[rkennke]

What does this PR do?:

Runs the #938 checks before CI does: the copyright and CLAUDE.md checks at git push, the ticket check at gh pr create.

• .githooks/pre-push: runs check-copyright.py and check-claude-md.py on each pushed branch commit. Exit 1 blocks the push. Any other exit code prints a warning and lets the push through, because CI still runs the check.
• --head <commit>: both scripts can check a commit instead of the working tree. With --head, check-claude-md.py never applies the cairn-block exception, because the content comes from the commit.
• require-fresh-review hook: runs check_pr_ticket.py on the title and body of gh pr create. It reads them from --title/-t, --body/-b, --body-file/-F, or, with --fill, from the branch's commit messages.
• pre-pr-review skill: step 4 runs both source checks, so their violations are fixed before the marker is written.

Motivation:

Step 1 of PROF-16469, decision D7: an agent that learns about a violation from CI has already pushed and opened the PR. The same scripts, run locally, catch it while the change is still cheap.

Additional Notes:

• Stacked on Enforce copyright, CLAUDE.md and ticket-reference rules in CI (PROF-16469) #938. Base is rkennke/PROF-16469-ci-checks. Retarget to main after Enforce copyright, CLAUDE.md and ticket-reference rules in CI (PROF-16469) #938 merges.
• Trust model: the hooks load every script from origin/main with python3 -I -c, like review-marker.py. A branch cannot weaken the check that judges it. So the scripts no longer compute their __file__ default eagerly.
• Inert until Enforce copyright, CLAUDE.md and ticket-reference rules in CI (PROF-16469) #938 is on main: a check that is not on origin/main yet is skipped, not failed.
• Ticket check limits, accepted: these bodies pass the local hook, and CI still checks them:
  • interactive gh pr create, or a body from stdin (-F -);
  • a title or body with $( or a backtick, because the hook cannot know what the shell will substitute.
• Pre-PR review: Sphinx (standard) on the full range, 0 Critical/High, 9 Low and 1 Info, left as is. The Low findings are false blocks or redundant work, none of them a bypass:
  • shlex treats # as a comment, so an unquoted --title fix#123 loses #123 and can be blocked;
  • --fill adds the commit messages even when --title/--body are given, so a ticket in a commit can stand in for the explicit text;
  • a plain "$BODY" variable is checked as literal text, so it is blocked;
  • a crash of the checker (exit 1) reads as "no ticket";
  • the pre-push source checks run for every pushed ref, also on branches without an open PR.

How to test the change?:

• bash utils/tests/test_quality_check_scripts.sh: 101 groups. The new --head cases check that:
  • the commit is read, not the working tree (staged, deleted and reverted files);
  • the change year comes from the commit's history;
  • symlinks and submodule entries in the commit are skipped;
  • a missing CLAUDE.md is reported;
  • a committed cairn block is never accepted.
• bash utils/tests/test_review_marker.sh: 165 tests in node:22-bookworm, Pi cases included. New cases cover the pre-push source checks and the ticket check for each flag form.
• Mutation check by hand: removing or inverting each new --head branch makes the suite fail.
• Test drive: in a scratch clone whose origin/main is this branch, a fresh headless Claude Code session ran gh pr create with a title and body without a ticket. The hook blocked it with the ticket message.

For Datadog employees:

• If this PR touches code that signs or publishes builds or packages, or handles
  credentials of any kind, I've requested a security review (run the dd:platform-security-review
  skill, or file a request via the PSEC review form).
  bewaire also runs automatically on every PR.
• This PR doesn't touch any of that.
• JIRA: PROF-16469

🤖 Generated with Claude Code

[dd-octo-sts]

Scan-Build Report

User:	runner@runnervm48cm3
Working Directory:	/home/runner/work/java-profiler/java-profiler/ddprof-lib/src/test/make
Command Line:	make -j4 all
Clang Version:	Ubuntu clang version 18.1.3 (1ubuntu1)
Date:	Wed Nov 4 21:50:56 2026

Bug Summary

Bug Type	Quantity	Display?
All Bugs	2
Logic error
Dereference of null pointer	1
Unused code
Dead initialization	1

Reports

Bug Group	Bug Type ▾	File	Function/Method	Line	Path Length
Unused code	Dead initialization	referenceChains.cpp	applyOomRamp	497	1
Logic error	Dereference of null pointer	perfEvents_linux.cpp	unregisterThread	720	26

[dd-octo-sts]

CI Test Results

Run: #41919545601 | Commit: 68398af | Duration: 19m 32s (longest job)

✅ All 32 test jobs passed

Status Overview

JDK	glibc-aarch64/debug	glibc-amd64/debug	musl-aarch64/debug	musl-amd64/debug
8	-	✅	-	-
8-ibm	-	✅	-	-
8-j9	✅	✅	-	-
8-librca	-	-	✅	✅
8-orcl	-	✅	-	-
11	-	✅	-	-
11-j9	✅	✅	-	-
11-librca	-	-	✅	✅
17	✅	✅	-	-
17-graal	✅	✅	-	-
17-j9	✅	✅	-	-
17-librca	-	-	✅	✅
21	✅	✅	-	-
21-graal	✅	✅	-	-
21-librca	-	-	✅	✅
25	✅	✅	-	-
25-graal	✅	✅	-	-
25-librca	-	-	✅	✅

Legend: ✅ passed | ❌ failed | ⚪ skipped | 🚫 cancelled

Summary: Total: 32 | Passed: 32 | Failed: 0

---

Updated: 2026-11-04 22:11:46 UTC

[dd-octo-sts]

✅ All 40 integration tests passed

📊 Dashboard · 👷 Pipeline · 📦 3a792572