[claponcet]

What Does This Do

Add a Lambda smoke test that verifies Junrar dependency and advisory reporting, then checks the exact application caller and source line after a watched method executes inside an instrumented RequestStreamHandler. SCA is enabled with AppSec disabled.

Motivation

Provide regression coverage for Java Lambda SCA as part of APPSEC-71306. The fixture retains Junrar as a separate JAR and waits for advisory telemetry before invoking the handler, so it tests reachability after deferred instrumentation is ready.

Additional Notes

Validated with ./gradlew :spotlessApply :dd-smoke-tests:appsec:lambda-sca:spotlessApply :dd-smoke-tests:appsec:lambda-sca:test -PtestJvm=17. The smoke test passes.

The fixture uses a local stub for the Lambda extension invocation protocol. This PR covers local dependency and reachability telemetry; AWS deployment, agentless delivery, and cold-start reachability remain outside its scope.

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
  Use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Update public documentation with any new configuration flags or behaviors
• Once approved, use merge queue to merge the PR

Jira ticket: APPSEC-71306

[datadog-datadog-prod-us1]

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 59.47% (-0.02%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 29bc589 | Docs | Give us feedback!}

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	14.07 s	13.99 s	[-0.2%; +1.4%] (no difference)
startup:insecure-bank:tracing:Agent	12.93 s	13.03 s	[-1.6%; -0.0%] (maybe better)
startup:petclinic:appsec:Agent	17.24 s	17.16 s	[-0.4%; +1.3%] (no difference)
startup:petclinic:iast:Agent	17.09 s	17.09 s	[-0.9%; +0.8%] (no difference)
startup:petclinic:profiling:Agent	16.69 s	16.98 s	[-2.7%; -0.8%] (maybe better)
startup:petclinic:sca:Agent	17.18 s	17.08 s	[-0.3%; +1.5%] (no difference)
startup:petclinic:tracing:Agent	16.32 s	16.20 s	[-0.2%; +1.7%] (no difference)

Commit: 29bc5891 · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T10:24:20.258352Z	ded1447	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-28T10:23:28.015078Z	ded1447	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[datadog-datadog-prod-us1]

More details

The readiness gate, Lambda invocation path, and caller/source-line assertions align with the existing reachability implementation. The static reviewer identified no actionable defects; the smoke test was not executed.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit ded1447}

[jandro996]

Thanks for addressing all the comments. LGTM.

[dd-octo-sts]

/merge

[gh-worker-devflow-routing-ef8351]

View all feedbacks in Devflow UI.

2026-10-29 13:25:51 UTC ℹ️ Start processing command /merge

---

2026-10-29 13:25:55 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 2h (p90).

---

2026-10-29 14:49:48 UTC ℹ️ MergeQueue: This merge request was merged