Migrate to ddoghq/images

.github/workflows/create-test-mirror-pr.yml

@@ -18,7 +18,7 @@ jobs:
       - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
         id: octo-sts
         with:
-          scope: DataDog/images
+          scope: ddoghq/images
           policy: dd-trace-java-docker-build.update-mirror
 
       - name: Checkout DataDog/dd-trace-java-docker-build
@@ -27,10 +27,10 @@ jobs:
           path: dd-trace-java-docker-build
           ref: refs/pull/${{ github.event.inputs.pr_number }}/merge
 
-      - name: Checkout DataDog/images
+      - name: Checkout ddoghq/images
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          repository: DataDog/images
+          repository: ddoghq/images
           token: ${{ steps.octo-sts.outputs.token }}
           path: images
 
@@ -80,7 +80,7 @@ jobs:
         if: ${{ steps.create-commit.outputs.has_changes == 'true' }}
         uses: DataDog/commit-headless@2801f6e08acb3a69b6c4d7b0d5deef27c1a15bc7 # action/v3.3.1
         with:
-          target: DataDog/images
+          target: ddoghq/images
           token: "${{ steps.octo-sts.outputs.token }}"
           branch: "${{ steps.define-branch.outputs.branch }}"
           head-sha: "${{ steps.images-head.outputs.sha }}"
@@ -96,7 +96,7 @@ jobs:
           PR_NUMBER: ${{ github.event.inputs.pr_number }}
         run: |
           PR_URL=$(gh pr create \
-            --repo DataDog/images \
+            --repo ddoghq/images \
             --title "Update dd-trace-java-docker-build test images for PR #${PR_NUMBER}" \
             --base master \
             --head "${{ steps.define-branch.outputs.branch }}" \

.github/workflows/delete-test-mirror-pr.yml

@@ -17,18 +17,18 @@ jobs:
       - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
         id: octo-sts
         with:
-          scope: DataDog/images
+          scope: ddoghq/images
           policy: dd-trace-java-docker-build.update-mirror
 
       - name: Checkout DataDog/dd-trace-java-docker-build
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           path: dd-trace-java-docker-build
 
-      - name: Checkout DataDog/images
+      - name: Checkout ddoghq/images
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          repository: DataDog/images
+          repository: ddoghq/images
           token: ${{ steps.octo-sts.outputs.token }}
           path: images
 
@@ -65,7 +65,7 @@ jobs:
       - name: Push changes
         uses: DataDog/commit-headless@2801f6e08acb3a69b6c4d7b0d5deef27c1a15bc7 # action/v3.3.1
         with:
-          target: DataDog/images
+          target: ddoghq/images
           token: "${{ steps.octo-sts.outputs.token }}"
           branch: "${{ steps.define-branch.outputs.branch }}"
           head-sha: "${{ steps.images-head.outputs.sha }}"
@@ -79,7 +79,7 @@ jobs:
           PR_NUMBER: ${{ github.event.inputs.pr_number }}
         run: |
           gh pr create \
-            --repo DataDog/images \
+            --repo ddoghq/images \
             --title "Remove dd-trace-java-docker-build test images for PR #${PR_NUMBER}" \
             --base master \
             --head "${{ steps.define-branch.outputs.branch }}" \

.github/workflows/update-mirror-digests.yml

@@ -17,18 +17,18 @@ jobs:
       - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
         id: octo-sts
         with:
-          scope: DataDog/images
+          scope: ddoghq/images
           policy: dd-trace-java-docker-build.update-mirror
 
       - name: Checkout DataDog/dd-trace-java-docker-build
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           path: dd-trace-java-docker-build
 
-      - name: Checkout DataDog/images
+      - name: Checkout ddoghq/images
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          repository: DataDog/images
+          repository: ddoghq/images
           token: ${{ steps.octo-sts.outputs.token }}
           path: images
 
@@ -96,7 +96,7 @@ jobs:
         if: ${{ steps.create-commit.outputs.has_changes == 'true' }}
         uses: DataDog/commit-headless@2801f6e08acb3a69b6c4d7b0d5deef27c1a15bc7 # action/v3.3.1
         with:
-          target: DataDog/images
+          target: ddoghq/images
           token: "${{ steps.octo-sts.outputs.token }}"
           branch: "${{ steps.define-branch.outputs.branch }}"
           head-sha: "${{ steps.images-head.outputs.sha }}"
@@ -110,7 +110,7 @@ jobs:
           GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
         run: |
           gh pr create \
-            --repo DataDog/images \
+            --repo ddoghq/images \
             --title "Update dd-trace-java-docker-build ci-* image digests" \
             --base master \
             --head "${{ steps.define-branch.outputs.branch }}" \

README.md

@@ -19,7 +19,7 @@ The `7` and `ibm8` variants are amd64-only because the upstream JDK images are n
 Images are tagged with `ci-` prefixes via the [Tag new images version](https://github.com/DataDog/dd-trace-java-docker-build/actions/workflows/docker-tag.yml) workflow, which runs quarterly on `master` and when manually triggered.
 A **48-hour cooldown** is enforced: the workflow verifies that all external upstream dependencies (Eclipse Temurin, Azul Zulu, IBM Semeru, GraalVM, etc.) referenced in the Dockerfile were built at least 48 hours ago before tagging.
 This ensures that upstream images have had sufficient time for vulnerability scans and community review before being CI use. On completion, it automatically triggers the [Update mirror digests for ci-* images](https://github.com/DataDog/dd-trace-java-docker-build/actions/workflows/update-mirror-digests.yml) workflow,
-which opens a PR in [DataDog/images](https://github.com/DataDog/images) updating the pinned `ci-*` mirror image digests.
+which opens a PR in [ddoghq/images](https://github.com/ddoghq/images) updating the pinned `ci-*` mirror image digests.
 Once that PR is merged, `dd-trace-java` CI picks up the updated images from `registry.ddbuild.io`. Images are mirrored in `registry.ddbuild.io` to ensure they are signed before use in CI.
 
 ## Development
@@ -51,10 +51,10 @@ Images are built per PR for ease in testing. These test images are prefixed with
 To test these images in `dd-trace-java` CI:
 
 1. Open a PR in [DataDog/dd-trace-java-docker-build](https://github.com/DataDog/dd-trace-java-docker-build) with the changes you want to test. Let's say these changes are made in PR #N.
-2. After the PR images are built in the [GitHub Container Registry](https://github.com/DataDog/dd-trace-java-docker-build/pkgs/container/dd-trace-java-docker-build), run the [Create test image mirror PR](https://github.com/DataDog/dd-trace-java-docker-build/actions/workflows/create-test-mirror-pr.yml) workflow with the corresponding PR number: `N`. This automatically opens a PR in [DataDog/images](https://github.com/DataDog/images) that adds mirror entries for the `N_merge-*` test images. Merge the PR that should be automatically approved by the `dd-prapprover` bot. After merging, the images may take 30 min or more to update.
+2. After the PR images are built in the [GitHub Container Registry](https://github.com/DataDog/dd-trace-java-docker-build/pkgs/container/dd-trace-java-docker-build), run the [Create test image mirror PR](https://github.com/DataDog/dd-trace-java-docker-build/actions/workflows/create-test-mirror-pr.yml) workflow with the corresponding PR number: `N`. This automatically opens a PR in [ddoghq/images](https://github.com/ddoghq/images) that adds mirror entries for the `N_merge-*` test images. Merge the PR that should be automatically approved by the `dd-prapprover` bot. After merging, the images may take 30 min or more to update.
 3. Open a PR in [DataDog/dd-trace-java](https://github.com/DataDog/dd-trace-java) that sets `BUILDER_IMAGE_VERSION_PREFIX: "N_merge-"` in `.gitlab-ci.yml`. Here, you can check your test images with `DataDog/dd-trace-java` CI.
-4. Every time you want to test changes made in PR #N, ensure the test image SHAs in `DataDog/images` are updated by running the [Create test image mirror PR](https://github.com/DataDog/dd-trace-java-docker-build/actions/workflows/create-test-mirror-pr.yml) workflow with `N`. Confirm that these PRs are approved and merged by the `dd-prapprover` bot.
+4. Every time you want to test changes made in PR #N, ensure the test image SHAs in `ddoghq/images` are updated by running the [Create test image mirror PR](https://github.com/DataDog/dd-trace-java-docker-build/actions/workflows/create-test-mirror-pr.yml) workflow with `N`. Confirm that these PRs are approved and merged by the `dd-prapprover` bot.
 5. When the test images look good and `DataDog/dd-trace-java` CI is green, merge your `DataDog/dd-trace-java-docker-build` PR #N.
 6. Close the test `DataDog/dd-trace-java` PR.
-7. Run the [Delete test image mirror PR](https://github.com/DataDog/dd-trace-java-docker-build/actions/workflows/delete-test-mirror-pr.yml) workflow with `N` to remove the `N_merge-*` images from `DataDog/images`. Confirm that this PR is approved and merged by the `dd-prapprover` bot.
-8. Finally, run the [Tag new images version](https://github.com/DataDog/dd-trace-java-docker-build/actions/workflows/docker-tag.yml) workflow. **Note:** The workflow enforces a 48-hour cooldown on external upstream dependencies — it will fail if any upstream image (Eclipse Temurin, Azul Zulu, IBM Semeru, GraalVM, etc.) was rebuilt less than 48 hours ago. If the workflow fails, check the logs to see which dependency is too new, and retry after the cooldown has elapsed. This check can also be skipped when manually triggering the workflow. On success, the [Update mirror digests for ci-* images](https://github.com/DataDog/dd-trace-java-docker-build/actions/workflows/update-mirror-digests.yml) workflow will automatically open a PR in `DataDog/images`, updating the pinned `ci-*` digests. `dd-trace-java` CI should automatically pick up these updated images a few minutes after the PR is merged.
+7. Run the [Delete test image mirror PR](https://github.com/DataDog/dd-trace-java-docker-build/actions/workflows/delete-test-mirror-pr.yml) workflow with `N` to remove the `N_merge-*` images from `ddoghq/images`. Confirm that this PR is approved and merged by the `dd-prapprover` bot.
+8. Finally, run the [Tag new images version](https://github.com/DataDog/dd-trace-java-docker-build/actions/workflows/docker-tag.yml) workflow. **Note:** The workflow enforces a 48-hour cooldown on external upstream dependencies — it will fail if any upstream image (Eclipse Temurin, Azul Zulu, IBM Semeru, GraalVM, etc.) was rebuilt less than 48 hours ago. If the workflow fails, check the logs to see which dependency is too new, and retry after the cooldown has elapsed. This check can also be skipped when manually triggering the workflow. On success, the [Update mirror digests for ci-* images](https://github.com/DataDog/dd-trace-java-docker-build/actions/workflows/update-mirror-digests.yml) workflow will automatically open a PR in `ddoghq/images`, updating the pinned `ci-*` digests. `dd-trace-java` CI should automatically pick up these updated images a few minutes after the PR is merged.

scripts/create-test-mirror-entries.sh

@@ -1,9 +1,9 @@
 #!/usr/bin/env bash
 # create-test-mirror-entries.sh — add or update {PR_NUMBER}_merge-* test image entries
-# in mirror.yaml and mirror.lock.yaml files in the DataDog/images repo.
+# in mirror.yaml and mirror.lock.yaml files in the ddoghq/images repo.
 #
 # This script is called in the create-test-mirror-pr Github workflow.
-# It must be run from the root of DataDog/images and requires crane to be installed.
+# It must be run from the root of ddoghq/images and requires crane to be installed.
 #
 # Required env var:
 #   PR_NUMBER  — pull request number in dd-trace-java-docker-build (numeric)

scripts/delete-test-mirror-entries.sh

@@ -1,9 +1,9 @@
 #!/usr/bin/env bash
 # delete-test-mirror-entries.sh — remove {PR_NUMBER}_merge-* test image entries
-# from mirror.yaml and mirror.lock.yaml in the DataDog/images repo.
+# from mirror.yaml and mirror.lock.yaml in the ddoghq/images repo.
 #
 # This script is called in the delete-test-mirror-pr GitHub workflow.
-# It must be run from the root of DataDog/images.
+# It must be run from the root of ddoghq/images.
 #
 # Required env var:
 #   PR_NUMBER  — pull request number in dd-trace-java-docker-build (numeric)

scripts/update-ci-image-digests.sh

@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
-# update-ci-image-digests.sh - add/update ci-* image mirror entries in the DataDog/images repo.
+# update-ci-image-digests.sh - add/update ci-* image mirror entries in the ddoghq/images repo.
 #
 # This script is called in the update-mirror-digests Github workflow.
-# It must be run from the root of DataDog/images and requires crane to be installed.
+# It must be run from the root of ddoghq/images and requires crane to be installed.
 
 set -euo pipefail