Merge branch 'master' into PROF-13025

Author: rkennke

.github/workflows/add-release-to-cloudfoundry.yaml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout "cloudfoundry" branch
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # 6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # 6.0.1
         with:
           ref: cloudfoundry
       - name: Get release version

.github/workflows/analyze-changes.yaml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # 6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # 6.0.1
         with:
           submodules: 'recursive'
       - name: Cache Gradle dependencies
@@ -30,7 +30,7 @@ jobs:
             ${{ runner.os }}-gradle-
         
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6
+        uses: github/codeql-action/init@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v4.31.7
         with:
           languages: 'java'
           build-mode: 'manual'
@@ -49,7 +49,7 @@ jobs:
             --build-cache --parallel --stacktrace --no-daemon --max-workers=4
 
       - name: Perform CodeQL Analysis and upload results to GitHub Security tab
-        uses: github/codeql-action/analyze@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6
+        uses: github/codeql-action/analyze@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v4.31.7
 
   trivy:
     name: Analyze changes with Trivy
@@ -61,7 +61,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # 6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # 6.0.1
         with:
           submodules: 'recursive'
 
@@ -114,7 +114,7 @@ jobs:
           TRIVY_JAVA_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-java-db,public.ecr.aws/aquasecurity/trivy-java-db
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6
+        uses: github/codeql-action/upload-sarif@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v4.31.7
         if: always()
         with:
           sarif_file: 'trivy-results.sarif'

.github/workflows/create-release-branch.yaml

@@ -38,7 +38,7 @@ jobs:
           echo "branch=release/${TAG%.0}.x" >> "$GITHUB_OUTPUT"
 
       - name: Checkout dd-trace-java at tag
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # 6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # 6.0.1
         with:
           ref: ${{ steps.determine-tag.outputs.tag }}
 

.github/workflows/prune-old-pull-requests.yaml

@@ -13,7 +13,7 @@ jobs:
       pull-requests: write
     steps:
     - name: Prune old pull requests
-      uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10.1.0
+      uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # v10.1.1
       with:
         days-before-stale: -1 # Disable general stale bot
         days-before-pr-stale: 90 # Only enable stale bot for PRs with no activity for 90 days

.github/workflows/run-system-tests.yaml

@@ -25,7 +25,7 @@ jobs:
       name: ci-build
     steps:
       - name: Checkout repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # 6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # 6.0.1
         with:
           submodules: 'recursive'
           fetch-depth: 0

.github/workflows/update-docker-build-image.yaml

@@ -25,7 +25,7 @@ jobs:
           policy: self.update-docker-build-image.create-pr
 
       - name: Checkout the repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - name: Define the Docker build image tag to use
         id: define-tag
         run: |

.github/workflows/update-gradle-dependencies.yaml

@@ -19,7 +19,7 @@ jobs:
           policy: self.update-gradle-dependencies.create-pr
 
       - name: Checkout repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # 6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # 6.0.1
         with:
           submodules: "recursive"
       - name: Update Gradle dependencies

.github/workflows/update-jmxfetch-submodule.yaml

@@ -19,7 +19,7 @@ jobs:
           policy: self.update-jmxfetch-submodule.create-pr
 
       - name: Checkout repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # 6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # 6.0.1
 
       - name: Update Submodule
         run: |

buildSrc/src/main/kotlin/dd-trace-java.configure-tests.gradle.kts

@@ -42,6 +42,10 @@ tasks.withType<Test>().configureEach {
     !rootProject.providers.gradleProperty("rerun.tests.${project.name}").isPresent
   }
 
+  // Trick to avoid on CI: "Couldn't flush user prefs: java.util.prefs.BackingStoreException: Couldn't get file lock."
+  // Use a task-specific user prefs directory
+  systemProperty("java.util.prefs.userRoot", "$buildDir/tmp/userPrefs/${name}")
+
   // Split up tests that want to run forked in their own separate JVM for generated tasks
   if (name.startsWith("forkedTest") || name.endsWith("ForkedTest")) {
     setExcludes(emptyList())

dd-java-agent/agent-ci-visibility/civisibility-test-fixtures/src/main/groovy/datadog/trace/civisibility/CiVisibilitySmokeTest.groovy

@@ -6,9 +6,13 @@ import datadog.trace.api.config.CiVisibilityConfig
 import datadog.trace.api.config.GeneralConfig
 import datadog.trace.api.config.TraceInstrumentationConfig
 import datadog.trace.api.config.TracerConfig
+import java.nio.file.Paths
 import spock.lang.Specification
+import spock.lang.TempDir
 import spock.util.environment.Jvm
 
+import java.nio.file.Path
+
 import static datadog.trace.util.ConfigStrings.propertyNameToSystemPropertyName
 
 abstract class CiVisibilitySmokeTest extends Specification {
@@ -21,6 +25,9 @@ abstract class CiVisibilitySmokeTest extends Specification {
 
   private static final Map<String,String> DEFAULT_TRACER_CONFIG = defaultJvmArguments()
 
+  @TempDir
+  protected Path prefsDir
+
   protected static String buildJavaHome() {
     if (Jvm.current.isJava8()) {
       return System.getenv("JAVA_8_HOME")
@@ -69,6 +76,9 @@ abstract class CiVisibilitySmokeTest extends Specification {
 
   protected List<String> buildJvmArguments(String mockBackendIntakeUrl, String serviceName, Map<String, String> additionalArgs) {
     List<String> arguments = []
+
+    arguments += preventJulPrefsFileLock()
+
     Map<String, String> argMap = buildJvmArgMap(mockBackendIntakeUrl, serviceName, additionalArgs)
 
     // for convenience when debugging locally
@@ -85,6 +95,28 @@ abstract class CiVisibilitySmokeTest extends Specification {
     return arguments
   }
 
+  /**
+   * Trick to prevent jul Prefs file lock issue on forked processes, in particular in CI which
+   * runs on Linux and have competing processes trying to write to it, including the Gradle daemon.
+   *
+   * <pre><code>
+   * Couldn't flush user prefs: java.util.prefs.BackingStoreException: Couldn't get file lock.
+   * </code></pre>
+   *
+   * Note, some tests can setup arguments on spec level, so `prefsDir` will be `null` during
+   * `setupSpec()`.
+   */
+  protected String preventJulPrefsFileLock() {
+    String prefsPath = (prefsDir ?: tempUserPrefsPath()).toAbsolutePath()
+    return "-Djava.util.prefs.userRoot=$prefsPath".toString()
+  }
+
+  private static Path tempUserPrefsPath() {
+    String uniqueId = "${System.currentTimeMillis()}_${System.nanoTime()}_${Thread.currentThread().id}"
+    Path prefsPath = Paths.get(System.getProperty("java.io.tmpdir"), "gradle-test-userPrefs", uniqueId)
+    return prefsPath
+  }
+
   protected verifyEventsAndCoverages(String projectName, String toolchain, String toolchainVersion, List<Map<String, Object>> events, List<Map<String, Object>> coverages, List<String> additionalDynamicTags = []) {
     def additionalReplacements = ["content.meta.['test.toolchain']": "$toolchain:$toolchainVersion"]