@@ -0,0 +1,2 @@
+.github/chainguard/serverless-init-ci-publish.sts.yaml @DataDog/serverless
+.github/publish-serverless-init-to-ghcr.yaml @DataDog/serverless
@@ -0,0 +1,25 @@
+# DD Octo STS Trust Policy for serverless-init-ci GitLab pipeline
+#
+# This policy allows the serverless-init-ci GitLab pipeline to trigger
+# GitHub Actions workflows that publish serverless-init images to GHCR.
+#
+# Reference: https://datadoghq.atlassian.net/wiki/spaces/SECENG/pages/5138645099
+# Pipeline: https://gitlab.ddbuild.io/DataDog/serverless-init-ci
+
+issuer: https://gitlab.ddbuild.io
+
+# Subject pattern matches the serverless-init-ci repo on any protected branch or tag
+subject_pattern: "project_path:DataDog/serverless-init-ci:ref_type:(branch|tag):ref:.*"
+
+# Only allow protected branches and tags (security control)
+claim_pattern:
+  project_path: "DataDog/serverless-init-ci"
+  ref_type: "^(branch|tag)$"
+  ref_protected: "true"
+  pipeline_source: "^(web|pipeline)$"
+  ci_config_ref_uri: "^gitlab\\.ddbuild\\.io/DataDog/serverless-init-ci//\\.gitlab-ci\\.yml@refs/(heads|tags)/.*$"
+
+# Minimal permissions: only trigger GitHub Actions workflows
+# The workflow itself uses GITHUB_TOKEN for GHCR access
+permissions:
+  actions: write
@@ -0,0 +1,129 @@
+name: Publish serverless-init to GHCR
+
+on:
+  workflow_dispatch:
+    inputs:
+      source_image:
+        description: 'Source image from registry.datadoghq.com (e.g., registry.datadoghq.com/serverless-init:1.7.8)'
+        required: true
+        type: string
+      version:
+        description: 'Version tag (e.g., 1.7.8 or 1.7.8-rc1)'
+        required: true
+        type: string
+      image_suffix:
+        description: 'Image suffix (empty for standard, -alpine for alpine)'
+        required: false
+        type: string
+        default: ''
+      pipeline_id:
+        description: 'GitLab pipeline ID'
+        required: true
+        type: string
+      is_latest:
+        description: 'Tag as latest (true for prod releases, false for RCs)'
+        required: true
+        type: boolean
+        default: false
+
+permissions:
+  packages: write
+  contents: read
+
+jobs:
+  publish-to-ghcr:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install crane
+        run: |
+          cd /tmp
+          wget https://github.com/google/go-containerregistry/releases/download/v0.20.2/go-containerregistry_Linux_x86_64.tar.gz
+          tar -xzf go-containerregistry_Linux_x86_64.tar.gz
+          sudo mv crane /usr/local/bin/
+          crane version
+
+      - name: Login to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Wait for image availability
+        run: |
+          SOURCE_IMAGE="${{ inputs.source_image }}"
+          MAX_ATTEMPTS=20
+          RETRY_DELAY=30
+          # Maximum wait time: 20 attempts × 30s = 600s (10 minutes)
+
+          echo "⏳ Waiting for image to be available: ${SOURCE_IMAGE}"
+          echo "Will check every ${RETRY_DELAY}s for up to $((MAX_ATTEMPTS * RETRY_DELAY))s"
+
+          for i in $(seq 1 $MAX_ATTEMPTS); do
+            echo "Attempt $i/$MAX_ATTEMPTS: Checking if image exists..."
+
+            if crane manifest ${SOURCE_IMAGE} >/dev/null 2>&1; then
+              echo "✅ Image is available!"
+              exit 0
+            fi
+
+            if [ $i -lt $MAX_ATTEMPTS ]; then
+              echo "⏳ Image not yet available, waiting ${RETRY_DELAY}s..."
+              sleep $RETRY_DELAY
+            fi
+          done
+
+          echo "❌ Image did not become available after $((MAX_ATTEMPTS * RETRY_DELAY))s"
+          exit 1
+
+      - name: Copy image to GHCR
+        run: |
+          SOURCE_IMAGE="${{ inputs.source_image }}"
+          VERSION="${{ inputs.version }}"
+          IMAGE_SUFFIX="${{ inputs.image_suffix }}"
+          PIPELINE_ID="${{ inputs.pipeline_id }}"
+          IS_LATEST="${{ inputs.is_latest }}"
+
+          DEST_BASE="ghcr.io/datadog/datadog-lambda-extension/serverless-init"
+
+          echo "📦 Publishing serverless-init image to GHCR"
+          echo "  Source: ${SOURCE_IMAGE}"
+          echo "  Destinations:"
+          echo "    - ${DEST_BASE}:${VERSION}${IMAGE_SUFFIX}"
+          echo "    - ${DEST_BASE}:v${PIPELINE_ID}${IMAGE_SUFFIX}"
+
+          # Copy with version tag (with retry logic)
+          # Maximum retry duration: 3 attempts with 10s delays between retries
+          # This workflow is triggered in parallel with the publish attempt to registry.datadoghq.com
+          # Registry.datadoghq.com should normally need about ~30 seconds to recieve the new image
+          MAX_COPY_ATTEMPTS=3
+          COPY_RETRY_DELAY=10
+
+          for i in $(seq 1 $MAX_COPY_ATTEMPTS); do
+            echo "Copying image (attempt $i/$MAX_COPY_ATTEMPTS)..."
+
+            if crane copy ${SOURCE_IMAGE} ${DEST_BASE}:${VERSION}${IMAGE_SUFFIX}; then
+              echo "✅ Image copied successfully!"
+              break
+            fi
+
+            if [ $i -lt $MAX_COPY_ATTEMPTS ]; then
+              echo "⚠️ Copy failed, retrying in ${COPY_RETRY_DELAY}s..."
+              sleep $COPY_RETRY_DELAY
+            else
+              echo "❌ Failed to copy image after $MAX_COPY_ATTEMPTS attempts"
+              exit 1
+            fi
+          done
+
+          # Tag for pipeline ID
+          crane tag ${DEST_BASE}:${VERSION}${IMAGE_SUFFIX} v${PIPELINE_ID}${IMAGE_SUFFIX}
+
+          # Tag as latest if this is a production release
+          if [ "$IS_LATEST" = "true" ]; then
+            echo "    - ${DEST_BASE}:latest${IMAGE_SUFFIX}"
+            crane tag ${DEST_BASE}:${VERSION}${IMAGE_SUFFIX} latest${IMAGE_SUFFIX}
+          fi
+
+          echo "✅ Successfully published image to GHCR!"
+          echo "📍 View at: https://github.com/DataDog/datadog-lambda-extension/pkgs/container/datadog-lambda-extension%2Fserverless-init"
@@ -418,6 +418,13 @@ pub struct EnvConfig {
     /// Default is `false`.
     #[serde(deserialize_with = "deserialize_optional_bool_from_anything")]
     pub compute_trace_stats_on_extension: Option<bool>,
+    /// @env `DD_SPAN_DEDUP_TIMEOUT`
+    ///
+    /// The timeout for the span deduplication service to check if a span key exists, in seconds.
+    /// For now, this is a temporary field added to debug the failure of `check_and_add()` in span dedup service.
+    /// Do not use this field extensively in production.
+    #[serde(deserialize_with = "deserialize_optional_duration_from_seconds_ignore_zero")]
+    pub span_dedup_timeout: Option<Duration>,
     /// @env `DD_API_KEY_SECRET_RELOAD_INTERVAL`
     ///
     /// The interval at which the Datadog API key is reloaded, in seconds.
@@ -654,6 +661,7 @@ fn merge_config(config: &mut Config, env_config: &EnvConfig) {
     merge_option_to_value!(config, env_config, capture_lambda_payload);
     merge_option_to_value!(config, env_config, capture_lambda_payload_max_depth);
     merge_option_to_value!(config, env_config, compute_trace_stats_on_extension);
+    merge_option!(config, env_config, span_dedup_timeout);
     merge_option!(config, env_config, api_key_secret_reload_interval);
     merge_option_to_value!(config, env_config, serverless_appsec_enabled);
     merge_option!(config, env_config, appsec_rules);
@@ -853,6 +861,7 @@ mod tests {
             jail.set_env("DD_CAPTURE_LAMBDA_PAYLOAD", "true");
             jail.set_env("DD_CAPTURE_LAMBDA_PAYLOAD_MAX_DEPTH", "5");
             jail.set_env("DD_COMPUTE_TRACE_STATS_ON_EXTENSION", "true");
+            jail.set_env("DD_SPAN_DEDUP_TIMEOUT", "5");
             jail.set_env("DD_API_KEY_SECRET_RELOAD_INTERVAL", "10");
             jail.set_env("DD_SERVERLESS_APPSEC_ENABLED", "true");
             jail.set_env("DD_APPSEC_RULES", "/path/to/rules.json");
@@ -1006,6 +1015,7 @@ mod tests {
                 capture_lambda_payload: true,
                 capture_lambda_payload_max_depth: 5,
                 compute_trace_stats_on_extension: true,
+                span_dedup_timeout: Some(Duration::from_secs(5)),
                 api_key_secret_reload_interval: Some(Duration::from_secs(10)),
                 serverless_appsec_enabled: true,
                 appsec_rules: Some("/path/to/rules.json".to_string()),
 
@@ -348,6 +348,7 @@ pub struct Config {
     pub capture_lambda_payload: bool,
     pub capture_lambda_payload_max_depth: u32,
     pub compute_trace_stats_on_extension: bool,
+    pub span_dedup_timeout: Option<Duration>,
     pub api_key_secret_reload_interval: Option<Duration>,
 
     pub serverless_appsec_enabled: bool,
@@ -457,6 +458,7 @@ impl Default for Config {
             capture_lambda_payload: false,
             capture_lambda_payload_max_depth: 10,
             compute_trace_stats_on_extension: false,
+            span_dedup_timeout: None,
             api_key_secret_reload_interval: None,
 
             serverless_appsec_enabled: false,
 
@@ -995,6 +995,7 @@ api_security_sample_delay: 60 # Seconds
                 capture_lambda_payload: true,
                 capture_lambda_payload_max_depth: 5,
                 compute_trace_stats_on_extension: true,
+                span_dedup_timeout: None,
                 api_key_secret_reload_interval: None,
 
                 serverless_appsec_enabled: true,
 
@@ -45,7 +45,7 @@ const FUNCTION_TAGS_KEY: &str = "_dd.tags.function";
 // TODO(astuyve) decide what to do with the version
 const EXTENSION_VERSION_KEY: &str = "dd_extension_version";
 // TODO(duncanista) figure out a better way to not hardcode this
-pub const EXTENSION_VERSION: &str = "91-next";
+pub const EXTENSION_VERSION: &str = "92-next";
 
 const REGION_KEY: &str = "region";
 const ACCOUNT_ID_KEY: &str = "account_id";
 
@@ -2,7 +2,8 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use tokio::sync::{mpsc, oneshot};
-use tracing::error;
+use tokio::time::Duration;
+use tracing::warn;
 
 use crate::traces::span_dedup::{DedupKey, Deduper};
 
@@ -12,6 +13,8 @@ pub enum DedupError {
     SendError(mpsc::error::SendError<DedupCommand>),
     #[error("Failed to receive response from deduper: {0}")]
     RecvError(oneshot::error::RecvError),
+    #[error("Timeout waiting for response from deduper")]
+    Timeout,
 }
 
 pub enum DedupCommand {
@@ -34,14 +37,29 @@ impl DedupHandle {
     ///
     /// # Errors
     ///
-    /// Returns an error if the command cannot be sent to the deduper service
-    /// or if the response cannot be received.
-    pub async fn check_and_add(&self, key: DedupKey) -> Result<bool, DedupError> {
+    /// Returns an error if the command cannot be sent to the deduper service,
+    /// if the response cannot be received, or if the operation times out after 5 seconds.
+    pub async fn check_and_add(
+        &self,
+        key: DedupKey,
+        timeout: Option<Duration>,
+    ) -> Result<bool, DedupError> {
         let (response_tx, response_rx) = oneshot::channel();
         self.tx
             .send(DedupCommand::CheckAndAdd(key, response_tx))
             .map_err(DedupError::SendError)?;
-        response_rx.await.map_err(DedupError::RecvError)
+
+        // Sometimes the dedup service fails to send a response for unknown reasons, so we
+        // add a timeout to avoid blocking the caller forever. We may remove the
+        // timeout if we can figure out and fix the root cause.
+        if let Some(timeout) = timeout {
+            tokio::time::timeout(timeout, response_rx)
+                .await
+                .map_err(|_| DedupError::Timeout)?
+                .map_err(DedupError::RecvError)
+        } else {
+            response_rx.await.map_err(DedupError::RecvError)
+        }
     }
 }
 
@@ -77,7 +95,7 @@ impl DedupService {
                 DedupCommand::CheckAndAdd(key, response_tx) => {
                     let was_added = self.deduper.check_and_add(key);
                     if let Err(e) = response_tx.send(was_added) {
-                        error!("Failed to send check_and_add response: {e:?}");
+                        warn!("Failed to send check_and_add response: {e:?}");
                     }
                 }
             }
@@ -112,17 +130,17 @@ mod tests {
         let key2 = DedupKey::new(100, 456);
 
         // First call should return true (key was added)
-        assert!(handle.check_and_add(key1).await.unwrap());
+        assert!(handle.check_and_add(key1, None).await.unwrap());
 
         // Second call should return false (key already exists)
-        assert!(!handle.check_and_add(key1).await.unwrap());
+        assert!(!handle.check_and_add(key1, None).await.unwrap());
 
         // Different key should return true again
-        assert!(handle.check_and_add(key2).await.unwrap());
+        assert!(handle.check_and_add(key2, None).await.unwrap());
 
         // Calling again on already-added keys should return false
-        assert!(!handle.check_and_add(key1).await.unwrap());
-        assert!(!handle.check_and_add(key2).await.unwrap());
+        assert!(!handle.check_and_add(key1, None).await.unwrap());
+        assert!(!handle.check_and_add(key2, None).await.unwrap());
     }
 
     #[tokio::test]
@@ -139,17 +157,17 @@ mod tests {
         let key4 = DedupKey::new(4, 40);
 
         // Add 3 keys
-        assert!(handle.check_and_add(key1).await.unwrap());
-        assert!(handle.check_and_add(key2).await.unwrap());
-        assert!(handle.check_and_add(key3).await.unwrap());
+        assert!(handle.check_and_add(key1, None).await.unwrap());
+        assert!(handle.check_and_add(key2, None).await.unwrap());
+        assert!(handle.check_and_add(key3, None).await.unwrap());
 
         // Add a 4th key, should evict the oldest (key1)
-        assert!(handle.check_and_add(key4).await.unwrap());
+        assert!(handle.check_and_add(key4, None).await.unwrap());
 
         // Now key1 should be addable again (was evicted)
-        assert!(handle.check_and_add(key1).await.unwrap());
+        assert!(handle.check_and_add(key1, None).await.unwrap());
 
         // But key2 should now be evicted
-        assert!(handle.check_and_add(key2).await.unwrap());
+        assert!(handle.check_and_add(key2, None).await.unwrap());
     }
 }
@@ -19,7 +19,7 @@ use tokio::sync::{
 };
 use tokio_util::sync::CancellationToken;
 use tower_http::limit::RequestBodyLimitLayer;
-use tracing::{debug, error};
+use tracing::{debug, error, warn};
 
 use crate::traces::trace_processor::SendingTraceProcessor;
 use crate::{
@@ -545,7 +545,8 @@ impl TraceAgent {
             for mut span in original_chunk {
                 // Check for duplicates
                 let key = DedupKey::new(span.trace_id, span.span_id);
-                let should_keep = match deduper.check_and_add(key).await {
+                let should_keep = match deduper.check_and_add(key, config.span_dedup_timeout).await
+                {
                     Ok(should_keep) => {
                         if !should_keep {
                             debug!(
@@ -556,7 +557,7 @@ impl TraceAgent {
                         should_keep
                     }
                     Err(e) => {
-                        error!("Failed to check span in deduper, keeping span: {e}");
+                        warn!("Failed to check span in deduper, keeping span: {e}");
                         true
                     }
                 };
 
@@ -67,12 +67,23 @@ describe('LMI Integration Tests', () => {
       expect(awsLambdaSpan?.attributes.custom.init_type).toBe('lambda-managed-instances')
     })
     // SVLS-8232
-    test.skip('aws.lambda.span should have cold_start set to false', () => {
+    it('aws.lambda.span should have cold_start set to false if no cold_start operation', () => {
       const trace = results[runtime].traces![0];
+
+      // The presence of 'aws.lambda.cold_start' span indicates a cold start
+      const coldStartSpan = trace.spans.find((span: any) =>
+          span.attributes.operation_name === 'aws.lambda.cold_start'
+      );
+
       const awsLambdaSpan = trace.spans.find((span: any) =>
           span.attributes.operation_name === 'aws.lambda'
       );
-      expect(awsLambdaSpan?.attributes.custom.cold_start).toBe('false')
+      expect(awsLambdaSpan).toBeDefined(); // Ensure span exists before checking attributes
+
+      // Only check cold_start attribute when no dedicated cold_start span exists
+      if (!coldStartSpan) {
+        expect(awsLambdaSpan?.attributes.custom.cold_start).toBe('false');
+      }
     })
 
   });
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+.github/chainguard/serverless-init-ci-publish.sts.yaml @DataDog/serverless`
	`2`	`+.github/publish-serverless-init-to-ghcr.yaml @DataDog/serverless`