Merge branch 'main' into maximo/otlp-runtime-metrics-test

Author: link04

.github/workflows/run-end-to-end.yml

@@ -101,6 +101,11 @@ on:
         default: "datadoghq.com"
         required: false
         type: string
+      _system_tests_dev_mode:
+        description: "Shall we run system tests in dev mode (library and agent dev binary)"
+        default: false
+        required: false
+        type: boolean
 
 jobs:
   main:
@@ -111,6 +116,7 @@ jobs:
       SYSTEM_TESTS_REPORT_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
       SYSTEM_TESTS_SKIP_EMPTY_SCENARIO: ${{ inputs.skip_empty_scenarios }}
       SYSTEM_TESTS_FORCE_EXECUTE: ${{ inputs.force_execute }}
+      SYSTEM_TESTS_DEV_MODE: ${{ inputs._system_tests_dev_mode }}
     steps:
     - name: Compute ref
       id: compute_ref

.github/workflows/stale-prs.yml

@@ -0,0 +1,35 @@
+name: Close stale PRs
+
+on:
+  schedule:
+    - cron: '0 9 * * 1'  # Every Monday at 09:00 UTC
+  workflow_dispatch:
+
+jobs:
+  stale:
+    name: Mark and close stale PRs
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+
+    steps:
+      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
+        with:
+          # Only touch PRs, not issues
+          days-before-issue-stale: -1
+          days-before-issue-close: -1
+
+          # Mark a PR stale after 1 year of no activity
+          days-before-pr-stale: 365
+          # Close it 2 weeks after the stale warning, if still no activity
+          days-before-pr-close: 14
+
+          stale-pr-label: stale
+          stale-pr-message: >
+            This PR has had no activity for over a year. It will be closed in 2 weeks
+            unless there is new activity or the `stale` label is removed.
+          close-pr-message: >
+            Closing this PR due to inactivity. Feel free to reopen if the work is still relevant.
+
+          # Exempt PRs whose authors are members or collaborators
+          exempt-pr-labels: 'do-not-close,pinned'

.github/workflows/system-tests.yml

@@ -177,6 +177,7 @@ jobs:
     secrets: inherit
     permissions:
       id-token: write
+      contents: read
     with:
       library: ${{ inputs.library }}
       ref: ${{ inputs.ref }}
@@ -265,6 +266,7 @@ jobs:
     secrets: inherit
     permissions:
       id-token: write
+      contents: read
     with:
       runs_on: ${{ matrix.job.runs_on }}
       library: ${{ matrix.job.library }}
@@ -285,6 +287,7 @@ jobs:
       _build_proxy_image: ${{ inputs._build_proxy_image }}
       _build_lambda_proxy_image: ${{ inputs._build_lambda_proxy_image }}
       _enable_replay_scenarios: ${{ inputs._enable_replay_scenarios }}
+      _system_tests_dev_mode: ${{ inputs._system_tests_dev_mode }}
 
   display_summary:
     name: Report failures

conftest.py

@@ -20,7 +20,7 @@
 
 from utils import context
 from utils._context._scenarios import Scenario, scenarios
-from utils._context.component_version import ComponentVersion, Version
+from utils._context.component_version import ComponentVersion
 from utils.const import COMPONENT_GROUPS
 from utils._decorators import add_pytest_marker
 from utils._decorators import configure as configure_decorators
@@ -233,7 +233,7 @@ def pytest_sessionstart(session: pytest.Session) -> None:
     if not session.config.option.collectonly:
         context.scenario.pytest_sessionstart(session)
 
-    # The canonical way o adding Junit properties to testsuite is not working with xdist
+    # The canonical way of adding Junit properties to testsuite is not working with xdist
     # Workaround to tackle this issue
     # https://github.com/pytest-dev/pytest/issues/7767#issuecomment-698560400
     xml = session.config._store.get(xml_key, None)  # noqa: SLF001
@@ -247,6 +247,15 @@ def pytest_sessionstart(session: pytest.Session) -> None:
         logger.terminal.write(" *** .:: Sleep mode activated. Press Ctrl+C to exit ::. *** ")
         logger.terminal.write("\n ********************************************************** \n\n")
 
+    if os.environ.get("SYSTEM_TESTS_DEV_MODE", "").lower() == "true":
+        logger.info("Checking that no version is ahead of main branch")
+        manifest = Manifest(context.scenario.components, context.weblog_variant)
+        errors = manifest.assert_versions_not_ahead_of_current()
+        if errors:
+            message = "Dev mode check: manifest declares versions ahead of the current tested version:\n"
+            message += "\n".join(f"  - {e}" for e in errors)
+            pytest.exit(message, 1)
+
 
 # called when each test item is collected
 def _collect_item_metadata(item: pytest.Item):
@@ -290,10 +299,8 @@ def pytest_collection_modifyitems(session: pytest.Session, config: pytest.Config
     """Unselect items that were deactivated in the manifests or that are not included in the current scenario"""
 
     logger.debug("pytest_collection_modifyitems")
-    manifest_components: dict[str, Version] = {
-        name: version for name, version in context.scenario.components.items() if isinstance(version, Version)
-    }
-    manifest = Manifest(manifest_components, context.weblog_variant)
+    manifest = Manifest(context.scenario.components, context.weblog_variant)
+
     for item in items:
         assert isinstance(item, pytest.Function)
         declarations = manifest.get_declarations(item.nodeid)
@@ -399,6 +406,8 @@ def _item_is_skipped(item: pytest.Item):
 
 
 def pytest_collection_finish(session: pytest.Session) -> None:
+    logger.debug("pytest_collection_finish")
+
     if session.config.option.collectonly:
         return
 

manifests/cpp_nginx.yml

@@ -189,6 +189,7 @@ manifest:
   tests/appsec/waf/test_addresses.py::Test_GrpcServerMethod: irrelevant
   tests/appsec/waf/test_addresses.py::Test_Headers: v1.2.0
   tests/appsec/waf/test_addresses.py::Test_Headers::test_specific_key2: irrelevant (Header rejected by nginx ('client sent invalid header line)
+  tests/appsec/waf/test_addresses.py::Test_IoFsFileWrite: "irrelevant (Java-only address: server.io.fs.file_write)"
   tests/appsec/waf/test_addresses.py::Test_PathParams: irrelevant (path params waf address unfilled)
   tests/appsec/waf/test_addresses.py::Test_ResponseStatus: v1.2.0
   tests/appsec/waf/test_addresses.py::Test_UrlQueryKey: v1.2.0

manifests/dotnet.yml

@@ -534,6 +534,7 @@ manifest:
   tests/appsec/waf/test_addresses.py::Test_GraphQL: missing_feature
   tests/appsec/waf/test_addresses.py::Test_GrpcServerMethod: missing_feature
   tests/appsec/waf/test_addresses.py::Test_Headers: v1.28.6
+  tests/appsec/waf/test_addresses.py::Test_IoFsFileWrite: "irrelevant (Java-only address: server.io.fs.file_write)"
   tests/appsec/waf/test_addresses.py::Test_PathParams: v2.5.1
   tests/appsec/waf/test_addresses.py::Test_ResponseStatus: v2.3.0
   tests/appsec/waf/test_addresses.py::Test_UrlQuery: v1.28.6
@@ -1152,6 +1153,7 @@ manifest:
   tests/test_span_events.py: incomplete_test_app (Weblog `/add_event` not implemented)
   tests/test_standard_tags.py::Test_StandardTagsClientIp: v2.26.0
   tests/test_standard_tags.py::Test_StandardTagsMethod: v2.0.0-prerelease
+  tests/test_standard_tags.py::Test_StandardTagsNetworkClientIp: v0.1  # unknown initial version
   tests/test_standard_tags.py::Test_StandardTagsReferrerHostname: missing_feature
   tests/test_standard_tags.py::Test_StandardTagsRoute: v2.13.0
   tests/test_standard_tags.py::Test_StandardTagsStatusCode: v2.0.0-prerelease

manifests/envoy.yml

@@ -36,6 +36,7 @@ manifest:
   tests/test_semantic_conventions.py: v1.72.0
   tests/test_semantic_conventions.py::Test_Meta::test_meta_component_tag: v2.3.0
   tests/test_standard_tags.py: v1.72.0
+  tests/test_standard_tags.py::Test_StandardTagsNetworkClientIp: v0.1  # unknown initial version
   tests/test_standard_tags.py::Test_StandardTagsReferrerHostname: missing_feature
   tests/test_standard_tags.py::Test_StandardTagsUrl::test_multiple_matching_substring: irrelevant (tracer did not yet implemented the new version of query parameters obfuscation regex)
   tests/test_standard_tags.py::Test_StandardTagsUrl::test_url_with_sensitive_query_string: irrelevant (tracer did not yet implemented the new version of query parameters obfuscation regex)

manifests/golang.yml

@@ -39,7 +39,14 @@ manifest:
   tests/appsec/api_security/test_custom_data_classification.py::Test_API_Security_Custom_Data_Classification_Negative: v2.4.0
   tests/appsec/api_security/test_custom_data_classification.py::Test_API_Security_Custom_Data_Classification_Processor_Override: v2.4.0
   tests/appsec/api_security/test_custom_data_classification.py::Test_API_Security_Custom_Data_Classification_Scanner: v2.4.0
-  tests/appsec/api_security/test_endpoint_discovery.py::Test_Endpoint_Discovery: missing_feature
+  tests/appsec/api_security/test_endpoint_discovery.py::Test_Endpoint_Discovery:
+    - weblog_declaration:
+        "*": missing_feature
+        echo: v2.7.0-dev  # Automatic with orchestrion, semi-manual without
+  tests/appsec/api_security/test_endpoint_discovery.py::Test_Endpoint_Discovery::test_optional_authentication: irrelevant (Not supported)
+  tests/appsec/api_security/test_endpoint_discovery.py::Test_Endpoint_Discovery::test_optional_request_body_type: irrelevant (Not supported)
+  tests/appsec/api_security/test_endpoint_discovery.py::Test_Endpoint_Discovery::test_optional_response_body_type: irrelevant (Not supported)
+  tests/appsec/api_security/test_endpoint_discovery.py::Test_Endpoint_Discovery::test_optional_response_code: irrelevant (Not supported)
   tests/appsec/api_security/test_endpoint_fallback.py: missing_feature
   tests/appsec/api_security/test_endpoints.py: irrelevant (language not implementing this feature)
   tests/appsec/api_security/test_schemas.py::Test_Scanners: v2.0.0
@@ -670,6 +677,7 @@ manifest:
         chi: v1.36.0
         echo: v1.36.0
         gin: v1.37.0
+  tests/appsec/waf/test_addresses.py::Test_IoFsFileWrite: "irrelevant (Java-only address: server.io.fs.file_write)"
   tests/appsec/waf/test_addresses.py::Test_PathParams:
     - weblog_declaration:
         "*": v1.36.0
@@ -1360,12 +1368,7 @@ manifest:
         gqlgen: v1.73.0
         graph-gophers: v1.73.0
         graphql-go: v1.73.0
-  tests/test_graphql.py::Test_GraphQLOperationErrorTracking:
-    - weblog_declaration:
-        "*": missing_feature
-        gqlgen: missing_feature
-        graph-gophers: missing_feature
-        graphql-go: missing_feature
+  tests/test_graphql.py::Test_GraphQLOperationErrorTracking: missing_feature
   tests/test_identify.py::Test_Basic: v1.37.0
   tests/test_identify.py::Test_Basic::test_identify_tags:
     - declaration: bug (APMRP-360)
@@ -1433,6 +1436,7 @@ manifest:
     - declaration: missing_feature (missing fastly-client-ip, cf-connecting-ip, cf-connecting-ipv6)
       component_version: <1.69.0
   tests/test_standard_tags.py::Test_StandardTagsMethod: v1.39.0
+  tests/test_standard_tags.py::Test_StandardTagsNetworkClientIp: v0.1  # unknown initial version
   tests/test_standard_tags.py::Test_StandardTagsReferrerHostname: missing_feature
   tests/test_standard_tags.py::Test_StandardTagsRoute: v1.39.0
   tests/test_standard_tags.py::Test_StandardTagsStatusCode: v1.39.0

manifests/haproxy.yml

@@ -33,6 +33,7 @@ manifest:
   tests/test_scrubbing.py: v2.4.0
   tests/test_semantic_conventions.py: v2.4.0
   tests/test_standard_tags.py: v2.4.0
+  tests/test_standard_tags.py::Test_StandardTagsNetworkClientIp: v0.1  # unknown initial version
   tests/test_standard_tags.py::Test_StandardTagsReferrerHostname: missing_feature
   tests/test_standard_tags.py::Test_StandardTagsUrl::test_multiple_matching_substring: irrelevant (tracer did not yet implemented the new version of query parameters obfuscation regex)
   tests/test_standard_tags.py::Test_StandardTagsUrl::test_url_with_sensitive_query_string: irrelevant (tracer did not yet implemented the new version of query parameters obfuscation regex)

manifests/java.yml

@@ -2585,6 +2585,10 @@ manifest:
   tests/appsec/waf/test_addresses.py::Test_Headers::test_specific_wrong_key:
     - weblog_declaration:
         spring-boot-3-native: missing_feature (GraalVM. Tracing support only)
+  tests/appsec/waf/test_addresses.py::Test_IoFsFileWrite:
+    - weblog_declaration:
+        "*": v1.62.0-SNAPSHOT
+        spring-boot-3-native: irrelevant (GraalVM. Tracing support only)
   tests/appsec/waf/test_addresses.py::Test_PathParams:
     - weblog_declaration:
         "*": v0.95.1
@@ -4299,6 +4303,11 @@ manifest:
   tests/test_standard_tags.py::Test_StandardTagsMethod::test_method_trace:
     - weblog_declaration:
         spring-boot-payara: missing_feature (This weblog variant is currently not accepting TRACE)
+  tests/test_standard_tags.py::Test_StandardTagsNetworkClientIp:
+    - weblog_declaration:
+        "*": v0.93.0
+        spring-boot-3-native: irrelevant (GraalVM. Tracing support only)
+  tests/test_standard_tags.py::Test_StandardTagsNetworkClientIp::test_network_client_ip: missing_feature (APPSEC-62219)
   tests/test_standard_tags.py::Test_StandardTagsReferrerHostname: missing_feature
   tests/test_standard_tags.py::Test_StandardTagsRoute:
     - weblog_declaration: