Merge branch 'main' into opentelemetrybot/update-opentelemetry-sdk-to-1.47.0

Author: laurit

.fossa.yml

@@ -125,6 +125,7 @@ settings](https://github.com/open-telemetry/community/blob/main/docs/how-to-conf
 
 ### Organization secrets
 
+- `FOSSA_API_KEY`
 - `OTELBOT_PRIVATE_KEY`
 
 ### Organization variables

.github/repository-settings.md

@@ -87,6 +87,43 @@ jobs:
             exit 1
           fi
 
+  fossa-configuration-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Free disk space
+        run: .github/scripts/gha-free-disk-space.sh
+
+      - name: Set up JDK for running Gradle
+        uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
+        with:
+          distribution: temurin
+          java-version-file: .java-version
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@94baf225fe0a508e581a564467443d0e2379123b # v4.3.0
+        with:
+          cache-read-only: ${{ inputs.cache-read-only }}
+
+      - name: Generate FOSSA configuration
+        run: ./gradlew generateFossaConfiguration
+
+      - name: Check configuration
+        run: |
+          git add .fossa.yml
+          if [[ $(git diff --cached --shortstat .fossa.yml) == "" ]]
+          then
+            echo "FOSSA configuration is up-to-date."
+          else
+            echo "FOSSA configuration is not up-to-date, please run './gradlew generateFossaConfiguration' locally and commit."
+            echo
+            git diff --cached --stat .fossa.yml
+            echo
+            git diff --cached .fossa.yml
+            exit 1
+          fi
+
   # this is needed because we don't auto-update dependencies in instrumentation/**
   # and so we want to enforce that all "real" dependencies are dependency managed
   extra-dependency-management-enforcement:

.github/workflows/build-common.yml

@@ -0,0 +1,19 @@
+name: FOSSA
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  fossa:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - uses: fossas/fossa-action@93a52ecf7c3ac7eb40f5de77fd69b1a19524de94 # v1.5.0
+        with:
+          api-key: ${{secrets.FOSSA_API_KEY}}

.github/workflows/fossa.yml

@@ -106,3 +106,36 @@ if (gradle.startParameter.taskNames.contains("listTestsInPartition")) {
     }
   }
 }
+
+tasks {
+  val generateFossaConfiguration by registering {
+    group = "Help"
+    description = "Generate .fossa.yml configuration file"
+
+    doLast {
+      File(".fossa.yml").printWriter().use { writer ->
+        writer.println("version: 3")
+        writer.println()
+        writer.println("targets:")
+        writer.println("  only:")
+        writer.println("    # only scanning the modules which are published")
+        writer.println("    # (as opposed to internal testing modules")
+        rootProject.subprojects
+          .sortedBy { it.findProperty("archivesName") as String? }
+          .filter { !it.name.startsWith("bom") }
+          .filter { it.plugins.hasPlugin("maven-publish") }
+          .forEach {
+            writer.println("    - type: gradle")
+            writer.println("      path: ./")
+            writer.println("      target: '${it.path}'")
+          }
+        writer.println()
+        writer.println("experimental:")
+        writer.println("  gradle:")
+        writer.println("    configurations-only:")
+        writer.println("      # consumer will only be exposed to these dependencies")
+        writer.println("      - runtimeClasspath")
+      }
+    }
+  }
+}

build.gradle.kts

@@ -4,9 +4,6 @@ plugins {
 
 data class DependencySet(val group: String, val version: String, val modules: List<String>)
 
-val dependencyVersions = hashMapOf<String, String>()
-rootProject.extra["versions"] = dependencyVersions
-
 // this line is managed by .github/scripts/update-sdk-version.sh
 val otelSdkVersion = "1.47.0"
 val otelContribVersion = "1.43.0-alpha"
@@ -27,15 +24,16 @@ val groovyVersion = "4.0.25"
 // configurations.testRuntimeClasspath.resolutionStrategy.force "com.google.guava:guava:19.0"
 
 val DEPENDENCY_BOMS = listOf(
+  // for some reason boms show up as runtime dependencies in license and vulnerability scans
+  // even if they are only used by test dependencies, so not using junit bom since it is LGPL
+
   "com.fasterxml.jackson:jackson-bom:2.18.2",
   "com.squareup.okio:okio-bom:3.10.2", // see https://github.com/open-telemetry/opentelemetry-java/issues/5637
   "com.google.guava:guava-bom:33.4.0-jre",
   "org.apache.groovy:groovy-bom:${groovyVersion}",
   "io.opentelemetry:opentelemetry-bom:${otelSdkVersion}",
   "io.opentelemetry:opentelemetry-bom-alpha:${otelSdkAlphaVersion}",
-  "org.junit:junit-bom:5.11.4",
-  "org.testcontainers:testcontainers-bom:1.20.4",
-  "org.spockframework:spock-bom:2.4-M5-groovy-4.0"
+  "org.testcontainers:testcontainers-bom:1.20.4"
 )
 
 val autoServiceVersion = "1.1.1"
@@ -83,6 +81,10 @@ val CORE_DEPENDENCIES = listOf(
 // There are dependencies included here that appear to have no usages, but are maintained at
 // this top level to help consistently satisfy large numbers of transitive dependencies.
 val DEPENDENCIES = listOf(
+  "org.junit.jupiter:junit-jupiter-api:5.11.4",
+  "org.spockframework:spock-core:2.4-M5-groovy-4.0",
+  "org.spockframework:spock-junit4:2.4-M5-groovy-4.0",
+
   "io.r2dbc:r2dbc-proxy:1.1.5.RELEASE",
   "ch.qos.logback:logback-classic:1.3.15", // 1.4+ requires Java 11+
   "com.github.stefanbirkner:system-lambda:1.2.1",
@@ -127,19 +129,13 @@ javaPlatform {
 dependencies {
   for (bom in DEPENDENCY_BOMS) {
     api(enforcedPlatform(bom))
-    val split = bom.split(':')
-    dependencyVersions[split[0]] = split[2]
   }
   constraints {
     for (dependency in CORE_DEPENDENCIES) {
       api(dependency)
-      val split = dependency.split(':')
-      dependencyVersions[split[0]] = split[2]
     }
     for (dependency in DEPENDENCIES) {
       api(dependency)
-      val split = dependency.split(':')
-      dependencyVersions[split[0]] = split[2]
     }
   }
 }

dependencyManagement/build.gradle.kts

@@ -8,7 +8,7 @@ group = "io.opentelemetry.instrumentation"
 val springBootVersion = "2.6.15"
 
 dependencies {
-  api("org.springframework.boot:spring-boot-starter:$springBootVersion")
+  compileOnly("org.springframework.boot:spring-boot-starter:$springBootVersion")
   api(project(":instrumentation:spring:starters:spring-boot-starter"))
   api("io.opentelemetry:opentelemetry-exporter-zipkin")
 }

instrumentation/spring/starters/zipkin-spring-boot-starter/build.gradle.kts

@@ -11,6 +11,8 @@ dependencies {
   testCompileOnly(project(":javaagent-bootstrap"))
   testCompileOnly(project(":javaagent-extension-api"))
   testCompileOnly(project(":muzzle"))
+  testCompileOnly("com.google.auto.service:auto-service-annotations")
+  testCompileOnly("com.google.code.findbugs:annotations")
 
   testImplementation("net.bytebuddy:byte-buddy")
   testImplementation("net.bytebuddy:byte-buddy-agent")
@@ -47,25 +49,10 @@ tasks {
     jvmArgs("-XX:+IgnoreUnrecognizedVMOptions")
   }
 
-  val testIndyModuleOldBytecodeInstrumentation by registering(Test::class) {
-    filter {
-      includeTestsMatching("InstrumentOldBytecode")
-    }
-    include("**/InstrumentOldBytecode.*")
-  }
-
-  val testInlineModuleOldBytecodeInstrumentation by registering(Test::class) {
-    filter {
-      includeTestsMatching("InstrumentOldBytecode")
-    }
-    include("**/InstrumentOldBytecode.*")
-  }
-
   test {
     filter {
       excludeTestsMatching("context.FieldInjectionDisabledTest")
       excludeTestsMatching("context.FieldBackedImplementationTest")
-      excludeTestsMatching("InstrumentOldBytecode")
     }
     // this is needed for AgentInstrumentationSpecificationTest
     jvmArgs("-Dotel.javaagent.exclude-classes=config.exclude.packagename.*,config.exclude.SomeClass,config.exclude.SomeClass\$NestedClass")