refactor(config): route env reads through the config singleton (#8241)

* refactor(config): route env reads through the config singleton

Replace `getValueFromEnvSources(...)` with config singleton reads across CI
visibility, runtime metrics, Azure metadata, AWS SDK, the git-cache helper,
and a few smaller helpers. The singleton already applies parsers, alias
precedence, and origin tracking; the helper bypasses all three and re-walks
the source order on every call.

A few sites need more than a drop-in replacement:

1. `serverless.js` lazily requires `./config` inside
   `enableGCPPubSubPushSubscription` to break the
   `config -> serverless -> config` import cycle.
2. `aws-sdk/base.js` needs to check `config.getOrigin(key) === 'default'`.
   As a side effect, programmatic `batchPropagationEnabled` now wins over
   env vars in every permutation; master's `??` chain happened to let the
   service-specific env var beat a top-level programmatic value, which was
   the one rung that disagreed with how every other plugin option resolves.
3. `git-cache.js` defers the env read into an idempotent `ensureCacheDir()`
   first called from `cachedExec()`. The integration test also invalidates
   `packages/dd-trace/src/config` from the require cache so the next
   `require(...)` rebuilds the singleton from the just-set env vars.
4. `getJobIDFromDiagFile` reads `RUNNER_TEMP`, which is not a DD env var,
   so it goes through `getEnvironmentVariable` rather than the singleton.

Unit tests use a proxyquire-injected
`() => proxyquire.noPreserveCache()(.../config, {})()` so per-test
`process.env` mutations still drive a fresh singleton.
`runtime_metrics.spec.js`'s synthetic config object gains
`DD_RUNTIME_METRICS_FLUSH_INTERVAL`. The aws-sdk plugin spec hoists
`process.env.DD_TRACE_AWS_SDK_*_BATCH_PROPAGATION_ENABLED` into the outer
`describe('Plugin')` so the env vars are set before the singleton is first
built. A new `serverless.spec.js` covers the cycle-broken branch directly.

Two call sites stay on the helper:

1. `llmobs/sdk.js`'s `enable()` reads `DD_LLMOBS_ENABLED` at call time so
   user code (and the existing test) can mutate the env var after
   `tracer.init()` and have it honored. The singleton snapshot can't
   reflect a post-init mutation.
2. `test-optimization-cache.js`'s `setupSettingsCachePath` writes
   `process.env` so NYC subprocesses inherit the path; the singleton is a
   one-shot snapshot of the parent's env.

Drive-by fix:

* The `DD_TRACE_AWS_SDK_*_BATCH_PROPAGATION_ENABLED` entries in
  `supported-configurations.json` flip from `default: "true"` /
  `implementation: "A"` to `default: "false"` / `implementation: "B"`. The
  shipped chain has always defaulted to `false` via `isTrue(undefined)`.

* fix(serverless): keep Pub/Sub push check on the env helper

`enableGCPPubSubPushSubscription` lazy-required `./config` to break the
`config -> serverless -> config` import cycle. `HttpPlugin.plugins` calls
it on every `tracer.use('http')`, and each `proxyquire.noPreserveCache(
.../config)` in the test harness clears `config/index.js` from
`require.cache`. The next call then re-evaluates the module and builds a
fresh `Config()` (parsing `supported-configurations.json`, walking
`process.env`, reading git files). AppSec / express CI timed out three
RASP-SSRF `before all` hooks at 5 s.

Read `DD_TRACE_GCP_PUBSUB_PUSH_ENABLED` via `getValueFromEnvSources` and
inline it so `K_SERVICE !== undefined` short-circuits the env lookup.

Drive-by fix:

* `.github/CODEOWNERS`: route the new `test/serverless.spec.js` to
  `@DataDog/apm-serverless`, matching `azure_metadata.spec.js` so
  `lint:codeowners:ci` stops failing on it.

Author: BridgeAR

.github/CODEOWNERS

@@ -32,6 +32,7 @@
 /packages/dd-trace/src/lambda/ @DataDog/serverless-aws @DataDog/apm-serverless
 /packages/dd-trace/test/lambda/ @DataDog/serverless-aws @DataDog/apm-serverless
 /packages/dd-trace/test/azure_metadata.spec.js @DataDog/apm-serverless
+/packages/dd-trace/test/serverless.spec.js @DataDog/apm-serverless
 /packages/dd-trace/test/plugins/util/inferred_proxy.spec.js @DataDog/serverless-aws @DataDog/apm-serverless
 
 # IDM

integration-tests/ci-visibility/git-cache.spec.js

@@ -45,8 +45,11 @@ describe('git-cache integration tests', () => {
   beforeEach(() => {
     process.env.DD_EXPERIMENTAL_TEST_OPT_GIT_CACHE_ENABLED = 'true'
     process.env.DD_EXPERIMENTAL_TEST_OPT_GIT_CACHE_DIR = cacheDir
-    // We need this, otherwise the file is already loaded and the cache is disabled
+    // git-cache reads its config from the dd-trace config singleton on first
+    // use; clearing both modules from the require cache makes the next
+    // `require(...)` rebuild the singleton from the env we just set.
     delete require.cache[require.resolve('../../packages/dd-trace/src/plugins/util/git-cache')]
+    delete require.cache[require.resolve('../../packages/dd-trace/src/config')]
     gitCache = require('../../packages/dd-trace/src/plugins/util/git-cache')
 
     originalPath = process.env.PATH
@@ -148,6 +151,7 @@ describe('git-cache integration tests', () => {
     delete process.env.DD_EXPERIMENTAL_TEST_OPT_GIT_CACHE_ENABLED
 
     delete require.cache[require.resolve('../../packages/dd-trace/src/plugins/util/git-cache')]
+    delete require.cache[require.resolve('../../packages/dd-trace/src/config')]
     const disabledGitCache = require('../../packages/dd-trace/src/plugins/util/git-cache')
 
     const firstResult = disabledGitCache.cachedExec('git', GET_COMMIT_MESSAGE_COMMAND_ARGS)
@@ -172,11 +176,39 @@ describe('git-cache integration tests', () => {
     assert.match(secondError.message, /git/)
   })
 
+  it('should cache when DD_EXPERIMENTAL_TEST_OPT_GIT_CACHE_ENABLED is true and cache dir is unset', function () {
+    delete process.env.DD_EXPERIMENTAL_TEST_OPT_GIT_CACHE_DIR
+
+    delete require.cache[require.resolve('../../packages/dd-trace/src/plugins/util/git-cache')]
+    const defaultDirGitCache = require('../../packages/dd-trace/src/plugins/util/git-cache')
+
+    const firstResultStr = String(defaultDirGitCache.cachedExec('git', GET_COMMIT_MESSAGE_COMMAND_ARGS)).trim()
+    assert.strictEqual(firstResultStr, FIXED_COMMIT_MESSAGE)
+
+    const cacheKey = defaultDirGitCache.getCacheKey('git', GET_COMMIT_MESSAGE_COMMAND_ARGS)
+    const cacheFilePath = defaultDirGitCache.getCacheFilePath(cacheKey)
+    assert.ok(cacheFilePath.includes('dd-trace-git-cache'))
+    assert.strictEqual(fs.existsSync(cacheFilePath), true)
+
+    removeGitFromPath()
+
+    const secondResult = String(defaultDirGitCache.cachedExec('git', GET_COMMIT_MESSAGE_COMMAND_ARGS)).trim()
+    assert.strictEqual(secondResult, firstResultStr)
+
+    fs.rmSync(cacheFilePath, { force: true })
+    try {
+      fs.rmdirSync(path.dirname(cacheFilePath))
+    } catch {
+      // Ignore, if the directory is not empty
+    }
+  })
+
   context('invalid DD_EXPERIMENTAL_TEST_OPT_GIT_CACHE_DIR', () => {
     function runInvalidCacheTest (invalidCacheDir) {
       process.env.DD_EXPERIMENTAL_TEST_OPT_GIT_CACHE_DIR = invalidCacheDir
 
       delete require.cache[require.resolve('../../packages/dd-trace/src/plugins/util/git-cache')]
+      delete require.cache[require.resolve('../../packages/dd-trace/src/config')]
       const invalidDirGitCache = require('../../packages/dd-trace/src/plugins/util/git-cache')
 
       const firstResult = invalidDirGitCache.cachedExec('git', GET_COMMIT_MESSAGE_COMMAND_ARGS)

packages/datadog-plugin-aws-sdk/src/base.js

@@ -3,9 +3,8 @@
 const analyticsSampler = require('../../dd-trace/src/analytics_sampler')
 const ClientPlugin = require('../../dd-trace/src/plugins/client')
 const { storage } = require('../../datadog-core')
-const { isTrue } = require('../../dd-trace/src/util')
 const { tagsFromRequest, tagsFromResponse } = require('../../dd-trace/src/payload-tagging')
-const { getValueFromEnvSources } = require('../../dd-trace/src/config/helper')
+const getConfig = require('../../dd-trace/src/config')
 const { IS_SERVERLESS } = require('../../dd-trace/src/serverless')
 
 const RESPONSE_SKIP_KEYS = new Set(['request', 'requestId', 'error', '$metadata'])
@@ -313,29 +312,25 @@ function normalizeConfig (config, serviceIdentifier) {
   const hooks = getHooks(config)
 
   let specificConfig = config[serviceIdentifier]
-  switch (typeof specificConfig) {
-    case 'undefined':
-      specificConfig = {}
-      break
-    case 'boolean':
-      specificConfig = { enabled: specificConfig }
-      break
+  if (typeof specificConfig === 'boolean') {
+    specificConfig = { enabled: specificConfig }
   }
 
-  // check if AWS batch propagation or AWS_[SERVICE] batch propagation is enabled via env variable
+  // Check if AWS batch propagation or AWS_[SERVICE] batch propagation is enabled via env variable
+  const tracerConfig = getConfig()
   const serviceId = serviceIdentifier.toUpperCase()
-  const batchPropagationEnabled = isTrue(
-    specificConfig.batchPropagationEnabled ??
-    getValueFromEnvSources(`DD_TRACE_AWS_SDK_${serviceId}_BATCH_PROPAGATION_ENABLED`) ??
-    config.batchPropagationEnabled ??
-    getValueFromEnvSources('DD_TRACE_AWS_SDK_BATCH_PROPAGATION_ENABLED')
+  const serviceBatchKey = /** @type {import('../../dd-trace/src/config/config-types').ConfigPath} */(
+    `DD_TRACE_AWS_SDK_${serviceId}_BATCH_PROPAGATION_ENABLED`
   )
+  const batchPropagationEnabled = tracerConfig.getOrigin(serviceBatchKey) === 'default'
+    ? tracerConfig.DD_TRACE_AWS_SDK_BATCH_PROPAGATION_ENABLED
+    : tracerConfig[serviceBatchKey]
 
   // Merge the specific config back into the main config
   return {
+    batchPropagationEnabled,
     ...config,
     ...specificConfig,
-    batchPropagationEnabled,
     hooks,
   }
 }

packages/datadog-plugin-aws-sdk/test/aws-sdk.spec.js

@@ -11,6 +11,31 @@ const { assertObjectContains } = require('../../../integration-tests/helpers')
 const { setup, sort, withAwsSdkV2Versions, withAwsSdkVersions } = require('./spec_helpers')
 
 describe('Plugin', () => {
+  // The config singleton is built lazily on the first `agent.load(...)` and is
+  // not rebuilt across describes, so any env var the singleton needs to see
+  // must be set before then. The 'with env variable _BATCH_PROPAGATION_ENABLED'
+  // describe asserts on these specific values; they're harmless to the other
+  // describes (which assert on programmatic config that wins in the `??` chain).
+  const ORIGINAL_BATCH_PROPAGATION_ENV = {
+    GLOBAL: process.env.DD_TRACE_AWS_SDK_BATCH_PROPAGATION_ENABLED,
+    KINESIS: process.env.DD_TRACE_AWS_SDK_KINESIS_BATCH_PROPAGATION_ENABLED,
+    SQS: process.env.DD_TRACE_AWS_SDK_SQS_BATCH_PROPAGATION_ENABLED,
+  }
+  before(() => {
+    process.env.DD_TRACE_AWS_SDK_BATCH_PROPAGATION_ENABLED = 'true'
+    process.env.DD_TRACE_AWS_SDK_KINESIS_BATCH_PROPAGATION_ENABLED = 'false'
+    process.env.DD_TRACE_AWS_SDK_SQS_BATCH_PROPAGATION_ENABLED = 'true'
+  })
+  after(() => {
+    function restore (name, original) {
+      if (original === undefined) delete process.env[name]
+      else process.env[name] = original
+    }
+    restore('DD_TRACE_AWS_SDK_BATCH_PROPAGATION_ENABLED', ORIGINAL_BATCH_PROPAGATION_ENV.GLOBAL)
+    restore('DD_TRACE_AWS_SDK_KINESIS_BATCH_PROPAGATION_ENABLED', ORIGINAL_BATCH_PROPAGATION_ENV.KINESIS)
+    restore('DD_TRACE_AWS_SDK_SQS_BATCH_PROPAGATION_ENABLED', ORIGINAL_BATCH_PROPAGATION_ENV.SQS)
+  })
+
   // TODO: use the Request class directly for generic tests
   // TODO: add test files for every service
   describe('aws-sdk direct import', function () {

packages/datadog-plugin-cypress/src/cypress-plugin.js

@@ -73,7 +73,7 @@ const {
 } = require('../../dd-trace/src/plugins/util/test')
 const { isMarkedAsUnskippable } = require('../../datadog-plugin-jest/src/util')
 const { ORIGIN_KEY, COMPONENT } = require('../../dd-trace/src/constants')
-const { getValueFromEnvSources } = require('../../dd-trace/src/config/helper')
+const getConfig = require('../../dd-trace/src/config')
 const { appClosing: appClosingTelemetry } = require('../../dd-trace/src/telemetry')
 const log = require('../../dd-trace/src/log')
 
@@ -505,8 +505,7 @@ class CypressPlugin {
 
     this.isTestIsolationEnabled = getIsTestIsolationEnabled(cypressConfig)
 
-    const envFlushWait = Number(getValueFromEnvSources('DD_CIVISIBILITY_RUM_FLUSH_WAIT_MILLIS'))
-    this.rumFlushWaitMillis = Number.isFinite(envFlushWait) ? envFlushWait : undefined
+    this.rumFlushWaitMillis = getConfig().DD_CIVISIBILITY_RUM_FLUSH_WAIT_MILLIS
 
     if (!this.isTestIsolationEnabled) {
       log.warn('Test isolation is disabled, retries will not be enabled')
@@ -995,7 +994,7 @@ class CypressPlugin {
       this.ciVisEvent(TELEMETRY_EVENT_FINISHED, 'session')
       incrementCountMetric(TELEMETRY_TEST_SESSION, {
         provider: this.ciProviderName,
-        autoInjected: !!getValueFromEnvSources('DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER'),
+        autoInjected: !!getConfig().DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER,
       })
 
       finishAllTraceSpans(this.testSessionSpan)

packages/dd-trace/src/azure_metadata.js

@@ -3,10 +3,8 @@
 // Modeled after https://github.com/DataDog/libdatadog/blob/f3994857a59bb5679a65967138c5a3aec418a65f/ddcommon/src/azure_app_services.rs
 
 const os = require('os')
-const {
-  getEnvironmentVariable,
-  getValueFromEnvSources,
-} = require('./config/helper')
+const getConfig = require('./config')
+const { getEnvironmentVariable } = require('./config/helper')
 const { getIsAzureFunction } = require('./serverless')
 
 function extractSubscriptionID (ownerName) {
@@ -69,7 +67,7 @@ function buildMetadata () {
   const WEBSITE_SITE_NAME = getEnvironmentVariable('WEBSITE_SITE_NAME')
   const WEBSITE_SKU = getEnvironmentVariable('WEBSITE_SKU')
 
-  const DD_AZURE_RESOURCE_GROUP = getValueFromEnvSources('DD_AZURE_RESOURCE_GROUP')
+  const { DD_AZURE_RESOURCE_GROUP } = getConfig()
   const isAzureFunction = FUNCTIONS_EXTENSION_VERSION !== undefined && FUNCTIONS_WORKER_RUNTIME !== undefined
   const isFlexConsumptionAzureFunction = isAzureFunction && WEBSITE_SKU === 'FlexConsumption'
 

packages/dd-trace/src/ci-visibility/exporters/test-worker/index.js

@@ -11,10 +11,12 @@ const {
   VITEST_WORKER_TRACE_PAYLOAD_CODE,
   VITEST_WORKER_LOGS_PAYLOAD_CODE,
 } = require('../../../plugins/util/test')
-const { getEnvironmentVariable, getValueFromEnvSources } = require('../../../config/helper')
+const getConfig = require('../../../config')
+const { getEnvironmentVariable } = require('../../../config/helper')
 const Writer = require('./writer')
 
 function getInterprocessTraceCode () {
+  const { DD_PLAYWRIGHT_WORKER, DD_VITEST_WORKER } = getConfig()
   if (getEnvironmentVariable('JEST_WORKER_ID')) {
     return JEST_WORKER_TRACE_PAYLOAD_CODE
   }
@@ -24,13 +26,13 @@ function getInterprocessTraceCode () {
   if (getEnvironmentVariable('MOCHA_WORKER_ID')) {
     return MOCHA_WORKER_TRACE_PAYLOAD_CODE
   }
-  if (getValueFromEnvSources('DD_PLAYWRIGHT_WORKER')) {
+  if (DD_PLAYWRIGHT_WORKER) {
     return PLAYWRIGHT_WORKER_TRACE_PAYLOAD_CODE
   }
   if (getEnvironmentVariable('TINYPOOL_WORKER_ID')) {
     return VITEST_WORKER_TRACE_PAYLOAD_CODE
   }
-  if (getValueFromEnvSources('DD_VITEST_WORKER')) {
+  if (DD_VITEST_WORKER) {
     return VITEST_WORKER_TRACE_PAYLOAD_CODE
   }
   return null
@@ -51,7 +53,7 @@ function getInterprocessLogsCode () {
   if (getEnvironmentVariable('TINYPOOL_WORKER_ID')) {
     return VITEST_WORKER_LOGS_PAYLOAD_CODE
   }
-  if (getValueFromEnvSources('DD_VITEST_WORKER')) {
+  if (getConfig().DD_VITEST_WORKER) {
     return VITEST_WORKER_LOGS_PAYLOAD_CODE
   }
   return null

packages/dd-trace/src/config/generated-config-types.d.ts

@@ -90,7 +90,7 @@ export interface GeneratedConfig {
   DD_ENABLE_LAGE_PACKAGE_NAME: boolean;
   DD_ENABLE_NX_SERVICE_NAME: boolean;
   DD_EXPERIMENTAL_PROPAGATE_PROCESS_TAGS_ENABLED: boolean;
-  DD_EXPERIMENTAL_TEST_OPT_GIT_CACHE_DIR: string;
+  DD_EXPERIMENTAL_TEST_OPT_GIT_CACHE_DIR: string | undefined;
   DD_EXPERIMENTAL_TEST_OPT_GIT_CACHE_ENABLED: boolean;
   DD_EXPERIMENTAL_TEST_OPT_SETTINGS_CACHE: string;
   DD_EXPERIMENTAL_TEST_REQUESTS_FS_CACHE: boolean;