Document lockfile expectations

[sarahchen6]

What Does This Do

Specifically document (for humans and agents) that lockfiles should be updated with dependency upgrade PRs, though this requirement is not strictly enforced in CI and a weekly CI job still exists to update lockfiles.

Motivation

Be clear on our lockfile behavior expectations and avoid confusing comments such as #12834 (comment)

Additional Notes

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
  Use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Update public documentation with any new configuration flags or behaviors
• Once approved, use merge queue to merge the PR

Jira ticket: [PROJ-IDENT]

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-14T15:42:33.522439Z	5c408f8	PR opened
🔒 Security Review	✅ Completed 2026-10-14T15:42:40.509703Z	5c408f8	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[datadog-prod-us1-5]

More details

The documented lockfile regeneration commands match the repository’s Gradle tasks and dependency-locking configuration. The guidance distinguishes contributor expectations from CI enforcement.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit 5c408f8}

[mcculls]

LGTM

[bric3]

LGTM, thnaks for the improvement. I'll leave my comments resolution to your discretion.

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	13.96 s	13.94 s	[-0.7%; +1.0%] (no difference)
startup:insecure-bank:tracing:Agent	12.87 s	12.94 s	[-1.2%; +0.2%] (no difference)
startup:petclinic:appsec:Agent	17.19 s	17.10 s	[-0.3%; +1.4%] (no difference)
startup:petclinic:iast:Agent	16.90 s	16.99 s	[-1.3%; +0.3%] (no difference)
startup:petclinic:profiling:Agent	16.74 s	16.89 s	[-2.1%; +0.3%] (no difference)
startup:petclinic:sca:Agent	17.16 s	17.02 s	[-0.0%; +1.7%] (no difference)
startup:petclinic:tracing:Agent	16.15 s	16.05 s	[-0.3%; +1.5%] (no difference)

Commit: 0d1a77a9 · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[datadog-prod-us1-5]

More details

The lockfile guidance matches the repository’s Gradle plugin and weekly update workflow. The dump-test timing change preserves the expected 15-second delay while allowing more time for dump collection.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit 0d1a77a}

[sarahchen6]

/merge

[gh-worker-devflow-routing-ef8351]

View all feedbacks in Devflow UI.

2026-10-14 20:28:53 UTC ℹ️ Start processing command /merge

---

2026-10-14 20:28:58 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 1h (p90).

---

2026-10-14 21:35:49 UTC ℹ️ MergeQueue: This merge request was merged