Merge remote-tracking branch 'upstream/main' into varhandle-string-encoder

Author: trask

.github/CODEOWNERS

@@ -1,5 +1,6 @@
-# Code owners file.
-# This file controls who is tagged for review for any given pull request.
+#
+# Learn about membership in OpenTelemetry community:
+#  https://github.com/open-telemetry/community/blob/main/guides/contributor/membership.md
+#
 
- # For anything not explicitly taken by someone else:
 * @open-telemetry/java-approvers

.github/config/lychee.toml

@@ -0,0 +1,21 @@
+# Lychee configuration file
+# See https://lychee.cli.rs/config/
+
+timeout = 30
+retry_wait_time = 5
+max_retries = 6
+max_concurrency = 4
+
+# Check link anchors
+include_fragments = true
+
+remap = [
+  # workaround for https://github.com/lycheeverse/lychee/issues/1729
+  "https://github.com/(.*?)/(.*?)/blob/(.*?)/(.*#.*)$ https://raw.githubusercontent.com/$1/$2/$3/$4",
+]
+
+# excluding links to pull requests and issues is done for performance
+exclude = [
+  "^https://github.com/open-telemetry/opentelemetry-java/(issues|pull)/\\d+$",
+  "^https://www.javadoc.io/badge/(.*?)/(.*?).svg$", # returns 522
+]

.github/renovate.json5

@@ -4,6 +4,9 @@
     'config:best-practices',
     'helpers:pinGitHubActionDigestsToSemver',
   ],
+  ignorePresets: [
+    'workarounds:javaLTSVersions', // Allow all Java major versions, not just LTS
+  ],
   ignorePaths: [], // overwrite default ignore which includes **/test/**
                    // used to update docker image versions used in Java test files
   packageRules: [
@@ -31,6 +34,17 @@
       ignoreUnstable: false,
       allowedVersions: '!/\\-SNAPSHOT$/',
     },
+    {
+      // junit 6+ requires Java 17+
+      matchPackageNames: [
+        'org.junit:**',
+        'org.junit.jupiter:**',
+      ],
+      matchUpdateTypes: [
+        'major',
+      ],
+      enabled: false,
+    },
     {
       // junit-pioneer 2+ requires Java 11+
       matchPackageNames: [
@@ -48,7 +62,7 @@
       ],
       enabled: false,
       matchPackageNames: [
-        'org.mockito:{/,}**',
+        'org.mockito:**',
       ],
     },
     {
@@ -73,7 +87,8 @@
     {
       groupName: 'spotless packages',
       matchPackageNames: [
-        'com.diffplug.spotless{/,}**',
+        'com.diffplug.spotless',
+        'com.diffplug.spotless:**',
       ],
     },
     {

.github/repository-settings.md

@@ -6,6 +6,8 @@ private admin repo.
 
 ## Secrets and variables > Actions
 
+### Repository secrets
+
 - `GPG_PASSWORD` - stored in OpenTelemetry-Java 1Password
 - `GPG_PRIVATE_KEY` - stored in OpenTelemetry-Java 1Password
 - `NVD_API_KEY` - stored in OpenTelemetry-Java 1Password
@@ -16,6 +18,8 @@ private admin repo.
 
 ### Organization secrets
 
+- `CODECOV_TOKEN`
+- `DEVELOCITY_ACCESS_KEY` (scoped only to Java repos)
 - `FOSSA_API_KEY`
 - `OTELBOT_PRIVATE_KEY`
 

…b/scripts/use-cla-approved-github-bot.sh .github/scripts/use-cla-approved-bot.sh.github/scripts/use-cla-approved-github-bot.sh renamed to .github/scripts/use-cla-approved-bot.sh .github/scripts/use-cla-approved-github-bot.sh renamed to .github/scripts/use-cla-approved-bot.sh

@@ -27,7 +27,7 @@ jobs:
           fetch-depth: 0
 
       - name: Use CLA approved github bot
-        run: .github/scripts/use-cla-approved-github-bot.sh
+        run: .github/scripts/use-cla-approved-bot.sh
 
       - uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
         id: otelbot-token

.github/workflows/backport.yml

@@ -11,38 +11,16 @@ jobs:
     permissions:
       contents: write # for git push to benchmarks branch
     name: Benchmark SDK
-    runs-on: equinix-bare-metal
-    timeout-minutes: 10
+    runs-on: oracle-bare-metal-64cpu-512gb-x86-64
+    container:
+      image: ubuntu:24.04@sha256:66460d557b25769b102175144d538d88219c077c678a49af4afca6fbfc1b5252
+    timeout-minutes: 20 # since there is only a single bare metal runner across all repos
     strategy:
       fail-fast: false
       matrix:
         tag-version:
-          - v1.6.0
-          - v1.7.0
-          - v1.7.1
-          - v1.10.0
-          - v1.10.1
-          - v1.11.0
-          - v1.12.0
-          - v1.13.0
-          - v1.14.0
-          - v1.15.0
-          - v1.16.0
-          - v1.17.0
-          - v1.18.0
-          - v1.19.0
-          - v1.21.0
-          - v1.22.0
-          - v1.23.0
-          - v1.23.1
-          - v1.24.0
-          - v1.25.0
-          - v1.26.0
-          - v1.27.0
-          - v1.28.0
           - v1.29.0
           - v1.30.0
-          - v1.30.1
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
@@ -53,12 +31,14 @@ jobs:
         uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
           distribution: temurin
-          java-version: 17
+          java-version: 21
 
       - name: Set up gradle
-        uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a # v4.4.3
+        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
       - name: Run jmh
         run: ./gradlew jmhJar
+        env:
+          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Run Benchmark
         run: |

.github/workflows/benchmark-tags.yml

@@ -15,7 +15,7 @@ jobs:
     name: Benchmark SDK
     runs-on: oracle-bare-metal-64cpu-512gb-x86-64
     container:
-      image: ubuntu:24.04@sha256:353675e2a41babd526e2b837d7ec780c2a05bca0164f7ea5dbbd433d21d166fc
+      image: ubuntu:24.04@sha256:66460d557b25769b102175144d538d88219c077c678a49af4afca6fbfc1b5252
     timeout-minutes: 20 # since there is only a single bare metal runner across all repos
     steps:
       - name: Install Git
@@ -33,20 +33,22 @@ jobs:
         uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
           distribution: temurin
-          java-version: 17
+          java-version: 21
 
       - name: Set up gradle
-        uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a # v4.4.3
+        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
       - name: Run jmh
         run: ./gradlew jmhJar
+        env:
+          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Run Benchmark
         run: |
           cd sdk/trace/build
           java -jar libs/opentelemetry-sdk-trace-*-jmh.jar -rf json SpanBenchmark SpanPipelineBenchmark ExporterBenchmark
 
       - name: Use CLA approved github bot
-        run: .github/scripts/use-cla-approved-github-bot.sh
+        run: .github/scripts/use-cla-approved-bot.sh
 
       - name: Store benchmark results
         uses: benchmark-action/github-action-benchmark@4bdcce38c94cec68da58d012ac24b7b1155efe8b # v1.20.7

.github/workflows/benchmark.yml

@@ -22,7 +22,7 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Login to GitHub package registry
-        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}

.github/workflows/build-tracecontext-testsuite.yml

@@ -32,7 +32,7 @@ jobs:
           - 11
           - 17
           - 21
-          - 24 # renovate: datasource=java-version
+          - 25 # renovate: datasource=java-version
         # Collect coverage on latest LTS
         include:
           - os: ubuntu-latest
@@ -50,7 +50,7 @@ jobs:
           - os: macos-13
             test-java-version: 21
           - os: macos-13
-            test-java-version: 24 # renovate: datasource=java-version
+            test-java-version: 25 # renovate: datasource=java-version
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
@@ -66,10 +66,10 @@ jobs:
         uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
           distribution: temurin
-          java-version: 17
+          java-version: 21
 
       - name: Set up gradle
-        uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a # v4.4.3
+        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
       - name: Build
         run: >
             ./gradlew build
@@ -80,6 +80,7 @@ jobs:
         env:
           # JMH-based tests run only if this environment variable is set to true
           RUN_JMH_BASED_TESTS: ${{ matrix.jmh-based-tests }}
+          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Check for diff
         # The jApiCmp diff compares current to latest, which isn't appropriate for release branches
@@ -104,7 +105,7 @@ jobs:
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         if: ${{ matrix.coverage }}
         with:
           name: coverage-report
@@ -113,7 +114,7 @@ jobs:
   markdown-link-check:
     # release branches are excluded to avoid unnecessary maintenance
     if: ${{ !startsWith(github.ref_name, 'release/') }}
-    uses: ./.github/workflows/reusable-markdown-link-check.yml
+    uses: ./.github/workflows/reusable-link-check.yml
 
   misspell-check:
     # release branches are excluded to avoid unnecessary maintenance
@@ -142,10 +143,10 @@ jobs:
         uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
           distribution: temurin
-          java-version: 17
+          java-version: 21
 
       - name: Set up gradle
-        uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a # v4.4.3
+        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
         # skipping release branches because the versions in those branches are not snapshots
         # (also this skips pull requests)
         if: ${{ github.ref_name == 'main' && github.repository == 'open-telemetry/opentelemetry-java' }}
@@ -159,6 +160,7 @@ jobs:
           SONATYPE_KEY: ${{ secrets.SONATYPE_KEY }}
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
           GPG_PASSWORD: ${{ secrets.GPG_PASSWORD }}
+          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
   build-graal:
     name: Build GraalVM
@@ -168,10 +170,10 @@ jobs:
       matrix:
         test-graal-version:
           - 21
-          - 24 # renovate: datasource=java-version
+          - 25 # renovate: datasource=java-version
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - uses: graalvm/setup-graalvm@aba6a077d71fbfc02138d7470c4ad6e7f85bd2a9 # v1.3.7
+      - uses: graalvm/setup-graalvm@eec48106e0bf45f2976c2ff0c3e22395cced8243 # v1.4.2
         with:
           java-version: ${{ matrix.test-graal-version }}
           distribution: 'graalvm'
@@ -184,6 +186,8 @@ jobs:
           java --version
           native-image --version
           ./gradlew nativeTest
+        env:
+          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
   required-status-check:
     # markdown-link-check is not required so pull requests are not blocked if external links break