chore(ci): introduce code freeze flow using milestones

[kakkoyun]

• chore(ci): Add code freeze flow

What does this PR do?

This PR adds three workflows and an action (pr-updater) to enforce a code freeze. When a milestone is opened starting with "Incident" or "Code Freeze" it will make all the PR CI checks red so that it won't get merged. If a PR created and added to the active milestones it will be exempt from the freeze so that we can fix the issues that causes the code freeze.

Motivation

According the guidelines (https://datadoghq.atlassian.net/wiki/spaces/APMINT/pages/5734924301/Incident+and+code+freeze+rules), we want to freeze any further merges until we fix the issues with the CI or similar facilities.

Reviewer's Checklist

• Changed code has unit tests for its functionality at or near 100% coverage.
• System-Tests covering this feature have been added and enabled with the va.b.c-dev version tag.
• There is a benchmark for any new code, or changes to existing code.
• If this interacts with the agent in a new way, a system test has been added.
• New code is free of linting errors. You can check this by running ./scripts/lint.sh locally.
• Add an appropriate team label so this PR gets put in the right place for the release notes.
• Non-trivial go.mod changes, e.g. adding new modules, are reviewed by @DataDog/dd-trace-go-guild.

Unsure? Have a question? Request a review!

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 55.01%. Comparing base (119632b) to head (8d93017).

Additional details and impacted files

see 365 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[pr-commenter]

Benchmarks

Benchmark execution time: 2026-01-08 11:41:24

Comparing candidate commit 9560093 in PR branch kakkoyun/code_freeze_actions with baseline commit 24e2490 in branch main.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 155 metrics, 9 unstable metrics.

[datadog-datadog-prod-us1]

✅ Tests

🎉 All green!

❄️ No new flaky tests detected
🧪 All tests passed

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 8d93017 | Docs | Datadog PR Page | Was this helpful? Give us feedback!}

[darccio]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[hannahkm]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 956009383f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Avoid failing forked PRs when posting status

This workflow runs on pull_request events but always posts a commit status via gh api to /statuses/$SHA. On forked PRs, GitHub Actions provides a read‑only GITHUB_TOKEN that cannot write commit statuses, so this POST returns 403 and the step fails. That means the workflow itself fails even when no code freeze is active, blocking merges for external contributors. Consider skipping the status update for forked PRs or using a safer event/permissions model.

Useful? React with 👍 / 👎.