Merge branch 'open-telemetry:main' into gradle_task_for_weaver_command

Author: mcmho

.github/CODEOWNERS

@@ -1,10 +1,6 @@
 #
 # Learn about membership in OpenTelemetry community:
-# https://github.com/open-telemetry/community/blob/main/guides/contributor/membership.md
-#
-#
-# Learn about CODEOWNERS file format:
-#  https://help.github.com/en/articles/about-code-owners
+#  https://github.com/open-telemetry/community/blob/main/guides/contributor/membership.md
 #
 
 * @open-telemetry/java-contrib-approvers

.github/component_owners.yml

@@ -25,6 +25,11 @@ components:
   baggage-processor:
     - mikegoldsmith
     - zeitlinger
+  cel-sampler:
+    - dol
+    - trask
+    - jack-berg
+    - breedx-splk
   cloudfoundry-resources:
     - KarstenSchnitter
   compressors:

.github/config/lychee.toml

@@ -1,3 +1,6 @@
+# Lychee configuration file
+# See https://lychee.cli.rs/config/
+
 timeout = 30
 retry_wait_time = 5
 max_retries = 6

.github/renovate.json5

@@ -81,6 +81,16 @@
       ],
       enabled: false,
     },
+    {
+      // caffeine 3+ requires Java 11+
+      matchPackageNames: [
+        'com.github.ben-manes.caffeine:caffeine',
+      ],
+      matchUpdateTypes: [
+        'major',
+      ],
+      enabled: false,
+    },
     {
       // junit-pioneer 2+ requires Java 11+
       matchPackageNames: [

.github/repository-settings.md

@@ -15,3 +15,28 @@ private admin repo.
   - Maximum pull requests to merge: 5
   - Only merge non-failing pull requests: CHECKED
   - Status check timeout: 60 minutes
+
+## Secrets and variables > Actions
+
+### Repository secrets
+
+- `GPG_PASSWORD` - stored in OpenTelemetry-Java 1Password
+- `GPG_PRIVATE_KEY` - stored in OpenTelemetry-Java 1Password
+- `NVD_API_KEY` - stored in OpenTelemetry-Java 1Password
+  - Generated at https://nvd.nist.gov/developers/request-an-api-key
+  - Key is associated with [@trask](https://github.com/trask)'s gmail address
+- `SONATYPE_KEY` - owned by [@trask](https://github.com/trask)
+- `SONATYPE_USER` - owned by [@trask](https://github.com/trask)
+
+### Organization secrets
+
+- `CODECOV_TOKEN`
+- `DEVELOCITY_ACCESS_KEY` (scoped only to Java repos)
+- `FOSSA_API_KEY`
+- `OTELBOT_JAVA_CONTRIB_PRIVATE_KEY` (scoped only to this repo)
+- `OTELBOT_PRIVATE_KEY`
+
+### Organization variables
+
+- `OSSF_SCORECARD_APP_ID`
+- `OTELBOT_APP_ID`

.github/scripts/draft-change-log-entries.sh

@@ -29,6 +29,7 @@ component_names["aws-xray/"]="AWS X-Ray SDK support"
 component_names["aws-xray-propagator/"]="AWS X-Ray propagator"
 component_names["azure-resources/"]="Azure resources"
 component_names["baggage-processor/"]="Baggage processor"
+component_names["cel-sampler/"]="Common Expression Language sampler"
 component_names["cloudfoundry-resources/"]="CloudFoundry resources"
 component_names["compressors/"]="Compressors"
 component_names["consistent-sampling/"]="Consistent sampling"

.github/workflows/auto-spotless-apply.yml

@@ -17,7 +17,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Download patch
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
           run-id: ${{ github.event.workflow_run.id }}
           path: ${{ runner.temp }}

.github/workflows/auto-spotless-check.yml

@@ -22,7 +22,7 @@ jobs:
         uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
           distribution: temurin
-          java-version: 17
+          java-version: 21
 
       - name: Set up gradle
         uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
@@ -36,6 +36,8 @@ jobs:
 
       - name: Spotless
         run: ./gradlew spotlessApply
+        env:
+          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - id: create-patch
         name: Create patch file
@@ -47,7 +49,7 @@ jobs:
 
       - name: Upload patch file
         if: steps.create-patch.outputs.exists == 'true'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           path: patch
           name: patch

.github/workflows/build-common.yml

@@ -27,7 +27,7 @@ jobs:
         uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
           distribution: temurin
-          java-version: 17
+          java-version: 21
 
       - name: Set up Gradle
         uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
@@ -36,6 +36,8 @@ jobs:
 
       - name: Spotless
         run: ./gradlew spotlessCheck ${{ inputs.no-build-cache && '--no-build-cache' || '' }}
+        env:
+          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
   build:
     runs-on: ubuntu-latest
@@ -46,7 +48,7 @@ jobs:
         uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
           distribution: temurin
-          java-version: 17
+          java-version: 21
 
       - name: Set up Gradle
         uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
@@ -55,6 +57,8 @@ jobs:
 
       - name: Build
         run: ./gradlew build -x spotlessCheck -x test ${{ inputs.no-build-cache && '--no-build-cache' || '' }}
+        env:
+          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Check for jApiCmp diffs
         # The jApiCmp diff compares current to latest, which isn't appropriate for release branches
@@ -102,7 +106,7 @@ jobs:
         uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
           distribution: temurin
-          java-version: 17
+          java-version: 21
 
       - name: Set up Gradle
         uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
@@ -117,6 +121,8 @@ jobs:
           "-Porg.gradle.java.installations.auto-download=false"
           "-PmaxTestRetries=${{ inputs.max-test-retries }}"
           ${{ inputs.no-build-cache && '--no-build-cache' || '' }}
+        env:
+          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Build scan
         if: ${{ !cancelled() && hashFiles('build-scan.txt') != '' }}

.github/workflows/build-daily.yml

@@ -14,6 +14,8 @@ jobs:
     uses: ./.github/workflows/build-common.yml
     with:
       no-build-cache: true
+    secrets:
+      DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
   link-check:
     uses: ./.github/workflows/reusable-link-check.yml