[PerfectSlayer]

What Does This Do

Runs every Gradle Test task on the JUnit Platform and makes a test task fail when it discovers no tests. A misconfigured test task can no longer pass silently.

This brings back test tasks that had never run a test since their creation:

• the four multi-Scala test tasks of scala-2.10.7 (34 tests each);
• the testRuntimeActivation task of springboot-graphql. Its attack-detection feature is skipped for now, because nothing activates AppSec in that mode (APMLP-2199).

It also removes spring-tomcat7's testRuntimeActivation task, which was a copy of springboot's that only reran the test task.

Motivation

Since the Gradle 8.1 upgrade (April 2023), only test suites get the JUnit Platform. A task registered with tasks.register(..., Test) falls back to JUnit 4. It then discovers none of the Spock 2 or JUnit 5 tests and still passes. The Gradle 9.5.1 bump would have surfaced this, but it added failOnNoDiscoveredTests = false, which hid it. CI Visibility reports zero executions for these tasks on master.

Additional Notes

• Where empty tasks are still allowed:
  • A non-forked task whose compiled test classes include *ForkedTest classes is allowed to be empty, because it only hosts abstract bases. The check reads the compiled classes at execution time.
  • Three modules whose test source set only holds shared abstract bases opt out explicitly.
  • Based on master CI data, no other test task discovers zero tests. Tag-filtered runs (-PrunFlakyTests) and --tests runs are exempt on Gradle's side.
• testRuntimeActivation: only springboot's task was designed for runtime activation (2022). Since Upgrade libddwaf java to 14.0.0 #8654, AppSec only loads its rules on a real activation through remote config, so the app-side reflective activation no longer works. The other modules copied the task without any activation:
  • springboot-graphql keeps its task. Its detection feature is skipped in that mode until the AppSec team adds a real activation through remote config (APMLP-2199).
  • spring-tomcat7's spec is IAST-only and never applies the inactive-AppSec flag, so its task reran test unchanged. It is removed.
  • The two smoke apps without any tests are tracked in APMLP-2206 (springboot-security) and APMLP-2205 (kafkaschemaregistry).
• Known edge: a task whose only tests are @Flaky JUnit tests would now fail under -PskipFlakyTests, since FlakyJUnitFilter removes them during discovery. No task is in that situation today.

Jira ticket: APMLP-2186

🤖 Generated with Claude Code

[datadog-prod-us1-6]

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 59.98% (+0.00%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: c6071d7 | Docs | Give us feedback!}

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	14.86 s	14.75 s	[-0.1%; +1.6%] (no difference)
startup:insecure-bank:tracing:Agent	13.62 s	13.66 s	[-1.0%; +0.3%] (no difference)
startup:petclinic:appsec:Agent	17.10 s	16.93 s	[+0.3%; +1.7%] (maybe worse)
startup:petclinic:iast:Agent	16.92 s	17.02 s	[-1.6%; +0.4%] (no difference)
startup:petclinic:profiling:Agent	16.08 s	16.63 s	[-7.6%; +1.1%] (no difference)
startup:petclinic:sca:Agent	17.13 s	17.07 s	[-0.7%; +1.4%] (no difference)
startup:petclinic:tracing:Agent	16.18 s	16.28 s	[-1.5%; +0.2%] (no difference)

Commit: c6071d74 · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-06T09:37:44.197996Z	a109a8d	Draft marked ready
🔒 Security Review	✅ Completed 2026-11-06T09:36:44.478647Z	a109a8d	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[datadog-prod-us1-6]

More details

The empty-task exceptions are consistent with the repository’s forked-test and abstract-base conventions. Whether the revived tasks execute successfully remains unverified because Gradle tests were not run.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit a109a8d}

[jandro996]

It seems that the testRuntimeActivation tasks of springboot-security and datastreams/kafkaschemaregistry still run nothing after this change. Neither module has a src/test source set, so Gradle skips both tasks as NO-SOURCE (@SkipWhenEmpty on the candidate class files) before failOnNoDiscoveredTests is ever evaluated, and they keep passing silently. The description lists them among the revived tasks, and APMLP-2186 has "the two smoke apps without tests either get tests or are removed" in its done criteria. APMLP-2199 covers springboot-security (item 4), but I could not find anything tracking kafkaschemaregistry, whose task does not even set an AppSec mode and looks like a copy of the regular test task. Would it make sense to drop those two tasks here, or at least adjust the description and track kafkaschemaregistry in a follow-up? I might be missing something, what do you think?

[jandro996]

LGTM! Just left some comments to track with APMLP-2199

[PerfectSlayer]

but I could not find anything tracking kafkaschemaregistry,

I'm currently investigating if it can be dropped or not (as covered by instrumentation tests).
But the AppSec part of this smoke test is clearly a copy/paste errror.
So far, I'll drop it if covered somewhere else as, right now, it leaves the false sense of coverage while nothing is run.