Merge branch 'master' into sarahchen6/update-dd-octo-sts

Author: sarahchen6

.github/CODEOWNERS

@@ -12,20 +12,20 @@
 /.gitlab/                              @DataDog/apm-release-platform
 /.gitlab-ci.yml                        @DataDog/apm-release-platform
 
-# @DataDog/apm-sdk-api-java
-/dd-java-agent/agent-otel                                       @DataDog/apm-sdk-api-java
-/dd-smoke-tests/sample-trace                                    @DataDog/apm-sdk-api-java
-/dd-trace-core/src/main/java/datadog/trace/core/baggage         @DataDog/apm-sdk-api-java
-/dd-trace-core/src/test/groovy/datadog/trace/core/baggage       @DataDog/apm-sdk-api-java
-/dd-trace-core/src/main/java/datadog/trace/core/propagation     @DataDog/apm-sdk-api-java
-/dd-trace-core/src/test/groovy/datadog/trace/core/propagation   @DataDog/apm-sdk-api-java
-/dd-trace-core/src/main/java/datadog/trace/core/scopemanager    @DataDog/apm-sdk-api-java
-/dd-trace-core/src/test/groovy/datadog/trace/core/scopemanager  @DataDog/apm-sdk-api-java
-/dd-trace-ot/                                                   @DataDog/apm-sdk-api-java
-/internal-api/src/main/java/datadog/trace/bootstrap             @DataDog/apm-sdk-api-java
-/internal-api/src/test/groovy/datadog/trace/bootstrap           @DataDog/apm-sdk-api-java
-/internal-api/src/main/java/datadog/trace/api/sampling          @DataDog/apm-sdk-api-java
-/internal-api/src/test/groovy/datadog/trace/api/sampling        @DataDog/apm-sdk-api-java
+# @DataDog/apm-sdk-capabilities-java
+/dd-java-agent/agent-otel                                       @DataDog/apm-sdk-capabilities-java
+/dd-smoke-tests/sample-trace                                    @DataDog/apm-sdk-capabilities-java
+/dd-trace-core/src/main/java/datadog/trace/core/baggage         @DataDog/apm-sdk-capabilities-java
+/dd-trace-core/src/test/groovy/datadog/trace/core/baggage       @DataDog/apm-sdk-capabilities-java
+/dd-trace-core/src/main/java/datadog/trace/core/propagation     @DataDog/apm-sdk-capabilities-java
+/dd-trace-core/src/test/groovy/datadog/trace/core/propagation   @DataDog/apm-sdk-capabilities-java
+/dd-trace-core/src/main/java/datadog/trace/core/scopemanager    @DataDog/apm-sdk-capabilities-java
+/dd-trace-core/src/test/groovy/datadog/trace/core/scopemanager  @DataDog/apm-sdk-capabilities-java
+/dd-trace-ot/                                                   @DataDog/apm-sdk-capabilities-java
+/internal-api/src/main/java/datadog/trace/bootstrap             @DataDog/apm-sdk-capabilities-java
+/internal-api/src/test/groovy/datadog/trace/bootstrap           @DataDog/apm-sdk-capabilities-java
+/internal-api/src/main/java/datadog/trace/api/sampling          @DataDog/apm-sdk-capabilities-java
+/internal-api/src/test/groovy/datadog/trace/api/sampling        @DataDog/apm-sdk-capabilities-java
 
 # @DataDog/apm-serverless
 /dd-trace-core/src/main/java/datadog/trace/lambda/              @DataDog/apm-serverless
@@ -46,6 +46,7 @@
 
 # @DataDog/asm-java (AppSec/IAST)
 /buildSrc/call-site-instrumentation-plugin/                     @DataDog/asm-java
+/dd-java-agent/agent-aiguard/                                   @DataDog/asm-java
 /dd-java-agent/agent-iast/                                      @DataDog/asm-java
 /dd-java-agent/appsec/appsec-test-fixtures/                     @DataDog/asm-java
 /dd-java-agent/instrumentation/*iast*                           @DataDog/asm-java
@@ -58,6 +59,7 @@
 /dd-smoke-tests/spring-security/                                @DataDog/asm-java
 /dd-java-agent/instrumentation/commons-fileupload/              @DataDog/asm-java
 /dd-java-agent/instrumentation/spring/spring-security/          @DataDog/asm-java
+/dd-trace-api/src/main/java/datadog/trace/api/aiguard/          @DataDog/asm-java
 /dd-trace-api/src/main/java/datadog/trace/api/EventTracker.java @DataDog/asm-java
 /internal-api/src/main/java/datadog/trace/api/gateway/          @DataDog/asm-java
 **/appsec/                                                      @DataDog/asm-java
@@ -77,16 +79,14 @@
 /dd-java-agent/agent-ci-visibility/                 @DataDog/ci-app-libraries-java
 /dd-java-agent/instrumentation/cucumber/            @DataDog/ci-app-libraries-java
 /dd-java-agent/instrumentation/jacoco/              @DataDog/ci-app-libraries-java
-/dd-java-agent/instrumentation/junit-4.10/          @DataDog/ci-app-libraries-java
-/dd-java-agent/instrumentation/junit-5.3/           @DataDog/ci-app-libraries-java
+/dd-java-agent/instrumentation/junit                @DataDog/ci-app-libraries-java
 /dd-java-agent/instrumentation/karate/              @DataDog/ci-app-libraries-java
 /dd-java-agent/instrumentation/scalatest/           @DataDog/ci-app-libraries-java
 /dd-java-agent/instrumentation/selenium/            @DataDog/ci-app-libraries-java
 /dd-java-agent/instrumentation/testng/              @DataDog/ci-app-libraries-java
-/dd-java-agent/instrumentation/gradle-3.0/          @DataDog/ci-app-libraries-java
-/dd-java-agent/instrumentation/gradle-8.3/          @DataDog/ci-app-libraries-java
+/dd-java-agent/instrumentation/gradle/              @DataDog/ci-app-libraries-java
 /dd-java-agent/instrumentation/gradle-testing/      @DataDog/ci-app-libraries-java
-/dd-java-agent/instrumentation/maven-3.2.1/         @DataDog/ci-app-libraries-java
+/dd-java-agent/instrumentation/maven                @DataDog/ci-app-libraries-java
 /dd-java-agent/instrumentation/maven-surefire/      @DataDog/ci-app-libraries-java
 /dd-java-agent/instrumentation/weaver/              @DataDog/ci-app-libraries-java
 /dd-smoke-tests/gradle/                             @DataDog/ci-app-libraries-java
@@ -119,7 +119,7 @@
 /dd-java-agent/agent-profiling/                                                             @DataDog/profiling-java
 /dd-java-agent/agent-crashtracking/                                                         @DataDog/profiling-java
 /dd-java-agent/instrumentation/exception-profiling/                                         @DataDog/profiling-java
-/dd-java-agent/instrumentation/java-directbytebuffer/                                       @DataDog/profiling-java
+/dd-java-agent/instrumentation/java/java-nio-1.8/                                           @DataDog/profiling-java
 /dd-java-agent/agent-bootstrap/src/main/java/datadog/trace/bootstrap/instrumentation/jfr/   @DataDog/profiling-java
 /dd-java-agent/agent-bootstrap/src/main/java11/datadog/trace/bootstrap/instrumentation/jfr/ @DataDog/profiling-java
 /dd-trace-api/src/main/java/datadog/trace/api/profiling                                     @DataDog/profiling-java

.github/pull_request_template.md

@@ -7,7 +7,7 @@
 # Contributor Checklist
 
 - Format the title [according the contribution guidelines](https://github.com/DataDog/dd-trace-java/blob/master/CONTRIBUTING.md#title-format)
-- Assign the `type:` and (`comp:` or `inst:`) labels in addition to [any usefull labels](https://github.com/DataDog/dd-trace-java/blob/master/CONTRIBUTING.md#labels)
+- Assign the `type:` and (`comp:` or `inst:`) labels in addition to [any useful labels](https://github.com/DataDog/dd-trace-java/blob/master/CONTRIBUTING.md#labels)
 - Don't use `close`, `fix` or any [linking keywords](https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue#linking-a-pull-request-to-an-issue-using-a-keyword) when referencing an issue.  
   Use `solves` instead, and assign the PR [milestone](https://github.com/DataDog/dd-trace-java/milestones) to the issue
 - Update the [CODEOWNERS](https://github.com/DataDog/dd-trace-java/blob/master/.github/CODEOWNERS) file on source file addition, move, or deletion

.github/workflows/README.md

@@ -28,6 +28,14 @@ _Action:_ Check the pull request complies with [the contribution guidelines](htt
 
 _Recovery:_ Manually verify the guideline compliance.
 
+### check-pull-request-labels [🔗](check-pull-request-labels.yaml)
+
+_Trigger:_ When creating or updating a pull request.
+
+_Action:_ Check the pull request did not introduce unexpected label.
+
+_Recovery:_ Update the pull request or add a comment to trigger the action again.
+
 ### draft-release-notes-on-tag [🔗](draft-release-notes-on-tag.yaml)
 
 _Trigger:_ When creating a tag, or manually (providing a tag)

.github/workflows/analyze-changes.yaml

@@ -23,9 +23,8 @@ jobs:
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # 5.0.0
         with:
           submodules: 'recursive'
-
       - name: Cache Gradle dependencies
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.gradle/caches
@@ -35,12 +34,14 @@ jobs:
             ${{ runner.os }}-gradle-
         
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@192325c86100d080feab897ff886c34abd4c83a3 # v3.29.5
+        uses: github/codeql-action/init@64d10c13136e1c5bce3e5fbde8d4906eeaafc885 # v3.29.5
         with:
           languages: 'java'
           build-mode: 'manual'
 
       - name: Build dd-trace-java for creating the CodeQL database
+        env:
+          ORG_GRADLE_PROJECT_akkaRepositoryToken: ${{ secrets.AKKA_REPO_TOKEN }}
         run: |
           GRADLE_OPTS="-Dorg.gradle.jvmargs='-Xmx3G -Xms2G'" \
           JAVA_HOME=$JAVA_HOME_8_X64 \
@@ -52,7 +53,7 @@ jobs:
             --build-cache --parallel --stacktrace --no-daemon --max-workers=4
 
       - name: Perform CodeQL Analysis and upload results to GitHub Security tab
-        uses: github/codeql-action/analyze@192325c86100d080feab897ff886c34abd4c83a3 # v3.29.5
+        uses: github/codeql-action/analyze@64d10c13136e1c5bce3e5fbde8d4906eeaafc885 # v3.29.5
 
   trivy:
     name: Analyze changes with Trivy
@@ -69,7 +70,7 @@ jobs:
           submodules: 'recursive'
 
       - name: Cache Gradle dependencies
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.gradle/caches
@@ -85,6 +86,8 @@ jobs:
           rm -rf "${MVN_LOCAL_REPO}/com/datadoghq"
 
       - name: Build and publish artifacts locally
+        env:
+          ORG_GRADLE_PROJECT_akkaRepositoryToken: ${{ secrets.AKKA_REPO_TOKEN }}
         run: |
           GRADLE_OPTS="-Dorg.gradle.jvmargs='-Xmx3G -Xms2G'" \
           JAVA_HOME=$JAVA_HOME_8_X64 \
@@ -115,7 +118,7 @@ jobs:
           TRIVY_JAVA_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-java-db,public.ecr.aws/aquasecurity/trivy-java-db
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@192325c86100d080feab897ff886c34abd4c83a3 # v3.29.5
+        uses: github/codeql-action/upload-sarif@64d10c13136e1c5bce3e5fbde8d4906eeaafc885 # v3.29.5
         if: always()
         with:
           sarif_file: 'trivy-results.sarif'

.github/workflows/check-pull-request-labels.yaml

@@ -0,0 +1,82 @@
+name: Validate PR Label Format
+on:
+  pull_request:
+    types: [opened, edited, ready_for_review, labeled]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check_pr_labels:
+    name: Check pull request labels
+    permissions:
+      issues: write
+      pull-requests: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check pull request labels
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # 8.0.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            // Skip draft pull requests
+            if (context.payload.pull_request.draft) {
+              return
+            }
+            // Define valid label categories
+            const validCategories = [
+              'type:',
+              'comp:',
+              'inst:',
+              'tag:',
+              'performance:',  // To refactor to 'ci: ' in the future
+              'run-tests:'     // Unused since GitLab migration
+            ]
+            // Look for invalid labels
+            const invalidLabels = context.payload.pull_request.labels
+              .map(label => label.name)
+              .filter(label => validCategories.every(prefix => !label.startsWith(prefix)))
+            const hasInvalidLabels = invalidLabels.length > 0
+            // Get existing comments to check for blocking comment
+            const comments = await github.rest.issues.listComments({
+              issue_number: context.payload.pull_request.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo
+            })
+            const commentMarker = '<!-- dd-trace-java-check-pr-labels-workflow -->'
+            const blockingComment = comments.data.find(comment => comment.body.includes(commentMarker))
+            // Create or update blocking comment if there are invalid labels
+            if (hasInvalidLabels) {
+              const commentBody = '**PR Blocked - Invalid Label**\n\n' +
+                `The pull request introduced unexpected labels:\n\n` +
+                invalidLabels.map(label => `* \`${label}\``).join('\n') + '\n\n' +
+                '**This PR is blocked until:**\n' +
+                '1. The invalid labels are deleted, and\n' +
+                '2. A maintainer deletes this comment to unblock the PR\n\n' +
+                '**Note:** Simply removing labels from the pull request is not enough - a maintainer must remove the label and delete this comment to remove the block.\n\n' +
+                commentMarker
+
+              if (blockingComment) {
+                // Update existing blocking comment
+                await github.rest.issues.updateComment({
+                  comment_id: blockingComment.id,
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  body: commentBody
+                })
+              } else {
+                // Create new blocking comment
+                await github.rest.issues.createComment({
+                  issue_number: context.payload.pull_request.number,
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  body: commentBody
+                })
+              }
+              blockingComment = true
+            }
+            if (blockingComment) {
+              // Block the PR by failing the workflow
+              core.setFailed(`PR blocked: Invalid labels detected: (${invalidLabels.join(', ')}). A maintainer must delete the blocking comment after fixing the labels to allow merging.`)
+            }

.github/workflows/prune-old-pull-requests.yaml

@@ -13,7 +13,7 @@ jobs:
       pull-requests: write
     steps:
     - name: Prune old pull requests
-      uses: actions/stale@3a9db7e6a41a89f618792c92c0e97cc736e1b13f # v10.0.0
+      uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10.1.0
       with:
         days-before-stale: -1 # Disable general stale bot
         days-before-pr-stale: 90 # Only enable stale bot for PRs with no activity for 90 days

.github/workflows/run-system-tests.yaml

@@ -29,7 +29,7 @@ jobs:
           fetch-depth: 0
 
       - name: Cache Gradle dependencies
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.gradle/caches
@@ -39,6 +39,8 @@ jobs:
             ${{ runner.os }}-gradle-
 
       - name: Build dd-trace-java
+        env:
+          ORG_GRADLE_PROJECT_akkaRepositoryToken: ${{ secrets.AKKA_REPO_TOKEN }}
         run: |
           GRADLE_OPTS="-Xms2g -Xmx4g -XX:+HeapDumpOnOutOfMemoryError -XX:+UseParallelGC" \
           JAVA_HOME=$JAVA_HOME_8_X64 \
@@ -76,7 +78,7 @@ jobs:
   check:
     name: Check system tests success
     runs-on: ubuntu-latest
-    needs:
-    - main
+    if: ${{ always() }}
+    needs: [build, main]
     steps:
     - run: exit 0

.github/workflows/update-gradle-dependencies.yaml

@@ -26,6 +26,8 @@ jobs:
         id: define-branch
         run: echo "branch=ci/update-gradle-dependencies-$(date +'%Y%m%d')" >> $GITHUB_OUTPUT
       - name: Update Gradle dependencies
+        env:
+          ORG_GRADLE_PROJECT_akkaRepositoryToken: ${{ secrets.AKKA_REPO_TOKEN }}
         run: |
           GRADLE_OPTS="-Dorg.gradle.jvmargs='-Xmx3G -Xms2G'" \
           JAVA_HOME=$JAVA_HOME_8_X64 \

.gitlab-ci.yml

@@ -256,6 +256,7 @@ build:
     DEPENDENCY_CACHE_POLICY: pull
   script:
     - if [ $CI_PIPELINE_SOURCE == "schedule" ] ; then ./gradlew resolveAndLockAll --write-locks $GRADLE_ARGS; fi
+    - ./gradlew --version
     - ./gradlew clean :dd-java-agent:shadowJar :dd-trace-api:jar :dd-trace-ot:shadowJar -PskipTests $GRADLE_ARGS
     - echo UPSTREAM_TRACER_VERSION=$(java -jar workspace/dd-java-agent/build/libs/*.jar) >> upstream.env
     - echo "BUILD_JOB_NAME=$CI_JOB_NAME" >> build.env
@@ -296,6 +297,7 @@ build_tests:
 
   script:
     - *gitlab_base_ref_params
+    - ./gradlew --version
     - ./gradlew clean $GRADLE_TARGET $GRADLE_PARAMS -PskipTests $GRADLE_ARGS
 
 populate_dep_cache:
@@ -362,7 +364,7 @@ spotless:
   stage: tests
   needs: []
   script:
-    - export JAVA_HOME=$JAVA_11_HOME
+    - ./gradlew --version
     - ./gradlew spotlessCheck $GRADLE_ARGS
 
 test_published_artifacts:
@@ -381,6 +383,7 @@ test_published_artifacts:
     - ./gradlew publishToMavenLocal $GRADLE_ARGS
     - cd test-published-dependencies
     - export GRADLE_OPTS="-Dorg.gradle.jvmargs='-Xmx1G -Xms1G -XX:ErrorFile=/tmp/hs_err_pid%p.log -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/tmp'"
+    - ./gradlew --version
     - ./gradlew check --info $GRADLE_ARGS
   after_script:
     - *cgroup_info
@@ -401,6 +404,7 @@ test_published_artifacts:
     CACHE_TYPE: lib
   script:
     - *gitlab_base_ref_params
+    - ./gradlew --version
     - ./gradlew $GRADLE_TARGET $GRADLE_PARAMS -PskipTests -PrunBuildSrcTests -PskipSpotless -PtaskPartitionCount=$NORMALIZED_NODE_TOTAL -PtaskPartition=$NORMALIZED_NODE_INDEX $GRADLE_ARGS
   after_script:
     - *cgroup_info
@@ -461,6 +465,7 @@ muzzle:
     CACHE_TYPE: inst
   script:
     - export SKIP_BUILDSCAN="true"
+    - ./gradlew --version
     - ./gradlew :runMuzzle -PtaskPartitionCount=$NORMALIZED_NODE_TOTAL -PtaskPartition=$NORMALIZED_NODE_INDEX $GRADLE_ARGS
   after_script:
     - *cgroup_info
@@ -482,6 +487,7 @@ muzzle-dep-report:
     CACHE_TYPE: inst
   script:
     - export SKIP_BUILDSCAN="true"
+    - ./gradlew --version
     - ./gradlew generateMuzzleReport muzzleInstrumentationReport $GRADLE_ARGS
   after_script:
     - *cgroup_info
@@ -541,6 +547,7 @@ muzzle-dep-report:
       fi
     - *prepare_test_env
     - export GRADLE_OPTS="-Dorg.gradle.jvmargs='-Xms$GRADLE_MEM -Xmx$GRADLE_MEM $PROFILER_COMMAND -XX:ErrorFile=/tmp/hs_err_pid%p.log -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/tmp' -Ddatadog.forkedMaxHeapSize=1024M -Ddatadog.forkedMinHeapSize=128M"
+    - ./gradlew --version
     - ./gradlew $GRADLE_TARGET $GRADLE_PARAMS -PtestJvm=$testJvm -PtaskPartitionCount=$NORMALIZED_NODE_TOTAL -PtaskPartition=$NORMALIZED_NODE_INDEX $GRADLE_ARGS --continue || $CONTINUE_ON_FAILURE
   after_script:
     - *restore_pretest_env

BUILDING.md

@@ -63,9 +63,6 @@ Requirements to build the full project:
 
 Download and install JDK versions 8, 11, 17, 21 and 25, and GraalVM 17 for your OS.
 
-> [!NOTE]
-> While Temurin JDK 25 from [Eclipse Temurin releases](https://adoptium.net/temurin/releases/) has not been released, please download the OpenJDK EA version at [this link](https://jdk.java.net/25/). Add the required environment variable using an `export` command along the lines of `export JAVA_25_HOME=/Library/Java/JavaVirtualMachines/jdk-25.jdk/Contents/Home`. Then, confirm that this was set properly by executing `echo $JAVA_25_HOME`.
-
 #### macOS
 
 * Install the required JDKs using `brew`: