Basis for java agent rule skill by colin-higgins · Pull Request #12816 · DataDog/dd-trace-java

colin-higgins · 2026-10-09T15:03:22Z

What Does This Do

Add a skill for guiding agentic static analysis rule suggestions

Motivation

See above

Additional Notes

None

Contributor Checklist

Format the title according to the contribution guidelines
Assign the type: and (comp: or inst:) labels in addition to any other useful labels
Avoid using close, fix, or any linking keywords when referencing an issue
Use solves instead, and assign the PR milestone to the issue
Update the CODEOWNERS file on source file addition, migration, or deletion
Update public documentation with any new configuration flags or behaviors
Once approved, use merge queue to merge the PR

Jira ticket: [PROJ-IDENT]

dd-octo-sts · 2026-10-09T15:03:35Z

Hi! 👋 Thanks for your pull request! 🎉

To help us review it, please make sure to:

Add at least one type, and one component or instrumentation label to the pull request

If you need help, please check our contributing guidelines.

chatgpt-codex-connector · 2026-10-09T15:03:36Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-09T15:12:38.751819Z	`d27fba9`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d27fba9cb6

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-10-09T15:12:32Z

+
+Use this file after the [SpotBugs skill](../SKILL.md) classification step finds no matching detector. Do not start here.
+
+Pick the **narrowest** vehicle that can fail CI with low false positives. One rule per change, same as SpotBugs.


Account for non-blocking Forbidden APIs modules

For repository-wide banned-call rules, Forbidden APIs is not currently a blocking gate in every production module: dd-java-agent/agent-otel/otel-bootstrap/build.gradle overrides forbiddenApis.ignoreFailures to true. A violation confined to that module therefore does not fail CI, contrary to the selection criterion here; either document the coverage exception, remove the override as part of enabling the rule, or choose a vehicle that can enforce it there.

Useful? React with 👍 / 👎.

suggestion: This is true, and this is intentional, on some specific modules only, currently only 3 modules disable it.
It might be worth mentioning it though.

chatgpt-codex-connector · 2026-10-09T15:12:33Z

+
+Use when the rule is “never call this method/class” with **no location qualifier** (not “only in `@Advice`”, not “only in premain”).
+
+1. Append **one** signature (and optional `@defaultMessage`) to `main.txt`.


Reset the inherited Forbidden APIs message

When a signature is appended without its own message, it inherits the last @defaultMessage in the file; the parser retains that value for every subsequent signature until another directive replaces or clears it (implementation). Because main.txt currently ends with the OkHostnameVerifier message, following this instruction literally gives the new rule that unrelated CVE message; require an inline message or an explicit @defaultMessage reset before appending.

Useful? React with 👍 / 👎.

suggestion: Maybe adding an example there would be useful, to teach the agent how this file format works.
In particular if the rule is not added to an existing one, then require an explicit message for each new rule, either inline or through its own @defaultMessage?

See my message on https://github.com/DataDog/dd-trace-java/pull/12816/changes#r4295777114 that addresses the two points.

datadog-datadog-prod-us1

The skill can retain a newly enabled visitor after checking only the main source set, although blocking CI also analyzes Java 11 production sources.

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit d27fba9}

dd-octo-sts · 2026-10-09T15:27:35Z

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	13.95 s	13.88 s	[-0.2%; +1.3%] (no difference)
startup:insecure-bank:tracing:Agent	12.86 s	12.93 s	[-1.2%; +0.2%] (no difference)
startup:petclinic:appsec:Agent	17.07 s	16.95 s	[-0.2%; +1.6%] (no difference)
startup:petclinic:iast:Agent	16.26 s	16.92 s	[-8.1%; +0.3%] (no difference)
startup:petclinic:profiling:Agent	16.64 s	16.75 s	[-1.7%; +0.4%] (no difference)
startup:petclinic:sca:Agent	17.03 s	16.87 s	[-0.0%; +1.9%] (no difference)
startup:petclinic:tracing:Agent	16.12 s	15.64 s	[-1.2%; +7.3%] (no difference)

Commit: 90b4c8d9 · CI Pipeline · Benchmarking Platform UI

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

bric3

Two documentation suggestions on shared conventions and justified exceptions. The existing discussions cover the source-set commands and detector selection.

bric3 · 2026-10-14T15:44:17Z

+Config: [`gradle/forbiddenApiFilters/main.txt`](../../../../gradle/forbiddenApiFilters/main.txt),
+[`gradle/forbiddenapis.gradle`](../../../../gradle/forbiddenapis.gradle).
+
+Use when the rule is “never call this method/class” with **no location qualifier** (not “only in `@Advice`”, not “only in premain”).


suggestion: We may want to we mention the extra signature lists for specific module types?

main.txt holds the common rules,

while the instrumentation convention also adds instrumentation.txt.

This helps the skill choose the right file for a new ban while keeping tool enablement in the module configuration.

dd-trace-java/buildSrc/src/main/kotlin/dd-trace-java.module.instrumentation.gradle.kts

Lines 28 to 33 in d27fba9

forbiddenApis {

signaturesFiles = files(

"$rootDir/gradle/forbiddenApiFilters/main.txt",

"$rootDir/gradle/forbiddenApiFilters/instrumentation.txt"

)

}

bric3

Answered some messages from codex.

bric3 · 2026-10-16T14:33:24Z

+
+Use this file after the [SpotBugs skill](../SKILL.md) classification step finds no matching detector. Do not start here.
+
+Pick the **narrowest** vehicle that can fail CI with low false positives. One rule per change, same as SpotBugs.


suggestion: This is true, and this is intentional, on some specific modules only, currently only 3 modules disable it.
It might be worth mentioning it though.

bric3 · 2026-10-16T14:33:25Z

+
+Use when the rule is “never call this method/class” with **no location qualifier** (not “only in `@Advice`”, not “only in premain”).
+
+1. Append **one** signature (and optional `@defaultMessage`) to `main.txt`.


suggestion: Maybe adding an example there would be useful, to teach the agent how this file format works.
In particular if the rule is not added to an existing one, then require an explicit message for each new rule, either inline or through its own @defaultMessage?

See my message on https://github.com/DataDog/dd-trace-java/pull/12816/changes#r4295777114 that addresses the two points.

Co-authored-by: Brice Dutheil <brice.dutheil@gmail.com>

Basis for java agent rule skill

d27fba9

colin-higgins requested a review from a team as a code owner October 9, 2026 15:03

colin-higgins requested review from amarziali and removed request for a team October 9, 2026 15:03

colin-higgins requested a review from bric3 October 9, 2026 15:11

colin-higgins assigned bric3 Oct 9, 2026

chatgpt-codex-connector Bot reviewed Oct 9, 2026

View reviewed changes

datadog-datadog-prod-us1 Bot reviewed Oct 9, 2026

View reviewed changes

Comment thread .agents/skills/spotbugs/SKILL.md

This comment has been minimized.

Sign in to view

bric3 reviewed Oct 14, 2026

View reviewed changes

bric3 reviewed Oct 16, 2026

View reviewed changes

bric3 added tag: no release notes Changes to exclude from release notes comp: tooling Build & Tooling labels Oct 16, 2026

colin-higgins and others added 11 commits October 18, 2026 21:33

Instructions to allow suppression

00be7e0

Apply suggestion from @bric3

de30dc6

Co-authored-by: Brice Dutheil <brice.dutheil@gmail.com>

Apply suggestion from @bric3

eecf082

Co-authored-by: Brice Dutheil <brice.dutheil@gmail.com>

Apply suggestion from @bric3

810bc62

Co-authored-by: Brice Dutheil <brice.dutheil@gmail.com>

Apply suggestion from @bric3

b554899

Co-authored-by: Brice Dutheil <brice.dutheil@gmail.com>

Apply suggestion from @bric3

3153330

Co-authored-by: Brice Dutheil <brice.dutheil@gmail.com>

Apply suggestion from @bric3

5234b16

Co-authored-by: Brice Dutheil <brice.dutheil@gmail.com>

Apply suggestion from @bric3

5996536

Co-authored-by: Brice Dutheil <brice.dutheil@gmail.com>

Apply suggestion from @bric3

51e2193

Co-authored-by: Brice Dutheil <brice.dutheil@gmail.com>

Final feedback

b619afb

Merge branch 'master' into colin.higgins/rule-agent-skill

90b4c8d


		Use this file after the [SpotBugs skill](../SKILL.md) classification step finds no matching detector. Do not start here.

		Pick the narrowest vehicle that can fail CI with low false positives. One rule per change, same as SpotBugs.


		Use when the rule is “never call this method/class” with no location qualifier (not “only in `@Advice`”, not “only in premain”).

		1. Append one signature (and optional `@defaultMessage`) to `main.txt`.

	forbiddenApis {
	signaturesFiles = files(
	"$rootDir/gradle/forbiddenApiFilters/main.txt",
	"$rootDir/gradle/forbiddenApiFilters/instrumentation.txt"
	)
	}

Conversation

colin-higgins commented Oct 9, 2026

What Does This Do

Motivation

Additional Notes

Contributor Checklist

Uh oh!

dd-octo-sts Bot commented Oct 9, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

bric3 Oct 16, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

bric3 Oct 16, 2026

Choose a reason for hiding this comment

Uh oh!

datadog-datadog-prod-us1 Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This comment has been minimized.

dd-octo-sts Bot commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🟢 Java Benchmark SLOs — All performance SLOs passed

Uh oh!

bric3 left a comment

Choose a reason for hiding this comment

Uh oh!

bric3 Oct 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

bric3 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bric3 Oct 16, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

bric3 Oct 16, 2026

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

chatgpt-codex-connector Bot commented Oct 9, 2026 •

edited

Loading

dd-octo-sts Bot commented Oct 9, 2026 •

edited

Loading

bric3 Oct 14, 2026 •

edited

Loading