Merge branch 'main' into fix-prometheus-exporter-link

Author: xrmx

.github/ISSUE_TEMPLATE/bug_report.yaml

@@ -19,7 +19,7 @@ body:
         Please describe any aspect of your environment relevant to the problem, including your Python version, [platform](https://docs.python.org/3/library/platform.html), version numbers of installed dependencies, information about your cloud hosting provider, etc. If you're reporting a problem with a specific version of a library in this repo, please check whether the problem has been fixed on main.
       value: |
         OS: (e.g, Ubuntu)
-        Python version: (e.g., Python 3.8.10)
+        Python version: (e.g., Python 3.9.10)
         SDK version: (e.g., 1.25.0)
         API version: (e.g., 1.25.0)
   

.github/workflows/benchmarks.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   sdk-benchmarks:
-    runs-on: self-hosted
+    runs-on: equinix-bare-metal
     steps:
     - name: Checkout Core Repo @ SHA - ${{ github.sha }}
       uses: actions/checkout@v4

.github/workflows/contrib.yml

@@ -15,4 +15,8 @@ jobs:
     uses: open-telemetry/opentelemetry-python-contrib/.github/workflows/core_contrib_test_0.yml@main
     with:
       CORE_REPO_SHA: ${{ github.sha }}
-      CONTRIB_REPO_SHA: main
+      CONTRIB_REPO_SHA: ${{ github.event_name == 'pull_request' && (
+          contains(github.event.pull_request.labels.*.name, 'prepare-release') && github.event.pull_request.head.ref ||
+          contains(github.event.pull_request.labels.*.name, 'backport') && github.event.pull_request.base.ref ||
+          'main'
+        ) || 'main' }}

.github/workflows/fossa.yml

@@ -14,7 +14,7 @@ jobs:
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - uses: fossas/fossa-action@c0a7d013f84c8ee5e910593186598625513cc1e4 # v1.6.0
+      - uses: fossas/fossa-action@3ebcea1862c6ffbd5cf1b4d0bd6b3fe7bd6f2cac # v1.7.0
         with:
           api-key: ${{secrets.FOSSA_API_KEY}}
           team: OpenTelemetry

.github/workflows/generate_workflows.py

@@ -47,8 +47,7 @@ def get_test_job_datas(tox_envs: list, operating_systems: list) -> list:
     os_alias = {"ubuntu-latest": "Ubuntu", "windows-latest": "Windows"}
 
     python_version_alias = {
-        "pypy3": "pypy-3.8",
-        "py38": "3.8",
+        "pypy3": "pypy-3.9",
         "py39": "3.9",
         "py310": "3.10",
         "py311": "3.11",

.github/workflows/lint_0.yml

@@ -15,7 +15,15 @@ concurrency:
 
 env:
   CORE_REPO_SHA: main
-  CONTRIB_REPO_SHA: main
+  # Set the SHA to the branch name if the PR has a label 'prepare-release' or 'backport' otherwise, set it to 'main'
+  # For PRs you can change the inner fallback ('main')
+  # For pushes you change the outer fallback ('main')
+  # The logic below is used during releases and depends on having an equivalent branch name in the contrib repo.
+  CONTRIB_REPO_SHA: ${{ github.event_name == 'pull_request' && (
+       contains(github.event.pull_request.labels.*.name, 'prepare-release') && github.event.pull_request.head.ref ||
+       contains(github.event.pull_request.labels.*.name, 'backport') && github.event.pull_request.base.ref ||
+       'main'
+    ) || 'main' }}
   PIP_EXISTS_ACTION: w
 
 jobs:
@@ -39,8 +47,8 @@ jobs:
       - name: Run tests
         run: tox -e lint-opentelemetry-api
 
-  lint-opentelemetry-proto-protobuf5:
-    name: opentelemetry-proto-protobuf5
+  lint-opentelemetry-proto-gen-latest:
+    name: opentelemetry-proto-gen-latest
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
@@ -56,7 +64,7 @@ jobs:
         run: pip install tox
 
       - name: Run tests
-        run: tox -e lint-opentelemetry-proto-protobuf5
+        run: tox -e lint-opentelemetry-proto-gen-latest
 
   lint-opentelemetry-sdk:
     name: opentelemetry-sdk
@@ -210,8 +218,8 @@ jobs:
       - name: Run tests
         run: tox -e lint-opentelemetry-exporter-otlp-combined
 
-  lint-opentelemetry-exporter-otlp-proto-grpc:
-    name: opentelemetry-exporter-otlp-proto-grpc
+  lint-opentelemetry-exporter-otlp-proto-grpc-latest:
+    name: opentelemetry-exporter-otlp-proto-grpc-latest
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
@@ -227,7 +235,7 @@ jobs:
         run: pip install tox
 
       - name: Run tests
-        run: tox -e lint-opentelemetry-exporter-otlp-proto-grpc
+        run: tox -e lint-opentelemetry-exporter-otlp-proto-grpc-latest
 
   lint-opentelemetry-exporter-otlp-proto-http:
     name: opentelemetry-exporter-otlp-proto-http

.github/workflows/misc_0.yml

@@ -15,7 +15,15 @@ concurrency:
 
 env:
   CORE_REPO_SHA: main
-  CONTRIB_REPO_SHA: main
+  # Set the SHA to the branch name if the PR has a label 'prepare-release' or 'backport' otherwise, set it to 'main'
+  # For PRs you can change the inner fallback ('main')
+  # For pushes you change the outer fallback ('main')
+  # The logic below is used during releases and depends on having an equivalent branch name in the contrib repo.
+  CONTRIB_REPO_SHA: ${{ github.event_name == 'pull_request' && (
+       contains(github.event.pull_request.labels.*.name, 'prepare-release') && github.event.pull_request.head.ref ||
+       contains(github.event.pull_request.labels.*.name, 'backport') && github.event.pull_request.base.ref ||
+       'main'
+    ) || 'main' }}
   PIP_EXISTS_ACTION: w
 
 jobs:
@@ -58,44 +66,6 @@ jobs:
       - name: Run tests
         run: tox -e tracecontext
 
-  mypy:
-    name: mypy
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - name: Checkout repo @ SHA - ${{ github.sha }}
-        uses: actions/checkout@v4
-
-      - name: Set up Python 3.11
-        uses: actions/setup-python@v5
-        with:
-          python-version: "3.11"
-
-      - name: Install tox
-        run: pip install tox
-
-      - name: Run tests
-        run: tox -e mypy
-
-  mypyinstalled:
-    name: mypyinstalled
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - name: Checkout repo @ SHA - ${{ github.sha }}
-        uses: actions/checkout@v4
-
-      - name: Set up Python 3.11
-        uses: actions/setup-python@v5
-        with:
-          python-version: "3.11"
-
-      - name: Install tox
-        run: pip install tox
-
-      - name: Run tests
-        run: tox -e mypyinstalled
-
   typecheck:
     name: typecheck
     runs-on: ubuntu-latest

.github/workflows/ossf-scorecard.yml

@@ -0,0 +1,47 @@
+name: OSSF Scorecard
+
+on:
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: "16 11 * * 4" # once a week
+  workflow_dispatch:
+
+permissions: read-all
+
+jobs:
+  analysis:
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed for Code scanning upload
+      security-events: write
+      # Needed for GitHub OIDC token if publish_results is true
+      id-token: write
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable
+      # uploads of run results in SARIF format to the repository Actions tab.
+      # https://docs.github.com/en/actions/advanced-guides/storing-workflow-data-as-artifacts
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard (optional).
+      # Commenting out will disable upload of results to your repo's Code Scanning dashboard
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@5f8171a638ada777af81d42b55959a643bb29017 # v3.28.12
+        with:
+          sarif_file: results.sarif

.github/workflows/prepare-patch-release.yml

@@ -65,6 +65,7 @@ jobs:
         run: .github/scripts/use-cla-approved-github-bot.sh
 
       - name: Create pull request
+        id: create_pr
         env:
           # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
           GITHUB_TOKEN: ${{ secrets.OPENTELEMETRYBOT_GITHUB_TOKEN }}
@@ -74,7 +75,15 @@ jobs:
 
           git commit -a -m "$message"
           git push origin HEAD:$branch
-          gh pr create --title "[$GITHUB_REF_NAME] $message" \
+          pr_url=$(gh pr create --title "[$GITHUB_REF_NAME] $message" \
                        --body "$message." \
                        --head $branch \
-                       --base $GITHUB_REF_NAME
+                       --base $GITHUB_REF_NAME)
+
+          echo "pr_url=$pr_url" >> $GITHUB_OUTPUT
+      - name: Add prepare-release label to PR
+        if: steps.create_pr.outputs.pr_url != ''
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh pr edit ${{ steps.create_pr.outputs.pr_url }}  --add-label "prepare-release"

.github/workflows/prepare-release-branch.yml

@@ -91,6 +91,7 @@ jobs:
         run: .github/scripts/use-cla-approved-github-bot.sh
 
       - name: Create pull request against the release branch
+        id: create_release_branch_pr
         env:
           # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
           GITHUB_TOKEN: ${{ secrets.OPENTELEMETRYBOT_GITHUB_TOKEN }}
@@ -100,10 +101,18 @@ jobs:
 
           git commit -a -m "$message"
           git push origin HEAD:$branch
-          gh pr create --title "[$RELEASE_BRANCH_NAME] $message" \
+          pr_url=$(gh pr create --title "[$RELEASE_BRANCH_NAME] $message" \
                        --body "$message." \
                        --head $branch \
-                       --base $RELEASE_BRANCH_NAME
+                       --base $RELEASE_BRANCH_NAME)
+          echo "pr_url=$pr_url" >> $GITHUB_OUTPUT
+
+      - name: Add prepare-release label to PR
+        if: steps.create_release_branch_pr.outputs.pr_url != ''
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh pr edit ${{ steps.create_release_branch_pr.outputs.pr_url }}  --add-label "prepare-release"
 
   create-pull-request-against-main:
     runs-on: ubuntu-latest
@@ -170,6 +179,7 @@ jobs:
         run: .github/scripts/use-cla-approved-github-bot.sh
 
       - name: Create pull request against main
+        id: create_main_pr
         env:
           # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
           GITHUB_TOKEN: ${{ secrets.OPENTELEMETRYBOT_GITHUB_TOKEN }}
@@ -180,7 +190,15 @@ jobs:
 
           git commit -a -m "$message"
           git push origin HEAD:$branch
-          gh pr create --title "$message" \
+          pr_url=$(gh pr create --title "$message" \
                        --body "$body" \
                        --head $branch \
-                       --base main
+                       --base main)
+          echo "pr_url=$pr_url" >> $GITHUB_OUTPUT
+
+      - name: Add prepare-release label to PR
+        if: steps.create_main_pr.outputs.pr_url != ''
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh pr edit ${{ steps.create_main_pr.outputs.pr_url }}  --add-label "prepare-release"