Aggregate Muzzle reports through Gradle variants

[bric3]

What Does This Do

Publish instrumentation dependency range reports as Gradle verification variants and collect them with :dd-java-agent:instrumentation:aggregateMuzzleReports.

The aggregation plugin reuses the instrumentation project's declared dependencies. CI invokes the aggregate directly; the root generateMuzzleReport proxy is removed. The instrumentation project's mergeMuzzleReports and muzzleInstrumentationReport aliases remain.

Motivation

Align Muzzle reporting with Gradle's recommended variant-aware sharing of project outputs. This follows the pattern used by Gradle's JaCoCo Report Aggregation and Test Report Aggregation plugins: producers publish verification artifacts, and a separate aggregation plugin consumes matching variants through project dependencies.

The report artifact becomes the contract between projects, rather than task names or filesystem layout:

• Gradle infers producer task dependencies from the consumed outputs, without looking up another project's tasks.
• Lazy, variant-aware resolution reuses the instrumentation dependency graph instead of scanning shared report directories.
• Separate producer and aggregation plugins keep responsibilities clear. Only selected report artifacts are merged, excluding stale CSVs left in build directories.

Additional Notes

Follow-up to

• Make Muzzle report tasks configuration-cache compatible #12757
• Restore the original Muzzle report task roles #12760

Related to

• [hackaton] use muzzle to document supported instrumentation versions #5208

The existing CI report filename is preserved.
Report generation remains separate from compatibility validation with muzzle, which now clarified in the docs.

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
  Use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Update public documentation with any new configuration flags or behaviors
• Once approved, use merge queue to merge the PR

[bric3]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-07T16:32:07.108189Z	77a7371	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-07T16:32:24.440827Z	77a7371	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: 77a7371718

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 77a7371718

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[datadog-prod-us1-3]

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 59.29% (-0.01%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: a2aba82 | Docs | Give us feedback!}

[datadog-prod-us1-3]

More details

Published report outputs preserve producer task dependencies, and CI artifact collection covers the relocated report path. Full instrumentation report generation remains unverified.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit 77a7371 · @DataDog review to ask questions}

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	13.97 s	13.85 s	[-0.0%; +1.7%] (no difference)
startup:insecure-bank:tracing:Agent	12.85 s	12.94 s	[-1.4%; -0.0%] (maybe better)
startup:petclinic:appsec:Agent	17.15 s	17.04 s	[-0.0%; +1.3%] (no difference)
startup:petclinic:iast:Agent	16.92 s	16.41 s	[-1.3%; +7.5%] (no difference)
startup:petclinic:profiling:Agent	16.58 s	16.81 s	[-2.3%; -0.3%] (maybe better)
startup:petclinic:sca:Agent	17.07 s	16.85 s	[+0.4%; +2.2%] (maybe worse)
startup:petclinic:tracing:Agent	16.14 s	16.11 s	[-0.5%; +1.0%] (no difference)

Commit: a2aba82c · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[sarahchen6]

👍

[amarziali]

Thanks for having improved that one! looks good. I would ask @DataDog/apm-idm-java if the report is still used