Merge branch 'main' of github.com:open-telemetry/opentelemetry-java-instrumentation into openai-embeddings

Author: anuraaga

.github/workflows/codeql.yml

@@ -63,7 +63,7 @@ jobs:
           cache-read-only: ${{ github.event_name == 'pull_request' }}
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
+        uses: github/codeql-action/init@4e828ff8d448a8a6e532957b1811f387a63867e8 # v3.29.4
         with:
           languages: ${{ matrix.language }}
           # using "latest" helps to keep up with the latest Kotlin support
@@ -79,6 +79,6 @@ jobs:
         run: ./gradlew assemble -x javadoc -x :instrumentation:quarkus-resteasy-reactive:quarkus3-testing:quarkusGenerateCodeDev -x :instrumentation:quarkus-resteasy-reactive:quarkus2-testing:quarkusGenerateCodeDev --no-build-cache --no-daemon
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
+        uses: github/codeql-action/analyze@4e828ff8d448a8a6e532957b1811f387a63867e8 # v3.29.4
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/documentation-disable-list-audit.yml

@@ -0,0 +1,40 @@
+name: opentelemetry.io documentation disable list audit
+
+on:
+  schedule:
+    - cron: "30 1 * * *" # daily at 1:30 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  crawl:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        with:
+          distribution: temurin
+          java-version: 17
+
+      - name: Set up gradle
+        uses: gradle/actions/setup-gradle@06832c7b30a0129d7fb559bcc6e43d26f6374244 # v4.3.1
+
+      - name: Run instrumentation analyzer (identify any module changes)
+        run: ./gradlew :instrumentation-docs:runAnalysis
+
+      - name: Run doc site audit
+        run: ./gradlew :instrumentation-docs:docSiteAudit
+
+  workflow-notification:
+    permissions:
+      contents: read
+      issues: write
+    needs:
+      - crawl
+    if: always()
+    uses: ./.github/workflows/reusable-workflow-notification.yml
+    with:
+      success: ${{ needs.crawl.result == 'success' }}

.github/workflows/ossf-scorecard.yml

@@ -42,6 +42,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
+        uses: github/codeql-action/upload-sarif@4e828ff8d448a8a6e532957b1811f387a63867e8 # v3.29.4
         with:
           sarif_file: results.sarif

.github/workflows/reusable-native-tests.yml

@@ -27,7 +27,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - id: read-java
         run: echo "version=$(cat .java-version)" >> "$GITHUB_OUTPUT"
-      - uses: graalvm/setup-graalvm@e1df20a713a4cc6ab5b0eb03f0e0dcdc0199b805 # v1.3.4.1
+      - uses: graalvm/setup-graalvm@7f488cf82a3629ee755e4e97342c01d6bed318fa # v1.3.5.1
         with:
           version: "latest"
           java-version: ${{ matrix.test-java-version }}

custom-checks/src/main/java/com/google/errorprone/bugpatterns/checkreturnvalue/CanIgnoreReturnValueSuggesterFactory.java

@@ -6,13 +6,14 @@
 package com.google.errorprone.bugpatterns.checkreturnvalue;
 
 import com.google.errorprone.ErrorProneFlags;
+import com.google.errorprone.bugpatterns.WellKnownKeep;
 
 public final class CanIgnoreReturnValueSuggesterFactory {
 
   // calls package private constructor of CanIgnoreReturnValueSuggester
   public static CanIgnoreReturnValueSuggester createCanIgnoreReturnValueSuggester(
-      ErrorProneFlags errorProneFlags) {
-    return new CanIgnoreReturnValueSuggester(errorProneFlags);
+      ErrorProneFlags errorProneFlags, WellKnownKeep wellKnownKeep) {
+    return new CanIgnoreReturnValueSuggester(errorProneFlags, wellKnownKeep);
   }
 
   private CanIgnoreReturnValueSuggesterFactory() {}

custom-checks/src/main/java/io/opentelemetry/javaagent/customchecks/OtelCanIgnoreReturnValueSuggester.java

@@ -12,6 +12,7 @@
 import com.google.errorprone.ErrorProneFlags;
 import com.google.errorprone.VisitorState;
 import com.google.errorprone.bugpatterns.BugChecker;
+import com.google.errorprone.bugpatterns.WellKnownKeep;
 import com.google.errorprone.bugpatterns.checkreturnvalue.CanIgnoreReturnValueSuggester;
 import com.google.errorprone.bugpatterns.checkreturnvalue.CanIgnoreReturnValueSuggesterFactory;
 import com.google.errorprone.matchers.Description;
@@ -33,9 +34,10 @@ public class OtelCanIgnoreReturnValueSuggester extends BugChecker
   private final CanIgnoreReturnValueSuggester delegate;
 
   @Inject
-  OtelCanIgnoreReturnValueSuggester(ErrorProneFlags errorProneFlags) {
+  OtelCanIgnoreReturnValueSuggester(ErrorProneFlags errorProneFlags, WellKnownKeep wellKnownKeep) {
     delegate =
-        CanIgnoreReturnValueSuggesterFactory.createCanIgnoreReturnValueSuggester(errorProneFlags);
+        CanIgnoreReturnValueSuggesterFactory.createCanIgnoreReturnValueSuggester(
+            errorProneFlags, wellKnownKeep);
   }
 
   public OtelCanIgnoreReturnValueSuggester() {

dependencyManagement/build.gradle.kts

@@ -38,7 +38,7 @@ val DEPENDENCY_BOMS = listOf(
 
 val autoServiceVersion = "1.1.1"
 val autoValueVersion = "1.11.0"
-val errorProneVersion = "2.40.0"
+val errorProneVersion = "2.41.0"
 val byteBuddyVersion = "1.17.6"
 val asmVersion = "9.8"
 val jmhVersion = "1.37"

docs/advanced-configuration-options.md

@@ -39,19 +39,19 @@ this option if your application relies on security manager to run untrusted code
 
 ## JavaScript snippet injection
 
-This experimental feature allows you to inject JavaScript code into HTML responses from servlet applications. The agent will look for the `</head>` tag in HTML responses, and inject the configured JavaScript snippet before the closing `</head>` tag.
+This experimental feature allows you to inject JavaScript code into HTML responses from servlet applications. The agent will look for the `<head>` tag in HTML responses, and inject the configured JavaScript snippet after it.
 
 This feature is designed for integrating client-side monitoring.
 We plan to integrate OpenTelemetry's own client-side monitoring solution by default once it's available
 (see the [browser instrumentation proposal](https://github.com/open-telemetry/community/blob/main/projects/browser-phase-1.md)).
 
-| System property                      | Environment variable                 | Purpose                                                                                                                                                                                                                                                              |
-|--------------------------------------|--------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| otel.experimental.javascript-snippet | OTEL_EXPERIMENTAL_JAVASCRIPT_SNIPPET | JavaScript code to inject into HTML responses before the closing `</head>` tag. The value should be a complete JavaScript snippet including `<script>` tags if needed, e.g. `-Dotel.experimental.javascript-snippet="<script>console.log('Hello world!');</script>"` |
+| System property                      | Environment variable                 | Purpose                                                                                                                                                                                                                                                                                      |
+|--------------------------------------|--------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| otel.experimental.javascript-snippet | OTEL_EXPERIMENTAL_JAVASCRIPT_SNIPPET | Experimental setting to inject a JavaScript snippet into HTML responses after the opening `<head>` tag. The value should be a complete JavaScript snippet including `<script>` tags if needed, e.g. `-Dotel.experimental.javascript-snippet="<script>console.log('Hello world!');</script>"` |
 
 **Important notes:**
 
 - This only works with servlet-based applications currently
-- The snippet is injected only into HTML responses that contain a `</head>` tag
+- The snippet is injected only into HTML responses that contain a `<head>` tag
 - The agent will attempt to preserve the original character encoding of the response
 - If the response already has a `Content-Length` header, it will be updated to reflect the additional content