Merge branch 'master' into alexeyk/debug-ci-timeout

Author: AlexeyKuznetsov-DD

.github/chainguard/self.update-docker-build-image.create-pr.sts.yaml

@@ -0,0 +1,13 @@
+issuer: https://token.actions.githubusercontent.com
+
+subject: repo:DataDog/dd-trace-java:ref:refs/heads/master
+
+claim_pattern:
+  event_name: (schedule|workflow_dispatch)
+  ref: refs/heads/master
+  ref_protected: "true"
+  job_workflow_ref: DataDog/dd-trace-java/\.github/workflows/update-docker-build-image\.yaml@refs/heads/master
+
+permissions:
+  contents: write
+  pull_requests: write

.github/chainguard/self.update-gradle-dependencies.create-pr.sts.yaml

@@ -0,0 +1,13 @@
+issuer: https://token.actions.githubusercontent.com
+
+subject: repo:DataDog/dd-trace-java:ref:refs/heads/master
+
+claim_pattern:
+  event_name: (schedule|workflow_dispatch)
+  ref: refs/heads/master
+  ref_protected: "true"
+  job_workflow_ref: DataDog/dd-trace-java/\.github/workflows/update-gradle-dependencies\.yaml@refs/heads/master
+
+permissions:
+  contents: write
+  pull_requests: write

.github/workflows/update-docker-build-image.yaml

@@ -3,21 +3,27 @@ name: Update Docker Build Image
 on:
   schedule:
     # A day after creating the tag from https://github.com/DataDog/dd-trace-java-docker-build/blob/master/.github/workflows/docker-tag.yml
-    - cron: '0 0 1 2,5,8,11 *'
+    - cron: "0 0 1 2,5,8,11 *"
   workflow_dispatch:
     inputs:
       tag:
-        description: 'The tag to use for the Docker build image'
+        description: "The tag to use for the Docker build image"
         required: true
-        default: 'vYY.MM'
-    
+        default: "vYY.MM"
+
 jobs:
   update-docker-build-image:
     runs-on: ubuntu-latest
     permissions:
-      contents: write # Required to commit and push changes to a new branch
-      pull-requests: write # Required to create a pull request
+      contents: write # Required to create and push branch
+      id-token: write # Required for OIDC token federation
     steps:
+      - uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
+        id: octo-sts
+        with:
+          scope: DataDog/dd-trace-java
+          policy: self.update-docker-build-image.create-pr
+
       - name: Checkout the repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Download ghcommit CLI
@@ -55,12 +61,12 @@ jobs:
           sed -i '' -E 's|(BUILDER_IMAGE_VERSION_PREFIX:)[^#]*([#].*)|\1 "${{ steps.define-tag.outputs.tag }}-" \2|' .gitlab-ci.yml
       - name: Commit and push changes
         env:
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+          GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }}
         run: |
           ghcommit --repository ${{ github.repository }} --branch ${{ steps.define-branch.outputs.branch }} --add .gitlab-ci.yml --message "feat(ci): Update Docker build image"
       - name: Create pull request
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
         run: |
           gh pr create --title "Update Docker build image" \
             --base master \

.github/workflows/update-gradle-dependencies.yaml

@@ -1,21 +1,27 @@
 name: Update Gradle dependencies
 on:
   schedule:
-    - cron: '0 4 * * 0'
+    - cron: "0 4 * * 0"
   workflow_dispatch:
 
 jobs:
   update-gradle-dependencies:
     runs-on: ubuntu-latest
     name: Update Gradle dependencies
     permissions:
-      contents: write # Required to commit and push changes to a new branch
-      pull-requests: write # Required to create a pull request
+      contents: write # Required to create new branch
+      id-token: write # Required for OIDC token federation
     steps:
+      - uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
+        id: octo-sts
+        with:
+          scope: DataDog/dd-trace-java
+          policy: self.update-gradle-dependencies.create-pr
+
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
         with:
-          submodules: 'recursive'
+          submodules: "recursive"
       - name: Download ghcommit CLI
         run: |
           curl https://github.com/planetscale/ghcommit/releases/download/v0.1.48/ghcommit_linux_amd64 -o /usr/local/bin/ghcommit -L
@@ -37,7 +43,7 @@ jobs:
           ./gradlew resolveAndLockAll --write-locks --parallel --stacktrace --no-daemon --max-workers=4
       - name: Commit changes
         env:
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+          GITHUB_TOKEN: ${{ steps.octo-sts.outputs.token }}
         run: |
           GH_ADD_ARGS=""
           COUNT=0
@@ -69,7 +75,7 @@ jobs:
           fi
       - name: Create pull request
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
         run: |
           # use echo to set a multiline body for the PR
           echo -e "This PR updates the Gradle dependencies. ⚠️ Don't forget to squash commits before merging. ⚠️\n\n- [ ] Update PR title if a code change is needed to support one of those new dependencies" | \

communication/src/main/java/datadog/communication/http/OkHttpUtils.java

@@ -7,6 +7,7 @@
 import datadog.common.container.ContainerInfo;
 import datadog.common.socket.NamedPipeSocketFactory;
 import datadog.common.socket.UnixDomainSocketFactory;
+import datadog.environment.SystemProperties;
 import datadog.trace.api.Config;
 import datadog.trace.util.AgentProxySelector;
 import java.io.File;
@@ -49,9 +50,12 @@ public final class OkHttpUtils {
 
   private static final String DD_API_KEY = "DD-API-KEY";
 
-  private static final String JAVA_VERSION = System.getProperty("java.version", "unknown");
-  private static final String JAVA_VM_NAME = System.getProperty("java.vm.name", "unknown");
-  private static final String JAVA_VM_VENDOR = System.getProperty("java.vm.vendor", "unknown");
+  private static final String JAVA_VERSION =
+      SystemProperties.getOrDefault("java.version", "unknown");
+  private static final String JAVA_VM_NAME =
+      SystemProperties.getOrDefault("java.vm.name", "unknown");
+  private static final String JAVA_VM_VENDOR =
+      SystemProperties.getOrDefault("java.vm.vendor", "unknown");
 
   public static OkHttpClient buildHttpClient(final HttpUrl url, final long timeoutMillis) {
     return buildHttpClient(url, null, null, timeoutMillis);

dd-java-agent/agent-ci-visibility/src/main/java/datadog/trace/civisibility/CiVisibilityServices.java

@@ -144,17 +144,17 @@ private static GitClient.Factory buildGitClientFactory(
 
   @Nonnull
   private static CiEnvironment buildCiEnvironment(Config config, SharedCommunicationObjects sco) {
+    CiEnvironment localEnvironment = CiEnvironmentImpl.local();
     String remoteEnvVarsProviderUrl = config.getCiVisibilityRemoteEnvVarsProviderUrl();
     if (remoteEnvVarsProviderUrl != null) {
       String remoteEnvVarsProviderKey = config.getCiVisibilityRemoteEnvVarsProviderKey();
       CiEnvironment remoteEnvironment =
           new CiEnvironmentImpl(
               getRemoteEnvironment(
                   remoteEnvVarsProviderUrl, remoteEnvVarsProviderKey, sco.okHttpClient));
-      CiEnvironment localEnvironment = new CiEnvironmentImpl(System.getenv());
       return new CompositeCiEnvironment(remoteEnvironment, localEnvironment);
     } else {
-      return new CiEnvironmentImpl(System.getenv());
+      return localEnvironment;
     }
   }
 

dd-java-agent/agent-ci-visibility/src/main/java/datadog/trace/civisibility/ProcessHierarchy.java

@@ -1,11 +1,13 @@
 package datadog.trace.civisibility;
 
+import static datadog.trace.api.config.CiVisibilityConfig.CIVISIBILITY_SIGNAL_SERVER_HOST;
+import static datadog.trace.api.config.CiVisibilityConfig.CIVISIBILITY_SIGNAL_SERVER_PORT;
 import static datadog.trace.bootstrap.instrumentation.api.AgentPropagation.extractContextAndGetSpanContext;
+import static datadog.trace.util.Strings.propertyNameToSystemPropertyName;
 
-import datadog.trace.api.config.CiVisibilityConfig;
+import datadog.environment.SystemProperties;
 import datadog.trace.bootstrap.instrumentation.api.AgentPropagation;
 import datadog.trace.bootstrap.instrumentation.api.AgentSpanContext;
-import datadog.trace.util.Strings;
 import java.net.InetSocketAddress;
 import java.util.Properties;
 import javax.annotation.Nullable;
@@ -69,8 +71,8 @@ private boolean isWrapper() {
   }
 
   private boolean isMavenParent() {
-    return System.getProperty("maven.home") != null
-            && System.getProperty("classworlds.conf") != null
+    return SystemProperties.get("maven.home") != null
+            && SystemProperties.get("classworlds.conf") != null
         // when using Maven Wrapper
         || ClassLoader.getSystemClassLoader()
                 .getResource("org/apache/maven/wrapper/WrapperExecutor.class")
@@ -82,7 +84,7 @@ private boolean isGradleDaemon() {
                 .getResource("org/gradle/launcher/daemon/bootstrap/GradleDaemon.class")
             != null
         // double-check this is not a Gradle Worker
-        && System.getProperties().getProperty("org.gradle.internal.worker.tmpdir") == null;
+        && SystemProperties.get("org.gradle.internal.worker.tmpdir") == null;
   }
 
   private boolean isGradleLauncher() {
@@ -93,16 +95,12 @@ private boolean isGradleLauncher() {
 
   @Nullable
   public InetSocketAddress getSignalServerAddress() {
-    // System.getProperty is used rather than Config,
+    // System properties are used rather than Config,
     // because system variables can be set after config was initialized
     String host =
-        System.getProperty(
-            Strings.propertyNameToSystemPropertyName(
-                CiVisibilityConfig.CIVISIBILITY_SIGNAL_SERVER_HOST));
+        SystemProperties.get(propertyNameToSystemPropertyName(CIVISIBILITY_SIGNAL_SERVER_HOST));
     String port =
-        System.getProperty(
-            Strings.propertyNameToSystemPropertyName(
-                CiVisibilityConfig.CIVISIBILITY_SIGNAL_SERVER_PORT));
+        SystemProperties.get(propertyNameToSystemPropertyName(CIVISIBILITY_SIGNAL_SERVER_PORT));
     if (host != null && port != null) {
       return new InetSocketAddress(host, Integer.parseInt(port));
     } else {

dd-java-agent/agent-ci-visibility/src/main/java/datadog/trace/civisibility/ci/env/CiEnvironmentImpl.java

@@ -1,5 +1,6 @@
 package datadog.trace.civisibility.ci.env;
 
+import java.util.Collections;
 import java.util.Map;
 
 public class CiEnvironmentImpl implements CiEnvironment {
@@ -10,6 +11,16 @@ public CiEnvironmentImpl(Map<String, String> env) {
     this.env = env;
   }
 
+  public static CiEnvironment local() {
+    Map<String, String> env;
+    try {
+      env = System.getenv();
+    } catch (SecurityException e) {
+      env = Collections.emptyMap();
+    }
+    return new CiEnvironmentImpl(env);
+  }
+
   @Override
   public String get(String name) {
     return env.get(name);

dd-java-agent/agent-ci-visibility/src/main/java/datadog/trace/civisibility/domain/buildsystem/BuildSystemModuleImpl.java

@@ -138,15 +138,18 @@ private Map<String, String> getPropertiesPropagatedToChildProcess(
       ExecutionSettings executionSettings,
       BuildSessionSettings sessionSettings) {
     Map<String, String> propagatedSystemProperties = new HashMap<>();
-    Properties systemProperties = System.getProperties();
-    for (Map.Entry<Object, Object> e : systemProperties.entrySet()) {
-      String propertyName = (String) e.getKey();
-      Object propertyValue = e.getValue();
-      if ((propertyName.startsWith(Config.PREFIX)
-              || propertyName.startsWith("datadog.slf4j.simpleLogger.defaultLogLevel"))
-          && propertyValue != null) {
-        propagatedSystemProperties.put(propertyName, propertyValue.toString());
+    try {
+      Properties systemProperties = System.getProperties();
+      for (Map.Entry<Object, Object> e : systemProperties.entrySet()) {
+        String propertyName = (String) e.getKey();
+        Object propertyValue = e.getValue();
+        if ((propertyName.startsWith(Config.PREFIX)
+                || propertyName.startsWith("datadog.slf4j.simpleLogger.defaultLogLevel"))
+            && propertyValue != null) {
+          propagatedSystemProperties.put(propertyName, propertyValue.toString());
+        }
       }
+    } catch (SecurityException ignored) {
     }
 
     propagatedSystemProperties.put(

dd-java-agent/agent-ci-visibility/src/main/java/datadog/trace/civisibility/utils/FileUtils.java

@@ -1,5 +1,6 @@
 package datadog.trace.civisibility.utils;
 
+import datadog.environment.SystemProperties;
 import de.thetaphi.forbiddenapis.SuppressForbidden;
 import java.io.IOException;
 import java.nio.file.FileVisitResult;
@@ -77,7 +78,7 @@ public static String expandTilde(final String path) {
       return path;
     }
 
-    return path.replaceFirst("^~", System.getProperty("user.home"));
+    return path.replaceFirst("^~", SystemProperties.getOrDefault("user.home", ""));
   }
 
   public static String toRealPath(String path) {