Merge branch 'master' into mattalp/ff-v1.39.1-profiler-version-bump

Author: MattAlp

.circleci/config.continue.yml.j2

@@ -36,7 +36,7 @@ instrumentation_modules: &instrumentation_modules "dd-java-agent/instrumentation
 debugger_modules: &debugger_modules "dd-java-agent/agent-debugger|dd-java-agent/agent-bootstrap|dd-java-agent/agent-builder|internal-api|communication|dd-trace-core"
 profiling_modules: &profiling_modules "dd-java-agent/agent-profiling"
 
-default_system_tests_commit: &default_system_tests_commit 15713a66e48f82b7d995cea2eb6eb78bec0270df
+default_system_tests_commit: &default_system_tests_commit c87bd359aad64a29f280fc5c70a879f7c7f4846e
 
 parameters:
   nightly:
@@ -54,7 +54,7 @@ parameters:
   global_pattern:
     # Pattern for files that should always trigger a test jobs
     type: string
-    default: "^build.gradle$|^settings.gradle$|^gradle.properties$|^buildSrc/|^gradle/|.circleci"
+    default: "^build.gradle$|^settings.gradle$|^gradle.properties$|^buildSrc/|^gradle/|.circleci|^gradlew|^mvnw|^.mvn/"
 
   docker_image:
     type: string
@@ -273,13 +273,6 @@ commands:
             git fetch origin << parameters.systemTestsCommit >>
             git reset --hard FETCH_HEAD
 
-      - run:
-          name: Install python 3.12
-          command: |
-            sudo apt-get update
-            sudo apt-get install -y python3.12-full python3.12-dev python3.12-venv
-            echo 'export PATH="$HOME/.local/bin:$PATH"' >>"$BASH_ENV"
-
 jobs:
   build:
     <<: *defaults
@@ -310,7 +303,7 @@ jobs:
           name: Build Project
           command: >-
 {% if is_nightly %}
-            ./gradlew resolveAndLockAll --write-locks
+            ./gradlew resolveAndLockAll --write-locks &&
 {% endif %}
             MAVEN_OPTS="-Xms64M -Xmx256M"
             GRADLE_OPTS="-Dorg.gradle.jvmargs='-Xmx2560M -Xms2560M -XX:ErrorFile=/tmp/hs_err_pid%p.log -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/tmp'"
@@ -667,7 +660,8 @@ jobs:
           - DD_POOL_TRACE_CHECK_FAILURES=true
           - DD_DISABLE_ERROR_RESPONSES=true
           - ENABLED_CHECKS=trace_content_length,trace_stall,meta_tracer_version_header,trace_count_header,trace_peer_service,trace_dd_service
-    resource_class: xlarge
+    # TODO: merge xlarge_tests and tests? or rename this?
+    resource_class: large
 
 
   # The only way to do fan-in in CircleCI seems to have a proper job, so let's have one that
@@ -1106,8 +1100,8 @@ build_test_jobs: &build_test_jobs
       triggeredBy: *instrumentation_modules
       stage: instrumentation
       cacheType: inst
-      parallelism: 4
-      maxWorkers: 4
+      parallelism: 12
+      maxWorkers: 3
       matrix:
         <<: *test_matrix
 
@@ -1120,8 +1114,8 @@ build_test_jobs: &build_test_jobs
       triggeredBy: *instrumentation_modules
       stage: instrumentation
       cacheType: inst
-      parallelism: 4
-      maxWorkers: 4
+      parallelism: 12
+      maxWorkers: 3
       testJvm: "8"
 
   - xlarge_tests:
@@ -1134,8 +1128,8 @@ build_test_jobs: &build_test_jobs
       triggeredBy: *instrumentation_modules
       stage: instrumentation
       cacheType: latestdep
-      parallelism: 4
-      maxWorkers: 4
+      parallelism: 12
+      maxWorkers: 3
       testJvm: "8"
 
   - xlarge_tests:
@@ -1148,8 +1142,8 @@ build_test_jobs: &build_test_jobs
       triggeredBy: *instrumentation_modules
       stage: instrumentation
       cacheType: latestdep
-      parallelism: 4
-      maxWorkers: 4
+      parallelism: 12
+      maxWorkers: 3
       testJvm: "17"
 
   - xlarge_tests:
@@ -1162,8 +1156,8 @@ build_test_jobs: &build_test_jobs
       triggeredBy: *instrumentation_modules
       stage: instrumentation
       cacheType: latestdep
-      parallelism: 4
-      maxWorkers: 4
+      parallelism: 12
+      maxWorkers: 3
       testJvm: "21"
 
 {% if flaky %}
@@ -1191,7 +1185,7 @@ build_test_jobs: &build_test_jobs
       triggeredBy: *instrumentation_modules
       stage: instrumentation
       cacheType: inst
-      parallelism: 2
+      parallelism: 12
       maxWorkers: 4
       testJvm: "8"
 

.github/CODEOWNERS

@@ -45,6 +45,8 @@ dd-java-agent/instrumentation/*iast*   @DataDog/asm-java
 dd-java-agent/instrumentation/*appsec* @DataDog/asm-java
 dd-java-agent/instrumentation/json/    @DataDog/asm-java
 dd-java-agent/instrumentation/snakeyaml/    @DataDog/asm-java
+dd-java-agent/instrumentation/velocity/    @DataDog/asm-java
+dd-java-agent/instrumentation/freemarker/    @DataDog/asm-java
 dd-smoke-tests/iast-util/              @DataDog/asm-java
 dd-smoke-tests/spring-security/        @DataDog/asm-java
 dd-java-agent/instrumentation/commons-fileupload/    @DataDog/asm-java
@@ -53,6 +55,9 @@ dd-java-agent/instrumentation/spring-security-5/ @DataDog/asm-java
 **/iast/                               @DataDog/asm-java
 **/Iast*.java                          @DataDog/asm-java
 **/Iast*.groovy                        @DataDog/asm-java
+**/rasp/                               @Datadog/asm-java
+**/*Rasp*.java                          @DataDog/asm-java
+**/*Rasp*.groovy                        @DataDog/asm-java
 
 # @DataDog/data-jobs-monitoring
 dd-java-agent/instrumentation/spark/            @DataDog/data-jobs-monitoring

.github/workflows/README.md

@@ -1,6 +1,6 @@
 # GitHub Actions Documentation
 
-This lists and describes the repository GitHub actions.
+This lists and describes the repository GitHub actions, how to maintain and test them.
 
 ## Release Management
 
@@ -18,15 +18,16 @@ _Trigger:_ When a release is published.
 
 _Action:_ Append the new release to the Cloud Foundry repository.
 
-_Recovery:_ Manually edit and push the `index.yml` file from [the cloudfoundry branch](https://github.com/DataDog/dd-trace-java/tree/cloudfoundry).
+_Recovery:_ Manually edit and push the `index.yml` file from [the cloudfoundry branch](https://github.com/DataDog/dd-trace-java/tree/cloudfoundry).
 
 ### create-next-milestone [🔗](create-next-milestone.yaml)
 
 _Trigger:_ When closing a milestone.
 
 _Action:_ Create a new milestone by incrementing minor version.
 
-_Comment:_ Already done when closing a tag. To delete?
+_Comment:_ Disabled as also covered by increment-milestone-on-tag.
+This will be removed after some testing.  
 
 ### draft-release-notes-on-tag [🔗](draft-release-notes-on-tag.yaml)
 
@@ -40,18 +41,17 @@ _Actions:_
 
 _Recovery:_ Manually trigger the action again on the relevant tag.
 
-### increment-milestones-on-tag [🔗](increment-milestones-on-tag.yaml)
+### increment-milestone-on-tag [🔗](increment-milestone-on-tag.yaml)
 
-_Trigger:_ When creating a tag. Release Candidate tags containing "-RC" or "-rc" will skip this.
+_Trigger:_ When creating a minor or major version tag.
 
 _Actions:_
 * Close the milestone related to the tag,
 * Create a new milestone by incrementing minor version.
 
-_Recovery:_ Manually close the related milestone and create a new one.
+_Recovery:_ Manually [close the related milestone and create a new one](https://github.com/DataDog/dd-trace-java/milestones).
 
-_Notes:_ This actions will handle _minor_ releases only.
-As there is no milestone for _patch_ releases, it won't close and create _patch_ releated milestone.
+_Notes:_ This action will not apply to release candidate versions using `-RC` tags.
 
 ### update-download-releases [🔗](update-download-releases.yaml)
 
@@ -117,3 +117,12 @@ Run the following script to get the list of actions to declare according the sta
 ```bash
 find .github/workflows -name "*.yaml" -exec  awk '/uses:/{print $2 ","}' {} \; | grep -vE '^(actions|github)/' | sort | uniq
 ```
+
+## Testing
+
+Workflows can be locally tested using the [`act` CLI](https://github.com/nektos/act/).
+The [.github/workflows/tests/](./tests) folder contains test scripts and event payloads to locally trigger workflows.
+
+> [!WARNING]
+> Locally running workflows will still query GitHub backend and will update the GitHub project accordingly.
+> Pay extra attention to the workflow jobs you trigger to not create development disruption.

.github/workflows/add-milestone-to-pull-requests.yaml

@@ -9,7 +9,7 @@ jobs:
   add_milestone_to_merged:
     name: Add milestone to merged pull requests
     permissions:
-      issues: read # Required to list milestones
+      issues: write # Required to update a pull request using the issues API
       pull-requests: write # Required to update the milestone of a pull request
     if: github.event.pull_request.merged && github.event.pull_request.milestone == null
     runs-on: ubuntu-latest

.github/workflows/analyze-changes.yaml

@@ -44,7 +44,8 @@ jobs:
         with:
           submodules: 'recursive'
 
-      - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
+      - name: Cache Gradle dependencies
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
         with:
           path: |
             ~/.gradle/caches
@@ -97,7 +98,8 @@ jobs:
         with:
           submodules: 'recursive'
 
-      - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
+      - name: Cache Gradle dependencies
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
         with:
           path: |
             ~/.gradle/caches

.github/workflows/comment-on-submodule-update.yaml

@@ -12,6 +12,7 @@ jobs:
   comment_on_submodule_update:
     permissions:
       issues: write # Required to create a comment on the pull request
+      pull-requests: write # Required to create a comment on the pull request
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/increment-milestone-on-tag.yaml

@@ -0,0 +1,64 @@
+name: Increment milestones on tag
+on:
+  create
+permissions:
+  issues: write # Required to update milestones
+
+jobs:
+  increment_milestone:
+    if: github.event.ref_type == 'tag' && contains(github.event.ref,'-RC') == false
+    runs-on: ubuntu-latest
+    steps:
+      - name: Close current milestone
+        id: close-milestone
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # 7.0.1
+        with:
+          script: |
+            // Get the milestone title ("X.Y.Z") from tag name ("vX.Y.Z")
+            const match = '${{github.event.ref}}'.match(/v(\d+\.\d+\.\d+)/i)
+            if (!match) {
+              core.setFailed('Failed to parse tag name into milestone title: ${{github.event.ref}}')
+              return
+            }
+            const milestoneTitle = match[1]
+            // Look for the milestone from its title
+            const response = await github.rest.issues.listMilestones({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              state: 'open'
+            })
+            if (!response.data || response.data.length == 0) {
+              core.setFailed(`Failed to list milestones: ${response.status}`)
+              return
+            }
+            const milestone = response.data.find(milestone => milestone.title == milestoneTitle)
+            if (!milestone) {
+              core.setFailed(`Failed to find milestone: ${milestoneTitle}`)
+              return
+            }
+            // Close the milestone
+            await github.rest.issues.updateMilestone({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              state: 'closed',
+              milestone_number: milestone.number
+            }).catch(error => {
+              core.setFailed(`Failed to close milestone: ${error}`)
+            })
+            // Compute the next milestone version
+            const versionNumbers = milestoneTitle.split('.').map(Number)
+            if (versionNumbers[2] != 0) {
+              core.info('Closing a patch version milestone. Not opening a new one.')
+              return
+            }
+            versionNumbers[1]++
+            const nextMilestoneTitle = versionNumbers.join('.')
+            core.info(`Creating next version milestone: ${nextMilestoneTitle}`)
+            // Create the next milestone
+            await github.issues.createMilestone({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              title: nextMilestoneTitle
+            }).catch(error => {
+              core.setFailed(`Failed to create milestone ${nextMilestoneTitle}: ${error}`)
+            })

.github/workflows/increment-milestones-on-tag.yaml

@@ -0,0 +1,9 @@
+{
+    "pull_request": {
+        "number": 7549,
+        "base": {
+            "ref": "master"
+        },
+        "merged": true
+    }
+}

.github/workflows/tests/add-milestone-to-pull-requests/payload-pull-request.json

@@ -0,0 +1,3 @@
+#!/bin/bash
+source "$(dirname "$0")/../env.sh"
+testworkflow pull_request