Merge branch 'master' into inferred-span-tags

Author: jordan-wong

.circleci/config.continue.yml.j2

@@ -36,7 +36,7 @@ instrumentation_modules: &instrumentation_modules "dd-java-agent/instrumentation
 debugger_modules: &debugger_modules "dd-java-agent/agent-debugger|dd-java-agent/agent-bootstrap|dd-java-agent/agent-builder|internal-api|communication|dd-trace-core"
 profiling_modules: &profiling_modules "dd-java-agent/agent-profiling"
 
-default_system_tests_commit: &default_system_tests_commit 315bc8a32cc888834726397f088336ba8038277f
+default_system_tests_commit: &default_system_tests_commit 2799fa982318da14c9d3e5f722abdc670d2802c3
 
 parameters:
   nightly:
@@ -696,6 +696,8 @@ jobs:
     <<: *tests
 
     resource_class: medium
+    environment:
+      - CI_AGENT_HOST=localhost
 
     docker:
       - image: << pipeline.parameters.docker_image >>:{{ docker_image_prefix }}8
@@ -850,6 +852,9 @@ jobs:
             DEFAULT
             APM_TRACING_E2E
             APM_TRACING_E2E_SINGLE_SPAN
+            TRACING_CONFIG_NONDEFAULT
+            TRACING_CONFIG_NONDEFAULT_2
+            TRACING_CONFIG_NONDEFAULT_3
             "
             if ! [[ << parameters.weblog-variant >> =~ .*native ]]; then
               echo "
@@ -860,6 +865,8 @@ jobs:
               APPSEC_API_SECURITY
               APPSEC_API_SECURITY_RC
               APPSEC_API_SECURITY_WITH_SAMPLING
+              APPSEC_AUTO_EVENTS_RC
+              APPSEC_AUTO_EVENTS_EXTENDED
               APPSEC_WAF_TELEMETRY
               APPSEC_STANDALONE_V2
               IAST_STANDALONE_V2
@@ -889,6 +896,7 @@ jobs:
             for log_dir in logs*; do
               tar -cvzf ../artifacts/${log_dir}_<< parameters.weblog-variant >>.tar.gz $log_dir
             done
+          when: always
 
       - store_artifacts:
           path: artifacts
@@ -978,6 +986,7 @@ jobs:
             for dir in system-tests/logs*/; do
                 cp -r "$dir" logs_debugger
             done
+          when: always
 
       - store_test_results:
           path: logs_debugger
@@ -1096,7 +1105,7 @@ build_test_jobs: &build_test_jobs
       requires:
         - ok_to_test
       name: check_inst
-      parallelism: 4
+      parallelism: 5
       gradleTarget: ":instrumentationCheck"
       cacheType: inst
       triggeredBy: *instrumentation_modules
@@ -1324,6 +1333,7 @@ build_test_jobs: &build_test_jobs
       matrix:
         <<: *test_matrix
 
+{% if ssi_smoke %}
   - tests:
       requires:
         - ok_to_test
@@ -1337,6 +1347,7 @@ build_test_jobs: &build_test_jobs
       maxWorkers: 3
       matrix:
         <<: *test_matrix
+{% endif %}
 
   - tests:
       requires:
@@ -1380,6 +1391,7 @@ build_test_jobs: &build_test_jobs
       maxWorkers: 3
       testJvm: "8"
 
+{% if ssi_smoke %}
   - tests:
       requires:
         - ok_to_test
@@ -1392,13 +1404,16 @@ build_test_jobs: &build_test_jobs
       parallelism: 4
       maxWorkers: 3
       testJvm: "8"
+{% endif %}
 
   - fan_in:
       requires:
         - z_test_<< matrix.testJvm >>_base
         - z_test_<< matrix.testJvm >>_inst
         - z_test_<< matrix.testJvm >>_smoke
+{% if ssi_smoke %}
         - z_test_<< matrix.testJvm >>_ssi_smoke
+{% endif %}
       name: test_<< matrix.testJvm >>
       stage: tracing
       matrix:
@@ -1409,7 +1424,9 @@ build_test_jobs: &build_test_jobs
         - z_test_8_base
         - z_test_8_inst
         - z_test_8_smoke
+{% if ssi_smoke %}
         - z_test_8_ssi_smoke
+{% endif %}
       name: test_8
       stage: tracing
       testJvm: "8"
@@ -1503,6 +1520,14 @@ build_test_jobs: &build_test_jobs
       stage: required
 
 workflows:
+{% if skip_circleci %}
+  build_test:
+    jobs:
+      # Just a "required" job to make GitHub PR checks happy, and run nothing else.
+      - fan_in:
+          name: required
+          stage: required
+{% else %}
 {% if is_regular %}
   build_test:
     jobs:
@@ -1543,3 +1568,4 @@ workflows:
           gradleTarget: :profilingTest
           cacheType: profiling
 {% endif %}
+{% endif %}

.circleci/no_circleci_changes.sh

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+set -eu
+git diff --name-only "$1" | grep --invert-match --quiet -E '^(.gitlab-ci.yml|.gitlab)'

.circleci/render_config.py

@@ -2,6 +2,7 @@
 
 import os
 import os.path
+import subprocess
 import time
 
 import jinja2
@@ -14,9 +15,10 @@
 GENERATED_CONFIG_PATH = os.path.join(SCRIPT_DIR, OUT_FILENAME)
 
 # JDKs that will run on every pipeline.
-ALWAYS_ON_JDKS = {"8", "11", "17", "21"}
+ALWAYS_ON_JDKS = {"8", "17", "21"}
 # And these will run only in master and release/ branches.
 MASTER_ONLY_JDKS = {
+    "11",
     "ibm8",
     "oracle8",
     "semeru8",
@@ -74,6 +76,13 @@
 run_all = "all" in labels
 is_master_or_release = branch == "master" or branch.startswith("release/v")
 
+skip_circleci = False
+if pr_base_ref:
+   ret = subprocess.call([".circleci/no_circleci_changes.sh", f"{pr_base_ref}..HEAD"], shell=False)
+   if ret == 1:
+       # Only GitLab-related files have changed, just skip Circle CI jobs.
+       skip_circleci = True
+
 if is_master_or_release or run_all:
     all_jdks = ALWAYS_ON_JDKS | MASTER_ONLY_JDKS
 else:
@@ -99,10 +108,12 @@
     "all_jdks": all_jdks,
     "all_debugger_jdks": all_debugger_jdks,
     "nocov_jdks": nocov_jdks,
-    "flaky": branch == "master" or "flaky" in labels or "all" in labels,
+    "flaky": "flaky" in labels or "all" in labels,
     "docker_image_prefix": "" if is_nightly else f"{DOCKER_IMAGE_VERSION}-",
     "use_git_changes": use_git_changes,
     "pr_base_ref": pr_base_ref,
+    "skip_circleci": skip_circleci,
+    "ssi_smoke": is_regular and is_master_or_release
 }
 
 print(f"Variables for this build: {vars}")

.github/CODEOWNERS

@@ -17,24 +17,26 @@ dd-java-agent/agent-bootstrap/src/main/java11/datadog/trace/bootstrap/instrument
 dd-smoke-tests/profiling-integration-tests/                                                @DataDog/profiling-java
 
 # @DataDog/ci-app-libraries-java
-dd-java-agent/agent-ci-visibility/         @DataDog/ci-app-libraries-java
-dd-java-agent/instrumentation/cucumber/    @DataDog/ci-app-libraries-java
-dd-java-agent/instrumentation/jacoco/      @DataDog/ci-app-libraries-java
-dd-java-agent/instrumentation/junit-4.10/  @DataDog/ci-app-libraries-java
-dd-java-agent/instrumentation/junit-5.3/   @DataDog/ci-app-libraries-java
-dd-java-agent/instrumentation/karate/      @DataDog/ci-app-libraries-java
-dd-java-agent/instrumentation/scalatest/   @DataDog/ci-app-libraries-java
-dd-java-agent/instrumentation/selenium/    @DataDog/ci-app-libraries-java
-dd-java-agent/instrumentation/testng/      @DataDog/ci-app-libraries-java
-dd-java-agent/instrumentation/gradle-3.0/  @DataDog/ci-app-libraries-java
-dd-java-agent/instrumentation/gradle-8.3/  @DataDog/ci-app-libraries-java
-dd-java-agent/instrumentation/maven-3.2.1/ @DataDog/ci-app-libraries-java
-dd-java-agent/instrumentation/weaver/      @DataDog/ci-app-libraries-java
-dd-smoke-tests/gradle/                     @DataDog/ci-app-libraries-java
-dd-smoke-tests/maven/                      @DataDog/ci-app-libraries-java
-**/civisibility/                           @DataDog/ci-app-libraries-java
-**/CiVisibility*.java                      @DataDog/ci-app-libraries-java
-**/CiVisibility*.groovy                    @DataDog/ci-app-libraries-java
+dd-java-agent/agent-ci-visibility/              @DataDog/ci-app-libraries-java
+dd-java-agent/instrumentation/cucumber/         @DataDog/ci-app-libraries-java
+dd-java-agent/instrumentation/jacoco/           @DataDog/ci-app-libraries-java
+dd-java-agent/instrumentation/junit-4.10/       @DataDog/ci-app-libraries-java
+dd-java-agent/instrumentation/junit-5.3/        @DataDog/ci-app-libraries-java
+dd-java-agent/instrumentation/karate/           @DataDog/ci-app-libraries-java
+dd-java-agent/instrumentation/scalatest/        @DataDog/ci-app-libraries-java
+dd-java-agent/instrumentation/selenium/         @DataDog/ci-app-libraries-java
+dd-java-agent/instrumentation/testng/           @DataDog/ci-app-libraries-java
+dd-java-agent/instrumentation/gradle-3.0/       @DataDog/ci-app-libraries-java
+dd-java-agent/instrumentation/gradle-8.3/       @DataDog/ci-app-libraries-java
+dd-java-agent/instrumentation/gradle-testing/   @DataDog/ci-app-libraries-java
+dd-java-agent/instrumentation/maven-3.2.1/      @DataDog/ci-app-libraries-java
+dd-java-agent/instrumentation/maven-surefire/   @DataDog/ci-app-libraries-java
+dd-java-agent/instrumentation/weaver/           @DataDog/ci-app-libraries-java
+dd-smoke-tests/gradle/                          @DataDog/ci-app-libraries-java
+dd-smoke-tests/maven/                           @DataDog/ci-app-libraries-java
+**/civisibility/                                @DataDog/ci-app-libraries-java
+**/CiVisibility*.java                           @DataDog/ci-app-libraries-java
+**/CiVisibility*.groovy                         @DataDog/ci-app-libraries-java
 
 # @DataDog/debugger-java (Live Debugger)
 dd-java-agent/agent-debugger/ @DataDog/debugger-java

.github/workflows/add-release-to-cloudfoundry.yaml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout "cloudfoundry" branch
-        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # 4.1.6
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
         with:
           ref: cloudfoundry
       - name: Get release version
@@ -43,7 +43,7 @@ jobs:
         run: |
           echo "${{ steps.get-release-version.outputs.VERSION }}: ${{ steps.get-release-url.outputs.URL }}" >> index.yml
       - name: Commit and push changes
-        uses: planetscale/ghcommit-action@b68767a2e130a71926b365322e62b583404a5e09 # v0.1.43
+        uses: planetscale/ghcommit-action@9400254a26464337cbe5af17c5f25075134e0089 # v0.2.7
         with:
           commit_message: "chore: Add version ${{ steps.get-release-version.outputs.VERSION }} to Cloud Foundry"
           repo: ${{ github.repository }}

.github/workflows/analyze-changes.yaml

@@ -18,13 +18,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # 4.1.6
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
         with:
           submodules: 'recursive'
       # Run the static analysis on the staging environment to benefit from the new features not yet released
       - name: Check code meets quality standards (staging)
         id: datadog-static-analysis-staging
-        uses: DataDog/datadog-static-analyzer-github-action@c74aff158c8cc1c3e285660713bcaa5f9c6d696e # v1
+        uses: DataDog/datadog-static-analyzer-github-action@1297a546e6bb268e2ac5bc98a1477d22be335822 # v1
         with:
           dd_app_key: ${{ secrets.DATADOG_APP_KEY_STAGING }}
           dd_api_key: ${{ secrets.DATADOG_API_KEY_STAGING }}
@@ -44,12 +44,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # 4.1.6
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
         with:
           submodules: 'recursive'
 
       - name: Cache Gradle dependencies
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+        uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
         with:
           path: |
             ~/.gradle/caches
@@ -59,7 +59,7 @@ jobs:
             ${{ runner.os }}-gradle-
         
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v3.26.6
+        uses: github/codeql-action/init@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
         with:
           languages: 'java'
           build-mode: 'manual'
@@ -76,7 +76,7 @@ jobs:
             --build-cache --parallel --stacktrace --no-daemon --max-workers=4
 
       - name: Perform CodeQL Analysis and upload results to GitHub Security tab
-        uses: github/codeql-action/analyze@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v3.26.6
+        uses: github/codeql-action/analyze@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
 
       # For now, CodeQL SARIF results are not supported by Datadog CI
       # - name: Upload results to Datadog CI Static Analysis
@@ -106,12 +106,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # 4.1.6
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
         with:
           submodules: 'recursive'
 
       - name: Cache Gradle dependencies
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+        uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
         with:
           path: |
             ~/.gradle/caches
@@ -144,7 +144,7 @@ jobs:
           ls -laR "./workspace/.trivy"
 
       - name: Run Trivy security scanner
-        uses: aquasecurity/trivy-action@915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2 # v0.28.0
+        uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # v0.29.0
         with:
           scan-type: rootfs
           scan-ref: './workspace/.trivy/'
@@ -157,7 +157,7 @@ jobs:
           TRIVY_JAVA_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-java-db,public.ecr.aws/aquasecurity/trivy-java-db
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v3.26.6
+        uses: github/codeql-action/upload-sarif@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
         if: always()
         with:
           sarif_file: 'trivy-results.sarif'

.github/workflows/prune-github-container-registry.yaml

@@ -20,8 +20,6 @@ jobs:
           container: dd-trace-java/dd-lib-java-init
           keep-younger-than: 7 # days
           keep-last: 10
-          keep-tags: |
-            latest_snapshot
           prune-tags-regexes: |
-            ^[a-z0-9]{40}(-arm64|-amd64)?$
+            .+
           prune-untagged: true

.github/workflows/prune-old-pull-requests.yaml

@@ -13,7 +13,7 @@ jobs:
       pull-requests: write
     steps:
     - name: Prune old pull requests
-      uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9.0.0
+      uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
       with:
         days-before-stale: -1 # Disable general stale bot
         days-before-pr-stale: 90 # Only enable stale bot for PRs with no activity for 90 days

.github/workflows/update-docker-build-image.yaml

@@ -19,7 +19,7 @@ jobs:
       pull-requests: write # Required to create a pull request
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Download ghcommit CLI
         run: |
           curl https://github.com/planetscale/ghcommit/releases/download/v0.1.48/ghcommit_linux_amd64 -o /usr/local/bin/ghcommit -L

.github/workflows/update-gradle-dependencies.yaml

@@ -13,7 +13,7 @@ jobs:
       pull-requests: write # Required to create a pull request
     steps:
       - name: Checkout repository
-        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # 4.1.6
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
         with:
           submodules: 'recursive'
       - name: Download ghcommit CLI