Merge remote-tracking branch 'origin/master' into mcculls/context-continuations

Author: mcculls

.github/chainguard/self.gitlab.release.sts.yaml

@@ -1,11 +1,11 @@
 issuer: https://gitlab.ddbuild.io
 
-subject_pattern: "project_path:DataDog/apm-reliability/dd-trace-java:ref_type:tag:ref:v.*"
+subject_pattern: 'project_path:DataDog/apm-reliability/dd-trace-java:ref_type:tag:ref:v\d+\.\d+\.\d+'
 
 claim_pattern:
   project_path: "DataDog/apm-reliability/dd-trace-java"
   ref_type: "tag"
-  ref: "v.*"
+  ref: 'v\d+\.\d+\.\d+'
 
 permissions:
   contents: "write"

.github/scripts/dependency_age.py

@@ -551,6 +551,8 @@ def build_validation_summary(
         blocks.append(
             "### :warning: Cannot verify age, reverted\n\n"
             "The age of these dependencies could not be verified, so the lockfiles were reverted. "
+            "This likely means that the following dependencies are published to a repo not yet configured in the workflow. "
+            "If this is the case, add the missing repository as a `--repo-url` in the `Validate changed lock files` step of `.github/workflows/update-gradle-dependencies.yaml`. "
             "**This needs to be resolved manually.**\n\n"
             + "\n".join(sorted(unverified))
         )

.github/workflows/update-gradle-dependencies.yaml

@@ -68,14 +68,22 @@ jobs:
             --min-age-hours "${MIN_DEPENDENCY_AGE_HOURS}" \
             --repo-url "https://repo1.maven.org/maven2" \
             --repo-url "https://repo.akka.io/${AKKA_REPO_TOKEN}/secure" \
+            --repo-url "https://packages.confluent.io/maven" \
+            --repo-url "https://repository.mulesoft.org/releases" \
+            --repo-url "https://repository.mulesoft.org/nexus/content/repositories/public" \
             --github-output "$GITHUB_OUTPUT"
 
       - name: Save instrumentation lock files
         run: |
           mkdir -p /tmp/instrumentation-lockfiles
           find dd-smoke-tests dd-java-agent/instrumentation -name 'gradle.lockfile' -exec cp --parents {} /tmp/instrumentation-lockfiles/ \;
-          # Restore instrumentation dirs to original state (keep only core changes)
+          # Restore instrumentation dirs to original state (keep only core changes).
+          # git restore only reverts tracked files; brand-new lock files are untracked
+          # and would otherwise leak into the core PR, so delete the untracked ones too.
           git restore -- 'dd-smoke-tests/' 'dd-java-agent/instrumentation/'
+          git ls-files --others --exclude-standard -- \
+            'dd-smoke-tests/*gradle.lockfile' 'dd-java-agent/instrumentation/*gradle.lockfile' \
+            | xargs -r rm -f
 
       # ==================== Core modules PR ====================
       - name: Check if core changes exist

.github/workflows/update-smoke-test-latest-versions.yaml

@@ -68,6 +68,8 @@ jobs:
             --artifact-id maven-surefire-plugin \
             --prerelease-pattern alpha \
             --prerelease-pattern beta \
+            --prerelease-pattern rc \
+            --prerelease-pattern '-m\d' \
             --min-age-hours "${MIN_DEPENDENCY_AGE_HOURS}" \
             --current-version "${{ steps.current.outputs.surefire_version }}" \
             --github-output "$GITHUB_OUTPUT"

.gitlab-ci.yml

@@ -49,7 +49,7 @@ variables:
   BUILD_JOB_NAME: "build"
   DEPENDENCY_CACHE_POLICY: pull
   BUILD_CACHE_POLICY: pull
-  GRADLE_VERSION: "9.5.1" # must match gradle-wrapper.properties
+  GRADLE_VERSION: "9.6.0" # must match gradle-wrapper.properties
   MASS_READ_URL: "https://mass-read.us1.ddbuild.io"
   MAVEN_REPOSITORY_PROXY: "https://depot-read-api-java.us1.ddbuild.io/magicmirror/magicmirror/@current/"
   GRADLE_PLUGIN_PROXY: "https://depot-read-api-java.us1.ddbuild.io/magicmirror/magicmirror/@current/"
@@ -242,8 +242,9 @@ default:
       EOF
     - mkdir -p .gradle
     - export GRADLE_USER_HOME=$(pwd)/.gradle
-    # replace maven central part by MAVEN_REPOSITORY_PROXY in .mvn/wrapper/maven-wrapper.properties
-    - sed -i "s|https://repo.maven.apache.org/maven2/|$MAVEN_REPOSITORY_PROXY|g" .mvn/wrapper/maven-wrapper.properties
+    # Apache Maven Wrapper supports MVNW_REPOURL for repository-manager downloads:
+    # https://maven.apache.org/tools/wrapper/#Using_a_Maven_Repository_Manager
+    - export MVNW_REPOURL=${MAVEN_REPOSITORY_PROXY%/}
     # Route Gradle distribution download through MASS pull-through cache
     - |
       mass_read_host="${MASS_READ_URL#https://}"
@@ -336,7 +337,7 @@ build:
   script:
     - if [ $CI_PIPELINE_SOURCE == "schedule" ] ; then ./gradlew resolveAndLockAll --write-locks $GRADLE_ARGS; fi
     - ./gradlew --version
-    - ./gradlew clean :dd-java-agent:shadowJar :dd-trace-api:jar :dd-trace-ot:shadowJar -PskipTests $GRADLE_ARGS
+    - ./gradlew clean :dd-java-agent:shadowJar :dd-java-agent:check :dd-trace-api:jar :dd-trace-ot:shadowJar -PskipTests -x spotlessCheck $GRADLE_ARGS
     - echo UPSTREAM_TRACER_VERSION=$(java -jar workspace/dd-java-agent/build/libs/*.jar) >> upstream.env
     - echo "BUILD_JOB_NAME=$CI_JOB_NAME" >> build.env
     - echo "BUILD_JOB_ID=$CI_JOB_ID" >> build.env
@@ -784,7 +785,9 @@ muzzle-dep-report:
     # and Gradle does `chmod 700 .gradle` on startup which requires user ownership.
     - sudo chown -R 1001:1001 .gradle
     - export GRADLE_USER_HOME=$(pwd)/.gradle
-    - sed -i "s|https://repo.maven.apache.org/maven2/|$MAVEN_REPOSITORY_PROXY|g" .mvn/wrapper/maven-wrapper.properties
+    # Apache Maven Wrapper supports MVNW_REPOURL for repository-manager downloads:
+    # https://maven.apache.org/tools/wrapper/#Using_a_Maven_Repository_Manager
+    - export MVNW_REPOURL=${MAVEN_REPOSITORY_PROXY%/}
     - *normalize_node_index
     - *prepare_test_env
     # Disable CDS in forked JVMs to avoid SIGSEGVs on Linux arm64.

.gitlab/java-benchmark-configs.yml

@@ -50,6 +50,10 @@ linux-java-spring-petclinic-load-parallel:
   needs: ["publish-artifacts-to-s3"]
   rules: *parallel_benchmark_rules
 
+linux-java-spring-petclinic-sca-load-parallel:
+  needs: ["publish-artifacts-to-s3"]
+  rules: *parallel_benchmark_rules
+
 linux-java-insecure-bank-startup-parallel:
   needs: ["publish-artifacts-to-s3"]
   rules: *parallel_startup_benchmark_rules

build-logic/smoke-test/build.gradle.kts

@@ -32,7 +32,7 @@ gradlePlugin {
 @Suppress("UnstableApiUsage")
 testing {
   suites {
-    val test by getting(JvmTestSuite::class) {
+    named<JvmTestSuite>("test") {
       useJUnitJupiter(libs.versions.junit5)
       dependencies {
         implementation(libs.junit.jupiter)

build-logic/smoke-test/src/main/kotlin/datadog/buildlogic/smoketest/NestedGradleBuild.kt

@@ -113,6 +113,11 @@ abstract class NestedGradleBuild @Inject constructor(
   @get:Input
   abstract val buildCacheEnabled: Property<Boolean>
 
+  /** Timeout, in seconds, for stopping the nested Gradle daemon after the build. */
+  @get:Input
+  @get:Optional
+  abstract val stopTimeoutSeconds: Property<Long>
+
   /**
    * Extra environment variables for the nested Gradle daemon. Merged on top of the outer process
    * environment; Gradle launcher variables are reserved by this task so nested builds do not
@@ -236,9 +241,17 @@ abstract class NestedGradleBuild @Inject constructor(
       }
 
       val process = processBuilder.start()
-      if (!process.waitFor(GRADLE_STOP_TIMEOUT_SECONDS, TimeUnit.SECONDS)) {
+      val timeoutSeconds = stopTimeoutSeconds.orNull
+      val completed =
+        if (timeoutSeconds == null) {
+          process.waitFor()
+          true
+        } else {
+          process.waitFor(timeoutSeconds, TimeUnit.SECONDS)
+        }
+      if (!completed) {
         process.destroyForcibly()
-        logger.warn("Timed out while stopping nested Gradle daemon")
+        logger.warn("Timed out after {} seconds while stopping nested Gradle daemon", timeoutSeconds)
         return
       }
       val exitCode = process.exitValue()
@@ -270,13 +283,6 @@ abstract class NestedGradleBuild @Inject constructor(
         file.parentFile?.name == "bin"
     }
 
-  private fun gradleExecutableName(): String =
-    if (System.getProperty("os.name").lowercase().contains("windows")) {
-      "gradle.bat"
-    } else {
-      "gradle"
-    }
-
   private fun createGradleUserHome(): File {
     val directory = temporaryDir.resolve("gradle-user-home")
     deleteGradleUserHome(directory)
@@ -294,8 +300,13 @@ abstract class NestedGradleBuild @Inject constructor(
     }
   }
 
-  private companion object {
-    const val GRADLE_STOP_TIMEOUT_SECONDS = 30L
+  companion object {
+    internal fun gradleExecutableName(osName: String = System.getProperty("os.name")): String =
+      if (isWindows(osName)) {
+        "gradle.bat"
+      } else {
+        "gradle"
+      }
   }
 }
 

build-logic/smoke-test/src/main/kotlin/datadog/buildlogic/smoketest/NestedMavenBuild.kt

@@ -0,0 +1,201 @@
+package datadog.buildlogic.smoketest
+
+import org.gradle.api.DefaultTask
+import org.gradle.api.GradleException
+import org.gradle.api.file.DirectoryProperty
+import org.gradle.api.file.FileTree
+import org.gradle.api.file.RegularFileProperty
+import org.gradle.api.model.ObjectFactory
+import org.gradle.api.provider.ListProperty
+import org.gradle.api.provider.MapProperty
+import org.gradle.api.provider.Property
+import org.gradle.api.tasks.CacheableTask
+import org.gradle.api.tasks.IgnoreEmptyDirectories
+import org.gradle.api.tasks.Input
+import org.gradle.api.tasks.InputFile
+import org.gradle.api.tasks.InputFiles
+import org.gradle.api.tasks.Internal
+import org.gradle.api.tasks.Nested
+import org.gradle.api.tasks.Optional
+import org.gradle.api.tasks.OutputDirectory
+import org.gradle.api.tasks.PathSensitive
+import org.gradle.api.tasks.PathSensitivity
+import org.gradle.api.tasks.TaskAction
+import org.gradle.jvm.toolchain.JavaLanguageVersion
+import org.gradle.jvm.toolchain.JavaLauncher
+import org.gradle.jvm.toolchain.JavaToolchainService
+import java.io.File
+import java.util.concurrent.TimeUnit
+import javax.inject.Inject
+
+/**
+ * Runs a nested Maven build inside [applicationDir] via the root Maven wrapper.
+ *
+ * The nested build is expected to honour `-Dtarget.dir=<path>` and write outputs under that
+ * directory so Gradle can track the artifact under [applicationBuildDir].
+ */
+@CacheableTask
+abstract class NestedMavenBuild @Inject constructor(
+  private val objects: ObjectFactory,
+  javaToolchains: JavaToolchainService,
+) : DefaultTask() {
+
+  init {
+    javaLauncher.convention(
+      javaToolchains.launcherFor {
+        languageVersion.set(JavaLanguageVersion.of(DEFAULT_NESTED_JAVA_VERSION))
+      },
+    )
+    goals.convention(listOf("package"))
+    arguments.convention(emptyList())
+    environment.convention(emptyMap())
+    mavenOpts.convention("")
+    useMavenLocalRepository.convention(false)
+  }
+
+  @get:Internal
+  abstract val applicationDir: DirectoryProperty
+
+  @get:InputFiles
+  @get:IgnoreEmptyDirectories
+  @get:PathSensitive(PathSensitivity.RELATIVE)
+  val applicationSources: FileTree =
+    objects.fileTree().from(applicationDir).matching {
+      exclude("target/**")
+    }
+
+  @get:OutputDirectory
+  abstract val applicationBuildDir: DirectoryProperty
+
+  @get:InputFile
+  @get:PathSensitive(PathSensitivity.RELATIVE)
+  abstract val mavenExecutable: RegularFileProperty
+
+  @get:InputFiles
+  @get:IgnoreEmptyDirectories
+  @get:PathSensitive(PathSensitivity.RELATIVE)
+  val mavenWrapperFiles: FileTree =
+    objects.fileTree().from(project.rootProject.layout.projectDirectory.dir(".mvn/wrapper")).matching {
+      include("maven-wrapper.properties", "maven-wrapper.jar")
+    }
+
+  @get:Nested
+  abstract val javaLauncher: Property<JavaLauncher>
+
+  @get:Input
+  abstract val goals: ListProperty<String>
+
+  @get:Input
+  abstract val arguments: ListProperty<String>
+
+  @get:Input
+  abstract val environment: MapProperty<String, String>
+
+  @get:Input
+  @get:Optional
+  abstract val mavenOpts: Property<String>
+
+  @get:Input
+  @get:Optional
+  abstract val mavenRepositoryProxy: Property<String>
+
+  @get:Input
+  abstract val useMavenLocalRepository: Property<Boolean>
+
+  /** Timeout, in seconds, for the nested Maven build process. */
+  @get:Input
+  @get:Optional
+  abstract val buildTimeoutSeconds: Property<Long>
+
+  @get:Internal
+  abstract val mavenLocalRepository: DirectoryProperty
+
+  @TaskAction
+  fun runNestedBuild() {
+    val appDir = applicationDir.get().asFile
+    val appBuildDirFile = applicationBuildDir.get().asFile
+    val targetDir = appBuildDirFile.resolve("target")
+    val daemonJavaHome = javaLauncher.get().metadata.installationPath.asFile
+    val command = mavenCommand(mavenExecutable.get().asFile).apply {
+      add("-Dtarget.dir=${targetDir.absolutePath}")
+      if (useMavenLocalRepository.get()) {
+        add("-Dmaven.repo.local=${mavenLocalRepository.get().asFile.absolutePath}")
+      }
+      addAll(arguments.get())
+      addAll(goals.get())
+    }
+
+    val process = ProcessBuilder(command)
+      .directory(appDir)
+      .redirectOutput(ProcessBuilder.Redirect.INHERIT)
+      .redirectError(ProcessBuilder.Redirect.INHERIT)
+      .apply {
+        environment().apply {
+          clear()
+          putAll(nestedEnvironment(daemonJavaHome))
+        }
+      }
+      .start()
+
+    try {
+      val timeoutSeconds = buildTimeoutSeconds.orNull
+      val completed =
+        if (timeoutSeconds == null) {
+          process.waitFor()
+          true
+        } else {
+          process.waitFor(timeoutSeconds, TimeUnit.SECONDS)
+        }
+      if (!completed) {
+        process.destroyForcibly()
+        throw GradleException(
+          "Nested Maven build timed out after $timeoutSeconds seconds: " +
+            command.joinToString(" "),
+        )
+      }
+    } catch (e: InterruptedException) {
+      process.destroyForcibly()
+      Thread.currentThread().interrupt()
+      throw GradleException("Interrupted while running nested Maven build", e)
+    }
+    val exitCode = process.exitValue()
+    if (exitCode != 0) {
+      throw GradleException(
+        "Nested Maven build failed with exit code $exitCode: ${command.joinToString(" ")}",
+      )
+    }
+  }
+
+  private fun nestedEnvironment(daemonJavaHome: File): Map<String, String> {
+    val env = System.getenv().toMutableMap()
+    val repositoryProxy = mavenRepositoryProxy.orNull?.takeIf { it.isNotBlank() }
+    if (repositoryProxy != null) {
+      env["MAVEN_REPOSITORY_PROXY"] = repositoryProxy
+      env.putIfAbsent("MVNW_REPOURL", repositoryProxy.trimEnd('/'))
+    }
+    val opts = mavenOpts.orNull
+    if (!opts.isNullOrBlank()) {
+      env["MAVEN_OPTS"] = opts
+    }
+    env["JAVA_HOME"] = daemonJavaHome.absolutePath
+    env.putAll(environment.get())
+    return env
+  }
+
+  private fun mavenCommand(executable: File): MutableList<String> =
+    if (isWindows()) {
+      mutableListOf("cmd", "/c", executable.absolutePath)
+    } else {
+      mutableListOf(executable.absolutePath)
+  }
+
+  companion object {
+    internal fun mavenWrapperName(osName: String = System.getProperty("os.name")): String =
+      if (isWindows(osName)) {
+        "mvnw.cmd"
+      } else {
+        "mvnw"
+      }
+
+  }
+}

build-logic/smoke-test/src/main/kotlin/datadog/buildlogic/smoketest/OperatingSystem.kt

@@ -0,0 +1,7 @@
+package datadog.buildlogic.smoketest
+
+import java.util.Locale
+
+internal fun isWindows(osName: String = System.getProperty("os.name")): Boolean =
+  osName.lowercase(Locale.ROOT).contains("windows")
+