From b8637f783396f69515e972e629176245f5cdadea Mon Sep 17 00:00:00 2001
From: Florian Engelhardt <florian.engelhardt@datadoghq.com>
Date: Thu, 30 Jul 2026 08:02:19 +0200
Subject: [PATCH 1/3] fix(ci): isolate PHPTs from Fabric egress proxy

---
 .gitlab/generate-appsec.php   | 2 ++
 .gitlab/generate-profiler.php | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/.gitlab/generate-appsec.php b/.gitlab/generate-appsec.php
index 599a54c805..425c3fef5a 100644
--- a/.gitlab/generate-appsec.php
+++ b/.gitlab/generate-appsec.php
@@ -100,6 +100,8 @@
       -DCMAKE_CXX_FLAGS='-stdlib=libc++' -DCMAKE_CXX_LINK_FLAGS='-stdlib=libc++'
 	  -DDD_APPSEC_TESTING=ON -DBOOST_CACHE_PREFIX=$CI_PROJECT_DIR/boost-cache
       -DENABLE_ASAN=$ASAN_FLAG"
+    # The Fabric proxy changes curl test behavior and leaks HTTP_PROXY into $_SERVER.
+    - unset HTTP_PROXY HTTPS_PROXY http_proxy https_proxy ALL_PROXY all_proxy
     - ASAN_OPTIONS=malloc_context_size=0 make -j 4 xtest
 
 .appsec_integration_tests:
diff --git a/.gitlab/generate-profiler.php b/.gitlab/generate-profiler.php
index 6cdfa579fb..eb7f707060 100644
--- a/.gitlab/generate-profiler.php
+++ b/.gitlab/generate-profiler.php
@@ -165,6 +165,8 @@
     - "if php -r 'exit(PHP_VERSION_ID < 80400 ? 0 : 1);'; then cat profiling/tests/php-language-xfail-pre84.list >> /tmp/profiler-php-language-xfail.list; fi"
     - export XFAIL_LIST=/tmp/profiler-php-language-xfail.list
     - ulimit -c unlimited
+    # The Fabric proxy changes curl test behavior and leaks HTTP_PROXY into $_SERVER.
+    - unset HTTP_PROXY HTTPS_PROXY http_proxy https_proxy ALL_PROXY all_proxy
     - .gitlab/run_php_language_tests.sh
   after_script:
     - |

From 847cfbb738c513d0af384f4805fb6bd346d5c39f Mon Sep 17 00:00:00 2001
From: Florian Engelhardt <florian.engelhardt@datadoghq.com>
Date: Thu, 30 Jul 2026 08:18:49 +0200
Subject: [PATCH 2/3] fix(ci): isolate integration tests from Fabric proxy

---
 .gitlab/generate-appsec.php       | 4 +++-
 .gitlab/generate-package.php      | 2 ++
 .gitlab/generate-profiler.php     | 2 --
 .gitlab/generate-tracer.php       | 2 ++
 .gitlab/run_php_language_tests.sh | 3 +++
 5 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/.gitlab/generate-appsec.php b/.gitlab/generate-appsec.php
index 425c3fef5a..7c04b93ec5 100644
--- a/.gitlab/generate-appsec.php
+++ b/.gitlab/generate-appsec.php
@@ -100,7 +100,7 @@
       -DCMAKE_CXX_FLAGS='-stdlib=libc++' -DCMAKE_CXX_LINK_FLAGS='-stdlib=libc++'
 	  -DDD_APPSEC_TESTING=ON -DBOOST_CACHE_PREFIX=$CI_PROJECT_DIR/boost-cache
       -DENABLE_ASAN=$ASAN_FLAG"
-    # The Fabric proxy changes curl test behavior and leaks HTTP_PROXY into $_SERVER.
+    # The Fabric proxy changes network failure semantics and leaks HTTP_PROXY into $_SERVER.
     - unset HTTP_PROXY HTTPS_PROXY http_proxy https_proxy ALL_PROXY all_proxy
     - ASAN_OPTIONS=malloc_context_size=0 make -j 4 xtest
 
@@ -359,6 +359,8 @@
         -DBOOST_CACHE_PREFIX="$CI_PROJECT_DIR/boost-cache"
     - |
       export PATH=$PATH:$HOME/.cargo/bin
+      # The Fabric proxy changes network failure semantics and leaks HTTP_PROXY into $_SERVER.
+      unset HTTP_PROXY HTTPS_PROXY http_proxy https_proxy ALL_PROXY all_proxy
       LLVM_PROFILE_FILE="/tmp/cov-ext/%p.profraw" \
         VERBOSE=1 make -j 4 xtest
     - VERBOSE=1 make -j 4 ddappsec_helper_test
diff --git a/.gitlab/generate-package.php b/.gitlab/generate-package.php
index f43076792a..c078130539 100644
--- a/.gitlab/generate-package.php
+++ b/.gitlab/generate-package.php
@@ -1217,6 +1217,8 @@ function appsec_image_from_tag_mapping(string $tag): string
     - pecl install datadog_trace.tgz
     - echo "extension=ddtrace.so" | sudo tee $(php -i | awk -F"=> " '/Scan this dir for additional .ini files/ {print $2}')/ddtrace.ini
     - php --ri=ddtrace
+    # The Fabric proxy changes network failure semantics in PECL tests.
+    - unset HTTP_PROXY HTTPS_PROXY http_proxy https_proxy ALL_PROXY all_proxy
     - TERM=dumb HTTPBIN_HOSTNAME=httpbin-integration HTTPBIN_PORT=8080 DATADOG_HAVE_DEV_ENV=1 DD_TRACE_GIT_METADATA_ENABLED=0 pecl run-tests --showdiff --ini=" -d datadog.trace.sources_path=" -p datadog_trace
   after_script:
     - mkdir artifacts
diff --git a/.gitlab/generate-profiler.php b/.gitlab/generate-profiler.php
index eb7f707060..6cdfa579fb 100644
--- a/.gitlab/generate-profiler.php
+++ b/.gitlab/generate-profiler.php
@@ -165,8 +165,6 @@
     - "if php -r 'exit(PHP_VERSION_ID < 80400 ? 0 : 1);'; then cat profiling/tests/php-language-xfail-pre84.list >> /tmp/profiler-php-language-xfail.list; fi"
     - export XFAIL_LIST=/tmp/profiler-php-language-xfail.list
     - ulimit -c unlimited
-    # The Fabric proxy changes curl test behavior and leaks HTTP_PROXY into $_SERVER.
-    - unset HTTP_PROXY HTTPS_PROXY http_proxy https_proxy ALL_PROXY all_proxy
     - .gitlab/run_php_language_tests.sh
   after_script:
     - |
diff --git a/.gitlab/generate-tracer.php b/.gitlab/generate-tracer.php
index bf7fbc8f54..05aea7c9b6 100644
--- a/.gitlab/generate-tracer.php
+++ b/.gitlab/generate-tracer.php
@@ -571,6 +571,8 @@ function before_script_steps($with_docker_auth = false) {
     - make composer_tests_update
     - .gitlab/wait-for-service-ready.sh
   script:
+    # The Fabric proxy changes network failure semantics in integration tests.
+    - unset HTTP_PROXY HTTPS_PROXY http_proxy https_proxy ALL_PROXY all_proxy
     - DD_TRACE_AGENT_TIMEOUT=1000 make $MAKE_TARGET RUST_DEBUG_BUILD=1 PHPUNIT_JUNIT="artifacts/tests/results.xml" <?= ASSERT_NO_MEMLEAKS ?>
 <?php after_script(".", true); ?>
     - find tests -type f \( -name 'phpunit_error.log' -o -name 'nginx_*.log' -o -name 'apache_*.log' -o -name 'php_fpm_*.log' -o -name 'dd_php_error.log' \) -exec cp --parents '{}' artifacts \;
diff --git a/.gitlab/run_php_language_tests.sh b/.gitlab/run_php_language_tests.sh
index 7261c7d0c0..475cdb25e5 100755
--- a/.gitlab/run_php_language_tests.sh
+++ b/.gitlab/run_php_language_tests.sh
@@ -1,6 +1,9 @@
 #!/usr/bin/env bash
 set -eo pipefail
 
+# The Fabric proxy changes network failure semantics and leaks HTTP_PROXY into $_SERVER.
+unset HTTP_PROXY HTTPS_PROXY http_proxy https_proxy ALL_PROXY all_proxy
+
 # Helper to parse version strings for comparison
 function version { echo "$@" | awk -F. '{ printf("%d%03d%03d%03d\n", $1,$2,$3,$4); }'; }
 

From 645c602a692bd5efb2a2750c73ea4fdb27568249 Mon Sep 17 00:00:00 2001
From: Florian Engelhardt <florian.engelhardt@datadoghq.com>
Date: Thu, 30 Jul 2026 12:13:14 +0200
Subject: [PATCH 3/3] fix(appsec): unset proxy in test wrapper

---
 .gitlab/generate-appsec.php       | 4 ----
 appsec/cmake/run-tests-wrapper.sh | 3 +++
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/.gitlab/generate-appsec.php b/.gitlab/generate-appsec.php
index 7c04b93ec5..599a54c805 100644
--- a/.gitlab/generate-appsec.php
+++ b/.gitlab/generate-appsec.php
@@ -100,8 +100,6 @@
       -DCMAKE_CXX_FLAGS='-stdlib=libc++' -DCMAKE_CXX_LINK_FLAGS='-stdlib=libc++'
 	  -DDD_APPSEC_TESTING=ON -DBOOST_CACHE_PREFIX=$CI_PROJECT_DIR/boost-cache
       -DENABLE_ASAN=$ASAN_FLAG"
-    # The Fabric proxy changes network failure semantics and leaks HTTP_PROXY into $_SERVER.
-    - unset HTTP_PROXY HTTPS_PROXY http_proxy https_proxy ALL_PROXY all_proxy
     - ASAN_OPTIONS=malloc_context_size=0 make -j 4 xtest
 
 .appsec_integration_tests:
@@ -359,8 +357,6 @@
         -DBOOST_CACHE_PREFIX="$CI_PROJECT_DIR/boost-cache"
     - |
       export PATH=$PATH:$HOME/.cargo/bin
-      # The Fabric proxy changes network failure semantics and leaks HTTP_PROXY into $_SERVER.
-      unset HTTP_PROXY HTTPS_PROXY http_proxy https_proxy ALL_PROXY all_proxy
       LLVM_PROFILE_FILE="/tmp/cov-ext/%p.profraw" \
         VERBOSE=1 make -j 4 xtest
     - VERBOSE=1 make -j 4 ddappsec_helper_test
diff --git a/appsec/cmake/run-tests-wrapper.sh b/appsec/cmake/run-tests-wrapper.sh
index df84590d5f..5033164c71 100755
--- a/appsec/cmake/run-tests-wrapper.sh
+++ b/appsec/cmake/run-tests-wrapper.sh
@@ -68,6 +68,9 @@ else
   set -- "${@:1:$#-1}" "${EXTRA_FLAGS[@]}" "${!#}"
 fi
 
+# The Fabric proxy leaks HTTP_PROXY into $_SERVER as a request header.
+unset HTTP_PROXY HTTPS_PROXY http_proxy https_proxy ALL_PROXY all_proxy
+
 set -x
 exec "$@"