Merge branch 'master' into alejandro.gonzalez/sca-reachability-add-symbols

Author: jandro996

.github/chainguard/self.gitlab.release.sts.yaml

@@ -1,11 +1,11 @@
 issuer: https://gitlab.ddbuild.io
 
-subject_pattern: "project_path:DataDog/apm-reliability/dd-trace-java:ref_type:tag:ref:v.*"
+subject_pattern: 'project_path:DataDog/apm-reliability/dd-trace-java:ref_type:tag:ref:v\d+\.\d+\.\d+'
 
 claim_pattern:
   project_path: "DataDog/apm-reliability/dd-trace-java"
   ref_type: "tag"
-  ref: "v.*"
+  ref: 'v\d+\.\d+\.\d+'
 
 permissions:
   contents: "write"

.github/scripts/dependency_age.py

@@ -439,7 +439,7 @@ def validate_lockfiles(args: argparse.Namespace) -> int:
             elif published_at > cutoff:
                 hours_remaining = int((published_at - cutoff).total_seconds() / 3600) + 1
                 group_id, artifact_id, version = gav.split(":", 2)
-                baseline_version = next((c[len(f"{group_id}:{artifact_id}:"):] for c in baseline_coords if c.startswith(f"{group_id}:{artifact_id}:")), None)
+                baseline_version = highest_baseline_version(baseline_coords, group_id, artifact_id)
                 eligible = find_eligible_version(
                     group_id=group_id, artifact_id=artifact_id,
                     too_new_version=version, baseline_version=baseline_version,
@@ -678,6 +678,15 @@ def fetch_available_versions(group_id: str, artifact_id: str, repo_urls: list[st
     return []
 
 
+# select the highest baseline version of group:artifact present in a lockfile.
+def highest_baseline_version(baseline_coords: set[str], group_id: str, artifact_id: str) -> str | None:
+    prefix = f"{group_id}:{artifact_id}:"
+    versions = [coord[len(prefix):] for coord in baseline_coords if coord.startswith(prefix)]
+    if not versions:
+        return None
+    return max(versions, key=_version_sort_key)
+
+
 # for a too-new coordinate, walk backward through available versions to find the newest one
 # that meets the age cutoff and is newer than the baseline version
 def find_eligible_version(

.github/scripts/tests/test_dependency_age.py

@@ -1,3 +1,6 @@
+import argparse
+import contextlib
+import io
 import json
 import os
 import re
@@ -6,7 +9,9 @@
 import sys
 import tempfile
 import unittest
+from datetime import datetime, timezone
 from pathlib import Path
+from unittest import mock
 
 REPO_ROOT = Path(__file__).resolve().parents[3]
 SCRIPT = REPO_ROOT / ".github/scripts/dependency_age.py"
@@ -469,6 +474,24 @@ def test_summary_groups_outcomes_into_sections(self) -> None:
         self.assertIn("com.example:update-lib:4.0.0", updated_block)
         self.assertIn("updated to `3.9.0`", updated_block)
 
+    def test_highest_baseline_version_picks_newest_of_coexisting_pins(self) -> None:
+        # A single lockfile can pin the same artifact at several versions (one per Gradle
+        # configuration). The baseline should be the newest so that only versions higher than
+        # the highest existing version are considered upgrades.
+        baseline_coords = {
+            "ch.qos.logback:logback-core:1.1.11",
+            "ch.qos.logback:logback-core:1.2.13",
+            "ch.qos.logback:logback-core:1.5.34",
+            "com.example:unrelated:9.9.9",
+        }
+        self.assertEqual(
+            dependency_age.highest_baseline_version(baseline_coords, "ch.qos.logback", "logback-core"),
+            "1.5.34",
+        )
+        self.assertIsNone(
+            dependency_age.highest_baseline_version(baseline_coords, "ch.qos.logback", "logback-classic")
+        )
+
     def test_summary_omits_empty_sections(self) -> None:
         # only too-new violations -> only the "reverted" section should appear
         summary = dependency_age.build_validation_summary(

.github/workflows/add-release-to-cloudfoundry.yaml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout "cloudfoundry" branch
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 7.0.0
         with:
           ref: cloudfoundry
       - name: Get release version

.github/workflows/analyze-changes.yaml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 7.0.0
         with:
           submodules: 'recursive'
       - name: Cache Gradle dependencies
@@ -55,7 +55,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 7.0.0
         with:
           submodules: 'recursive'
 

.github/workflows/create-release-branch.yaml

@@ -43,7 +43,7 @@ jobs:
           echo "branch=release/${TAG%.0}.x" >> "$GITHUB_OUTPUT"
 
       - name: Check out repo at tag
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 7.0.0
         with:
           ref: ${{ steps.determine-tag.outputs.tag }}
 
@@ -82,7 +82,7 @@ jobs:
           policy: self.pin-system-tests.create-pr
 
       - name: Check out repo at release branch
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 7.0.0
         with:
           ref: ${{ needs.create-release-branch.outputs.release-branch-name }}
 

.github/workflows/run-system-tests.yaml

@@ -24,7 +24,7 @@ jobs:
       group: APM Larger Runners
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 7.0.0
         with:
           submodules: 'recursive'
           fetch-depth: 0

.github/workflows/update-gradle-dependencies.yaml

@@ -21,11 +21,11 @@ jobs:
           policy: self.update-gradle-dependencies.create-pr
 
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 7.0.0
         with:
           submodules: "recursive"
 
-      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
         with:
           distribution: 'temurin'
           java-version: '21'

.github/workflows/update-jmxfetch-submodule.yaml

@@ -19,7 +19,7 @@ jobs:
           policy: self.update-jmxfetch-submodule.create-pr
 
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 7.0.0
 
       - name: Update Submodule
         run: |

.github/workflows/update-smoke-test-latest-versions.yaml

@@ -21,7 +21,7 @@ jobs:
           policy: self.update-smoke-test-latest-versions.create-pr
 
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 7.0.0
 
       - name: Define branch name
         id: define-branch