v6.20.0 proposal

.github/CODEOWNERS

@@ -335,6 +335,9 @@
 /packages/dd-trace/test/baggage.spec.js @DataDog/dd-trace-js @DataDog/apm-sdk-capabilities-js
 /packages/dd-trace/src/carrier.js @DataDog/dd-trace-js @DataDog/apm-sdk-capabilities-js
 /packages/dd-trace/test/carrier.spec.js @DataDog/dd-trace-js @DataDog/apm-sdk-capabilities-js
+/packages/dd-trace/src/knuth-hash.js @DataDog/dd-trace-js @DataDog/apm-sdk-capabilities-js
+/packages/dd-trace/src/otel-sampling.js @DataDog/dd-trace-js @DataDog/apm-sdk-capabilities-js
+/packages/dd-trace/test/opentracing/propagation/otel-sampling.spec.js @DataDog/dd-trace-js @DataDog/apm-sdk-capabilities-js
 /packages/dd-trace/src/*sampler.js @DataDog/dd-trace-js @DataDog/apm-sdk-capabilities-js
 /packages/dd-trace/test/*sampler.spec.js @DataDog/dd-trace-js @DataDog/apm-sdk-capabilities-js
 /packages/dd-trace/src/sampling_rule.js @DataDog/dd-trace-js @DataDog/apm-sdk-capabilities-js
@@ -387,6 +390,7 @@
 /.github/workflows/audit.yml @DataDog/dd-trace-js @DataDog/lang-platform-js @dd-octo-sts
 /.github/workflows/custom-node-version-dispatch.yml @DataDog/dd-trace-js @Datadog/lang-platform-js @dd-octo-sts
 /.github/workflows/dependabot-automation.yml @DataDog/dd-trace-js @DataDog/lang-platform-js @DataDog/apm-sdk-capabilities-js @dd-octo-sts
+/.github/workflows/renovate-automation.yml @DataDog/dd-trace-js @DataDog/lang-platform-js @DataDog/apm-sdk-capabilities-js @dd-octo-sts
 /.github/workflows/flakiness.yml @DataDog/dd-trace-js @DataDog/lang-platform-js @dd-octo-sts
 /.github/workflows/platform.yml @DataDog/dd-trace-js @DataDog/lang-platform-js @dd-octo-sts
 /.github/workflows/project.yml @DataDog/dd-trace-js @Datadog/lang-platform-js @dd-octo-sts
@@ -442,6 +446,7 @@
 
 /.github/CODEOWNERS @DataDog/dd-trace-js @DataDog/lang-platform-js
 /.github/dependabot.yml @DataDog/dd-trace-js @DataDog/lang-platform-js @DataDog/apm-sdk-capabilities-js
+/.github/renovate.json @DataDog/dd-trace-js @DataDog/lang-platform-js @DataDog/apm-sdk-capabilities-js
 /.github/pull_request_template.md @DataDog/dd-trace-js @DataDog/lang-platform-js
 /.github/vendored-dependencies.csv @DataDog/dd-trace-js @DataDog/lang-platform-js
 
@@ -455,6 +460,7 @@
 /benchmark/sirun/exporting-pipeline/ @DataDog/dd-trace-js @DataDog/lang-platform-js
 /benchmark/sirun/id/ @DataDog/dd-trace-js @DataDog/lang-platform-js
 /benchmark/sirun/log/ @DataDog/dd-trace-js @DataDog/lang-platform-js
+/benchmark/sirun/openfeature/ @DataDog/feature-flagging-and-experimentation-sdk
 /benchmark/sirun/runtime-metrics/ @DataDog/dd-trace-js @DataDog/lang-platform-js
 /benchmark/sirun/scope/ @DataDog/dd-trace-js @DataDog/lang-platform-js
 /benchmark/sirun/shimmer-runtime/ @DataDog/dd-trace-js @DataDog/lang-platform-js

.github/chainguard/yarn-dedupe.sts.yaml → .github/chainguard/renovate-automation.sts.yaml

@@ -3,10 +3,10 @@ issuer: https://token.actions.githubusercontent.com
 subject: repo:DataDog/dd-trace-js:pull_request
 
 claim_pattern:
+  actor: renovate\[bot\]
   event_name: pull_request
   ref: refs/pull/[0-9]+/merge
-  job_workflow_ref: DataDog/dd-trace-js/\.github/workflows/project.yml@refs/pull/[0-9]+/merge
+  job_workflow_ref: DataDog/dd-trace-js/\.github/workflows/renovate-automation.yml@refs/pull/[0-9]+/merge
 
 permissions:
-  contents: write
-
+  pull_requests: write

.github/renovate.json

@@ -0,0 +1,130 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ],
+  "enabledManagers": [
+    "npm"
+  ],
+  "includePaths": [
+    "package.json",
+    "yarn.lock",
+    "docs/package.json",
+    "docs/yarn.lock",
+    ".github/actions/datadog-ci/package.json",
+    ".github/actions/datadog-ci/yarn.lock",
+    "vendor/package.json",
+    "vendor/package-lock.json"
+  ],
+  "timezone": "UTC",
+  "dependencyDashboard": true,
+  "automergeType": "pr",
+  "automergeStrategy": "squash",
+  "platformAutomerge": true,
+  "rebaseWhen": "behind-base-branch",
+  "postUpdateOptions": [
+    "yarnDedupeHighest"
+  ],
+  "vulnerabilityAlerts": {
+    "enabled": false
+  },
+  "osvVulnerabilityAlerts": false,
+  "lockFileMaintenance": {
+    "enabled": true,
+    "schedule": [
+      "* 0-4 * * 0"
+    ]
+  },
+  "packageRules": [
+    {
+      "description": "Disable regular dependency updates",
+      "matchManagers": [
+        "npm"
+      ],
+      "matchUpdateTypes": [
+        "major",
+        "minor",
+        "patch",
+        "pin",
+        "pinDigest",
+        "digest",
+        "rollback",
+        "bump",
+        "replacement"
+      ],
+      "enabled": false
+    },
+    {
+      "description": "Automerge Sunday lockfile maintenance",
+      "matchManagers": [
+        "npm"
+      ],
+      "matchUpdateTypes": [
+        "lockFileMaintenance"
+      ],
+      "groupSingleUpdates": true,
+      "automerge": true,
+      "labels": [
+        "dependencies",
+        "javascript",
+        "semver-patch"
+      ]
+    },
+    {
+      "description": "Root lockfile maintenance",
+      "matchManagers": [
+        "npm"
+      ],
+      "matchUpdateTypes": [
+        "lockFileMaintenance"
+      ],
+      "matchFileNames": [
+        "package.json"
+      ],
+      "groupName": "root lockfile maintenance",
+      "groupSlug": "root-lockfile-maintenance"
+    },
+    {
+      "description": "Docs lockfile maintenance",
+      "matchManagers": [
+        "npm"
+      ],
+      "matchUpdateTypes": [
+        "lockFileMaintenance"
+      ],
+      "matchFileNames": [
+        "docs/package.json"
+      ],
+      "groupName": "docs lockfile maintenance",
+      "groupSlug": "docs-lockfile-maintenance"
+    },
+    {
+      "description": "datadog-ci action lockfile maintenance",
+      "matchManagers": [
+        "npm"
+      ],
+      "matchUpdateTypes": [
+        "lockFileMaintenance"
+      ],
+      "matchFileNames": [
+        ".github/actions/datadog-ci/package.json"
+      ],
+      "groupName": "datadog-ci action lockfile maintenance",
+      "groupSlug": "datadog-ci-action-lockfile-maintenance"
+    },
+    {
+      "description": "Vendor lockfile maintenance",
+      "matchManagers": [
+        "npm"
+      ],
+      "matchUpdateTypes": [
+        "lockFileMaintenance"
+      ],
+      "matchFileNames": [
+        "vendor/package.json"
+      ],
+      "groupName": "vendor lockfile maintenance",
+      "groupSlug": "vendor-lockfile-maintenance"
+    }
+  ]
+}

.github/workflows/project.yml

@@ -160,121 +160,3 @@ jobs:
   #     - uses: ./.github/actions/node/latest
   #     - uses: ./.github/actions/install
   #     - run: node scripts/verify-ci-config.js
-
-  yarn-dedupe:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    outputs:
-      has_changes: ${{ steps.diff.outputs.has_changes }}
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Setup Node.js
-        uses: ./.github/actions/node/latest
-
-      - name: Install dependencies
-        uses: ./.github/actions/install
-
-      - name: Run npm run dependencies:dedupe
-        run: npm run dependencies:dedupe
-
-      - name: Prepare yarn.lock update (same-repo PRs only; restricted paths)
-        id: diff
-        run: |
-          set -euo pipefail
-
-          if git diff --quiet; then
-            echo "has_changes=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          fail_message() { cat <<'EOF'
-          ❌ The yarn.lock file needs deduplication!
-
-          The dedupe command has modified your yarn.lock file.
-          This means there were duplicate dependencies that could be optimized.
-
-          To fix this issue:
-          1. Run 'npm run dependencies:dedupe' locally
-          2. Commit the updated yarn.lock file
-          3. Push your changes
-
-          This helps keep the dependency tree clean.
-          EOF
-          }
-
-          changes="$(git diff --name-only)"
-          if [ "$changes" != "yarn.lock" ]; then
-            echo "Unexpected changed paths during yarn dedupe:"
-            echo "$changes"
-            exit 1
-          fi
-
-          # Never push updates to fork PR branches, and don't auto-fix outside PRs.
-          if [ "${{ github.event_name }}" != "pull_request" ]; then
-            fail_message
-            exit 1
-          fi
-          if [ "${{ github.event.pull_request.head.repo.full_name }}" != "${{ github.repository }}" ]; then
-            fail_message
-            exit 1
-          fi
-
-          cp yarn.lock "${RUNNER_TEMP}/yarn.lock"
-          echo "has_changes=true" >> "$GITHUB_OUTPUT"
-
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        if: steps.diff.outputs.has_changes == 'true'
-        with:
-          name: yarn-lock
-          path: ${{ runner.temp }}/yarn.lock
-          if-no-files-found: error
-
-  yarn-dedupe-push:
-    # If this job pushes a commit, GitHub will re-trigger the workflow on `pull_request:synchronize`
-    # with `github.actor == 'dd-octo-sts[bot]'`. Never attempt to mint another token / push again on
-    # that follow-up run.
-    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && needs.yarn-dedupe.outputs.has_changes == 'true' && github.actor != 'dd-octo-sts[bot]'
-    runs-on: ubuntu-latest
-    needs: yarn-dedupe
-    # Security: this job has an STS-minted token, but never runs installs/builds.
-    # It only updates yarn.lock via the GitHub API.
-    permissions:
-      id-token: write
-    steps:
-      - uses: DataDog/dd-octo-sts-action@c85802a58e202b7e764b5441e4378c76043c8108 # v1.0.5
-        id: octo-sts
-        with:
-          scope: DataDog/dd-trace-js
-          policy: yarn-dedupe
-
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: yarn-lock
-          path: ${{ runner.temp }}/yarn-lock-artifact
-
-      - name: Update yarn.lock via GitHub API (server-created verified commit)
-        env:
-          GH_TOKEN: ${{ steps.octo-sts.outputs.token }}
-          OWNER: ${{ github.repository_owner }}
-          REPO: ${{ github.event.repository.name }}
-          BRANCH: ${{ github.event.pull_request.head.ref }}
-        run: |
-          set -euo pipefail
-
-          test -f "${{ runner.temp }}/yarn-lock-artifact/yarn.lock"
-          sha="$(gh api -q '.sha' "repos/${OWNER}/${REPO}/contents/yarn.lock?ref=${BRANCH}")"
-          base64 -w 0 "${{ runner.temp }}/yarn-lock-artifact/yarn.lock" > "${{ runner.temp }}/yarn-lock-b64.txt"
-
-          jq -n \
-            --arg message "chore: deduplicate yarn.lock" \
-            --rawfile content "${{ runner.temp }}/yarn-lock-b64.txt" \
-            --arg sha "$sha" \
-            --arg branch "$BRANCH" \
-            '{message: $message, content: $content, sha: $sha, branch: $branch}' \
-          | gh api -X PUT "repos/${OWNER}/${REPO}/contents/yarn.lock" --input -

.github/workflows/renovate-automation.yml

@@ -0,0 +1,28 @@
+name: "Renovate Automation"
+
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - synchronize
+
+jobs:
+  renovate-automation:
+    if: >-
+      github.event.pull_request.user.login == 'renovate[bot]' &&
+      github.actor == 'renovate[bot]'
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+      - uses: DataDog/dd-octo-sts-action@c85802a58e202b7e764b5441e4378c76043c8108 # v1.0.5
+        id: octo-sts
+        with:
+          scope: DataDog/dd-trace-js
+          policy: renovate-automation
+      - name: Approve the PR
+        run: gh pr review --approve "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ steps.octo-sts.outputs.token }}

.gitlab/one-pipeline.locked.yml

@@ -1,4 +1,4 @@
 # DO NOT EDIT THIS FILE MANUALLY
 # This file is auto-generated by automation.
 include:
-  - remote: https://gitlab-templates.ddbuild.io/libdatadog/include/versions/1.5.4/one-pipeline.yml
+  - remote: https://gitlab-templates.ddbuild.io/libdatadog/include/versions/1.5.5/one-pipeline.yml