test: deprecate aws lambda based integration tests because now we have e2e and the RIE based tests (#826)

* test: retire the AWS-based integration suite (moved to local docker + serverless-e2e-tests)

The integration_tests/ AWS suite is retired. Its coverage now lives in two
places, each stronger at what it owns:

- Behavior: integration_tests_local/ (docker/RIE, GitHub Actions, per PR) is
  now the behavior oracle — hermetic, contributor-runnable, and strictly
  stronger than the AWS suite at behavior (its goldens preserve span
  meta/metrics keys the AWS normalization stripped wholesale). After #821 and
  #823 it covers every variant the AWS suite pinned, including callback-style
  handlers, fetch, metrics-only mode, payload capture, and the manual-wrap
  no-init path.

- Real-AWS-only signals: the four variants whose value IS the platform —
  esm (published layer zip artifact + ESM loader), sync-metrics (direct-API
  sink to the real intake), http-requests (_X_AMZN_TRACE_ID pass-through +
  real egress), status-code-500s (real API Gateway) — move to a dedicated
  integration-tests-residual suite in serverless-e2e-tests, which deploys
  against published/candidate layer ARNs and keeps the same snapshots and
  byte-identical normalization pipeline.

Deleted here: serverless.yml, the six top-level handlers, all 450 snapshots,
and scripts/run_integration_tests.sh (459 files). Kept: input_events/,
parse-json.js, and container/ — the local suite references the first two and
uses container/ as fixture; a new integration_tests/README.md documents this.

CI: the GitLab `integration test` job and its sign/publish `needs` entries
are removed (build-layer keeps CI_ENABLE_CONTAINER_IMAGE_BUILDS, which it
uses to docker-build the layer). CONTRIBUTING.md now points contributors at
the local suite.

Release-gate note: the per-pipeline AWS gate on sign/publish goes away. The
candidate-layer gate moves to the residual suite in serverless-e2e-tests —
manual until the e2e release-gate automation lands (migration roadmap), so
release runbooks should trigger it until then.

* merge main

* docs: clarify AWS integration test deprecation

* ci: retry pipeline

* test: pin RIE tracer per runtime

* ci: retrigger pipeline

Author: joeyzhao2018

.claude/skills/release-lambda-layer/SKILL.md

@@ -34,8 +34,11 @@ Reference: https://datadoghq.atlassian.net/wiki/spaces/SLS/pages/3375925277
 1. Create a branch for the version bump.
 2. Run `yarn upgrade dd-trace` (or `yarn upgrade dd-trace@^a.b.c` for a
    specific version) to pick up the latest tracer.
-3. If dd-trace changed, refresh integration test snapshots:
-   `BUILD_LAYERS=true UPDATE_SNAPSHOTS=true DD_API_KEY=<key from 1Password> aws-vault exec sso-serverless-sandbox-account-admin -- ./scripts/run_integration_tests.sh`
+3. If dd-trace changed, refresh the integration test snapshots. The local
+   RIE-based docker suite is the behavioral gate:
+   `UPDATE_SNAPSHOTS=true ./integration_tests_local/run.sh`
+   Rely on the end-to-end test suites for coverage that requires real AWS
+   Lambda resources.
 4. Bump `package.json` version to `X.Y.0`:
    - Minor version bumps on every release, and **must match the layer
      version**.

.gitlab/input_files/build.yaml.tpl

@@ -108,27 +108,6 @@ npm package test ({{ $runtime.name }}):
   script:
     - ./scripts/test_npm_package.sh datadog-lambda-js-*.tgz
 
-integration test ({{ $runtime.name }}):
-  stage: test
-  # `docker-in-docker:<arch>` routes the job to a runner with a live Docker
-  # daemon (vs. plain `arch:amd64` which only has the docker CLI). Required by
-  # the container-image integration tests, which build & push ECR images for
-  # the `container-{cjs,esm}_node*` functions.
-  tags: ["docker-in-docker:amd64"]
-  image: ${CI_DOCKER_TARGET_IMAGE}:${CI_DOCKER_TARGET_VERSION}
-  needs: 
-    - build layer ({{ $runtime.name }})
-  dependencies:
-    - build layer ({{ $runtime.name }})
-  cache: &{{ $runtime.name }}-cache
-  variables:
-    CI_ENABLE_CONTAINER_IMAGE_BUILDS: "true"
-  before_script:
-    - EXTERNAL_ID_NAME=integration-test-externalid ROLE_TO_ASSUME=sandbox-integration-test-deployer AWS_ACCOUNT=425362996713 source .gitlab/scripts/get_secrets.sh
-    - (cd integration_tests && yarn install)
-  script:
-    - RUNTIME_PARAM={{ $runtime.node_major_version }} ./scripts/run_integration_tests.sh
-
 {{ range $environment := (ds "environments").environments }}
 {{ $dotenv := print $runtime.name "_" $environment.name ".env" }}
 
@@ -146,7 +125,6 @@ sign layer ({{ $runtime.name }}):
     - lint ({{ $runtime.name }})
     - unit test ({{ $runtime.name }})
     - npm package test ({{ $runtime.name }})
-    - integration test ({{ $runtime.name }})
   dependencies:
     - build layer ({{ $runtime.name }})
   artifacts: # Re specify artifacts so the modified signed file is passed
@@ -182,7 +160,6 @@ publish layer {{ $environment.name }} ({{ $runtime.name }}):
       - lint ({{ $runtime.name }})
       - unit test ({{ $runtime.name }})
       - npm package test ({{ $runtime.name }})
-      - integration test ({{ $runtime.name }})
 {{ end }}
   dependencies:
 {{ if or (eq $environment.name "prod") }}

.pre-commit-config.yaml

@@ -5,7 +5,7 @@ repos:
       - id: check-merge-conflict
         files: \.py$
       - id: trailing-whitespace
-        exclude: integration_tests/snapshots
+        exclude: integration_tests_local/snapshots
   - repo: git@github.com:pre-commit/mirrors-prettier
     rev: ""
     hooks:
@@ -18,4 +18,4 @@ repos:
         description: Checks for AWS or Datadog API keys
         entry: .github/.git-hooks/detect-api-keys.py
         language: python
-        exclude: ^(yarn.lock|integration_tests/|event_samples/|src/trace/trigger.spec.ts|src/trace/context.spec.ts|src/trace/trigger.ts)
+        exclude: ^(yarn.lock|integration_tests/|integration_tests_local/snapshots/|event_samples/|src/trace/trigger.spec.ts|src/trace/context.spec.ts|src/trace/trigger.ts)

CONTRIBUTING.md

@@ -34,19 +34,13 @@ We love pull requests. For new features, consider opening an issue to discuss th
     ```bash
     yarn test
     ```
-1. Run the integration tests against your own AWS account and Datadog org (or ask a Datadog member to run):
+1. Run the local docker-based integration tests (no AWS account needed — this is the
+   behavioral gate that runs per PR):
    ```bash
-   BUILD_LAYERS=true DD_API_KEY=<your Datadog api key> ./scripts/run_integration_tests.sh
+   ./integration_tests_local/run.sh
    ```
-1. Update integration test snapshots if needed (Datadog employees only; requires AWS credentials and Docker):
-   ```bash
-   BUILD_LAYERS=true UPDATE_SNAPSHOTS=true DD_API_KEY=<your Datadog api key> aws-vault exec sso-serverless-sandbox-account-admin -- ./scripts/run_integration_tests.sh
-   ```
-   If ECR image push fails locally, update zip/layer handler snapshots only:
-   ```bash
-   BUILD_LAYERS=true UPDATE_SNAPSHOTS=true SKIP_CONTAINER_TESTS=true DD_API_KEY=<your Datadog api key> aws-vault exec sso-serverless-sandbox-account-admin -- ./scripts/run_integration_tests.sh
-   ```
-   The script uses Serverless `3.39.0` from `integration_tests/package.json` (not a globally installed CLI).
+1. Rely on the end-to-end test suites for cases that require real AWS Lambda
+   resources. See `integration_tests/README.md`.
 1. Push to your fork and [submit a pull request][pr].
 
 [pr]: https://github.com/your-username/datadog-lambda-js/compare/DataDog:main..main.

integration_tests/README.md

@@ -0,0 +1,25 @@
+# integration_tests/
+
+This directory now hosts only the **fixtures shared with the local docker-based
+integration suite** (`integration_tests_local/`):
+
+- `input_events/` — the nine event payloads the local RIE-based suite invokes
+  with,
+- `parse-json.js` — JSON-log line parser used by `integration_tests_local/normalize.sh`,
+- `container/` — the container-image fixtures (`cjs`, `esm`) built by the local suite.
+
+## The real AWS Lambda resource-based suite was deprecated
+
+The serverless-deployed suite that used to live here (`serverless.yml`,
+`snapshots/`, per-handler files, `scripts/run_integration_tests.sh`) was removed.
+The in-repo integration coverage now uses `integration_tests_local/`, a
+docker/RIE-based suite that runs per PR without an AWS account. Its goldens are
+strictly stronger for behavior: they preserve span `meta`/`metrics` keys, which
+the deprecated suite's normalization stripped wholesale.
+
+Cases that require real AWS Lambda resources are covered by the end-to-end test
+suites.
+
+Do not re-add serverless-deployed tests here. Add behavioral cases to the local
+RIE-based suite, and rely on the end-to-end suites for real AWS Lambda resource
+cases.

integration_tests/container/cjs/Dockerfile

@@ -1,9 +1,9 @@
 ARG NODE_VERSION=22
 FROM public.ecr.aws/lambda/nodejs:${NODE_VERSION}
 
-# Overrides the dd-trace pin in package.json so this image tracks the same
-# tracer line as the layer built for NODE_VERSION (v5 below Node 22, v6 above).
-ARG DD_TRACE_VERSION=""
+# Exact lockfile-resolved v6 pin, or the maintained v5 compatibility pin for
+# Node 18/20. The runner always supplies it.
+ARG DD_TRACE_VERSION
 
 # handler.js is the default redirect-mode fixture (DD_LAMBDA_HANDLER=handler.handle).
 # The remaining *.js files are the manual-wrap fixture handlers ported from the
@@ -12,7 +12,8 @@ ARG DD_TRACE_VERSION=""
 COPY package.json *.js ${LAMBDA_TASK_ROOT}/
 COPY datadog-lambda-js-local.tgz /tmp/datadog-lambda-js-local.tgz
 RUN cd ${LAMBDA_TASK_ROOT} \
-    && if [ -n "$DD_TRACE_VERSION" ]; then npm pkg set dependencies.dd-trace="$DD_TRACE_VERSION"; fi \
+    && test -n "$DD_TRACE_VERSION" \
+    && npm pkg set dependencies.dd-trace="$DD_TRACE_VERSION" \
     && npm install --omit=dev \
     && npm install --no-save /tmp/datadog-lambda-js-local.tgz \
     && rm /tmp/datadog-lambda-js-local.tgz

integration_tests/container/cjs/package.json

@@ -3,7 +3,6 @@
   "version": "1.0.0",
   "private": true,
   "dependencies": {
-    "axios": "1.18.1",
-    "dd-trace": "6.15.0"
+    "axios": "1.18.1"
   }
 }

integration_tests/container/esm/Dockerfile

@@ -1,14 +1,15 @@
 ARG NODE_VERSION=22
 FROM public.ecr.aws/lambda/nodejs:${NODE_VERSION}
 
-# Overrides the dd-trace pin in package.json so this image tracks the same
-# tracer line as the layer built for NODE_VERSION (v5 below Node 22, v6 above).
-ARG DD_TRACE_VERSION=""
+# Exact lockfile-resolved v6 pin, or the maintained v5 compatibility pin for
+# Node 18/20. The runner always supplies it.
+ARG DD_TRACE_VERSION
 
 COPY package.json handler.mjs ${LAMBDA_TASK_ROOT}/
 COPY datadog-lambda-js-local.tgz /tmp/datadog-lambda-js-local.tgz
 RUN cd ${LAMBDA_TASK_ROOT} \
-    && if [ -n "$DD_TRACE_VERSION" ]; then npm pkg set dependencies.dd-trace="$DD_TRACE_VERSION"; fi \
+    && test -n "$DD_TRACE_VERSION" \
+    && npm pkg set dependencies.dd-trace="$DD_TRACE_VERSION" \
     && npm install --omit=dev \
     && npm install --no-save /tmp/datadog-lambda-js-local.tgz \
     && rm /tmp/datadog-lambda-js-local.tgz

integration_tests/container/esm/package.json

@@ -3,7 +3,5 @@
   "version": "1.0.0",
   "private": true,
   "type": "module",
-  "dependencies": {
-    "dd-trace": "6.15.0"
-  }
+  "dependencies": {}
 }

integration_tests/container/layer/Dockerfile

@@ -11,14 +11,21 @@
 ARG NODE_VERSION=22
 FROM public.ecr.aws/lambda/nodejs:${NODE_VERSION}
 
+# Exact lockfile-resolved v6 pin, or the maintained v5 compatibility pin for
+# Node 18/20. The runner always supplies it.
+ARG DD_TRACE_VERSION
+
 # Install dependencies BEFORE copying layer_pkg: npm prunes anything in
 # node_modules that is not in deps.package.json, so copying the layer tree
 # first would silently delete it.
 COPY deps.package.json /opt/nodejs/package.json
 # --omit=optional matches the release build's --ignore-optional: pprof/appsec
 # natives are not exercised by these fixtures and skipping them keeps the
 # build fast.
-RUN cd /opt/nodejs && npm install --omit=dev --omit=optional --no-audit --no-fund
+RUN cd /opt/nodejs \
+    && test -n "$DD_TRACE_VERSION" \
+    && npm pkg set dependencies.dd-trace="$DD_TRACE_VERSION" \
+    && npm install --omit=dev --omit=optional --no-audit --no-fund
 COPY layer_pkg /opt/nodejs/node_modules/datadog-lambda-js/
 
 # handler.js (CJS) and esm.mjs (top-level await) are plain unwrapped user