Merge branch 'main' of https://github.com/open-telemetry/opentelemetry-java into value-convert-object

Author: jack-berg

.codecov.yaml

@@ -11,7 +11,7 @@ coverage:
   status:
     project:
       default:
-        target: 90%
+        target: 89%
         paths:
           - "!opencensus-shim/"
           - "!opentracing-shim/"

.github/workflows/backport.yml

@@ -6,8 +6,13 @@ on:
         description: "The pull request # to backport"
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   backport:
+    permissions:
+      contents: write  # for git push to PR branch
     runs-on: ubuntu-latest
     steps:
       - run: |

.github/workflows/benchmark-tags.yml

@@ -3,8 +3,13 @@ name: Benchmark Tags
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   sdk-benchmark:
+    permissions:
+      contents: write # for git push to benchmarks branch
     name: Benchmark SDK
     runs-on: self-hosted
     timeout-minutes: 10

.github/workflows/benchmark.yml

@@ -5,8 +5,13 @@ on:
     branches: [ main ]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   sdk-benchmark:
+    permissions:
+      contents: write # for git push to benchmarks branch
     name: Benchmark SDK
     runs-on: self-hosted
     timeout-minutes: 10

.github/workflows/build-tracecontext-testsuite.yml

@@ -9,8 +9,14 @@ on:
       - main
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   publish:
+    permissions:
+      contents: read
+      packages: write
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4

.github/workflows/codeql-daily.yml

@@ -0,0 +1,54 @@
+name: CodeQL
+
+on:
+  pull_request:
+    branches:
+      - main
+      - release/*
+      - benchmarks
+  push:
+    branches:
+      - main
+      - release/*
+      - benchmarks
+  schedule:
+    - cron: "29 13 * * 2"  # weekly at 13:29 UTC on Tuesday
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    permissions:
+      contents: read
+      actions: read  # for github/codeql-action/init to get workflow details
+      security-events: write  # for github/codeql-action/analyze to upload SARIF results
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Set up Java 17
+        uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
+        with:
+          distribution: temurin
+          java-version: 17
+
+      - name: Set up gradle
+        uses: gradle/actions/setup-gradle@94baf225fe0a508e581a564467443d0e2379123b # v4.3.0
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3.28.8
+        with:
+          languages: java, actions
+          # using "latest" helps to keep up with the latest Kotlin support
+          # see https://github.com/github/codeql-action/issues/1555#issuecomment-1452228433
+          tools: latest
+
+      - name: Assemble
+        # --no-build-cache is required for codeql to analyze all modules
+        # --no-daemon is required for codeql to observe the compilation
+        # (see https://docs.github.com/en/code-security/codeql-cli/getting-started-with-the-codeql-cli/preparing-your-code-for-codeql-analysis#specifying-build-commands)
+        run: ./gradlew assemble --no-build-cache --no-daemon
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3.28.8

.github/workflows/codeql.yml

@@ -5,8 +5,14 @@ on:
     - cron: "23 3 * * *"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   copy-images:
+    permissions:
+      contents: read
+      packages: write
     strategy:
       matrix:
         include:

.github/workflows/docker-test-containers-daily.yml

@@ -1,16 +1,16 @@
 name: Gradle wrapper validation
+
 on:
-  pull_request:
-    paths:
-      - '**/gradle/wrapper/**'
   push:
-    paths:
-      - '**/gradle/wrapper/**'
+  pull_request:
+
+permissions:
+  contents: read
 
 jobs:
-  validation:
+  gradle-wrapper-validation:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
 
-      - uses: gradle/actions/wrapper-validation@v4.2.2
+      - uses: gradle/actions/wrapper-validation@v4.3.0

.github/workflows/gradle-wrapper-validation.yml

@@ -4,8 +4,14 @@ on:
   issue_comment:
     types: [created]
 
+permissions:
+  contents: read
+
 jobs:
   issue_comment:
+    permissions:
+      contents: read
+      issues: write
     if: >
       contains(github.event.issue.labels.*.name, 'needs author feedback') &&
       github.event.comment.user.login == github.event.issue.user.login