Merge remote-tracking branch 'origin/main' into instrumentation-supplementary-guidelines

Signed-off-by: cijothomas <cijo.thomas@gmail.com>

# Conflicts:
#	CHANGELOG.md

Author: cijothomas

.github/renovate.json5

@@ -21,6 +21,10 @@
       "groupName": "github-actions deps"
     }
   ],
+  lockFileMaintenance: {
+    enabled: true,
+    schedule: ["* 0-7 * * 2"], // weekly, before 8am on Tuesday
+  },
   "labels": [
     "dependencies"
   ]

.github/scripts/triage-helper/Pipfile.lock

@@ -15,10 +15,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: check out code
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: install dependencies
-      run: npm install
+      run: npm ci --ignore-scripts
 
     - name: run markdownlint
       run: make markdownlint
@@ -27,9 +29,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: check out code
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
-    - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
 
     - name: install yamllint
       run: make install-yamllint
@@ -41,10 +45,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: check out code
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: install dependencies
-      run: npm install
+      run: npm ci --ignore-scripts
 
     - name: run markdown-link-check
       run: make markdown-link-check
@@ -56,10 +62,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: check out code
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: install dependencies
-      run: npm install
+      run: npm ci --ignore-scripts
 
     - name: run markdown-toc
       run: make markdown-toc-check
@@ -68,7 +76,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: check out code
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: run compliance-matrix
       run: make compliance-matrix
@@ -80,9 +90,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: check out code
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
-    - uses: streetsidesoftware/cspell-action@de2a73e963e7443969755b648a1008f77033c5b2 # v8.4.0
+    - uses: streetsidesoftware/cspell-action@e0668cf020899e887ee8ad4d173c31738a79eae8 # v9.0.1
       with:
         incremental_files_only: false # check all files, not just changed files
         config: .cspell.yaml
@@ -93,10 +105,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: check out code
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: install dependencies
-      run: npm install
+      run: npm ci --ignore-scripts
 
     - name: run textlint
       run: make textlint format=github

.github/workflows/checks.yaml

@@ -12,9 +12,11 @@ jobs:
   fossa:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
-      - uses: fossas/fossa-action@ff70fe9fe17cbd2040648f1c45e8ec4e4884dcf3 # v1.9.0
+      - uses: fossas/fossa-action@29693cc50323968e039056be419b32989fc5880c # v2.0.0
         with:
           api-key: ${{secrets.FOSSA_API_KEY}}
           team: OpenTelemetry

.github/workflows/fossa.yml

@@ -8,40 +8,12 @@ on:
     - cron: "2 22 * * 3" # once a week
   workflow_dispatch:
 
-permissions: read-all
+permissions: {}
 
 jobs:
   analysis:
-    runs-on: ubuntu-latest
     permissions:
-      # Needed for Code scanning upload
-      security-events: write
-      # Needed for GitHub OIDC token if publish_results is true
-      id-token: write
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
-
-      - uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
-        with:
-          results_file: results.sarif
-          results_format: sarif
-          publish_results: true
-
-      # Upload the results as artifacts (optional). Commenting out will disable
-      # uploads of run results in SARIF format to the repository Actions tab.
-      # https://docs.github.com/en/actions/advanced-guides/storing-workflow-data-as-artifacts
-      - name: "Upload artifact"
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: SARIF file
-          path: results.sarif
-          retention-days: 5
-
-      # Upload the results to GitHub's code scanning dashboard (optional).
-      # Commenting out will disable upload of results to your repo's Code Scanning dashboard
-      - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
-        with:
-          sarif_file: results.sarif
+      contents: read # for actions/checkout
+      id-token: write # for Scorecard to publish results
+      security-events: write # for the SARIF upload to code scanning
+    uses: open-telemetry/shared-workflows/.github/workflows/scorecard.yml@d9b812f9924a121c6a8276ea2f9e6f5b622cdd4d # v0.10.0

.github/workflows/ossf-scorecard.yml

@@ -0,0 +1,37 @@
+name: "Reopen issue on command"
+on:
+  issue_comment:
+    types: [created]
+
+permissions:
+  contents: read
+
+jobs:
+  reopen:
+    # Only run on issues (not PRs), on closed issues, when the comment is exactly "/reopen",
+    # and only if the commenter is the issue author or a member/collaborator/owner/contributor.
+    if: >
+      !github.event.issue.pull_request &&
+      github.event.issue.state == 'closed' &&
+      startsWith(github.event.comment.body, '/reopen') &&
+      (
+        github.event.comment.user.login == github.event.issue.user.login ||
+        contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR", "CONTRIBUTOR"]'), github.event.comment.author_association)
+      )
+    permissions:
+      issues: write # required to reopen the issue
+    runs-on: ubuntu-latest
+    steps:
+      - name: Reopen issue
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPO: ${{ github.repository }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          COMMENT_BODY: ${{ github.event.comment.body }}
+        run: |
+          # Require the comment to be exactly "/reopen" (ignoring trailing whitespace)
+          if [[ ! "$COMMENT_BODY" =~ ^/reopen[[:space:]]*$ ]]; then
+            echo "Comment is not an exact /reopen command; skipping."
+            exit 0
+          fi
+          gh issue reopen "$ISSUE_NUMBER" --repo "$REPO"

.github/workflows/reopen-issue.yaml

@@ -0,0 +1,39 @@
+name: "Close stale pull requests and issues"
+on:
+  schedule:
+    - cron: "12 3 * * *" # arbitrary time not to DDOS GitHub
+
+permissions:
+  contents: read
+
+jobs:
+  stale:
+    permissions:
+      pull-requests: write # required for marking and closing stale PRs
+      issues: write # required for marking and closing stale issues
+      actions: write # required for the stale action to manage (reset) its state cache
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          stale-pr-message: 'This PR was marked stale. It will be closed in 14 days without additional activity.'
+          close-pr-message: 'Closed as inactive. Feel free to reopen if this PR is still being worked on.'
+          exempt-pr-labels: 'release:after-ga'
+          stale-issue-message: 'This issue was marked stale due to lack of activity. Please leave a comment if you would like to keep this issue open.'
+          close-issue-message: |
+            Closed due to inactivity.
+
+            We appreciate your input, and if this issue is still relevant,
+            please reopen it, or comment "/reopen" and we'll do it for you.
+
+            Thank you for your contribution!
+          # applies only to pull requests
+          days-before-pr-stale: 14
+          days-before-pr-close: 14
+          # applies only to issues
+          days-before-issue-stale: 365
+          days-before-issue-close: 14
+          # TODO: remove or lower once we process through old issues backlog
+          # defaults to 30 operations per run, empirically ~12 issues or PRs.
+          operations-per-run: 100

.github/workflows/stale-pr.yaml

@@ -17,8 +17,10 @@ jobs:
       run:
         working-directory: ./.github/scripts/triage-helper
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: 3.14
       - name: Install pipenv

.github/workflows/stale.yaml

@@ -29,14 +29,17 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           fetch-depth: 0
 
       - name: Verify CHANGELOG updated
+        env:
+          BASE_REF: ${{ github.base_ref }}
         run: |
           echo "Checking for CHANGELOG modifications..."
-          if git diff --name-only --merge-base origin/${{ github.base_ref }} | grep -q 'CHANGELOG'; then
+          if git diff --name-only --merge-base "origin/${BASE_REF}" | grep -q 'CHANGELOG'; then
             echo "CHANGELOG updated — OK"
           else
             echo "::error::No CHANGELOG file was updated in this PR."