Fix CODEOWNERS routing for AppSec, IAST, and RASP instrumentation modules

[jandro996]

What Does This Do

• Add /dd-java-agent/instrumentation/**/*appsec* and **/*iast* (lowercase, wildcard both sides) co-owned by @DataDog/asm-java @DataDog/apm-idm-java, so nested modules named with lowercase-hyphenated style (e.g. jetty-appsec-11.0, akka-http-10.2-iast) are no longer routed to apm-idm-java only.
• Add /dd-java-agent/instrumentation/**/*AppSec* (CamelCase), same owners, so standalone files inside generic framework modules (e.g. AppSecInterceptor.java under okhttp/spring-webmvc/spring-security/tomcat/jetty-server/liberty/grizzly/jersey/ratpack/vertx-web) are also routed correctly. **/*Iast* and **/*Rasp* (CamelCase) already existed.
• Add /dd-java-agent/instrumentation/**/*rasp* (lowercase) preventively — no RASP file currently uses lowercase naming, but this closes the same class of gap before it can regress.
• Remove the now-subsumed lines: **/appsec/, **/iast/, **/rasp/, flat *iast*, flat *appsec*. Confirmed with a pathspec-based last-match-wins simulator (run against the full file, matching GitHub's actual resolution semantics) that the new patterns are a strict superset of what was removed.

Motivation

APPSEC-70201 reported AppSec/IAST-owned code being routed to @DataDog/apm-idm-java instead of @DataDog/asm-java. The ticket's original root cause (* not crossing /) had already been fixed by #12276 before this PR; the live gap that remained was narrower: case-sensitivity / substring-wildcarding for lowercase-hyphenated modules and a missing **/*AppSec* CamelCase pattern. This PR closes that remaining gap. The decoupling work described as "Problem 2" in the same ticket (BlockResponseFunction consolidation) is explicitly out of scope for this PR.

Additional Notes

• Known, pre-existing, out-of-scope limitation: IAST/AppSec code embedded inside a module claimed by a later, more specific CODEOWNERS rule elsewhere in the file (e.g. kafka-clients-0.11/src/test/groovy/iast/, which a later data-streams-monitoring rule also matches) still resolves to that later rule due to CODEOWNERS' last-match-wins semantics. Fixing it would require reordering/auditing the whole file's section precedence — a separate, larger task.
• gh api repos/DataDog/dd-trace-java/codeowners/errors returned {"errors":[]} against the pushed branch (syntax check).

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
  Use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Update public documentation with any new configuration flags or behaviors

Jira ticket: APPSEC-70201

Note: Once your PR is ready to merge, add it to the merge queue by commenting /merge. /merge -c cancels the queue request. /merge -f --reason "reason" skips all merge queue checks; please use this judiciously, as some checks do not run at the PR-level. For more information, see this doc.

[jandro996]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-21T13:23:28.142815Z	0059d45	Draft marked ready
🔒 Security Review	✅ Completed 2026-09-21T13:24:33.936859Z	0059d45	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: 22aa60c950

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 22aa60c950

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[datadog-datadog-prod-us1]

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 59.13% (+0.00%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 4ecfa7c | Docs | Give us feedback!}

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	13.99 s	13.99 s	[-0.7%; +0.7%] (no difference)
startup:insecure-bank:tracing:Agent	12.88 s	12.99 s	[-1.6%; -0.1%] (maybe better)
startup:petclinic:appsec:Agent	16.91 s	16.87 s	[-0.8%; +1.2%] (no difference)
startup:petclinic:iast:Agent	16.86 s	16.97 s	[-1.8%; +0.4%] (no difference)
startup:petclinic:profiling:Agent	16.74 s	16.61 s	[-0.2%; +1.7%] (no difference)
startup:petclinic:sca:Agent	16.36 s	16.25 s	[-5.6%; +6.9%] (unstable)
startup:petclinic:tracing:Agent	16.14 s	16.25 s	[-1.5%; +0.2%] (no difference)

Commit: 4ecfa7c5 · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[datadog-datadog-prod-us1]

More details

The new patterns preserve the removed path coverage. They also route lowercase nested module names and CamelCase AppSec files to both owner teams.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Datadog Autotest · Commit 0059d45 · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}

[jordan-wong]

LGTM, thanks for this PR!