Merge branch 'main' into fix/renovate-tidy-loop

Author: thompson-tomo

.github/actions/build-java-layer/action.yml

@@ -8,6 +8,9 @@ outputs:
   javawrapper-artifact-path:
     description: 'Absolute path to the javawrapper layer zip artifact'
     value: ${{ github.workspace }}/java/layer-wrapper/build/distributions/opentelemetry-javawrapper-layer.zip
+  javawrapper-targz-artifact-path:
+    description: 'Absolute path to the javawrapper layer tar.gz artifact'
+    value: ${{ github.workspace }}/java/layer-wrapper/build/distributions/opentelemetry-javawrapper-layer.tar.gz
   javaagent-version:
     description: 'OpenTelemetry Java agent version included in the layer'
     value: ${{ steps.javaagent-version.outputs.javaagent-version }}
@@ -18,7 +21,7 @@ outputs:
 runs:
   using: composite
   steps:
-    - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+    - uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
       with:
         distribution: corretto
         java-version: 17

.github/renovate.json5

@@ -27,6 +27,8 @@
       ],
       postUpdateOptions: [
         'gomodTidyAll',
+        'gomodTidyE',
+        'gomodUpdateImportPaths',
       ],
       semanticCommitType: 'build',
       schedule: [
@@ -47,6 +49,8 @@
       ],
       postUpdateOptions: [
         'gomodTidyAll',
+        'gomodTidyE',
+        'gomodUpdateImportPaths',
       ],
       semanticCommitType: 'build',
       schedule: [
@@ -154,6 +158,15 @@
       ],
       dependencyDashboardApproval: true,
     },
+    {
+      matchUpdateTypes: [
+        'major'
+      ],
+      matchDepNames: [
+        'node',
+      ],
+      dependencyDashboardApproval: true,
+    },
     {
       matchManagers: [
         "gomod"
@@ -174,11 +187,15 @@
         'golang',
       ],
       enabled: true,
+      prBodyTemplate: "{{{header}}}{{{warnings}}}🔧 This Pull Request updates lock files to use the latest dependency versions.{{{notes}}}{{{configDescription}}}{{{controls}}}{{{footer}}}",
+      abandonmentThreshold: "50 years",
       schedule: [
         'before 8am on Wednesday',
       ],
       postUpdateOptions: [
         'gomodTidyAll',
+        'gomodTidyE',
+        'gomodUpdateImportPaths',
       ],
     }
   ],
@@ -192,6 +209,8 @@
   },
   postUpdateOptions: [
     'gomodTidyAll',
+    'gomodTidyE',
+    'gomodUpdateImportPaths',
   ],
   semanticCommits: 'enabled',
   semanticCommitType: 'build',

.github/workflows/ci-java.yml

@@ -25,7 +25,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+      - uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
         with:
           distribution: corretto
           java-version: 17

.github/workflows/codeql.yml

@@ -68,7 +68,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+      uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
       with:
         languages: ${{ matrix.target.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -82,7 +82,7 @@ jobs:
     # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+      uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
       with:
         working-directory: ${{ matrix.target.directory }}
       # There are no array literals in GHA that is why we need to use fromJson.
@@ -99,7 +99,7 @@ jobs:
     #     ./location_of_script_within_repo/buildscript.sh
 
     - name: Set up Java
-      uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+      uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
       with:
         distribution: corretto
         java-version: '17'
@@ -128,6 +128,6 @@ jobs:
       if: ${{ matrix.target.language == 'csharp' }}
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+      uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
       with:
         category: "/language:${{matrix.target.language}}"

.github/workflows/integration-test.yml

@@ -114,14 +114,14 @@ jobs:
           name: opentelemetry-${{ matrix.language }}-layer.zip
           path: artifacts/
 
-      - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
+      - uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4
         with:
           role-to-assume: ${{ secrets.INTEGRATION_TEST_ROLE_ARN }}
           role-duration-seconds: 1200
           aws-region: us-east-1
 
       - if: ${{ startsWith(matrix.language, 'java') }}
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
         with:
           distribution: corretto
           java-version: 17

.github/workflows/layer-publish.yml

@@ -94,7 +94,7 @@ jobs:
         with:
           name: ${{ inputs.artifact-name }}
 
-      - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
+      - uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4
         with:
           role-to-assume: ${{ inputs.role-arn || secrets.OTEL_LAMBDA_LAYER_PUBLISH_ROLE_ARN || secrets.PROD_LAMBDA_ROLE_ARN }}
           role-duration-seconds: 1200

.github/workflows/ossf-scorecard.yml

@@ -8,40 +8,12 @@ on:
     - cron: "59 7 * * 6" # once a week
   workflow_dispatch:
 
-permissions: read-all
+permissions: {}
 
 jobs:
   analysis:
-    runs-on: ubuntu-latest
     permissions:
-      # Needed for Code scanning upload
-      security-events: write
-      # Needed for GitHub OIDC token if publish_results is true
-      id-token: write
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
-        with:
-          results_file: results.sarif
-          results_format: sarif
-          publish_results: true
-
-      # Upload the results as artifacts (optional). Commenting out will disable
-      # uploads of run results in SARIF format to the repository Actions tab.
-      # https://docs.github.com/en/actions/advanced-guides/storing-workflow-data-as-artifacts
-      - name: "Upload artifact"
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: SARIF file
-          path: results.sarif
-          retention-days: 5
-
-      # Upload the results to GitHub's code scanning dashboard (optional).
-      # Commenting out will disable upload of results to your repo's Code Scanning dashboard
-      - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
-        with:
-          sarif_file: results.sarif
+      contents: read # for actions/checkout
+      id-token: write # for Scorecard to publish results
+      security-events: write # for the SARIF upload to code scanning
+    uses: open-telemetry/shared-workflows/.github/workflows/scorecard.yml@03559ef555db0eae5d85c3c6347d1530243e7aa7 # v0.13.0

.github/workflows/release-layer-java.yml

@@ -46,9 +46,15 @@ jobs:
           name: opentelemetry-javawrapper-layer.zip
           path: ${{ steps.build.outputs.javawrapper-artifact-path }}
 
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        name: Save javawrapper layer tar.gz to build
+        with:
+          name: opentelemetry-javawrapper-layer.tar.gz
+          path: ${{ steps.build.outputs.javawrapper-targz-artifact-path }}
+
       - name: Add Binary to Release
         run: |
-          gh release upload ${{github.ref_name}} ${{ steps.build.outputs.javawrapper-artifact-path }}
+          gh release upload ${{github.ref_name}} ${{ steps.build.outputs.javawrapper-artifact-path }} ${{ steps.build.outputs.javawrapper-targz-artifact-path }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}