Add CodeQL job for helper

Direct leak of 24 byte(s) in 1 object(s) allocated from:
    #0 0xffff8dfed43b in malloc (/usr/lib/aarch64-linux-gnu/libasan.so.5+0xcf43b)
    #1 0xffff81eb8f4f in __cxa_thread_atexit_impl /home/circleci/datadog/tmp/build_extension/ext/ddtrace.c:560
    #2 0xffff82ed7c8b in std::sys::unix::thread_local_dtor::register_dtor::ha7abe21b2e8f0491 library/std/src/sys/unix/thread_local_dtor.rs:31
    #3 0xffff81ec332b in _dd_writer_loop /home/circleci/datadog/tmp/build_extension/ext/coms.c:1053
    #4 0xffff8db7a7e3 in start_thread /build/glibc-tVuo8E/glibc-2.28/nptl/pthread_create.c:486
    #5 0xffff8b16a70b  (/lib/aarch64-linux-gnu/libc.so.6+0xcf70b)

SUMMARY: AddressSanitizer: 24 byte(s) leaked in 1 allocation(s).

Direct leak of 24 byte(s) in 1 object(s) allocated from:
    #0 0xffff8dfed43b in malloc (/usr/lib/aarch64-linux-gnu/libasan.so.5+0xcf43b)
    #1 0xffff81eb8f4f in __cxa_thread_atexit_impl /home/circleci/datadog/tmp/build_extension/ext/ddtrace.c:560
    #2 0xffff82ed7c8b in std::sys::unix::thread_local_dtor::register_dtor::ha7abe21b2e8f0491 library/std/src/sys/unix/thread_local_dtor.rs:31
    #3 0xffff81ec332b in _dd_writer_loop /home/circleci/datadog/tmp/build_extension/ext/coms.c:1053
    #4 0xffff8db7a7e3 in start_thread /build/glibc-tVuo8E/glibc-2.28/nptl/pthread_create.c:486
    #5 0xffff8b16a70b  (/lib/aarch64-linux-gnu/libc.so.6+0xcf70b)

SUMMARY: AddressSanitizer: 24 byte(s) leaked in 1 allocation(s).

…nd trace sender (#2672)

* Make use of the sidecar thread safe

* Collect trace_api.{requests,responses,errors} in the background trace sender

* Fix test

* Fix memory leak:

Direct leak of 24 byte(s) in 1 object(s) allocated from:
    #0 0xffff8dfed43b in malloc (/usr/lib/aarch64-linux-gnu/libasan.so.5+0xcf43b)
    #1 0xffff81eb8f4f in __cxa_thread_atexit_impl /home/circleci/datadog/tmp/build_extension/ext/ddtrace.c:560
    #2 0xffff82ed7c8b in std::sys::unix::thread_local_dtor::register_dtor::ha7abe21b2e8f0491 library/std/src/sys/unix/thread_local_dtor.rs:31
    #3 0xffff81ec332b in _dd_writer_loop /home/circleci/datadog/tmp/build_extension/ext/coms.c:1053
    #4 0xffff8db7a7e3 in start_thread /build/glibc-tVuo8E/glibc-2.28/nptl/pthread_create.c:486
    #5 0xffff8b16a70b  (/lib/aarch64-linux-gnu/libc.so.6+0xcf70b)

SUMMARY: AddressSanitizer: 24 byte(s) leaked in 1 allocation(s).

* Update libdatadog

* Fix tests

* Try running system tests with sidecar sender

Signed-off-by: Bob Weinand <[email protected]>

* Don't explicitly flush the bgs telemetry data

* Improve test stability

* Try to run system-tests from a fork

* Fix telemetry tests

* Shut up instrumentation telemetry in web tests

* Fix flakiness

Signed-off-by: Bob Weinand <[email protected]>

* Better flaky test check

Signed-off-by: Bob Weinand <[email protected]>

---------

Signed-off-by: Bob Weinand <[email protected]>
Co-authored-by: Bob Weinand <[email protected]>

…er PR #3630 review

Addresses all outstanding reviewer feedback from #3630:

bwoebi:
- Blocker #1: Route exposures through sidecar, zero HTTP from PHP main thread.
  Implements Rust ExposureState with 65K-entry LRU dedup + 1000-event batch
  buffer. PHP ExposureWriter uses injectable sidecarCallable routing to
  DDTrace\ffe_send_exposure() — fire-and-forget, never blocks evaluation.
- Blocker #2: Proper documented functions in ddtrace.stub.php (not
  dd_trace_internal_fn). Eight DDTrace\ffe_* functions declared with PHPDoc
  @internal: ffe_evaluate, ffe_has_config, ffe_config_changed, ffe_load_config,
  ffe_send_exposure, ffe_flush_exposures, ffe_set_service_context,
  ffe_reset_exposure_state. Each has PHP_FUNCTION impl + arginfo + registration.
- emalloc/ecalloc memory hygiene and C99 brace style consistent with existing
  dd-trace-php conventions.
- Fire-and-forget: DataDogProvider::resolveViaFfe() invokes exposureWriter->send()
  and ignores return. No exception propagates from exposure path to evaluation.
- Primitive-only attribute filtering in EvaluationContextNormalizer mirrors the
  C-side filter in ffe_evaluate (drops arrays, nulls, objects, resources).

dd-oleksii:
- Null targeting key preserved end-to-end (not coerced to empty string).
  EvaluationContextNormalizer returns [?string, array].
- do_log per-allocation hard gate: ExposureContext::fromBridgeResult() returns
  null when do_log=false; provider skips exposure send.
- OTel feature_flag.evaluations counter with OBSV-02 attributes (key, variant,
  reason, error.type, allocation_key). MetricsCounter injectable callable,
  no open-telemetry/api composer dep per CLAUDE.md. Gated on
  DD_METRICS_OTEL_ENABLED. Fires on every evaluation including errors.
- PR split into four independently-reviewable phases (roadmap in staging repo).

realFlowControl:
- ZTS per-thread FFE state: declined for v1 (NTS-only per PROJECT.md).
  Global Mutex<FfeState> is correct for NTS. Tracked as v2 requirement.

Architecture changes:
- Remove src/DDTrace/FeatureFlags/ (old in-process HTTP architecture).
  LRUCache.php, ExposureCache.php, ExposureWriter.php, Provider.php,
  FlagEvalMetrics.php — all replaced by Rust-sidecar pipeline.
- Remove tests/FeatureFlags/ (tests covered by staging PHPUnit suite).
- Add src/DDTrace/OpenFeature/ with 9 classes:
  BridgeResultMapper, ContextFlattener, DataDogProvider (rewritten),
  EvaluationContextNormalizer, ExposureContext, ExposureWriter,
  MetricsCounter, OpenFeatureLifecycleCompatibility, ProviderLifecycle.
- Add tests/OpenFeature/ with 7 test files, 143 tests.
- components-rs/ffe.rs: add ExposureState + extern C functions for
  enqueue_exposure, flush_exposures, set_service_context, reset_exposure_state,
  free_flush_result. Uses lru crate 0.12.
- components-rs/Cargo.toml: add lru = "0.12".
- composer.json: add open-feature/sdk ^2.1 as require-dev.
- src/bridge/_files_tracer.php: load new OpenFeature files, remove FeatureFlags.

Verification: 143/143 staging PHPUnit tests pass.