From a80208cac43f9da02b4507b6caab1187775d32ed Mon Sep 17 00:00:00 2001
From: "dd-apm-ecosystems[bot]"
 <183529005+dd-apm-ecosystems[bot]@users.noreply.github.com>
Date: Fri, 25 Sep 2026 23:22:24 +0000
Subject: [PATCH 1/2] Extend SpotBugs unclosed-resource check to test and JMH
 sources

Adds a narrowly-scoped SpotBugs check (FindUnsatisfiedObligation only)
for tasks ending in Test/Jmh, matching the enforcement already applied
to Main sources, to catch AutoCloseable/Closeable resources that are
allocated but not reliably closed on every path.
---
 gradle/spotbugs.gradle | 43 +++++++++++++++++++++++++++++++++++++-----
 1 file changed, 38 insertions(+), 5 deletions(-)

diff --git a/gradle/spotbugs.gradle b/gradle/spotbugs.gradle
index a69304a7728..794ecf23848 100644
--- a/gradle/spotbugs.gradle
+++ b/gradle/spotbugs.gradle
@@ -5,7 +5,8 @@ spotbugs {
   excludeFilter = file("$rootDir/gradle/spotbugFilters/exclude.xml")
 }
 
-// Configure spotbugs for Main tasks and disable it for all other
+// Configure spotbugs for Main tasks, restrict it to the unclosed-resource check on Test and Jmh
+// tasks, and disable it for all other
 // Can't use the class here due to being different class
 tasks.matching { it.name.startsWith('spotbugs') }.configureEach {
   // Needs Java 11+ to run spotbugs
@@ -14,10 +15,42 @@ tasks.matching { it.name.startsWith('spotbugs') }.configureEach {
   }
 
   def name = it.name
-  if (project.path.startsWith(":dd-smoke-tests")
-    || !(name.endsWith("Main")
-    || name.endsWith("Main_java11"))
-    ) {
+  if (project.path.startsWith(":dd-smoke-tests")) {
+    it.enabled = false
+    return
+  }
+
+  // Unclosed-resource check for test and JMH sources.
+  //
+  // Test and benchmark code regularly allocates an AutoCloseable/Closeable and then fails to close it
+  // on every path - most often the early-return and exceptional ones - because the resource is never
+  // put in a try-with-resources. Reviewers keep catching this by hand, which is slow and unreliable
+  // for a defect the 'FindUnsatisfiedObligation' detector (OBL_UNSATISFIED_OBLIGATION) finds
+  // mechanically. Only that detector runs here, so the check stays scoped to leaked resources and
+  // cannot start failing these sources for unrelated reasons as SpotBugs gains new detectors.
+  //
+  // It flags the obligation types SpotBugs knows: streams, readers, writers and the java.sql handles,
+  // plus any type annotated '@CleanupObligation' with a '@CreatesObligation' constructor and a
+  // '@DischargesObligation' close method. Project-specific handles are only covered once they carry
+  // those annotations; plain 'implements AutoCloseable' is not enough for SpotBugs to track them.
+  //
+  // Violations fail the build, exactly like main sources. Findings that predate this check are
+  // grandfathered in 'gradle/spotbugFilters/exclude.xml'; they are not a precedent for new code.
+  if (name.endsWith("Test") || name.endsWith("Jmh")) {
+    it.showProgress = !providers.environmentVariable("CI").isPresent()
+    it.ignoreFailures = false
+    it.visitors = ['FindUnsatisfiedObligation']
+    it.reports {
+      html {
+        required = true
+        destination(file("$buildDir/reports/spotbugs/${name}.html"))
+        stylesheet = 'fancy-hist.xsl'
+      }
+    }
+    return
+  }
+
+  if (!(name.endsWith("Main") || name.endsWith("Main_java11"))) {
     it.enabled = false
     return
   }

From 8970ef8c39c8d56ecbad4a5fedefc8aac8efe6a2 Mon Sep 17 00:00:00 2001
From: "dd-apm-ecosystems[bot]"
 <183529005+dd-apm-ecosystems[bot]@users.noreply.github.com>
Date: Fri, 25 Sep 2026 23:23:18 +0000
Subject: [PATCH 2/2] Grandfather pre-existing OBL_UNSATISFIED_OBLIGATION
 findings in profiling-uploader tests

These two test helper methods predate the new test/JMH SpotBugs check
introduced alongside this commit and are suppressed individually so the
check can be required going forward without breaking the build.
---
 gradle/spotbugFilters/exclude.xml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/gradle/spotbugFilters/exclude.xml b/gradle/spotbugFilters/exclude.xml
index 2276ed212e0..16b546cd5c9 100644
--- a/gradle/spotbugFilters/exclude.xml
+++ b/gradle/spotbugFilters/exclude.xml
@@ -23,4 +23,21 @@
       <Package name="com.datadog.appsec.report.raw.events" />
     </Or>
   </Match>
+
+  <!--
+    Grandfathered findings for the unclosed-resource check that test and JMH sources run
+    (see gradle/spotbugs.gradle). These predate the check; they are suppressed one method at a time
+    so the check can be required for everything else, and they are not a licence for new code to
+    leave resources unclosed. Fix the method and drop its entry rather than adding more.
+  -->
+  <Match>
+    <Class name="com.datadog.profiling.uploader.ProfileUploaderTest" />
+    <Method name="recordingStream" />
+    <Bug pattern="OBL_UNSATISFIED_OBLIGATION_EXCEPTION_EDGE" />
+  </Match>
+  <Match>
+    <Class name="com.datadog.profiling.uploader.util.JfrCliHelperTest" />
+    <Method name="recordingStream" />
+    <Bug pattern="OBL_UNSATISFIED_OBLIGATION_EXCEPTION_EDGE" />
+  </Match>
 </FindBugsFilter>