ci: exclude release-proposal wfs from green_ci and exclude benchmarks on release* branches

.github/CODEOWNERS

@@ -81,6 +81,7 @@ scripts/check_crypto_providers.sh    @DataDog/libdatadog-core
 scripts/commits-since-release.sh     @DataDog/libdatadog-core
 scripts/create-release.sh            @DataDog/apm-common-components-core
 scripts/crates-to-package.sh         @DataDog/libdatadog-core
+scripts/exclude-from-green-ci.sh     @DataDog/libdatadog-core
 scripts/major-bumps-level.sh         @DataDog/libdatadog-core
 scripts/publication-order.sh         @DataDog/libdatadog-core
 scripts/reformat_copyright.sh        @DataDog/libdatadog-core

.github/workflows/release-proposal-dispatch.yml

@@ -46,6 +46,13 @@ jobs:
       count: ${{ steps.normalize.outputs.count }}
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
+
+      - name: Exclude from Green CI
+        env:
+          DATADOG_SITE: datadoghq.com
+          DATADOG_API_KEY: ${{ secrets.DATADOG_API_KEY }}
+        run: ./scripts/exclude-from-green-ci.sh
+
       - name: Normalize and validate crate list
         id: normalize
         env:

.github/workflows/release-proposal-test.yml

@@ -21,6 +21,13 @@ jobs:
           fetch-depth: 0
           # Checkout PR head (not the synthetic merge commit) so version comparison matches the proposal branch.
           ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+
+      - name: Exclude from Green CI
+        env:
+          DATADOG_SITE: datadoghq.com
+          DATADOG_API_KEY: ${{ secrets.DATADOG_API_KEY }}
+        run: ./scripts/exclude-from-green-ci.sh
+
       - uses: dtolnay/rust-toolchain@stable
         with:
           toolchain: 1.92.0

.gitlab/benchmarks.yml

@@ -10,9 +10,9 @@ variables:
 .benchmark_run_rules: &benchmark_run_rules
   - if: '$CI_COMMIT_BRANCH =~ /^mq-working-branch-/'
     when: never
-  - if: '$CI_COMMIT_BRANCH =~ /^(release|hotfix)\//'
+  - if: '$CI_COMMIT_BRANCH =~ /^(release|hotfix)[-\/]/'
     when: never
-  - if: '$CI_EXTERNAL_PULL_REQUEST_SOURCE_BRANCH_NAME =~ /^(release|hotfix)\//'
+  - if: '$CI_EXTERNAL_PULL_REQUEST_SOURCE_BRANCH_NAME =~ /^(release|hotfix)[-\/]/'
     when: never
   - if: '$CI_COMMIT_BRANCH == "main"'
     interruptible: false

scripts/exclude-from-green-ci.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Copyright 2021-Present Datadog, Inc. https://www.datadoghq.com/
+# SPDX-License-Identifier: Apache-2.0
+#
+# Tags the current CI pipeline as excluded from Green CI (green_ci.excluded:true).
+#
+# Downloads the pinned, checksum-verified datadog-ci binary instead of `npm install -g`,
+# so no third-party install-time code runs with the Datadog API key in its environment.
+#
+# Requires DATADOG_SITE and DATADOG_API_KEY in the environment.
+
+set -euo pipefail
+
+URL="https://github.com/DataDog/datadog-ci/releases/download/v5.21.0/datadog-ci_linux-x64"
+OUTPUT="datadog-ci"
+EXPECTED_CHECKSUM="be4a6473fc451fec967ff277df3856060814b9a54d707d055a9c1542ae2869f0"
+
+echo "Downloading datadog-ci from $URL"
+curl -L --fail --retry 3 -o "$OUTPUT" "$URL"
+chmod +x "$OUTPUT"
+
+ACTUAL_CHECKSUM=$(sha256sum "$OUTPUT" | cut -d' ' -f1)
+if [ "$ACTUAL_CHECKSUM" != "$EXPECTED_CHECKSUM" ]; then
+  echo "Checksum verification failed! expected=$EXPECTED_CHECKSUM actual=$ACTUAL_CHECKSUM"
+  exit 1
+fi
+echo "Checksum verification passed"
+
+./"$OUTPUT" tag --level pipeline --tags green_ci.excluded:true