Merge branch 'main' into tm-lint-examples-bunyan

Author: trentm

.github/ISSUE_TEMPLATE/instrumentation_request.md

@@ -1,41 +1,36 @@
 ---
 name: Instrumentation request
-about: Create a report to add support for an instrumentation
+about: Create a request to add a new instrumentation
 labels: instrumentation-request
 ---
 
 <!--
-**NB:** Before opening an instrumentation request against this repo, please read [the contributing guidelines for new instrumentation](../../CONTRIBUTING.md#new-instrumentation).
+**NB:** Before opening an instrumentation request against this repo, please read [the contributing guidelines for new instrumentation](../blob/main/CONTRIBUTING.md#new-instrumentation).
 -->
 
-### Is your instrumentation request related to a problem? Please describe
+### Which library do you want to instrument?
 <!--
-A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+A clear and concise description of why this library should be instrumented. Ex. I'm always frustrated when [...]
 -->
 
-
-### Is it applicable for Node or Browser or both?
-
-
-### Do you expect this instrumentation to be commonly used?
-
-Weekly Downloads:
-
-### What version of instrumentation are you interested in using?
-
-Versions:
-
 ### Code Owners
 
 <!--
-New Instrumentation requests need at least 2 code-owners that will maintain the instrumentation long-term.
+New Instrumentations MUST have at least 2 code-owners that will maintain the instrumentation long-term.
+Any code-owners listed MUST fulfill all criteria laid out in the checklist below.
 -->
 
 - Owner 1
+  - [ ] I am a [member of the OpenTelemetry Organization](https://github.com/open-telemetry/community/blob/main/guides/contributor/membership.md#member)
+  - [ ] I have read [CONTRIBUTING.md](../blob/main/CONTRIBUTING.md) and understand the responsibilities of a component owner
+  - [ ] I agree to follow and uphold the [mission, vision and values](https://github.com/open-telemetry/community/blob/main/mission-vision-values.md) of the OpenTelemetry project
+  - [ ] I understand that the component may be subject to the [OpenTelemetry Semantic Conventions](https://github.com/open-telemetry/semantic-conventions) and agree to follow the rules set out therein
 - Owner 2
+  <!-- instruct any co-owners to complete the checklist above and comment it on this issue -->
+  - [ ] Commented on the issue confirming they have fulfilled all criteria for becoming a component owner
+<!-- continue listing co-owners if you have more than two -->
 
 ### Additional context
 <!--
 Add any other context or screenshots about the instrumentation request here. Is there a reference you could point for the well-defined lifecycle methods?
 -->
-

.github/ISSUE_TEMPLATE/ownership_request.md

@@ -5,7 +5,7 @@ labels: type:ownership-request
 ---
 
 <!--
-**NB:** Before opening a component ownership request against this repo, please read [CONTRIBUTING.md](../../CONTRIBUTING.md#component-ownership) and its subsections first.
+**NB:** Before opening a component ownership request against this repo, please read [CONTRIBUTING.md](../blob/main/CONTRIBUTING.md#component-ownership) and its subsections first.
 -->
 
 ### Which component are you requesting ownership of?
@@ -17,7 +17,7 @@ Put a link to the component here.
 ### Related Work and Qualifications
 
 <!--
-List here why you're qualified to take ownership of the component, see [CONTRIBUTING.md](../../CONTRIBUTING.md#becoming-a-component-owner) for details.
+List here why you're qualified to take ownership of the component, see [CONTRIBUTING.md](../blob/main/CONTRIBUTING.md#becoming-a-component-owner) for details.
 
 Examples:
 - I am working on <related open-source-project> and have deep knowledge of the instrumented package.
@@ -28,7 +28,8 @@ Examples:
 
 ### Checklist
 
-- [ ] I have read [CONTRIBUTING.md](../../CONTRIBUTING.md) and understand the responsibilities of a component owner.
+- [ ] I am a [member of the OpenTelemetry Organization](https://github.com/open-telemetry/community/blob/main/guides/contributor/membership.md#member)
+- [ ] I have read [CONTRIBUTING.md](../blob/main/CONTRIBUTING.md) and understand the responsibilities of a component owner.
 - [ ] I agree to follow and uphold the [mission, vision and values](https://github.com/open-telemetry/community/blob/main/mission-vision-values.md) of the OpenTelemetry project
 - [ ] I understand that the component I'm requesting ownership of may be subject to the [OpenTelemetry Semantic Conventions](https://github.com/open-telemetry/semantic-conventions) and agree to follow the rules set out therein.
 

.github/PULL_REQUEST_TEMPLATE.md

@@ -7,7 +7,7 @@ Before creating a pull request, please make sure:
 - You have read the guide for contributing
   - See https://github.com/open-telemetry/opentelemetry-js/blob/main/CONTRIBUTING.md
 - You signed all your commits (otherwise we won't be able to merge the PR)
-  - See https://github.com/open-telemetry/community/blob/main/CONTRIBUTING.md#sign-the-cla
+  - See https://github.com/open-telemetry/community/blob/main/guides/contributor#sign-the-cla
 - You added unit tests for the new functionality
 - You mention in the PR description which issue it is addressing, e.g. "Fixes #xxx". This will auto-close
   the issue that your PR fixes (if such)

.github/component-label-map.yml

@@ -131,6 +131,11 @@ pkg:instrumentation-ioredis:
           - plugins/node/opentelemetry-instrumentation-ioredis/**
           - packages/opentelemetry-test-utils/**
           - packages/opentelemetry-redis-common/**
+pkg:instrumentation-kafkajs:
+  - changed-files:
+      - any-glob-to-any-file:
+          - plugins/node/instrumentation-kafkajs/**
+          - packages/opentelemetry-test-utils/**
 pkg:instrumentation-knex:
   - changed-files:
       - any-glob-to-any-file:
@@ -183,6 +188,11 @@ pkg:instrumentation-net:
   - changed-files:
       - any-glob-to-any-file:
           - plugins/node/opentelemetry-instrumentation-net/**
+pkg:instrumentation-oracledb:
+  - changed-files:
+      - any-glob-to-any-file:
+          - plugins/node/opentelemetry-instrumentation-oracledb/**
+          - packages/opentelemetry-test-utils/**
 pkg:instrumentation-pg:
   - changed-files:
       - any-glob-to-any-file:
@@ -297,12 +307,9 @@ pkg-status:unmaintained:
           - plugins/node/opentelemetry-instrumentation-knex/**
           - plugins/node/opentelemetry-instrumentation-koa/**
           - plugins/node/opentelemetry-instrumentation-memcached/**
-          - plugins/node/opentelemetry-instrumentation-mongodb/**
           - plugins/node/opentelemetry-instrumentation-mysql/**
-          - plugins/node/opentelemetry-instrumentation-mysql2/**
           - plugins/node/opentelemetry-instrumentation-nestjs-core/**
           - plugins/node/opentelemetry-instrumentation-restify/**
           - plugins/node/opentelemetry-instrumentation-router/**
           - propagators/opentelemetry-propagator-ot-trace/**
-          - propagators/propagator-aws-xray/**
           - propagators/propagator-aws-xray-lambda/**

.github/component_owners.yml

@@ -18,6 +18,7 @@ components:
     - kirrg001
   incubator/opentelemetry-sampler-aws-xray:
     - jj22ee
+    - yiyuan-he
   metapackages/auto-configuration-propagators:
     - pichlermarc
   metapackages/auto-instrumentations-node:
@@ -30,6 +31,8 @@ components:
     - pichlermarc
     - legendecas
     - blumamir
+  packages/baggage-log-record-processor:
+    - maryliag
   packages/baggage-span-processor:
     - mikegoldsmith
     - jamiedanielson
@@ -69,11 +72,17 @@ components:
     - mottibec
   plugins/node/instrumentation-tedious: []
     # Unmaintained
+  plugins/node/instrumentation-typeorm:
+    - seemk
+    - weyert
+    - t2t2
+    - mhennoch
   plugins/node/opentelemetry-instrumentation-aws-lambda:
     - jj22ee
   plugins/node/opentelemetry-instrumentation-aws-sdk:
     - blumamir
     - jj22ee
+    - trivikr
   plugins/node/opentelemetry-instrumentation-bunyan:
     - seemk
     - trentm
@@ -86,6 +95,7 @@ components:
   plugins/node/opentelemetry-instrumentation-express:
     - JamieDanielson
     - pkanal
+    - raphael-theriault-swi
   plugins/node/opentelemetry-instrumentation-fastify: []
     # Unmaintained
   plugins/node/opentelemetry-instrumentation-generic-pool: []
@@ -103,16 +113,19 @@ components:
     # Unmaintained
   plugins/node/opentelemetry-instrumentation-memcached: []
     # Unmaintained
-  plugins/node/opentelemetry-instrumentation-mongodb: []
-    # Unmaintained
+  plugins/node/opentelemetry-instrumentation-mongodb:
+    - onurtemizkan
   plugins/node/opentelemetry-instrumentation-mysql: []
     # Unmaintained
-  plugins/node/opentelemetry-instrumentation-mysql2: []
-    # Unmaintained
+  plugins/node/opentelemetry-instrumentation-mysql2:
+    - raphael-theriault-swi
   plugins/node/opentelemetry-instrumentation-nestjs-core: []
     # Unmaintained
   plugins/node/opentelemetry-instrumentation-net:
     - seemk
+  plugins/node/opentelemetry-instrumentation-oracledb:
+    - sudarshan12s
+    - sharadraju
   plugins/node/instrumentation-runtime-node:
     - d4nyll
   plugins/node/opentelemetry-instrumentation-pg:

.github/workflows/fossa.yml

@@ -0,0 +1,20 @@
+name: FOSSA scanning
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  fossa:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - uses: fossas/fossa-action@93a52ecf7c3ac7eb40f5de77fd69b1a19524de94 # v1.5.0
+        with:
+          api-key: ${{secrets.FOSSA_API_KEY}}
+          team: OpenTelemetry

.github/workflows/ossf-scorecard.yml

@@ -0,0 +1,47 @@
+name: OSSF Scorecard
+
+on:
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: "31 18 * * 4" # once a week
+  workflow_dispatch:
+
+permissions: read-all
+
+jobs:
+  analysis:
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed for Code scanning upload
+      security-events: write
+      # Needed for GitHub OIDC token if publish_results is true
+      id-token: write
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable
+      # uploads of run results in SARIF format to the repository Actions tab.
+      # https://docs.github.com/en/actions/advanced-guides/storing-workflow-data-as-artifacts
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard (optional).
+      # Commenting out will disable upload of results to your repo's Code Scanning dashboard
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@5f8171a638ada777af81d42b55959a643bb29017 # v3.28.12
+        with:
+          sarif_file: results.sarif

.github/workflows/peer-api.yaml

@@ -19,4 +19,4 @@ jobs:
         run: npm ci
 
       - name: Check API dependency semantics
-        run: npx lerna exec "node \$LERNA_ROOT_PATH/scripts/peer-api-check.js"
+        run: node ./scripts/peer-api-check.js

.github/workflows/release-please-validate.yaml

@@ -15,8 +15,8 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Install lerna
-        run: npm install -g [email protected]
+      - name: Install glob
+        run: npm install glob
 
       - name: Ensure Release Please Config and Manifest are in sync with the repository
         run: node scripts/check-release-please.mjs

.github/workflows/release-please.yml

@@ -74,11 +74,11 @@ jobs:
 
       # Release Please has already incremented versions and published tags, so we just
       # need to publish all unpublished versions to npm here
-      # See: https://github.com/lerna/lerna/tree/main/commands/publish#bump-from-package
+      # See: https://github.com/lerna/lerna/tree/main/libs/commands/publish#bump-from-package
       - name: Publish to npm
         # only publish if a release has been created
         if: ${{ steps.release.outputs.releases_created }}
         env:
           NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
           NPM_CONFIG_PROVENANCE: true
-        run: npx lerna publish from-package --no-push --no-private --no-git-tag-version --no-verify-access --yes
+        run: npx lerna publish from-package --no-push --no-private --no-git-tag-version --yes