feat(ffe): add runtime-backed PHP feature flag evaluation

.github/CODEOWNERS

@@ -14,6 +14,17 @@ compile_rust.sh @Datadog/libdatadog-apm
 # APM IDM Team
 /src/ @DataDog/apm-idm-php
 
+# FFE (Feature Flagging & Experimentation) SDK Team
+/components-rs/ffe.rs @Datadog/libdatadog-apm @DataDog/feature-flagging-and-experimentation-sdk
+/libdatadog @Datadog/libdatadog-apm @DataDog/feature-flagging-and-experimentation-sdk
+/src/api/FeatureFlags/ @DataDog/feature-flagging-and-experimentation-sdk
+/src/DDTrace/OpenFeature/ @DataDog/feature-flagging-and-experimentation-sdk
+/src/bridge/_files_openfeature.php @DataDog/feature-flagging-and-experimentation-sdk
+/tests/FeatureFlags/ @DataDog/feature-flagging-and-experimentation-sdk
+/tests/api/Unit/FeatureFlags/ @DataDog/feature-flagging-and-experimentation-sdk
+/tests/OpenFeature/ @DataDog/feature-flagging-and-experimentation-sdk
+/tests/ext/ffe/ @DataDog/feature-flagging-and-experimentation-sdk
+
 # Release files
 Cargo.lock @DataDog/apm-php @DataDog/profiling-php @Datadog/libdatadog-apm
 package.xml @DataDog/apm-php @DataDog/profiling-php @Datadog/asm-php

.github/dependabot.yml

@@ -5,6 +5,13 @@
 
 version: 2
 updates:
+  - package-ecosystem: "gitsubmodule"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 2
+
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:

.gitlab-ci.yml

@@ -6,8 +6,8 @@ stages:
 
 variables:
   GIT_SUBMODULE_STRATEGY: recursive
-  # Only clone libdatadog submodule by default
-  GIT_SUBMODULE_PATHS: libdatadog
+  # Only clone submodules required by default test jobs
+  GIT_SUBMODULE_PATHS: libdatadog tests/FeatureFlags/ffe-system-test-data
   RELIABILITY_ENV_BRANCH:
     value: "master"
     description: "Run a specific datadog-reliability-env branch downstream"
@@ -71,6 +71,8 @@ tracer-trigger:
     strategy: depend
   variables:
     PARENT_PIPELINE_ID: $CI_PIPELINE_ID
+    GIT_SUBMODULE_STRATEGY: recursive
+    GIT_SUBMODULE_PATHS: libdatadog tests/FeatureFlags/ffe-system-test-data
 
 appsec-trigger:
   stage: tests
@@ -119,7 +121,8 @@ package-trigger:
       pipeline_variables: true
   variables:
     PARENT_PIPELINE_ID: $CI_PIPELINE_ID
-    GIT_SUBMODULE_PATHS: libdatadog appsec/third_party/cpp-base64 appsec/third_party/libddwaf appsec/third_party/libddwaf-rust appsec/third_party/msgpack-c
+    GIT_SUBMODULE_STRATEGY: recursive
+    GIT_SUBMODULE_PATHS: libdatadog tests/FeatureFlags/ffe-system-test-data appsec/third_party/cpp-base64 appsec/third_party/libddwaf appsec/third_party/libddwaf-rust appsec/third_party/msgpack-c
     NIGHTLY_BUILD: $NIGHTLY_BUILD
 
 # Runs after the full CI completes.  Triggered in two situations:

.gitlab/generate-tracer.php

@@ -386,6 +386,26 @@ function before_script_steps($with_docker_auth = false) {
     - make test_unit PHPUNIT_JUNIT="artifacts/tests/php-tests.xml" <?= ASSERT_NO_MEMLEAKS ?>
 <?php after_script(); ?>
 
+<?php if (version_compare($major_minor, "8.0", ">=")): ?>
+"Feature flags tests: [<?= $major_minor ?>]":
+  extends: .debug_test
+  needs:
+    - job: "compile extension: debug"
+      parallel:
+        matrix:
+          - PHP_MAJOR_MINOR: "<?= $major_minor ?>"
+            ARCH: "amd64"
+      artifacts: true
+    - job: "Prepare code"
+      artifacts: true
+  variables:
+    PHP_MAJOR_MINOR: "<?= $major_minor ?>"
+    ARCH: "amd64"
+  script:
+    - make test_featureflags PHPUNIT_JUNIT="artifacts/tests/php-tests.xml" <?= ASSERT_NO_MEMLEAKS ?>
+<?php after_script(); ?>
+<?php endif; ?>
+
 "API unit tests: [<?= $major_minor ?>]":
   extends: .debug_test
   needs:

.gitmodules

@@ -18,3 +18,6 @@
 	path = appsec/third_party/libddwaf-rust
 	url = https://github.com/DataDog/libddwaf-rust.git
 	branch = glopes/v2
+[submodule "tests/FeatureFlags/ffe-system-test-data"]
+	path = tests/FeatureFlags/ffe-system-test-data
+	url = https://github.com/DataDog/ffe-system-test-data

Makefile

@@ -1328,6 +1328,12 @@ test_distributed_tracing_coverage:
 test_metrics: global_test_run_dependencies
 	$(call run_tests,--testsuite=metrics $(TESTS))
 
+test_featureflags: global_test_run_dependencies tests/OpenFeature/composer.lock-php$(PHP_MAJOR_MINOR)
+	$(eval FEATUREFLAGS_TEST_EXTRA_INI := $(TEST_EXTRA_INI))
+	$(eval TEST_EXTRA_INI=$(FEATUREFLAGS_TEST_EXTRA_INI) -d auto_prepend_file=$(PWD)/tests/OpenFeature/vendor/autoload.php)
+	$(call run_tests,--testsuite=featureflags $(TESTS))
+	$(eval TEST_EXTRA_INI=$(FEATUREFLAGS_TEST_EXTRA_INI))
+
 benchmarks_run_dependencies: global_test_run_dependencies tests/Frameworks/Symfony/Version_5_2/composer.lock-php$(PHP_MAJOR_MINOR) tests/Frameworks/Laravel/Version_10_x/composer.lock-php$(PHP_MAJOR_MINOR) tests/Benchmarks/composer.lock-php$(PHP_MAJOR_MINOR)
 	php tests/Frameworks/Symfony/Version_5_2/bin/console cache:clear --no-warmup --env=prod
 

components-rs/Cargo.toml

@@ -15,7 +15,8 @@ libdd-telemetry-ffi = { path = "../libdatadog/libdd-telemetry-ffi", default-feat
 datadog-live-debugger = { path = "../libdatadog/datadog-live-debugger" }
 datadog-live-debugger-ffi = { path = "../libdatadog/datadog-live-debugger-ffi", default-features = false }
 datadog-ipc = { path = "../libdatadog/datadog-ipc" }
-datadog-remote-config = { path = "../libdatadog/datadog-remote-config" }
+datadog-ffe = { path = "../libdatadog/datadog-ffe" }
+datadog-remote-config = { path = "../libdatadog/datadog-remote-config", features = ["ffe"] }
 datadog-sidecar = { path = "../libdatadog/datadog-sidecar" }
 datadog-sidecar-ffi = { path = "../libdatadog/datadog-sidecar-ffi" }
 libdd-data-pipeline = { path = "../libdatadog/libdd-data-pipeline" }

components-rs/common.h

@@ -439,6 +439,8 @@ typedef struct ddog_DebuggerPayload ddog_DebuggerPayload;
 
 typedef struct ddog_DslString ddog_DslString;
 
+typedef struct ddog_FfeResult ddog_FfeResult;
+
 typedef struct ddog_HashMap_ShmCacheKey__ShmCache ddog_HashMap_ShmCacheKey__ShmCache;
 
 /**
@@ -478,6 +480,19 @@ typedef struct ddog_SidecarTransport ddog_SidecarTransport;
  */
 typedef struct ddog_SpanConcentrator ddog_SpanConcentrator;
 
+/**
+ * Flags selecting which Remote Config products/capabilities to subscribe to.
+ *
+ * Passed as a single C-ABI struct so call sites can use designated initializers
+ * and name the flags, instead of a positional sequence of bool args.
+ */
+typedef struct ddog_DdogRemoteConfigFlags {
+  bool live_debugging_enabled;
+  bool appsec_activation;
+  bool appsec_config;
+  bool ffe_enabled;
+} ddog_DdogRemoteConfigFlags;
+
 /**
  * Holds the raw parts of a Rust Vec; it should only be created from Rust,
  * never from C.
@@ -679,6 +694,14 @@ typedef struct ddog_Vec_DebuggerPayload {
  */
 typedef uint64_t ddog_QueueId;
 
+typedef struct ddog_FfeAttribute {
+  const char *key;
+  int32_t value_type;
+  const char *string_value;
+  double number_value;
+  bool bool_value;
+} ddog_FfeAttribute;
+
 /**
  * A (key, value) pair for peer-service tags, borrowed from PHP/concentrator memory.
  */

components-rs/ddtrace.h

@@ -61,6 +61,32 @@ int posix_spawn_file_actions_addchdir_np(void *file_actions, const char *path);
 
 uint64_t dd_fnv1a_64(const uint8_t *data, uintptr_t len);
 
+bool ddog_ffe_load_config(const char *json);
+
+bool ddog_ffe_has_config(void);
+
+uint64_t ddog_ffe_config_version(void);
+
+struct ddog_FfeResult *ddog_ffe_evaluate(const char *flag_key,
+                                         int32_t expected_type,
+                                         const char *targeting_key,
+                                         const struct ddog_FfeAttribute *attributes,
+                                         uintptr_t attributes_count);
+
+const char *ddog_ffe_result_value(const struct ddog_FfeResult *result);
+
+const char *ddog_ffe_result_variant(const struct ddog_FfeResult *result);
+
+const char *ddog_ffe_result_allocation_key(const struct ddog_FfeResult *result);
+
+int32_t ddog_ffe_result_reason(const struct ddog_FfeResult *result);
+
+int32_t ddog_ffe_result_error_code(const struct ddog_FfeResult *result);
+
+bool ddog_ffe_result_do_log(const struct ddog_FfeResult *result);
+
+void ddog_ffe_free_result(struct ddog_FfeResult *result);
+
 const char *ddog_normalize_process_tag_value(ddog_CharSlice tag_value);
 
 void ddog_free_normalized_tag_value(const char *ptr);
@@ -118,9 +144,7 @@ void ddog_reset_logger(void);
 
 uint32_t ddog_get_logs_count(ddog_CharSlice level);
 
-void ddog_init_remote_config(bool live_debugging_enabled,
-                             bool appsec_activation,
-                             bool appsec_config);
+void ddog_init_remote_config(struct ddog_DdogRemoteConfigFlags flags);
 
 struct ddog_RemoteConfigState *ddog_init_remote_config_state(const struct ddog_Endpoint *endpoint,
                                                              bool di_enabled);