Merge branch 'main' of github.com:open-telemetry/opentelemetry-js into config-yml

Author: maryliag

.github/workflows/create-or-update-release-pr.yml

@@ -25,8 +25,16 @@ jobs:
   create-or-update-release-pr:
     runs-on: ubuntu-latest
     steps:
+      - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+        id: otelbot-token
+        with:
+          app-id: ${{ vars.OTELBOT_JS_APP_ID }}
+          private-key: ${{ secrets.OTELBOT_JS_PRIVATE_KEY }}
+
       - name: Checkout
         uses: actions/checkout@v5
+        with:
+          token: ${{ steps.otelbot-token.outputs.token }}
 
       - uses: actions/setup-node@v5
         with:
@@ -37,12 +45,6 @@ jobs:
 
       - run: npm ci
 
-      - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
-        id: otelbot-token
-        with:
-          app-id: ${{ vars.OTELBOT_JS_APP_ID }}
-          private-key: ${{ secrets.OTELBOT_JS_PRIVATE_KEY }}
-
       - name: Create/Update Release PR
         run: |
           git config user.name otelbot

.github/workflows/publish-to-npm.yml

@@ -7,33 +7,50 @@ permissions:
   contents: read
 
 jobs:
-  release-to-npm:
+  setup-and-compile:
     runs-on: ubuntu-latest
-    permissions:
-      # needed for NPM provenance
-      id-token: write
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v5
         with:
           fetch-depth: 0
-
       - name: Setup Node
         uses: actions/setup-node@v5
         with:
-          node-version: 18
+          node-version: 24
           registry-url: 'https://registry.npmjs.org'
-
       - run: npm ci
-
       # NOTE: in the past, we've had situations where the compiled files were missing as the `prepublishOnly` script was
       # missing in some packages. `npx lerna publish` *should* also run compile, but this is intended as a safeguard
       # when that does not happen for whatever reason.
       - run: npm run compile
-
+      - name: Upload contents for publish
+        uses: actions/upload-artifact@v4
+        with:
+          name: publish-cache-${{ github.run_number }}
+          path: .
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 10
+  npm-publish:
+    needs: setup-and-compile
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # to generate npm OIDC and provenance statements
+    environment: npm-publish-environment
+    steps:
+      - name: Setup Node
+        uses: actions/setup-node@v5
+        with:
+          node-version: 24
+          registry-url: 'https://registry.npmjs.org'
+      - name: Download contents for publish
+        uses: actions/download-artifact@v4
+        with:
+          name: publish-cache-${{ github.run_number }}
       - name: Publish to npm
         env:
-          NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
           NPM_CONFIG_PROVENANCE: true
         # NOTE: using --concurrency 1 to reduce the likelihood of a race when publishing,
         # which happens when the npm registry is not fully consistent yet. This can cause the publishing of a package to be

experimental/packages/opentelemetry-instrumentation-http/package.json

@@ -58,7 +58,7 @@
     "@types/request-promise-native": "1.0.21",
     "@types/sinon": "17.0.4",
     "@types/superagent": "8.1.9",
-    "axios": "1.8.4",
+    "axios": "1.12.0",
     "lerna": "6.6.2",
     "mocha": "11.7.2",
     "nock": "13.5.6",

integration-tests/propagation-validation-server/package.json

@@ -15,7 +15,7 @@
     "@opentelemetry/context-async-hooks": "2.1.0",
     "@opentelemetry/core": "2.1.0",
     "@opentelemetry/sdk-trace-base": "2.1.0",
-    "axios": "1.8.4",
+    "axios": "1.12.0",
     "body-parser": "2.2.0",
     "express": "5.1.0"
   },