Merge remote-tracking branch 'origin/master' into bdu/convert-muzzle-to-kotlin

Author: bric3

.github/CODEOWNERS

@@ -45,6 +45,7 @@
 # @DataDog/asm-java (AppSec/IAST)
 /buildSrc/call-site-instrumentation-plugin/                     @DataDog/asm-java
 /dd-java-agent/agent-iast/                                      @DataDog/asm-java
+/dd-java-agent/appsec/appsec-test-fixtures/                     @DataDog/asm-java
 /dd-java-agent/instrumentation/*iast*                           @DataDog/asm-java
 /dd-java-agent/instrumentation/*appsec*                         @DataDog/asm-java
 /dd-java-agent/instrumentation/json/                            @DataDog/asm-java
@@ -54,7 +55,7 @@
 /dd-smoke-tests/iast-util/                                      @DataDog/asm-java
 /dd-smoke-tests/spring-security/                                @DataDog/asm-java
 /dd-java-agent/instrumentation/commons-fileupload/              @DataDog/asm-java
-/dd-java-agent/instrumentation/spring-security-5/               @DataDog/asm-java
+/dd-java-agent/instrumentation/spring/spring-security/          @DataDog/asm-java
 /dd-trace-api/src/main/java/datadog/trace/api/EventTracker.java @DataDog/asm-java
 /internal-api/src/main/java/datadog/trace/api/gateway/          @DataDog/asm-java
 **/appsec/                                                      @DataDog/asm-java
@@ -87,15 +88,17 @@
 /dd-java-agent/instrumentation/maven-surefire/      @DataDog/ci-app-libraries-java
 /dd-java-agent/instrumentation/weaver/              @DataDog/ci-app-libraries-java
 /dd-smoke-tests/gradle/                             @DataDog/ci-app-libraries-java
+/dd-smoke-tests/junit-console/                      @DataDog/ci-app-libraries-java
 /dd-smoke-tests/maven/                              @DataDog/ci-app-libraries-java
 /internal-api/src/main/java/datadog/trace/api/git/  @DataDog/ci-app-libraries-java
 **/civisibility/                                    @DataDog/ci-app-libraries-java
 **/CiVisibility*.java                               @DataDog/ci-app-libraries-java
 **/CiVisibility*.groovy                             @DataDog/ci-app-libraries-java
 
 # @DataDog/debugger-java (Live Debugger)
-/dd-java-agent/agent-debugger/               @DataDog/debugger-java
-/dd-smoke-tests/debugger-integration-tests/  @DataDog/debugger-java
+/dd-java-agent/agent-debugger/                          @DataDog/debugger-java
+/dd-smoke-tests/debugger-integration-tests/             @DataDog/debugger-java
+/internal-api/src/main/java/datadog/trace/api/debugger/ @DataDog/debugger-java
 
 # @DataDog/data-jobs-monitoring
 /dd-java-agent/instrumentation/spark/           @DataDog/data-jobs-monitoring

.github/chainguard/self.gitlab.github-access.read.sts.yaml

@@ -0,0 +1,7 @@
+issuer: https://gitlab.ddbuild.io
+
+subject_pattern: "project_path:DataDog/apm-reliability/dd-trace-java:ref_type:(branch|tag):ref:.*"
+
+permissions:
+  contents: read
+

.github/workflows/analyze-changes.yaml

@@ -35,7 +35,7 @@ jobs:
             ${{ runner.os }}-gradle-
         
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@3c3833e0f8c1c83d449a7478aa59c036a9165498 # v3.29.5
+        uses: github/codeql-action/init@2d92b76c45b91eb80fc44c74ce3fce0ee94e8f9d # v3.29.5
         with:
           languages: 'java'
           build-mode: 'manual'
@@ -52,7 +52,7 @@ jobs:
             --build-cache --parallel --stacktrace --no-daemon --max-workers=4
 
       - name: Perform CodeQL Analysis and upload results to GitHub Security tab
-        uses: github/codeql-action/analyze@3c3833e0f8c1c83d449a7478aa59c036a9165498 # v3.29.5
+        uses: github/codeql-action/analyze@2d92b76c45b91eb80fc44c74ce3fce0ee94e8f9d # v3.29.5
 
   trivy:
     name: Analyze changes with Trivy
@@ -102,7 +102,7 @@ jobs:
           ls -laR "./workspace/.trivy"
 
       - name: Run Trivy security scanner
-        uses: aquasecurity/trivy-action@dc5a429b52fcf669ce959baa2c2dd26090d2a6c4 # v0.32.0
+        uses: aquasecurity/trivy-action@f9424c10c36e288d5fa79bd3dfd1aeb2d6eae808 # v0.33.0
         with:
           scan-type: rootfs
           scan-ref: './workspace/.trivy/'
@@ -115,7 +115,7 @@ jobs:
           TRIVY_JAVA_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-java-db,public.ecr.aws/aquasecurity/trivy-java-db
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@3c3833e0f8c1c83d449a7478aa59c036a9165498 # v3.29.5
+        uses: github/codeql-action/upload-sarif@2d92b76c45b91eb80fc44c74ce3fce0ee94e8f9d # v3.29.5
         if: always()
         with:
           sarif_file: 'trivy-results.sarif'

.gitlab-ci.yml

@@ -30,7 +30,7 @@ variables:
   GRADLE_PLUGIN_PROXY: "https://depot-read-api-java.us1.ddbuild.io/magicmirror/magicmirror/@current/"
   BUILDER_IMAGE_VERSION_PREFIX: "v25.07-" # use either an empty string (e.g. "") for latest images or a version followed by a hyphen (e.g. "v25.05-")
   REPO_NOTIFICATION_CHANNEL: "#apm-java-escalations"
-  DEFAULT_TEST_JVMS: /^(8|11|17|21|stable)$/
+  DEFAULT_TEST_JVMS: /^(8|11|17|21|25)$/ # the latest "stable" version is LTS v25
   PROFILE_TESTS:
     description: "Enable profiling of tests"
     value: "false"
@@ -61,14 +61,14 @@ workflow:
       - "17"
       - "21"
       - "25"
-      - "stable"
       - "semeru11"
       - "oracle8"
       - "zulu8"
       - "semeru8"
       - "ibm8"
       - "zulu11"
       - "semeru17"
+      # - "stable"
     CI_SPLIT: ["1/1"]
 
 # Gitlab doesn't support "parallel" and "parallel:matrix" at the same time
@@ -580,7 +580,7 @@ muzzle-dep-report:
     CI_USE_TEST_AGENT: "true"
     CI_AGENT_HOST: local-agent
   services:
-    - name: ghcr.io/datadog/dd-apm-test-agent/ddapm-test-agent:v1.31.1
+    - name: ghcr.io/datadog/dd-apm-test-agent/ddapm-test-agent:v1.33.1
       alias: local-agent
       variables:
         LOG_LEVEL: "DEBUG"
@@ -636,7 +636,7 @@ test_inst_latest:
     CACHE_TYPE: "latestDep"
   parallel:
     matrix:
-      - testJvm: ["8", "17", "21", "stable"]
+      - testJvm: ["8", "17", "21", "25"] # the latest "stable" version is LTS v25
         # Gitlab doesn't support "parallel" and "parallel:matrix" at the same time
         # This emulates "parallel" by including it in the matrix
         CI_SPLIT: [ "1/6", "2/6", "3/6", "4/6", "5/6", "6/6"]
@@ -688,7 +688,7 @@ test_debugger:
   variables:
     GRADLE_TARGET: ":debuggerTest"
     CACHE_TYPE: "base"
-    DEFAULT_TEST_JVMS: /^(8|11|17|21|stable|semeru8)$/
+    DEFAULT_TEST_JVMS: /^(8|11|17|21|25|semeru8)$/ # the latest "stable" version is LTS v25
   parallel:
     matrix: *test_matrix
 
@@ -908,8 +908,6 @@ verify_maven_central_deployment:
       when: never
     - if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+$/'
       when: on_success
-    - when: manual
-      allow_failure: true
   cache: # Cache is used to signal between the override_verify_maven_central and verify_maven_central_deployment jobs
     - key: $CI_PIPELINE_ID-OVERRIDE_SIGNAL
       paths:
@@ -954,13 +952,6 @@ publishing-gate:
   needs:
     - job: verify_maven_central_deployment
       optional: true # Required for releases only
-  rules:
-    - if: '$POPULATE_CACHE'
-      when: on_success
-    - if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+$/'
-      when: on_success
-    - when: manual
-      allow_failure: true
 
 configure_system_tests:
   variables:

.gitlab/collect_reports.sh

@@ -62,6 +62,7 @@ function process_reports () {
       cp -r workspace/$project_to_save/build/reports/* $report_path/ 2>/dev/null || true
       cp workspace/$project_to_save/build/hs_err_pid*.log $report_path/ 2>/dev/null || true
       cp workspace/$project_to_save/build/javacore*.txt $report_path/ 2>/dev/null || true
+      cp workspace/$project_to_save/build/dumps/*.* $report_path/ 2>/dev/null || true
     fi
 }
 

.gitlab/macrobenchmarks.yml

@@ -1,7 +1,8 @@
 include:
-  project: 'DataDog/benchmarking-platform-tools'
-  file: 'images/templates/gitlab/notify-slo-breaches.template.yml'
-  ref: '925e0a3e7dd628885f6fc69cdaea5c8cc9e212bc'
+  - project: 'DataDog/benchmarking-platform-tools'
+    file: 'images/templates/gitlab/notify-slo-breaches.template.yml'
+  - project: 'DataDog/benchmarking-platform-tools'
+    file: 'images/templates/gitlab/check-slo-breaches.template.yml'
 
 .macrobenchmarks:
   stage: macrobenchmarks
@@ -76,10 +77,9 @@ otel-latest:
 
 
 check-slo-breaches:
+  extends: .check-slo-breaches
   stage: macrobenchmarks
   interruptible: true
-  tags: ["arch:amd64"]
-  image: registry.ddbuild.io/images/benchmarking-platform-tools-ubuntu:latest
   rules:
     - if: $POPULATE_CACHE
       when: never
@@ -127,6 +127,7 @@ check-slo-breaches:
       - platform/artifacts/
     expire_in: 1 week
   variables:
+    DDOCTOSTS_POLICY: "self.gitlab.github-access.read"
     UPSTREAM_PROJECT_ID: $CI_PROJECT_ID # The ID of the current project. This ID is unique across all projects on the GitLab instance.
     UPSTREAM_PROJECT_NAME: $CI_PROJECT_NAME # "dd-trace-java"
     UPSTREAM_BRANCH: $CI_COMMIT_REF_NAME # The branch or tag name for which project is built.

communication/gradle.lockfile

@@ -13,7 +13,7 @@ com.datadoghq:java-dogstatsd-client:4.4.3=compileClasspath,runtimeClasspath,test
 com.fasterxml.jackson.core:jackson-annotations:2.9.0=testCompileClasspath,testRuntimeClasspath
 com.fasterxml.jackson.core:jackson-core:2.9.9=testCompileClasspath,testRuntimeClasspath
 com.fasterxml.jackson.core:jackson-databind:2.9.9.3=testCompileClasspath,testRuntimeClasspath
-com.github.javaparser:javaparser-core:3.25.6=testCompileClasspath,testRuntimeClasspath
+com.github.javaparser:javaparser-core:3.25.6=codenarc,testCompileClasspath,testRuntimeClasspath
 com.github.jnr:jffi:1.2.23=compileClasspath,testCompileClasspath
 com.github.jnr:jffi:1.3.13=runtimeClasspath,testRuntimeClasspath
 com.github.jnr:jnr-a64asm:1.0.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
@@ -45,7 +45,7 @@ com.squareup.moshi:moshi:1.11.0=compileClasspath,runtimeClasspath,testCompileCla
 com.squareup.okhttp3:mockwebserver:3.12.12=testCompileClasspath,testRuntimeClasspath
 com.squareup.okhttp3:okhttp:3.12.12=testCompileClasspath,testRuntimeClasspath
 com.squareup.okio:okio:1.17.5=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.thoughtworks.qdox:qdox:1.12.1=testRuntimeClasspath
+com.thoughtworks.qdox:qdox:1.12.1=codenarc,testRuntimeClasspath
 commons-codec:commons-codec:1.15=spotbugs
 commons-fileupload:commons-fileupload:1.5=testCompileClasspath,testRuntimeClasspath
 commons-io:commons-io:2.11.0=testCompileClasspath,testRuntimeClasspath
@@ -59,10 +59,10 @@ net.bytebuddy:byte-buddy-agent:1.17.5=testCompileClasspath,testRuntimeClasspath
 net.bytebuddy:byte-buddy:1.17.5=testCompileClasspath,testRuntimeClasspath
 net.jcip:jcip-annotations:1.0=compileClasspath,spotbugs,testCompileClasspath,testRuntimeClasspath
 net.sf.saxon:Saxon-HE:11.4=spotbugs
+org.apache.ant:ant-antlr:1.10.14=codenarc
 org.apache.ant:ant-antlr:1.10.15=testRuntimeClasspath
-org.apache.ant:ant-antlr:1.9.15=codenarc
+org.apache.ant:ant-junit:1.10.14=codenarc
 org.apache.ant:ant-junit:1.10.15=testRuntimeClasspath
-org.apache.ant:ant-junit:1.9.15=codenarc
 org.apache.ant:ant-launcher:1.10.15=testRuntimeClasspath
 org.apache.ant:ant:1.10.15=testCompileClasspath,testRuntimeClasspath
 org.apache.bcel:bcel:6.5.0=spotbugs
@@ -77,37 +77,38 @@ org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath
 org.checkerframework:checker-compat-qual:2.5.5=testCompileClasspath,testRuntimeClasspath
 org.checkerframework:checker-qual:3.13.0=testCompileClasspath,testRuntimeClasspath
 org.codehaus.groovy:groovy-all:3.0.24=testCompileClasspath,testRuntimeClasspath
-org.codehaus.groovy:groovy-ant:2.5.14=codenarc
+org.codehaus.groovy:groovy-ant:3.0.23=codenarc
 org.codehaus.groovy:groovy-ant:3.0.24=testCompileClasspath,testRuntimeClasspath
 org.codehaus.groovy:groovy-astbuilder:3.0.24=testCompileClasspath,testRuntimeClasspath
 org.codehaus.groovy:groovy-cli-picocli:3.0.24=testCompileClasspath,testRuntimeClasspath
 org.codehaus.groovy:groovy-console:3.0.24=testCompileClasspath,testRuntimeClasspath
 org.codehaus.groovy:groovy-datetime:3.0.24=testCompileClasspath,testRuntimeClasspath
+org.codehaus.groovy:groovy-docgenerator:3.0.23=codenarc
 org.codehaus.groovy:groovy-docgenerator:3.0.24=testCompileClasspath,testRuntimeClasspath
-org.codehaus.groovy:groovy-groovydoc:2.5.14=codenarc
+org.codehaus.groovy:groovy-groovydoc:3.0.23=codenarc
 org.codehaus.groovy:groovy-groovydoc:3.0.24=testCompileClasspath,testRuntimeClasspath
 org.codehaus.groovy:groovy-groovysh:3.0.24=testCompileClasspath,testRuntimeClasspath
 org.codehaus.groovy:groovy-jmx:3.0.24=testCompileClasspath,testRuntimeClasspath
-org.codehaus.groovy:groovy-json:2.5.14=codenarc
+org.codehaus.groovy:groovy-json:3.0.23=codenarc
 org.codehaus.groovy:groovy-json:3.0.24=testCompileClasspath,testRuntimeClasspath
 org.codehaus.groovy:groovy-jsr223:3.0.24=testCompileClasspath,testRuntimeClasspath
 org.codehaus.groovy:groovy-macro:3.0.24=testCompileClasspath,testRuntimeClasspath
 org.codehaus.groovy:groovy-nio:3.0.24=testCompileClasspath,testRuntimeClasspath
 org.codehaus.groovy:groovy-servlet:3.0.24=testCompileClasspath,testRuntimeClasspath
 org.codehaus.groovy:groovy-sql:3.0.24=testCompileClasspath,testRuntimeClasspath
 org.codehaus.groovy:groovy-swing:3.0.24=testCompileClasspath,testRuntimeClasspath
-org.codehaus.groovy:groovy-templates:2.5.14=codenarc
+org.codehaus.groovy:groovy-templates:3.0.23=codenarc
 org.codehaus.groovy:groovy-templates:3.0.24=testCompileClasspath,testRuntimeClasspath
 org.codehaus.groovy:groovy-test-junit5:3.0.24=testCompileClasspath,testRuntimeClasspath
 org.codehaus.groovy:groovy-test:3.0.24=testCompileClasspath,testRuntimeClasspath
 org.codehaus.groovy:groovy-testng:3.0.24=testCompileClasspath,testRuntimeClasspath
-org.codehaus.groovy:groovy-xml:2.5.14=codenarc
+org.codehaus.groovy:groovy-xml:3.0.23=codenarc
 org.codehaus.groovy:groovy-xml:3.0.24=testCompileClasspath,testRuntimeClasspath
-org.codehaus.groovy:groovy:2.5.14=codenarc
+org.codehaus.groovy:groovy:3.0.23=codenarc
 org.codehaus.groovy:groovy:3.0.24=testCompileClasspath,testRuntimeClasspath
-org.codenarc:CodeNarc:2.2.0=codenarc
+org.codenarc:CodeNarc:3.6.0=codenarc
 org.dom4j:dom4j:2.1.3=spotbugs
-org.gmetrics:GMetrics:1.1=codenarc
+org.gmetrics:GMetrics:2.1.0=codenarc
 org.hamcrest:hamcrest-core:1.3=testCompileClasspath,testRuntimeClasspath
 org.hamcrest:hamcrest:2.2=testCompileClasspath,testRuntimeClasspath
 org.jacoco:org.jacoco.agent:0.8.13=jacocoAgent,jacocoAnt

communication/src/main/java/datadog/communication/BackendApiFactory.java

@@ -5,8 +5,8 @@
 import datadog.communication.http.HttpRetryPolicy;
 import datadog.communication.http.OkHttpUtils;
 import datadog.trace.api.Config;
+import datadog.trace.api.intake.Intake;
 import datadog.trace.util.throwable.FatalAgentMisconfigurationError;
-import java.util.function.Function;
 import javax.annotation.Nullable;
 import okhttp3.HttpUrl;
 import okhttp3.OkHttpClient;
@@ -28,8 +28,8 @@ public BackendApiFactory(Config config, SharedCommunicationObjects sharedCommuni
   public @Nullable BackendApi createBackendApi(Intake intake) {
     HttpRetryPolicy.Factory retryPolicyFactory = new HttpRetryPolicy.Factory(5, 100, 2.0, true);
 
-    if (intake.agentlessModeEnabled.apply(config)) {
-      HttpUrl agentlessUrl = getAgentlessUrl(intake);
+    if (intake.isAgentlessEnabled(config)) {
+      HttpUrl agentlessUrl = HttpUrl.get(intake.getAgentlessUrl(config));
       String apiKey = config.getApiKey();
       if (apiKey == null || apiKey.isEmpty()) {
         throw new FatalAgentMisconfigurationError(
@@ -49,50 +49,19 @@ public BackendApiFactory(Config config, SharedCommunicationObjects sharedCommuni
       String traceId = config.getIdGenerationStrategy().generateTraceId().toString();
       String evpProxyEndpoint = featuresDiscovery.getEvpProxyEndpoint();
       HttpUrl evpProxyUrl = sharedCommunicationObjects.agentUrl.resolve(evpProxyEndpoint);
+      String subdomain = intake.getUrlPrefix();
       return new EvpProxyApi(
-          traceId, evpProxyUrl, retryPolicyFactory, sharedCommunicationObjects.okHttpClient, true);
+          traceId,
+          evpProxyUrl,
+          subdomain,
+          retryPolicyFactory,
+          sharedCommunicationObjects.okHttpClient,
+          true);
     }
 
     log.warn(
         "Cannot create backend API client since agentless mode is disabled, "
             + "and agent does not support EVP proxy");
     return null;
   }
-
-  private HttpUrl getAgentlessUrl(Intake intake) {
-    String customUrl = intake.customUrl.apply(config);
-    if (customUrl != null && !customUrl.isEmpty()) {
-      return HttpUrl.get(String.format("%s/api/%s/", customUrl, intake.version));
-    } else {
-      String site = config.getSite();
-      return HttpUrl.get(
-          String.format("https://%s.%s/api/%s/", intake.urlPrefix, site, intake.version));
-    }
-  }
-
-  public enum Intake {
-    API("api", "v2", Config::isCiVisibilityAgentlessEnabled, Config::getCiVisibilityAgentlessUrl),
-    LLMOBS_API("api", "v2", Config::isLlmObsAgentlessEnabled, Config::getLlMObsAgentlessUrl),
-    LOGS(
-        "http-intake.logs",
-        "v2",
-        Config::isAgentlessLogSubmissionEnabled,
-        Config::getAgentlessLogSubmissionUrl);
-
-    public final String urlPrefix;
-    public final String version;
-    public final Function<Config, Boolean> agentlessModeEnabled;
-    public final Function<Config, String> customUrl;
-
-    Intake(
-        String urlPrefix,
-        String version,
-        Function<Config, Boolean> agentlessModeEnabled,
-        Function<Config, String> customUrl) {
-      this.urlPrefix = urlPrefix;
-      this.version = version;
-      this.agentlessModeEnabled = agentlessModeEnabled;
-      this.customUrl = customUrl;
-    }
-  }
 }

communication/src/main/java/datadog/communication/EvpProxyApi.java

@@ -25,23 +25,25 @@ public class EvpProxyApi implements BackendApi {
   private static final String X_DATADOG_PARENT_ID_HEADER = "x-datadog-parent-id";
   private static final String ACCEPT_ENCODING_HEADER = "Accept-Encoding";
   private static final String CONTENT_ENCODING_HEADER = "Content-Encoding";
-  private static final String API_SUBDOMAIN = "api";
   private static final String GZIP_ENCODING = "gzip";
 
   private final String traceId;
   private final HttpRetryPolicy.Factory retryPolicyFactory;
   private final HttpUrl evpProxyUrl;
+  private final String subdomain;
   private final OkHttpClient httpClient;
   private final boolean responseCompression;
 
   public EvpProxyApi(
       String traceId,
       HttpUrl evpProxyUrl,
+      String subdomain,
       HttpRetryPolicy.Factory retryPolicyFactory,
       OkHttpClient httpClient,
       boolean responseCompression) {
     this.traceId = traceId;
     this.evpProxyUrl = evpProxyUrl.resolve(String.format("api/%s/", API_VERSION));
+    this.subdomain = subdomain;
     this.retryPolicyFactory = retryPolicyFactory;
     this.httpClient = httpClient;
     this.responseCompression = responseCompression;
@@ -60,7 +62,7 @@ public <T> T post(
     Request.Builder requestBuilder =
         new Request.Builder()
             .url(url)
-            .addHeader(X_DATADOG_EVP_SUBDOMAIN_HEADER, API_SUBDOMAIN)
+            .addHeader(X_DATADOG_EVP_SUBDOMAIN_HEADER, subdomain)
             .addHeader(X_DATADOG_TRACE_ID_HEADER, traceId)
             .addHeader(X_DATADOG_PARENT_ID_HEADER, traceId);