Skip to content

Commit 396f02e

Browse files
jack-bergjack-berg
committed
Merge branch 'main' of https://github.com/open-telemetry/opentelemetry-java into declarative-config-0.4
2 parents 611299e + d511a28 commit 396f02e

File tree

212 files changed

+2704
-1139
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

212 files changed

+2704
-1139
lines changed

‎.clomonitor.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
11
exemptions:
22
- check: artifacthub_badge
33
reason: "Artifact Hub doesn't support Java packages"
4+
- check: signed_releases
5+
reason: "Maven central releases are signed and there are no GitHub release artifacts"

‎.github/renovate.json5‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,13 @@
77
],
88
"packageRules": [
99
{
10-
// this is to reduce the number of renovate PRs by consolidating them into a weekly batch
11-
"matchManagers": ["github-actions"],
10+
// this is to reduce the number of renovate PRs
11+
"matchManagers": [
12+
"github-actions",
13+
"dockerfile"
14+
],
1215
"extends": ["schedule:weekly"],
13-
"groupName": "github actions",
16+
"groupName": "weekly update"
1417
},
1518
{
1619
"matchPackageNames": [

‎.github/repository-settings.md‎

Lines changed: 82 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -5,71 +5,101 @@ Repository settings in addition to what's documented already at
55

66
## General > Pull Requests
77

8-
* Allow squash merging > Default to pull request title
8+
- Allow squash merging > Default to pull request title
9+
10+
- Allow auto-merge
911

1012
## Actions > General
1113

12-
* Fork pull request workflows from outside collaborators:
14+
- Fork pull request workflows from outside collaborators:
1315
"Require approval for first-time contributors who are new to GitHub"
1416

1517
(To reduce friction for new contributors,
1618
as the default is "Require approval for first-time contributors")
1719

18-
## Branch protections
19-
20-
The order of branch protection rules
21-
[can be important](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule#about-branch-protection-rules).
22-
The branch protection rules below should be added before the `**/**` branch protection rule
23-
(this may require deleting the `**/**` rule and recreating it at the end).
24-
25-
### `main`
26-
27-
* Require branches to be up to date before merging: UNCHECKED
28-
29-
(PR jobs take too long, and leaving this unchecked has not been a significant problem)
30-
31-
* Status checks that are required:
32-
33-
* EasyCLA
34-
* required-status-check
35-
36-
### `release/*`
37-
38-
Same settings as above for `main`, except:
20+
- Workflow permissions
21+
- Default permissions granted to the `GITHUB_TOKEN` when running workflows in this repository:
22+
Read repository contents and packages permissions
23+
- Allow GitHub Actions to create and approve pull requests: UNCHECKED
24+
25+
## Rules > Rulesets
26+
27+
### `main` and release branches
28+
29+
- Targeted branches:
30+
- `main`
31+
- `release/*`
32+
- Branch rules
33+
- Restrict deletions: CHECKED
34+
- Require linear history: CHECKED
35+
- Require a pull request before merging: CHECKED
36+
- Required approvals: 1
37+
- Require review from Code Owners: CHECKED
38+
- Allowed merge methods: Squash
39+
- Require status checks to pass
40+
- Do not require status checks on creation: CHECKED
41+
- Status checks that are required
42+
- EasyCLA
43+
- `required-status-check`
44+
- `gradle-wrapper-validation`
45+
- Block force pushes: CHECKED
46+
- Require code scanning results: CHECKED
47+
- CodeQL
48+
- Security alerts: High or higher
49+
- Alerts: Errors
50+
51+
### `benchmarks` branch
52+
53+
- Targeted branches:
54+
- `benchmarks`
55+
- Branch rules
56+
- Restrict deletions: CHECKED
57+
- Require linear history: CHECKED
58+
- Block force pushes: CHECKED
59+
60+
### Old-style release branches
61+
62+
- Targeted branches:
63+
- `v0.*`
64+
- `v1.*`
65+
- Branch rules
66+
- Restrict creations: CHECKED
67+
- Restrict updates: CHECKED
68+
- Restrict deletions: CHECKED
69+
70+
### Restrict branch creation
71+
72+
- Targeted branches
73+
- Exclude:
74+
- `release/*`
75+
- `renovate/**/*`
76+
- `otelbot/**/*`
77+
- `revert-*/**/*` (these are created when using the GitHub UI to revert a PR)
78+
- Restrict creations: CHECKED
79+
80+
### Restrict updating tags
81+
82+
- Targeted tags
83+
- All tags
84+
- Restrict updates: CHECKED
85+
- Restrict deletions: CHECKED
3986

40-
* Restrict pushes that create matching branches: UNCHECKED
41-
42-
(So that opentelemetrybot can create release branches)
43-
44-
### `renovate/**/**`, and `opentelemetrybot/*`
45-
46-
* Require status checks to pass before merging: UNCHECKED
47-
48-
(So that renovate PRs can be rebased)
49-
50-
* Restrict who can push to matching branches: UNCHECKED
51-
52-
(So that bots can create PR branches in this repository)
53-
54-
* Allow force pushes > Everyone
55-
56-
(So that renovate PRs can be rebased)
57-
58-
* Allow deletions: CHECKED
87+
## Branch protections
5988

60-
(So that bot PR branches can be deleted)
89+
### `main`, `release/*`
6190

62-
### `benchmarks`
91+
- Restrict who can push to matching branches: CHECKED
6392

64-
- Everything UNCHECKED
93+
## Code security and analysis
6594

66-
(This branch is currently only used for directly pushing benchmarking results from the
67-
[overhead benchmark](https://github.com/open-telemetry/opentelemetry-java/actions/workflows/benchmark.yml)
68-
job)
95+
- Secret scanning: Enabled
6996

7097
## Secrets and variables > Actions
7198

72-
* `GPG_PASSWORD` - stored in OpenTelemetry-Java 1Password
73-
* `GPG_PRIVATE_KEY` - stored in OpenTelemetry-Java 1Password
74-
* `SONATYPE_KEY` - owned by [@jack-berg](https://github.com/jack-berg)
75-
* `SONATYPE_USER` - owned by [@jack-berg](https://github.com/jack-berg)
99+
- `GPG_PASSWORD` - stored in OpenTelemetry-Java 1Password
100+
- `GPG_PRIVATE_KEY` - stored in OpenTelemetry-Java 1Password
101+
- `NVD_API_KEY` - stored in OpenTelemetry-Java 1Password
102+
- Generated at https://nvd.nist.gov/developers/request-an-api-key
103+
- Key is associated with [@trask](https://github.com/trask)'s gmail address
104+
- `SONATYPE_KEY` - owned by [@jack-berg](https://github.com/jack-berg)
105+
- `SONATYPE_USER` - owned by [@jack-berg](https://github.com/jack-berg)

‎.github/workflows/build-tracecontext-testsuite.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ jobs:
2929
password: ${{ secrets.GITHUB_TOKEN }}
3030

3131
- name: Build and push
32-
uses: docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991 # v6.13.0
32+
uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
3333
with:
3434
context: integration-tests/tracecontext/docker
3535
push: true

‎.github/workflows/build.yml‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ jobs:
3535
- 23
3636
# Collect coverage on latest LTS
3737
include:
38-
- os: ubuntu-20.04
38+
- os: ubuntu-latest
3939
test-java-version: 21
4040
coverage: true
4141
jmh-based-tests: true
@@ -99,12 +99,12 @@ jobs:
9999
exit 1
100100
fi
101101
102-
- uses: codecov/codecov-action@13ce06bfc6bbe3ecf90edbbf1bc32fe5978ca1d3 # v5.3.1
102+
- uses: codecov/codecov-action@0565863a31f2c772f9f0395002a31e3f06189574 # v5.4.0
103103
if: ${{ matrix.coverage }}
104104
env:
105105
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
106106

107-
- uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
107+
- uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
108108
if: ${{ matrix.coverage }}
109109
with:
110110
name: coverage-report
@@ -161,13 +161,19 @@ jobs:
161161
GPG_PASSWORD: ${{ secrets.GPG_PASSWORD }}
162162

163163
build-graal:
164+
name: Build GraalVM
164165
runs-on: ubuntu-latest
166+
strategy:
167+
fail-fast: false
168+
matrix:
169+
test-graal-version:
170+
- 21
171+
- 23
165172
steps:
166173
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
167-
- uses: graalvm/setup-graalvm@aafbedb8d382ed0ca6167d3a051415f20c859274 # v1.2.8
174+
- uses: graalvm/setup-graalvm@01ed653ac833fe80569f1ef9f25585ba2811baab # v1.3.3
168175
with:
169-
# TODO(jack-berg): Which versions do we need to test? Should we use a matrix scheme?
170-
java-version: '21'
176+
java-version: ${{ matrix.test-graal-version }}
171177
distribution: 'graalvm'
172178
components: 'native-image'
173179
github-token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/codeql.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ jobs:
3737
uses: gradle/actions/setup-gradle@94baf225fe0a508e581a564467443d0e2379123b # v4.3.0
3838

3939
- name: Initialize CodeQL
40-
uses: github/codeql-action/init@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
40+
uses: github/codeql-action/init@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
4141
with:
4242
languages: java, actions
4343
# using "latest" helps to keep up with the latest Kotlin support
@@ -51,4 +51,4 @@ jobs:
5151
run: ./gradlew assemble --no-build-cache --no-daemon
5252

5353
- name: Perform CodeQL analysis
54-
uses: github/codeql-action/analyze@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
54+
uses: github/codeql-action/analyze@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11

‎.github/workflows/fossa.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,3 +17,4 @@ jobs:
1717
- uses: fossas/fossa-action@93a52ecf7c3ac7eb40f5de77fd69b1a19524de94 # v1.5.0
1818
with:
1919
api-key: ${{secrets.FOSSA_API_KEY}}
20+
team: OpenTelemetry

‎.github/workflows/ossf-scorecard.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ jobs:
2323
with:
2424
persist-credentials: false
2525

26-
- uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
26+
- uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
2727
with:
2828
results_file: results.sarif
2929
results_format: sarif
@@ -33,7 +33,7 @@ jobs:
3333
# uploads of run results in SARIF format to the repository Actions tab.
3434
# https://docs.github.com/en/actions/advanced-guides/storing-workflow-data-as-artifacts
3535
- name: "Upload artifact"
36-
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
36+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
3737
with:
3838
name: SARIF file
3939
path: results.sarif
@@ -42,6 +42,6 @@ jobs:
4242
# Upload the results to GitHub's code scanning dashboard (optional).
4343
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
4444
- name: "Upload to code-scanning"
45-
uses: github/codeql-action/upload-sarif@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
45+
uses: github/codeql-action/upload-sarif@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
4646
with:
4747
sarif_file: results.sarif

‎.github/workflows/owasp-dependency-check-daily.yml‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,22 @@ jobs:
2626

2727
- name: Check dependencies
2828
run: ./gradlew dependencyCheckAnalyze
29+
env:
30+
NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
2931

3032
- name: Upload report
3133
if: always()
32-
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
34+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
3335
with:
3436
path: javaagent/build/reports
37+
38+
workflow-notification:
39+
permissions:
40+
contents: read
41+
issues: write
42+
needs:
43+
- analyze
44+
if: always()
45+
uses: ./.github/workflows/reusable-workflow-notification.yml
46+
with:
47+
success: ${{ needs.analyze.result == 'success' }}

‎.github/workflows/reusable-workflow-notification.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# this is useful because notifications for scheduled workflows are only sent to the user who
2+
# initially created the given workflow
3+
name: Reusable - Workflow notification
4+
5+
on:
6+
workflow_call:
7+
inputs:
8+
success:
9+
type: boolean
10+
required: true
11+
12+
permissions:
13+
contents: read
14+
15+
jobs:
16+
workflow-notification:
17+
permissions:
18+
contents: read
19+
issues: write
20+
runs-on: ubuntu-latest
21+
steps:
22+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
23+
24+
- name: Open issue or add comment if issue already open
25+
env:
26+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
27+
run: |
28+
# TODO (trask) search doesn't support exact phrases, so it's possible that this could grab the wrong issue
29+
number=$(gh issue list --search "in:title Workflow failed: $GITHUB_WORKFLOW" --limit 1 --json number -q .[].number)
30+
31+
echo $number
32+
echo ${{ inputs.success }}
33+
34+
if [[ $number ]]; then
35+
if [[ "${{ inputs.success }}" == "true" ]]; then
36+
gh issue close $number
37+
else
38+
gh issue comment $number \
39+
--body "See [$GITHUB_WORKFLOW #$GITHUB_RUN_NUMBER](https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID)."
40+
fi
41+
elif [[ "${{ inputs.success }}" == "false" ]]; then
42+
gh issue create --title "Workflow failed: $GITHUB_WORKFLOW (#$GITHUB_RUN_NUMBER)" \
43+
--body "See [$GITHUB_WORKFLOW #$GITHUB_RUN_NUMBER](https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID)."
44+
fi

0 commit comments

Comments
 (0)