chore: use static versions instead of setuptools-scm (#15245)

## Description

APMLP-587

Remove `setuptools-scm` and rely on statically defined versions in
`pyproject.toml` and `ddtrace/version.py`.

A lot of the changes are moving components away from using
`ddtrace.version.get_version()` to compute the version vs using the
statically defined `ddtrace.__version__`/`ddtrace.version.__version__`

## Testing

<!-- Describe your testing strategy or note what tests are included -->

## Risks

<!-- Note any risks associated with this change, or "None" if no risks
-->

## Additional Notes

We are dropping the version specific public s3 folders. This is because
the static versions mean we are likely to easily overwrite the contents
of a bucket on PRs/feature branches/new runs on main or release
branches/etc. Removing them and only relying on the pipeline id is the
safest way to not have any conflicts between versions and files
uploaded.


This PR also adds a helper script `scripts/verify-package-version`:

```
Verify and update static versions in pyproject.toml and ddtrace/version.py.

Performs the following validations:
- Ensures version in pyproject.toml is PEP 440 compliant (e.g., "4.1.0.dev0" not "4.1.0.dev")
- Verifies __version__ in ddtrace/version.py matches __version_tuple__ when parsed
- Checks that versions in both files are consistent

Usage:
    scripts/verify-package-version       # Check versions match (exit 0 if OK, 1 if mismatch)
    scripts/verify-package-version --fix # Update version.py from pyproject.toml
```

---------

Co-authored-by: Christophe Papazian <114495376+christophe-papazian@users.noreply.github.com>

Author: brettlangdon

.gitignore

@@ -152,9 +152,6 @@ CLAUDE.local.md
 .riot/venv*
 .riot/requirements/*.in
 
-# Auto-generated version file
-ddtrace/_version.py
-
 # Benchmarks
 artifacts/
 

.gitlab/package.yml

@@ -1,33 +1,3 @@
-compute_library_version:
-  image: registry.ddbuild.io/images/dd-octo-sts-ci-base:2025.06-1
-  tags: [ "arch:amd64" ]
-  stage: package
-  id_tokens:
-    DDOCTOSTS_ID_TOKEN:
-      aud: dd-octo-sts
-  script: |
-    set -eo pipefail
-
-    if [ -z ${GH_TOKEN} ]
-    then
-      # Use dd-octo-sts to get GitHub token
-      dd-octo-sts token --scope DataDog/dd-trace-py --policy gitlab.github-access.read > token
-      gh auth login --with-token < token
-      rm token
-    fi
-    # Prevent git operation errors:
-    #   failed to determine base repo: failed to run git: fatal: detected dubious ownership in repository at ...
-    git config --global --add safe.directory "${CI_PROJECT_DIR}"
-    .gitlab/download-library-version-from-gh-actions.sh
-
-    echo "SETUPTOOLS_SCM_PRETEND_VERSION_FOR_DDTRACE=$(cat library-version/version.txt)" | tee library_version.env
-    echo "DDTRACE_VERSION=$(cat library-version/version.txt)" | tee -a library_version.env
-  artifacts:
-    reports:
-      dotenv: library_version.env
-    paths:
-      - "library-version/version.txt"
-
 download_ddtrace_artifacts:
   image: registry.ddbuild.io/images/dd-octo-sts-ci-base:2025.06-1
   tags: [ "arch:amd64" ]
@@ -90,8 +60,6 @@ publish-wheels-to-s3:
   needs:
     - job: download_ddtrace_artifacts
       artifacts: true
-    - job: compute_library_version
-      artifacts: true
   variables:
     BUCKET: dd-trace-py-builds
   script:
@@ -107,24 +75,20 @@ publish-wheels-to-s3:
     - printf ' - %s\n' "${WHEELS[@]}"
 
     - |
-      if [ -f library-version/version.txt ]; then
-        VERSION="$(tr -d '\r\n' < library-version/version.txt)"
-      fi
+      VERSION=$(grep '^version = ' pyproject.toml | head -1 | sed -E 's/version = "(.+)"/\1/')
 
       if [ -z "${VERSION:-}" ]; then
-        echo "ERROR: VERSION is not defined or library-version/version.txt missing!"
+        echo "ERROR: VERSION is not defined in pyproject.toml!"
         exit 1
       fi
 
     - printf 'Detected version %s\n' ${VERSION}
 
-    # Upload all wheels to versioned prefix and pipeline-id prefix
-    - aws s3 cp --recursive --exclude "*" --include "*.whl" pywheels "s3://${BUCKET}/${VERSION}/"
+    # Upload all wheels to pipeline-id prefix
     - aws s3 cp --recursive --exclude "*" --include "*.whl" pywheels "s3://${BUCKET}/${CI_PIPELINE_ID}/"
 
     - |
       VERSION_ENC="${VERSION//+/%2B}"
-      S3_BASE_VER="https://${BUCKET}.s3.amazonaws.com/${VERSION_ENC}"
       S3_BASE_PIPE="https://${BUCKET}.s3.amazonaws.com/${CI_PIPELINE_ID}"
 
       generate_index_html() {
@@ -141,15 +105,27 @@ publish-wheels-to-s3:
       }
 
       # Generate both minimal indexes
-      generate_index_html "index.version.html"
       generate_index_html "index.pipeline.html"
 
       # Upload to each S3 prefix
-      aws s3 cp "index.version.html" "s3://${BUCKET}/${VERSION}/index.html" --content-type text/html
       aws s3 cp "index.pipeline.html" "s3://${BUCKET}/${CI_PIPELINE_ID}/index.html" --content-type text/html
 
       # Print the clickable URLs
-      VER_INDEX_URL="${S3_BASE_VER}/index.html"
       PIPE_INDEX_URL="${S3_BASE_PIPE}/index.html"
-      echo "S3 index (version):  ${VER_INDEX_URL}"
       echo "S3 index (pipeline): ${PIPE_INDEX_URL}"
+
+
+# Fail if the downloaded package versions do not match the git tag version
+verify_package_version:
+  image: registry.ddbuild.io/images/mirror/python:3.14.0
+  tags: [ "arch:amd64" ]
+  stage: package
+  needs: [ download_ddtrace_artifacts ]
+  only:
+    # v2.10.0
+    # v2.10.1
+    # v2.10.0rc0
+    # v2.10.0rc5
+    - /^v[0-9]+\.[0-9]+\.[0-9]+(rc[0-9]+)?$/
+  script:
+    - .gitlab/verify-package-versions.sh

.gitlab/verify-package-versions.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+WHEEL_FILES=(pywheels/*.whl)
+if [ ${#WHEEL_FILES[@]} -eq 0 ]; then
+  echo "No wheels found in pywheels/"; exit 1
+fi
+
+VERSION_TAG="${CI_COMMIT_TAG#v}"
+echo "Verifying package version ${VERSION_TAG}"
+
+for wf in "${WHEEL_FILES[@]}"; do
+  echo "Checking wheel file: ${wf}"
+  WHEEL_VERSION=$(basename "${wf}" | awk -F '-' '{print $2}')
+  if [ "${WHEEL_VERSION}" != "${VERSION_TAG}" ]; then
+    echo "ERROR: Wheel version ${WHEEL_VERSION} does not match tag version ${VERSION_TAG}"
+    exit 1
+  fi
+done
+
+SDIST_FILES=(pywheels/*.tar.gz)
+if [ ${#SDIST_FILES[@]} -eq 0 ]; then
+  echo "No sdist files found in pywheels/"; exit 1
+fi
+for sf in "${SDIST_FILES[@]}"; do
+  echo "Checking sdist file: ${sf}"
+  SDIST_VERSION=$(basename "${sf}" | awk -F '-' '{print $2}' | sed 's/\.tar\.gz$//')
+  if [ "${SDIST_VERSION}" != "${VERSION_TAG}" ]; then
+      echo "ERROR: Sdist version ${SDIST_VERSION} does not match tag version ${VERSION_TAG}"
+      exit 1
+  fi
+done

.sg/rules/ddtrace-version-import.yml

@@ -0,0 +1,50 @@
+id: ddtrace-version-import
+message: Import `__version__` from `ddtrace.version` instead of `ddtrace`
+severity: error
+language: python
+ignores:
+  - "tests/**"
+  - "benchmarks/**"
+rule:
+  any:
+    # Match: from ddtrace import __version__ (using variable with constraint)
+    - pattern: from $MOD import __version__
+    # Match: from ddtrace import __version__ as $ALIAS
+    - pattern: from $MOD import __version__ as $ALIAS
+    # Match: from ddtrace import $$$IMPORTS, __version__
+    - pattern: from $MOD import $$$IMPORTS, __version__
+    # Match: from ddtrace import $$$IMPORTS, __version__ as $ALIAS
+    - pattern: from $MOD import $$$IMPORTS, __version__ as $ALIAS
+    # Match: from ddtrace import __version__, $$$IMPORTS
+    - pattern: from $MOD import __version__, $$$IMPORTS
+    # Match: from ddtrace import __version__ as $ALIAS, $$$IMPORTS
+    - pattern: from $MOD import __version__ as $ALIAS, $$$IMPORTS
+    # Match: from ddtrace import $$$IMPORTS, __version__, $$$IMPORTS (middle case)
+    - pattern: from $MOD import $$$IMPORTS, __version__, $$$IMPORTS
+    # Match: from ddtrace import $$$IMPORTS, __version__ as $ALIAS, $$$IMPORTS (middle case with alias)
+    - pattern: from $MOD import $$$IMPORTS, __version__ as $ALIAS, $$$IMPORTS
+    # Match: ddtrace.__version__ usage
+    - pattern: ddtrace.__version__
+constraints:
+  MOD:
+    regex: "^ddtrace$"
+  ALIAS:
+    regex: ".*"
+note: |
+  The `__version__` attribute should be imported from `ddtrace.version` to avoid circular dependencies and ensure proper version management.
+
+  Change your imports as follows:
+
+  **Before:**
+  ```python
+  from ddtrace import __version__
+  import ddtrace
+  version = ddtrace.__version__
+  ```
+
+  **After:**
+  ```python
+  from ddtrace.version import __version__
+  ```
+
+  This ensures that `__version__` is accessed from the dedicated version module, preventing circular import issues and making version management more explicit.