Merge branch 'main' into aspnetcore-route-fix

Author: RassK

.github/codeql/codeql-config.yml

@@ -0,0 +1,12 @@
+name: "CodeQL config"
+
+queries:
+  - uses: security-extended
+
+# Disable specific queries
+query-filters:
+  - exclude:
+      id:
+        - actions/untrusted-checkout
+        - actions/untrusted-checkout/high
+        - actions/untrusted-checkout/medium

.github/component_owners.yml

@@ -17,6 +17,7 @@ components:
   src/OpenTelemetry.Extensions.AWS/:
     - srprash
     - normj
+    - lukeina2z
   src/OpenTelemetry.Extensions.Enrichment/:
     - evgenyfedorov2
     - dariusclay
@@ -30,10 +31,12 @@ components:
     - srprash
     - normj
     - muhammad-othman
+    - lukeina2z
   src/OpenTelemetry.Instrumentation.AWSLambda/:
     - rypdal
     - Oberon00
     - normj
+    - lukeina2z
   src/OpenTelemetry.Instrumentation.Cassandra/:
     - xsoheilalizadeh
   src/OpenTelemetry.Instrumentation.ConfluentKafka/:
@@ -71,6 +74,7 @@ components:
   src/OpenTelemetry.Resources.AWS/:
     - srprash
     - normj
+    - lukeina2z
   src/OpenTelemetry.Resources.Azure/:
     - rajkumar-rangaraj
   src/OpenTelemetry.Resources.Container/:
@@ -92,6 +96,7 @@ components:
   src/OpenTelemetry.Sampler.AWS/:
     - srprash
     - normj
+    - lukeina2z
   test/OpenTelemetry.Exporter.Geneva.Benchmarks/:
     - rajkumar-rangaraj
     - xiang17
@@ -114,6 +119,7 @@ components:
   test/OpenTelemetry.Extensions.AWS.Tests/:
     - srprash
     - normj
+    - lukeina2z
   test/OpenTelemetry.Extensions.Enrichment.Tests/:
     - evgenyfedorov2
     - dariusclay
@@ -127,10 +133,12 @@ components:
     - srprash
     - normj
     - muhammad-othman
+    - lukeina2z
   test/OpenTelemetry.Instrumentation.AWSLambda.Tests/:
     - rypdal
     - Oberon00
     - normj
+    - lukeina2z
   test/OpenTelemetry.Instrumentation.Cassandra.Tests/:
     - xsoheilalizadeh
   test/OpenTelemetry.Instrumentation.ConfluentKafka.Tests/:
@@ -164,6 +172,7 @@ components:
   test/OpenTelemetry.Resources.AWS.Tests/:
     - srprash
     - normj
+    - lukeina2z
   test/OpenTelemetry.Resources.Azure.Tests/:
     - rajkumar-rangaraj
   test/OpenTelemetry.Resources.Container.Tests/:
@@ -182,3 +191,4 @@ components:
   test/OpenTelemetry.Sampler.AWS.Tests/:
     - srprash
     - normj
+    - lukeina2z

.github/workflows/Component.BuildTest.yml

@@ -172,7 +172,7 @@ jobs:
         token: ${{ secrets.CODECOV_TOKEN }}
 
     - name: Publish ${{ steps.resolve-project.outputs.name }} NuGet packages to Artifacts
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
       # Only publish packages from the first job, which should be net462 for Windows in most cases, which is preferred for .NET Framework support
       if: ${{ matrix.os == 'windows-latest' && inputs.pack && strategy.job-index == 0 }}
       with:

.github/workflows/ci-Exporter.OneCollector-Integration.yml

@@ -24,32 +24,21 @@ jobs:
 
   build-integration-test:
     needs: authorize
-
     strategy:
-      fail-fast: false # ensures the entire test matrix is run, even if one permutation fails
+      fail-fast: false
       matrix:
         os: [ windows-latest, ubuntu-24.04 ]
         version: [ net462, net8.0 ]
         exclude:
         - os: ubuntu-24.04
           version: net462
-
-    runs-on: ${{ matrix.os }}
-    steps:
-    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      with:
-        ref: refs/pull/${{ github.event.pull_request.number }}/merge # Run on the merge commit once approved
-
-    - name: Setup dotnet
-      uses: actions/setup-dotnet@d4c94342e560b34958eacfc5d055d21461ed1c5d # v5.0.0
-
-    - name: dotnet restore Component.proj for OpenTelemetry.Exporter.OneCollector
-      run: dotnet restore build/Projects/Component.proj -p:BUILD_COMPONENT=OpenTelemetry.Exporter.OneCollector
-
-    - name: dotnet build Component.proj for OpenTelemetry.Exporter.OneCollector
-      run: dotnet build build/Projects/Component.proj --configuration Release --no-restore -p:BUILD_COMPONENT=OpenTelemetry.Exporter.OneCollector
-
-    - name: dotnet test Component.proj for OpenTelemetry.Exporter.OneCollector
-      run: dotnet test build/Projects/Component.proj --filter CategoryName=OneCollectorIntegrationTests --framework ${{ matrix.version }} --configuration Release --no-restore --no-build -p:BUILD_COMPONENT=OpenTelemetry.Exporter.OneCollector --logger:"console;verbosity=detailed"
-      env:
-        OTEL_ONECOLLECTOR_INSTRUMENTATION_KEY: ${{ secrets.OTEL_ONECOLLECTOR_INSTRUMENTATION_KEY }}
+    uses: ./.github/workflows/integration-test-reusable.yml
+    with:
+      component: OpenTelemetry.Exporter.OneCollector
+      os: ${{ matrix.os }}
+      version: ${{ matrix.version }}
+      test-filter: OneCollectorIntegrationTests
+      env-var-name: OTEL_ONECOLLECTOR_INSTRUMENTATION_KEY
+      checkout-ref: refs/pull/${{ github.event.pull_request.number }}/merge
+    secrets:
+      instrumentation-key: ${{ secrets.OTEL_ONECOLLECTOR_INSTRUMENTATION_KEY }}

.github/workflows/ci.yml

@@ -1,6 +1,8 @@
 name: Build
 
 on:
+  merge_group:
+    types: [ checks_requested ]
   push:
     branches: [ 'main' ]
   pull_request:

.github/workflows/codeql-analysis-steps.yml

@@ -35,13 +35,14 @@ jobs:
           show-progress: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@f443b600d91635bebf5b0d9ebc620189c0d6fba5 # v4.30.8
+        uses: github/codeql-action/init@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.0
         with:
           build-mode: none
           languages: ${{ matrix.language }}
+          config-file: ./.github/codeql/codeql-config.yml
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@f443b600d91635bebf5b0d9ebc620189c0d6fba5 # v4.30.8
+        uses: github/codeql-action/analyze@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.0
         with:
           category: '/language:${{ matrix.language }}'
 

.github/workflows/fossa.yml

@@ -11,10 +11,13 @@ permissions:
 jobs:
   fossa:
     runs-on: ubuntu-latest
+    env:
+      FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - uses: fossas/fossa-action@3ebcea1862c6ffbd5cf1b4d0bd6b3fe7bd6f2cac # v1.7.0
+        if: env.FOSSA_API_KEY != ''
         with:
-          api-key: ${{secrets.FOSSA_API_KEY}}
+          api-key: ${{ secrets.FOSSA_API_KEY }}
           team: OpenTelemetry

.github/workflows/integration-test-reusable.yml

@@ -0,0 +1,65 @@
+name: Reusable Integration Test
+
+permissions:
+  contents: read
+
+on:
+  workflow_call:
+    inputs:
+      component:
+        description: 'Component to build and test'
+        required: true
+        type: string
+      os:
+        description: 'Operating system to run on'
+        required: true
+        type: string
+      version:
+        description: 'Framework version to test'
+        required: true
+        type: string
+      test-filter:
+        description: 'Test filter category'
+        required: true
+        type: string
+      env-var-name:
+        description: 'Environment variable name for instrumentation key'
+        required: false
+        type: string
+        default: 'INSTRUMENTATION_KEY'
+      checkout-ref:
+        description: 'Git ref to checkout'
+        required: false
+        type: string
+        default: ''
+    secrets:
+      instrumentation-key:
+        description: 'Instrumentation key for testing'
+        required: false
+
+jobs:
+  build-and-test:
+    runs-on: ${{ inputs.os }}
+    steps:
+    # Security: When called from pull_request_target with untrusted PR code,
+    # this checkout requires prior approval via the 'authorize' job environment.
+    # The workflow has limited permissions (contents: read) and uses persist-credentials: false
+    # to prevent credential theft.
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        persist-credentials: false
+        ref: ${{ inputs.checkout-ref }}
+
+    - name: Setup dotnet
+      uses: actions/setup-dotnet@d4c94342e560b34958eacfc5d055d21461ed1c5d # v5.0.0
+
+    - name: dotnet restore Component.proj
+      run: dotnet restore build/Projects/Component.proj -p:BUILD_COMPONENT=${{ inputs.component }}
+
+    - name: dotnet build Component.proj
+      run: dotnet build build/Projects/Component.proj --configuration Release --no-restore -p:BUILD_COMPONENT=${{ inputs.component }}
+
+    - name: dotnet test Component.proj
+      run: dotnet test build/Projects/Component.proj --filter CategoryName=${{ inputs.test-filter }} --framework ${{ inputs.version }} --configuration Release --no-restore --no-build -p:BUILD_COMPONENT=${{ inputs.component }} --logger:"console;verbosity=detailed"
+      env:
+        ${{ inputs.env-var-name }}: ${{ secrets.instrumentation-key }}

.github/workflows/ossf-scorecard.yml

@@ -33,7 +33,7 @@ jobs:
       # uploads of run results in SARIF format to the repository Actions tab.
       # https://docs.github.com/en/actions/advanced-guides/storing-workflow-data-as-artifacts
       - name: "Upload artifact"
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: SARIF file
           path: results.sarif
@@ -42,6 +42,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@f443b600d91635bebf5b0d9ebc620189c0d6fba5 # v4.30.8
+        uses: github/codeql-action/upload-sarif@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.0
         with:
           sarif_file: results.sarif

.github/workflows/publish-packages.yml

@@ -94,7 +94,7 @@ jobs:
 
       - name: Publish Artifacts
         id: upload-artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: ${{ github.ref_name }}-packages
           path: ./artifacts/package/release
@@ -105,7 +105,7 @@ jobs:
           # renovate: datasource=nuget depName=dotnet-validate
           DOTNET_VALIDATE_VERSION: '0.0.1-preview.537'
           # renovate: datasource=nuget depName=Meziantou.Framework.NuGetPackageValidation.Tool
-          MEZIANTOU_VALIDATE_NUGET_PACKAGE_VERSION: '1.0.31'
+          MEZIANTOU_VALIDATE_NUGET_PACKAGE_VERSION: '1.0.34'
         run: |
           dotnet tool install --global dotnet-validate --version ${env:DOTNET_VALIDATE_VERSION} --allow-roll-forward
           dotnet tool install --global Meziantou.Framework.NuGetPackageValidation.Tool --version ${env:MEZIANTOU_VALIDATE_NUGET_PACKAGE_VERSION} --allow-roll-forward