feat: pin and automate library defaults for v3

[juan-fernandez]

What does this PR do?

Prepares v3 by replacing runtime latest resolution with pinned defaults for .NET, Java, JavaScript, Python, Python coverage, Ruby, and Go/Orchestrion.

It also:

• documents action-reference and per-library pinning trade-offs, including v2-to-v3 migration;
• adds local scripts to update pins, open a batched signed bump PR, and release the action from PR labels.

Motivation

Resolving latest can change customer environments without an action release. Pinned defaults make releases reproducible while keeping library updates reviewed and easy to publish.

Additional Notes

The semver-major label makes the release helper select v3.0.0 and move the v3 reference. The existing v2 line remains unchanged; future library bumps request patch or minor releases.

Possible Drawbacks / Trade-offs

@v3 receives reviewed updates automatically. Exact tags and SHAs remain stable but require users to update their reference; the README documents Dependabot for SHA updates.

A library-only release may not affect every language, so generated bump PRs list the changed libraries explicitly.

Describe how to test/QA your changes

• Parse the action and workflow YAML and compare defaults with README.md.
• Run bash -n and the isolated argument/update checks for the scripts.
• Run the library-bump and semver-major release helpers in dry-run mode.
• Run the existing GitHub Actions matrix.

[juan-fernandez]

@codex review

[juan-fernandez]

/datadog autotest review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bb4d7f67da

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[datadog-prod-us1-5]

More details

All seven tracer default pins were validated as consistent between action.yml and README.md. The three new scripts (bump, create-PR, release) handle version comparison, file mutation, and semver arithmetic correctly for all realistic inputs including Go's v-prefix convention — no behavioral regressions found.

Was this helpful? React 👍 or 👎

_{📊 Validated against 14 scenarios · Open Bits AI session}

_{🤖 Datadog Autotest · Commit bb4d7f6 · What is Autotest? · Any feedback? Reach out in #autotest}

[daniel-mohedano]

🚀

[datadog-prod-us1-5]

More details

All seven bump-library-versions.sh regex patterns matched their targets in the real files exactly once, in-memory writes are atomic (File.write only fires after the full loop completes), and the semver comparison, bump-rank selection, and tag arithmetic in the release scripts all produced correct results across the full range of upgrade/downgrade/equal-version inputs. No behavioral regressions found.

Was this helpful? React 👍 or 👎

_{📊 Validated against 18 scenarios · Open Bits AI session}

_{🤖 Datadog Autotest · Commit 5b4d576 · What is Autotest? · Any feedback? Reach out in #autotest}

[juan-fernandez]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: 04225d85ec

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".