fix(ci): wire GitLab CI to publish the system-tests image

[MilanGarnier]

Stacked on #4065 — needs the GH Actions workflow merged to master first
(workflow_dispatch resolves the workflow by filename against the
default branch, regardless of dispatch ref).

Summary

• Adds a check open pr for system tests job that gates on an open
  GitHub PR before anything is uploaded to S3, addressing:
  fix(ci): publish system-tests image via S3 + GH Actions dispatch #4065 (comment)
• Splits the old single job into upload + dispatch, both gated on that
  check via a dotenv artifact.

Test plan

• Merge fix(ci): publish system-tests image via S3 + GH Actions dispatch #4065 to master first
• Rebase this branch onto master, retarget base to master
• Push a throwaway branch with an open PR, confirm S3 upload +
  dispatch + image push succeed end to end
• Push a branch with no open PR, confirm S3 upload is skipped

[datadog-datadog-prod-us1-2]

 

✨ Unblock PR with BitsAI

⚠️ Warnings

🚦 5 Pipeline jobs failed

DataDog/apm-reliability/dd-trace-php | test_extension_ci: [8.1]     

DataDog/apm-reliability/dd-trace-php | test_extension_ci: [8.2]     

DataDog/apm-reliability/dd-trace-php | test_extension_ci: [8.4]     

View all 5 failed jobs.

ℹ️ Info

No other issues found (see more)

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 60.62% (-0.01%)

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 74a4136 | Docs | Datadog PR Page | Give us feedback!}

[MilanGarnier]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 27419ba1bf

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Move PR gating out of the upload job rules

GitLab evaluates rules before any upstream job runs, so the dotenv report emitted by check open pr for system tests cannot populate HAS_OPEN_PR here (see the GitLab rules docs: https://docs.gitlab.com/ci/jobs/job_rules/). In a normal branch pipeline this variable is unset while the rule is evaluated, so $HAS_OPEN_PR != "true" matches and excludes the upload job even when the PR check would later write HAS_OPEN_PR=true; as a result the system-tests artifacts/image never get published for open PR branches.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Serialize uploads to the per-branch S3 prefix

When two pipelines for the same branch overlap, both upload to the same ci/${CI_COMMIT_REF_SLUG} keys while the old per-slug resource_group was removed. The GitHub workflow later downloads from that shared prefix by slug, so a slower older pipeline can overwrite some or all of a newer pipeline's artifacts before either dispatch downloads them, causing the branch tag to be pushed with stale or mixed package contents; keep the upload/dispatch serialized per slug or use a unique prefix per pipeline/commit.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Gate the dispatch job when upload is omitted

In the intended no-open-PR path, the upload job is configured to be omitted, but this dispatch job is still added for every non-default branch and has a hard needs edge to that omitted job. GitLab documents that needs pointing at a job excluded by rules can make pipeline creation fail unless the need is optional (https://docs.gitlab.com/ci/yaml/), so branches without an open PR can fail the package child pipeline instead of cleanly skipping system-tests image publishing.

Useful? React with 👍 / 👎.