[pull] master from DataDog:master

.github/workflows/build-ddev.yml

@@ -707,6 +707,73 @@ jobs:
         path: ddev/signed/${{ steps.pkg.outputs.path }}
         if-no-files-found: error
 
+  # Extraction runs in its own unprivileged job so the dependency-resolving install of
+  # ddev never executes inside the privileged publish job (which holds contents: write
+  # and id-token: write). A compromised transitive dep can still execute here, but it
+  # has no access to release credentials and cannot tamper with archives/installers.
+  extract-release-notes:
+    name: Extract release notes
+    if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags')
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    # Extraction is best-effort end-to-end: any failure in setup, install, configure,
+    # or the extraction itself must not block the release. We pre-create an empty
+    # release-notes.md, run the install/extract steps with continue-on-error so they
+    # never fail the job, and always upload the artifact. The publish job can rely on
+    # extract-release-notes succeeding; the body it consumes may be empty.
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+    - name: Initialize empty release notes
+      working-directory: .
+      run: ': > release-notes.md'
+
+    - name: Set up Python ${{ env.PYTHON_VERSION }}
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      continue-on-error: true
+      with:
+        python-version: "${{ env.PYTHON_VERSION }}"
+
+    - name: Install uv
+      uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+      continue-on-error: true
+      with:
+        enable-cache: false
+
+    - name: Install ddev from local folder
+      continue-on-error: true
+      working-directory: .
+      run: uv pip install --system -e ./datadog_checks_dev[cli] -e ./ddev
+
+    - name: Configure ddev
+      continue-on-error: true
+      working-directory: .
+      run: |-
+        ddev config override
+        ddev config set upgrade_check false
+
+    - name: Extract release notes from CHANGELOG
+      continue-on-error: true
+      working-directory: .
+      run: |
+        version="${GITHUB_REF_NAME#ddev-v}"
+        if ! ddev release changelog show ddev "$version" --file release-notes.md; then
+          echo "::warning::Failed to extract changelog section for ddev $version; release body will be empty."
+          : > release-notes.md
+        fi
+
+    - name: Upload release notes
+      if: always()
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      with:
+        name: release-notes
+        path: release-notes.md
+        if-no-files-found: error
+
   publish:
     name: Publish release
     if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags')
@@ -716,6 +783,7 @@ jobs:
     - binaries
     - windows-packaging
     - macos-packaging
+    - extract-release-notes
     runs-on: ubuntu-latest
 
     permissions:
@@ -761,6 +829,14 @@ jobs:
         path: installers
         merge-multiple: true
 
+    # Downloaded by exact name (not pattern) so this step cannot pull in artifacts
+    # uploaded by other jobs.
+    - name: Download release notes
+      uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+      with:
+        name: release-notes
+        path: release-notes
+
     # Publish wheels to PyPI using Trusted Publishers.
     # https://docs.pypi.org/trusted-publishers/using-a-publisher/
     # This job needs to run from within the pypi-ddev environment. PyPi validates the
@@ -771,46 +847,10 @@ jobs:
       with:
         skip-existing: true
 
-    - name: Set up Python ${{ env.PYTHON_VERSION }}
-      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-      with:
-        python-version: "${{ env.PYTHON_VERSION }}"
-
-    - name: Install uv
-      uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
-      with:
-        enable-cache: false
-
-    - name: Install ddev from local folder
-      working-directory: .
-      run: uv pip install --system -e ./datadog_checks_dev[cli] -e ./ddev
-
-    - name: Configure ddev
-      working-directory: .
-      run: |-
-        ddev config override
-        ddev config set upgrade_check false
-
-    # Extraction is best-effort: PyPI publish has already happened by this point, so any failure
-    # here must not abort the workflow before the GitHub release is created. On failure we log a
-    # warning, leave the body file empty, and let the release proceed with an empty body.
-    - name: Extract release notes from CHANGELOG
-      id: release-notes
-      working-directory: .
-      run: |
-        version="${GITHUB_REF_NAME#ddev-v}"
-        notes_file="${RUNNER_TEMP}/release-notes.md"
-        : > "$notes_file"
-        if ! ddev release changelog show ddev "$version" --file "$notes_file"; then
-          echo "::warning::Failed to extract changelog section for ddev $version; release body will be empty."
-          : > "$notes_file"
-        fi
-        echo "path=$notes_file" >> "$GITHUB_OUTPUT"
-
     - name: Add assets to current release
       uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
       with:
-        body_path: ${{ steps.release-notes.outputs.path }}
+        body_path: release-notes/release-notes.md
         files: |-
           archives/*
           installers/*

.github/workflows/dependency-wheel-promotion-gate.yaml

@@ -1,7 +1,7 @@
 name: Dependency Wheel Promotion Gate
 
 on:
-  pull_request:
+  pull_request_target:
     branches:
     - master
     - 7.*.*

agent_metrics/metadata.csv

@@ -1,4 +1,4 @@
 metric_name,metric_type,interval,unit_name,per_unit_name,description,orientation,integration,short_name,curated_metric
-datadog.agent.python.version,gauge,,,,,0,agent_metrics,py version,
-datadog.agent.running,gauge,,,,,0,agent_metrics,running,
-datadog.agent.started,count,,,,,0,agent_metrics,started,
+datadog.agent.python.version,gauge,,,,"A value of 1, tagged with the Python version.",0,agent_metrics,py version,
+datadog.agent.running,gauge,,,,"A value of 1 if the Agent is running and reporting to Datadog, tagged with the Agent version.",0,agent_metrics,running,
+datadog.agent.started,count,,,,"A count of 1 each time the Agent starts.",0,agent_metrics,started,

n8n/assets/configuration/spec.yaml

@@ -19,12 +19,11 @@ files:
           https://docs.n8n.io/hosting/configuration/environment-variables/endpoints/
         raw_metric_prefix.description: |
           The prefix prepended to all metrics from n8n.
-          If not set, the default prefix n8n is used.
+          If not set, the default prefix n8n_ is used.
           If you are using a custom prefix in n8n through N8N_METRICS_PREFIX, you need to set it here.
         raw_metric_prefix.value:
-          display_default: n8n
           type: string
-          example: n8n
+          default: n8n_
         raw_metric_prefix.hidden: false
   - template: logs
     example:

n8n/changelog.d/23598.fixed

@@ -0,0 +1 @@
+Fix default raw metric prefix.

n8n/datadog_checks/n8n/check.py

@@ -7,10 +7,12 @@
 from datadog_checks.base import OpenMetricsBaseCheckV2
 from datadog_checks.n8n.metrics import METRIC_MAP, RENAME_LABELS_MAP
 
+from .config_models import ConfigMixin
+
 DEFAULT_READY_ENDPOINT = '/healthz/readiness'
 
 
-class N8nCheck(OpenMetricsBaseCheckV2):
+class N8nCheck(OpenMetricsBaseCheckV2, ConfigMixin):
     __NAMESPACE__ = 'n8n'
     DEFAULT_METRIC_LIMIT = 0
 
@@ -28,6 +30,7 @@ def get_default_config(self):
         return {
             'metrics': [METRIC_MAP],
             'rename_labels': RENAME_LABELS_MAP,
+            'raw_metric_prefix': 'n8n_',
         }
 
     def _check_n8n_readiness(self):

n8n/datadog_checks/n8n/config_models/defaults.py

@@ -85,7 +85,7 @@ def instance_persist_connections():
 
 
 def instance_raw_metric_prefix():
-    return 'n8n'
+    return 'n8n_'
 
 
 def instance_request_size():

n8n/datadog_checks/n8n/data/conf.yaml.example

@@ -20,12 +20,12 @@ instances:
     #
   - openmetrics_endpoint: http://localhost:5678
 
-    ## @param raw_metric_prefix - string - optional - default: n8n
+    ## @param raw_metric_prefix - string - optional - default: n8n_
     ## The prefix prepended to all metrics from n8n.
-    ## If not set, the default prefix n8n is used.
+    ## If not set, the default prefix n8n_ is used.
     ## If you are using a custom prefix in n8n through N8N_METRICS_PREFIX, you need to set it here.
     #
-    # raw_metric_prefix: n8n
+    # raw_metric_prefix: <RAW_METRIC_PREFIX>
 
     ## @param extra_metrics - (list of string or mapping) - optional
     ## This list defines metrics to collect from the `openmetrics_endpoint`, in addition to

n8n/tests/common.py

@@ -18,7 +18,6 @@ def get_fixture_path(filename):
 OPENMETRICS_URL = f'http://{HOST}:{PORT}'
 INSTANCE = {
     'openmetrics_endpoint': f'{OPENMETRICS_URL}/metrics',
-    'raw_metric_prefix': 'n8n_',
 }
 
 E2E_METADATA = {