Merge branch 'main' into sgali/otmpy-docs-test

Author: sginji

.github/ISSUE_TEMPLATE/bug_report.yaml

@@ -66,3 +66,11 @@ body:
       options:
         - "No"
         - "Yes"
+
+  - type: dropdown
+    attributes:
+      label: Tip
+      description: This element is static, used to render a helpful sub-heading for end-users and community members to help prioritize issues. Please leave as is.
+      options:
+        - <sub>[React](https://github.blog/news-insights/product-news/add-reactions-to-pull-requests-issues-and-comments/) with 👍 to help prioritize this issue. Please use comments to provide useful context, avoiding `+1` or `me too`, to help us triage it. Learn more [here](https://opentelemetry.io/community/end-user/issue-participation/).</sub>
+      default: 0

.github/ISSUE_TEMPLATE/feature_request.yaml

@@ -48,3 +48,11 @@ body:
       options:
         - "No"
         - "Yes"
+
+  - type: dropdown
+    attributes:
+      label: Tip
+      description: This element is static, used to render a helpful sub-heading for end-users and community members to help prioritize issues. Please leave as is.
+      options:
+        - <sub>[React](https://github.blog/news-insights/product-news/add-reactions-to-pull-requests-issues-and-comments/) with 👍 to help prioritize this issue. Please use comments to provide useful context, avoiding `+1` or `me too`, to help us triage it. Learn more [here](https://opentelemetry.io/community/end-user/issue-participation/).</sub>
+      default: 0

.github/scripts/use-cla-approved-github-bot.sh

@@ -1,4 +1,4 @@
 #!/bin/bash -e
 
-git config user.name opentelemetrybot
-git config user.email 107717825+opentelemetrybot@users.noreply.github.com
+git config user.name otelbot
+git config user.email 197425009+otelbot@users.noreply.github.com

.github/workflows/backport.yml

@@ -6,9 +6,14 @@ on:
         description: "The pull request # to backport"
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   backport:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write  # required for pushing changes
     steps:
       - run: |
           if [[ ! $GITHUB_REF_NAME =~ ^release/v[0-9]+\.[0-9]+\.x-0\.[0-9]+bx$ ]]; then
@@ -24,16 +29,22 @@ jobs:
       - name: Use CLA approved github bot
         run: .github/scripts/use-cla-approved-github-bot.sh
 
+      - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+        id: otelbot-token
+        with:
+          app-id: ${{ vars.OTELBOT_APP_ID }}
+          private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+
       - name: Create pull request
         env:
           NUMBER: ${{ github.event.inputs.number }}
           # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GITHUB_TOKEN: ${{ secrets.OPENTELEMETRYBOT_GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
           commit=$(gh pr view $NUMBER --json mergeCommit --jq .mergeCommit.oid)
           title=$(gh pr view $NUMBER --json title --jq .title)
 
-          branch="opentelemetrybot/backport-${NUMBER}-to-${GITHUB_REF_NAME//\//-}"
+          branch="otelbot/backport-${NUMBER}-to-${GITHUB_REF_NAME//\//-}"
 
           git cherry-pick $commit
           git push origin HEAD:$branch

.github/workflows/benchmarks.yml

@@ -4,19 +4,27 @@ on:
   push:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   sdk-benchmarks:
-    runs-on: self-hosted
+    permissions:
+      contents: write # required for pushing to gh-pages
+    runs-on: oracle-bare-metal-64cpu-512gb-x86-64
+    container:
+      image: python:3.13-slim
     steps:
+    - name: Install Git # since Git isn't available in the container image used above
+      run: |
+        apt-get update
+        apt-get install -y git
+    - name: Make repo safe for Git inside container
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
     - name: Checkout Core Repo @ SHA - ${{ github.sha }}
       uses: actions/checkout@v4
-    - name: Set up Python
-      uses: actions/setup-python@v5
-      with:
-        python-version: "3.13"
-        architecture: 'x64'
     - name: Install tox
-      run: pip install tox
+      run: pip install tox-uv
     - name: Run tox
       run: tox -e benchmark-opentelemetry-sdk -- -k opentelemetry-sdk/benchmarks --benchmark-json=opentelemetry-sdk/output.json
     - name: Report on SDK benchmark results

.github/workflows/changelog.yml

@@ -10,12 +10,15 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   changelog:
     runs-on: ubuntu-latest
     if: |
       !contains(github.event.pull_request.labels.*.name, 'Skip Changelog')
-      && github.actor != 'opentelemetrybot'
+      && github.actor != 'otelbot[bot]'
 
     steps:
       - uses: actions/checkout@v4

.github/workflows/check-links.yml

@@ -4,6 +4,9 @@ on:
     branches: [ main ]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   changedfiles:
     name: changed files
@@ -24,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: changedfiles
     if: |
-      github.event.pull_request.user.login != 'opentelemetrybot' && github.event_name == 'pull_request'
+      github.event.pull_request.user.login != 'otelbot[bot]' && github.event_name == 'pull_request'
       && ${{needs.changedfiles.outputs.md}}
     steps:
       - name: Checkout Repo

.github/workflows/codeql-analysis.yml

@@ -14,8 +14,13 @@ on:
     #        *  * * * *
     - cron: '30 1 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   CodeQL-Build:
+    permissions:
+      security-events: write # for github/codeql-action/analyze to upload SARIF results
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/contrib.yml

@@ -6,6 +6,9 @@ on:
     - 'release/*'
   pull_request:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true

.github/workflows/generate_workflows.py

@@ -14,7 +14,7 @@
 )
 _tox_lint_env_regex = re_compile(r"lint-(?P<name>[-\w]+)")
 _tox_contrib_env_regex = re_compile(
-    r"py38-test-(?P<name>[-\w]+\w)-?(?P<contrib_requirements>\d+)?"
+    r"py39-test-(?P<name>[-\w]+\w)-?(?P<contrib_requirements>\d+)?"
 )