Merge branch 'main' of github.com:DataDog/java-profiler into r1viollet/thread_filter_squash

Author: r1viollet

.github/actions/pr_comment/action.yml

@@ -0,0 +1,57 @@
+name: "Upsert PR Comment with Octo-STS"
+description: >
+  Exchanges OIDC for an Octo-STS GitHub-App token and
+  creates or updates a single comment on the PR.
+
+inputs:
+  body-file:
+    description: "Path to file whose contents become the comment body"
+    required: true
+  repo:        # optional; defaults to triggering repo
+    description: "Repository (owner/repo)."
+    required: false
+  pr-number:   # optional; defaults to triggering PR
+    description: "Pull-request number."
+    required: false
+
+runs:
+  using: "composite"
+  steps:
+    # 1. Get installation token from DD-Octo-STS
+    - name: Obtain Octo-STS token
+      id: octo-sts
+      uses: DataDog/dd-octo-sts-action@08f2144903ced3254a3dafec2592563409ba2aa0 # v1.0.1
+      with:
+        audience: dd-octo-sts
+        scope: DataDog/java-profiler
+        policy: self.pr-comment
+
+    # 2. Upsert the comment
+    - name: Upsert PR comment
+      env:
+        GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
+        BODY_FILE: ${{ inputs['body-file'] }}
+        REPO: ${{ inputs.repo || github.repository }}
+        PR:   ${{ inputs['pr-number'] || github.event.pull_request.number }}
+      shell: bash
+      run: |
+        if [[ -s "$BODY_FILE" ]]; then
+          set -e
+          # find last comment by this actor
+          # first, build a jq filter that embeds the actor’s login
+          filter=".[] | select(.user.login == \"${GITHUB_ACTOR}\") | .id"
+          cid=$(gh api "repos/$REPO/issues/$PR/comments?per_page=100" \
+                --jq "${filter}" | tail -n1)
+  
+          if [[ -n "$cid" ]]; then
+            gh api --method PATCH "repos/$REPO/issues/comments/$cid" \
+              --raw-field body="$(< "$BODY_FILE")"
+            echo "✏️  Updated comment $cid"
+          else
+            gh api --method POST "repos/$REPO/issues/$PR/comments" \
+              --raw-field body="$(< "$BODY_FILE")"
+            echo "💬  Created new comment"
+          fi
+        else
+          echo "⚠️  Skipping empty comment"
+        fi

.github/actions/upsert-pr-comment/action.yml

@@ -0,0 +1,14 @@
+issuer: https://token.actions.githubusercontent.com
+
+subject: repo:DataDog/java-profiler:pull_request
+
+claim_pattern:
+  event_name: pull_request_target
+  ref: refs/heads/main
+  ref_protected: "true"
+  job_workflow_ref: DataDog/java-profiler/\.github/workflows/approve-trivial\.yml@refs/heads/main
+
+permissions:
+  contents: read
+  pull_requests: write
+

.github/chainguard/self.approve-trivial.approve-pr.sts.yaml

@@ -0,0 +1,13 @@
+issuer: https://token.actions.githubusercontent.com
+
+subject: repo:DataDog/java-profiler:pull_request
+claim_pattern:
+  event_name: pull_request
+  # target only the codecheck workflow, but we may extend it later
+  job_workflow_ref: DataDog/java-profiler/.github/workflows/codecheck.yml@.*
+
+permissions:
+  issues: write
+  contents: read
+  metadata: read
+  pull_requests: write

.github/chainguard/self.pr-comment.sts.yaml

@@ -4,16 +4,19 @@ on:
   pull_request_target:
     types: [labeled]
 
-permissions:
-  pull-requests: write
-  contents: read
-
 jobs:
   auto-approve:
     if: contains(github.event.pull_request.labels.*.name, 'trivial') || contains(github.event.pull_request.labels.*.name, 'no-review')
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write # Needed to federate tokens
     steps:
+      - uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
+        id: octo-sts
+        with:
+          scope: DataDog/java-profiler
+          policy: self.approve-trivial.approve-pr
       - name: Auto-approve PR
         uses: hmarr/auto-approve-action@v4
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+          github-token: ${{ steps.octo-sts.outputs.token }}

.github/workflows/approve-trivial.yml

@@ -6,11 +6,13 @@ concurrency:
 
 on:
   pull_request:
+    types: [opened, synchronize, reopened]
 
 permissions:
   contents: read
   pull-requests: write
   actions: read
+  id-token: write
 
 jobs:
   scan-build:
@@ -46,13 +48,10 @@ jobs:
         id: read-report
         run: |
           find ddprof-lib/build/reports/scan-build -name 'index.html' | xargs -I {} python .github/scripts/python_utils.py scanbuild_cleanup {} ${HEAD_REF} > comment.html
-      - name: Post or update PR comment
-        uses: ./.github/actions/pr_comment
+      - name: Comment on PR
+        uses: ./.github/actions/upsert-pr-comment
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          comment-id: "scan-build"
-          commenter: "pr-comment-scanbuild"
-          comment-file: 'comment.html'
+          body-file: comment.html
 
   cppcheck:
     if: needs.check-for-pr.outputs.skip != 'true'
@@ -90,13 +89,11 @@ jobs:
           path: |
             report.html
             report.xml
-      - name: Post or update PR comment
-        uses: ./.github/actions/pr_comment
+      - name: Comment on PR
+        uses: ./.github/actions/upsert-pr-comment
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          comment-id: "cppcheck"
-          commenter: "pr-comment-cppcheck"
-          comment-file: 'comment.html'
+          body-file: comment.html
+
   codeql:
     if: needs.check-for-pr.outputs.skip != 'true'
     runs-on: ubuntu-latest

.github/workflows/codecheck.yml

@@ -31,7 +31,7 @@ cd java-profiler
 
 2. Build a release version of the project:
 ```bash
-./gradle buildRelease
+./gradlew buildRelease
 ```
 
 The resulting artifact will be in `ddprof-lib/build/libs/ddprof-<version>.jar`

README.md

@@ -14,7 +14,7 @@ plugins {
   id "com.diffplug.spotless" version "6.11.0"
 }
 
-version = "1.29.0"
+version = "1.30.0"
 
 apply plugin: "com.dipien.semantic-version"
 version = project.findProperty("ddprof_version") ?: version
@@ -81,6 +81,11 @@ nexusPublishing {
       // staging repo publishing https://central.sonatype.org/publish/publish-portal-ossrh-staging-api/#configuration
       // snapshot publishing https://central.sonatype.org/publish/publish-portal-snapshots/#publishing-via-other-methods
       sonatype {
+        // see https://central.sonatype.org/publish/publish-portal-ossrh-staging-api/#configuration
+        // see https://github.com/gradle-nexus/publish-plugin#publishing-to-maven-central-via-sonatype-central
+        // Also for official doc
+        // staging repo publishing https://central.sonatype.org/publish/publish-portal-ossrh-staging-api/#configuration
+        // snapshot publishing https://central.sonatype.org/publish/publish-portal-snapshots/#publishing-via-other-methods
         nexusUrl.set(uri("https://ossrh-staging-api.central.sonatype.com/service/local/"))
         snapshotRepositoryUrl.set(uri("https://central.sonatype.com/repository/maven-snapshots/"))
 

build.gradle

@@ -113,6 +113,9 @@ def createDebugLinkTask(config, linkTask, extractDebugTask) {
     dependsOn extractDebugTask
     description = 'Add debug link to the original library'
 
+    inputs.files linkTask, extractDebugTask
+    outputs.file { linkTask.get().linkedFile.get().asFile }
+
     doFirst {
       def sourceFile = linkTask.get().linkedFile.get().asFile
       def debugFile = getDebugFilePath(config)
@@ -265,7 +268,34 @@ tasks.register('copyExternalLibs', Copy) {
 def cloneAPTask = tasks.register('cloneAsyncProfiler') {
   description = 'Clones async-profiler repo if directory is missing or updates it if commit hash differs'
   inputs.file("${rootDir}/gradle/ap-lock.properties")
-  doFirst {
+  outputs.dir("${projectDir}/build/async-profiler")
+  outputs.upToDateWhen {
+    def targetDir = file("${projectDir}/build/async-profiler")
+    if (!targetDir.exists()) {
+      return false
+    }
+    def currentCommit = ""
+    try {
+      new ByteArrayOutputStream().withStream { os ->
+        exec {
+          workingDir targetDir.absolutePath
+          commandLine 'git', 'rev-parse', 'HEAD'
+          standardOutput = os
+        }
+        currentCommit = os.toString().trim()
+      }
+      return currentCommit == commit_lock
+    } catch (Exception e) {
+      return false
+    }
+  }
+  doLast {
+    // Fix for CI environments where git detects dubious ownership
+    exec {
+      commandLine 'git', 'config', '--global', '--add', 'safe.directory', projectDir.parentFile.absolutePath
+      ignoreExitValue = true  // Don't fail if this command fails
+    }
+
     def targetDir = file("${projectDir}/build/async-profiler")
     if (!targetDir.exists()) {
       println "Cloning missing async-profiler git subdirectory..."
@@ -277,6 +307,13 @@ def cloneAPTask = tasks.register('cloneAsyncProfiler') {
         commandLine 'git', 'checkout', commit_lock
       }
     } else {
+      // Also fix git ownership for existing directory
+      exec {
+        workingDir targetDir.absolutePath
+        commandLine 'git', 'config', '--global', '--add', 'safe.directory', targetDir.absolutePath
+        ignoreExitValue = true
+      }
+
       def currentCommit = ""
       new ByteArrayOutputStream().withStream { os ->
         exec {
@@ -336,6 +373,9 @@ def patchStackFrame = tasks.register("patchStackFrame") {
   configure {
     dependsOn copyUpstreamFiles
   }
+  inputs.files copyUpstreamFiles
+  outputs.file("${projectDir}/src/main/cpp-external/stackFrame_x64.cpp")
+
   doLast {
     def file = file("${projectDir}/src/main/cpp-external/stackFrame_x64.cpp")
     if (!file.exists()) throw new GradleException("File not found: ${file}")
@@ -386,8 +426,11 @@ def patchStackFrame = tasks.register("patchStackFrame") {
 def patchStackWalker = tasks.register("patchStackWalker") {
   description = 'Patch stackWalker.cpp after copying'
   configure {
-    dependsOn copyUpstreamFiles
+    dependsOn copyUpstreamFiles, patchStackFrame
   }
+  inputs.files copyUpstreamFiles
+  outputs.file("${projectDir}/src/main/cpp-external/stackWalker.cpp")
+
   doLast {
     def file = file("${projectDir}/src/main/cpp-external/stackWalker.cpp")
     if (!file.exists()) throw new GradleException("File not found: ${file}")
@@ -644,10 +687,6 @@ gradle.projectsEvaluated {
           copyTask.dependsOn linkTask
         }
       }
-      def gtestTask = project(':ddprof-lib:gtest').tasks.findByName("gtest${it.capitalize()}")
-      if (gtestTask != null) {
-        linkTask.dependsOn gtestTask
-      }
     }
     def javadocTask = tasks.findByName("javadoc")
     def copyReleaseLibs = tasks.findByName("copyReleaseLibs")

ddprof-lib/build.gradle

@@ -199,7 +199,8 @@ tasks.whenTaskAdded { task ->
               }
 
               inputs.files binary
-              outputs.upToDateWhen {true}
+              // Test tasks should run every time the test command is run
+              outputs.upToDateWhen { false }
             }
 
             def compileTask = tasks.findByName("compileGtest${config.name.capitalize()}_${testName}")