.yml b/.gitlab/native.yml
index 4b68565d3ae..65f92cf46b2 100644
--- a/.gitlab/native.yml
+++ b/.gitlab/native.yml
@@ -1,12 +1,52 @@
 include:
   - local: ".gitlab/testrunner.yml"
 
+.rust_changes: &rust_changes
+  - .gitlab-ci.yml
+  - .gitlab/native.yml
+  - setup.py
+  - pyproject.toml
+  - src/native/**/*
+  - src/native_heap_gotter/**/*
+
+.profiling_native_changes: &profiling_native_changes
+  - .gitlab-ci.yml
+  - .gitlab/native.yml
+  - setup.py
+  - pyproject.toml
+  - ddtrace/internal/datadog/profiling/**/*.cc
+  - ddtrace/internal/datadog/profiling/**/*.cmake
+  - ddtrace/internal/datadog/profiling/**/*.cpp
+  - ddtrace/internal/datadog/profiling/**/*.h
+  - ddtrace/internal/datadog/profiling/**/*.hpp
+  - ddtrace/internal/datadog/profiling/**/*.pyx
+  - ddtrace/internal/datadog/profiling/**/CMakeLists.txt
+  - ddtrace/internal/datadog/profiling/**/*.sh
+  - ddtrace/internal/datadog/profiling/**/*.supp
+  - ddtrace/profiling/**/*.cpp
+  - ddtrace/profiling/**/*.h
+  - ddtrace/profiling/**/*.hpp
+  - ddtrace/profiling/**/*.pxd
+  - ddtrace/profiling/**/*.pyx
+  - ddtrace/profiling/**/CMakeLists.txt
+  - src/native/**/*.rs
+  - src/native/**/*.toml
+  - src/native/**/*.txt
+  - src/native/**/Cargo.lock
+  - src/native_heap_gotter/**/*.rs
+  - src/native_heap_gotter/**/*.toml
+  - src/native_heap_gotter/**/Cargo.lock
+
 "rust ci":
   stage: tests
   image: !reference [.testrunner, image]
   tags: !reference [.testrunner, tags]
   timeout: 10m
   needs: []
+  rules:
+    - if: !reference [.run_all_tests]
+    - changes: *rust_changes
+    - when: never
   before_script: cd src/native
   script:
     - |
@@ -43,6 +83,10 @@ include:
   tags: ["arch:amd64"]
   timeout: 20m
   needs: []
+  rules:
+    - if: !reference [.run_all_tests]
+    - changes: *profiling_native_changes
+    - when: never
   before_script:
     - pyenv global 3.12
   script:
diff --git a/.gitlab/package.yml b/.gitlab/package.yml
index 766e09a0426..8133d9b28af 100644
--- a/.gitlab/package.yml
+++ b/.gitlab/package.yml
@@ -48,6 +48,25 @@ variables:
     - changes: *serverless_changes
     - when: never
 
+.package_build_changes: &package_build_changes
+  - .gitlab-ci.yml
+  - .gitlab/package.yml
+  - .gitlab/scripts/build-sdist.sh
+  - .gitlab/scripts/build-wheel.sh
+  - .gitlab/validate-ddtrace-package.py
+  - setup.py
+  - pyproject.toml
+  - MANIFEST.in
+  - ddtrace/**/*.c
+  - ddtrace/**/*.cc
+  - ddtrace/**/*.cpp
+  - ddtrace/**/*.h
+  - ddtrace/**/*.hpp
+  - ddtrace/**/*.pxd
+  - ddtrace/**/*.pyx
+  - src/native/**/*
+  - src/native_heap_gotter/**/*
+
 .build_base:
   stage: package
   variables:
@@ -381,6 +400,10 @@ variables:
   needs:
     - job: "build sdist"
       artifacts: true
+  rules:
+    - if: !reference [.run_all_tests]
+    - changes: *package_build_changes
+    - when: never
   script:
     - SDIST_FILE=$(ls ${CI_PROJECT_DIR}/pywheels/*.tar.gz | head -n 1)
     - TMP_DIR=$(mktemp -d) && cd $TMP_DIR