Merge branch 'main' into codeboten/fix-sec-warnings-4

.github/workflows/api-compatibility.yml

@@ -10,8 +10,7 @@ on:
     branches:
       - main
 
-permissions:
-  contents: read
+permissions: read-all
 
 jobs:
   Check-Compatibility:

.github/workflows/build-and-test-arm.yml

@@ -13,8 +13,7 @@ env:
   # We limit cache download as a whole to 5 minutes.
   SEGMENT_DOWNLOAD_TIMEOUT_MINS: 2
 
-permissions:
-  contents: read
+permissions: read-all
 
 # Do not cancel this workflow on main. See https://github.com/open-telemetry/opentelemetry-collector-contrib/pull/16616
 concurrency:

.github/workflows/build-and-test-windows.yaml

@@ -12,8 +12,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref_name }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
+permissions: read-all
 
 jobs:
   windows-unittest:

.github/workflows/build-and-test.yml

@@ -8,8 +8,7 @@ on:
     types: [checks_requested]
   pull_request:
 
-permissions:
-  contents: read
+permissions: read-all
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref_name }}

.github/workflows/builder-integration-test.yaml

@@ -15,16 +15,15 @@ on:
 
   # manual execution
   workflow_dispatch:
-  
+
   merge_group:
     types: [checks_requested]
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref_name }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
+permissions: read-all
 
 jobs:
   integration-test:

.github/workflows/changelog.yml

@@ -16,8 +16,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref_name }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
+permissions: read-all
 
 jobs:
   changelog:

.github/workflows/check-links.yaml

@@ -10,8 +10,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref_name }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
+permissions: read-all
 
 jobs:
   changedfiles:

.github/workflows/check-merge-freeze.yml

@@ -2,11 +2,22 @@ name: Merge freeze
 
 on:
   pull_request:
-    types: [opened, ready_for_review, synchronize, reopened, labeled, unlabeled, enqueued]
+    types:
+      [
+        opened,
+        ready_for_review,
+        synchronize,
+        reopened,
+        labeled,
+        unlabeled,
+        enqueued,
+      ]
     branches: [main]
   merge_group:
     types: [checks_requested]
 
+permissions: read-all
+
 jobs:
   check-merge-freeze:
     name: Check

.github/workflows/codeql-analysis.yml

@@ -8,8 +8,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref_name }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
+permissions: read-all
 
 jobs:
   CodeQL-Build:

.github/workflows/contrib-tests.yml

@@ -14,8 +14,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref_name }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
+permissions: read-all
 
 jobs:
   contrib-tests-matrix:

.github/workflows/generate-semantic-conventions-pr.yaml

@@ -6,8 +6,7 @@ on:
     - cron: "30 1 * * *"
   workflow_dispatch:
 
-permissions:
-  contents: read
+permissions: read-all
 
 jobs:
   check-versions:

.github/workflows/milestone-add-to-pr.yml

@@ -1,16 +1,20 @@
 # This action adds the "next release" milestone to a pull request
 # when it is merged
 
-name: 'Project: Add PR to Milestone'
+name: "Project: Add PR to Milestone"
 on:
   pull_request_target:
     types:
       - closed
 
+permissions: read-all
+
 jobs:
   update-pr:
     if: github.event.pull_request.merged
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
     steps:
       - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:

.github/workflows/perf.yml

@@ -4,8 +4,7 @@ on:
   push:
     branches: [main]
 
-permissions:
-  contents: read
+permissions: read-all
 
 jobs:
   runperf:

.github/workflows/shellcheck.yml

@@ -1,14 +1,13 @@
 name: Shellcheck lint
 on:
   push:
-    branches: [ main ]
+    branches: [main]
   pull_request:
-    branches: [ main ]
+    branches: [main]
   merge_group:
     types: [checks_requested]
 
-permissions:
-  contents: read
+permissions: read-all
 
 jobs:
   shellcheck:

.github/workflows/stale-pr.yaml

@@ -3,21 +3,20 @@ on:
   schedule:
     - cron: "12 3 * * *" # arbitrary time not to DDOS GitHub
 
-permissions:
-  contents: read
+permissions: read-all
 
 jobs:
   stale:
     permissions:
-      issues: write  # for actions/stale to close stale issues
-      pull-requests: write  # for actions/stale to close stale PRs
+      issues: write # for actions/stale to close stale issues
+      pull-requests: write # for actions/stale to close stale PRs
     runs-on: ubuntu-latest
     steps:
       - uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9.0.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
-          stale-pr-message: 'This PR was marked stale due to lack of activity. It will be closed in 14 days.'
-          close-pr-message: 'Closed as inactive. Feel free to reopen if this PR is still being worked on.'
+          stale-pr-message: "This PR was marked stale due to lack of activity. It will be closed in 14 days."
+          close-pr-message: "Closed as inactive. Feel free to reopen if this PR is still being worked on."
           days-before-pr-stale: 14
           days-before-issue-stale: 730
           days-before-pr-close: 14

.github/workflows/tidy-dependencies.yml

@@ -5,8 +5,7 @@ on:
     branches:
       - main
 
-permissions:
-  contents: read
+permissions: read-all
 
 jobs:
   setup-environment:

docs/coding-guidelines.md

@@ -47,11 +47,40 @@ When naming configuration structs, use the following guidelines:
 - Use the `Settings` suffix for configuration structs that are set by developers in the code. For example, `component.TelemetrySettings` ends in `Settings` since it is set by developers in the code.
 - Avoid redundant prefixes that are already implied by the package name. For example, use`configgrpc.ClientConfig` instead of `configgrpc.GRPCClientConfig`.
 
-#### Experimental module naming
-
-Experimental modules can be introduced as submodules of stable modules. They MUST have the same name as the stable
-modules prefixed with `x`. For example, `config/confighttp` module can have an experimental module named
-`config/confighttp/xconfighttp` that contains experimental APIs.
+### Module organization
+
+As usual in Go projects, organize your code into packages grouping related functionality. To ensure
+that we can evolve different parts of the API independently, you should also group related packages
+into modules.
+
+We use the following rules for some common situations where we split into separate modules:
+1. Each top-level directory should be a separate module.
+1. Each component referenceable by the OpenTelemetry Collector Builder should be in a separate
+   module. For example, the OTLP receiver is in its own module, different from that of other
+   receivers.
+1. Consider splitting into separate modules if the API may evolve independently in separate groups
+   of packages. For example, the configuration related to HTTP and gRPC evolve independently, so
+   `config/configgrpc` and `config/confighttp` are separate modules.
+1. Testing helpers should be in a separate submodule with the suffix `test`. For example, if you
+   have a module `component`, the helpers should be in `component/componenttest`.
+1. Experimental packages that will later be added to another module should be in their own module,
+   named as they will be after integration. For example, if adding a `pprofile` package to `pdata`,
+   you should add a separate module `pdata/pprofile` for the experimental code.
+1. Experimental code that will be added to an existing package in a stable module can be a submodule
+   with the same name, but prefixed with an `x`. For example, `config/confighttp` module can have an
+   experimental module named `config/confighttp/xconfighttp` that contains experimental APIs.
+
+When adding a new module remember to update the following:
+1. Add a changelog note for the new module.
+1. Add the module in `versions.yaml`.
+1. Use `make crosslink` to make sure the module replaces are added correctly throughout the
+   codebase. You may also have to manually add some of the replaces.
+1. Update the [otelcorecol
+   manifest](https://github.com/open-telemetry/opentelemetry-collector/blob/main/cmd/otelcorecol/builder-config.yaml)
+   and [builder
+   tests](https://github.com/open-telemetry/opentelemetry-collector/blob/main/cmd/builder/internal/builder/main_test.go).
+1. Open a follow up PR to update pseudo-versions in all go.mod files. See [this example
+   PR](https://github.com/open-telemetry/opentelemetry-collector/pull/11668).
 
 ### Enumerations