Pin injector for tracer SSI

[nccatoni]

Motivation

Tracer SSI pipelines currently test custom library packages with the latest injector unless callers coordinate an injector override themselves. That can expose tracer validation to an injector release before it has been deliberately promoted. APMSP-3754 establishes a repository-owned injector pin that DataDog/auto_inject can advance after successful default-branch OCI publication.

Changes

When DD_INSTALLER_LIBRARY_VERSION is set, SSI framework entry points load the trimmed version from auto_inject.lock and export it as DD_INSTALLER_INJECTOR_VERSION. The same rule is applied to Docker SSI, AWS VM SSI, AWS container-app SSI, and generated external pipelines. Default SSI runs remain unchanged when no custom library version is present.

The lock contains one immutable package version followed by a newline so automated updates remain a minimal one-line change.

Testing

• Added focused tests for the custom-library and default-library branches, plus the lock-file format invariant.
• pytest --scenario TEST_THE_TEST -q tests/test_the_test/test_installer_versions.py tests/test_the_test/test_external_gitlab_pipeline.py tests/test_the_test/test_gitlab_pipeline_structure.py — 11 passed.
• Existing Docker scenario assertions passed, but the test process could not complete teardown because this sandbox has no Docker daemon.
• Repository-wide mypy and Ruff checks passed. The aggregate formatter stopped only while downloading the absent yamlfmt binary through the sandbox's blocked network tunnel; no YAML is changed by this PR.

Workflow

1. ⚠️ Create your PR as draft ⚠️
2. Work on you PR until the CI passes
3. Mark it as ready for review
   • Test logic is modified? -> Get a review from RFC owner.
   • Framework is modified, or non obvious usage of it -> get a review from R&P team

🚀 Once your PR is reviewed and the CI green, you can merge it!

🛟 #apm-shared-testing 🛟

Reviewer checklist

• Anything but tests/ or manifests/ is modified ? I have the approval from R&P team
• A docker base image is modified?
  • the relevant build-XXX-image label is present
• A scenario is added, removed or renamed?
  • Get a review from R&P team

---

PR by Bits - View session in Datadog

Comment @DataDog to request changes

[datadog-official]

View session in Datadog

Bits Code status: ✅ Done

CI Auto-fix: Disabled | Enable

Comment @DataDog to request changes

[datadog-datadog-prod-us1]

I can only run on private repositories.

[github-actions]

CODEOWNERS have been resolved as:

auto_inject.lock                                                        @DataDog/system-tests-core
tests/test_the_test/test_installer_versions.py                          @DataDog/system-tests-reviewers
utils/installer_versions.py                                             @DataDog/system-tests-core
utils/_context/_scenarios/docker_ssi.py                                 @DataDog/system-tests-core
utils/scripts/ci_orchestrators/external_gitlab_pipeline.py              @DataDog/system-tests-core
utils/scripts/ci_orchestrators/gitlab_exporter.py                       @DataDog/system-tests-core
utils/virtual_machine/virtual_machines.py                               @DataDog/system-tests-core