Migrate dd-trace-core groovy files to java part 12

.github/chainguard/self.gitlab.release.sts.yaml

@@ -1,11 +1,11 @@
 issuer: https://gitlab.ddbuild.io
 
-subject_pattern: "project_path:DataDog/apm-reliability/dd-trace-java:ref_type:tag:ref:v.*"
+subject_pattern: 'project_path:DataDog/apm-reliability/dd-trace-java:ref_type:tag:ref:v\d+\.\d+\.\d+'
 
 claim_pattern:
   project_path: "DataDog/apm-reliability/dd-trace-java"
   ref_type: "tag"
-  ref: "v.*"
+  ref: 'v\d+\.\d+\.\d+'
 
 permissions:
   contents: "write"

.github/dependabot.yml

@@ -36,3 +36,8 @@ updates:
       prefix: 'chore(build): '
     cooldown:
       default-days: 2
+
+  - package-ecosystem: gitsubmodule
+    directory: /
+    schedule:
+      interval: weekly

.github/scripts/dependency_age.py

@@ -439,7 +439,7 @@ def validate_lockfiles(args: argparse.Namespace) -> int:
             elif published_at > cutoff:
                 hours_remaining = int((published_at - cutoff).total_seconds() / 3600) + 1
                 group_id, artifact_id, version = gav.split(":", 2)
-                baseline_version = next((c[len(f"{group_id}:{artifact_id}:"):] for c in baseline_coords if c.startswith(f"{group_id}:{artifact_id}:")), None)
+                baseline_version = highest_baseline_version(baseline_coords, group_id, artifact_id)
                 eligible = find_eligible_version(
                     group_id=group_id, artifact_id=artifact_id,
                     too_new_version=version, baseline_version=baseline_version,
@@ -501,6 +501,12 @@ def is_instrumentation_path(relative_path: str) -> bool:
 # build summary of reverted/downgraded dependencies for PR descriptions
 # path_filter restricts the summary to lockfiles whose relative path matches,
 # so each PR (core vs instrumentation) only lists the dependencies it actually changes
+#
+# The summary is split into three on-screen sections, ordered by how urgently a human
+# must act on them:
+#   1. "Cannot verify age, reverted" — age could not be checked at all, needs manual resolution
+#   2. "<N>h cooldown, reverted" — too new and no older eligible version exists, so reverted to baseline
+#   3. "<N>h cooldown, updated to the previous version" — too new, downgraded to an older eligible version
 def build_validation_summary(
     *,
     violations_by_file: dict[str, list[tuple[str, str, int]]],
@@ -509,34 +515,62 @@ def build_validation_summary(
     min_age_hours: int,
     path_filter: Callable[[str], bool],
 ) -> str:
-    header = ["## Dependency age policy", ""]
-    lines = list(header)
+    unverified: list[str] = []
+    cooldown_reverted: list[str] = []
+    cooldown_updated: list[str] = []
     seen: set[str] = set()
+
     for relative_path, replacements in replacements_by_file.items():
         if not path_filter(relative_path):
             continue
         baseline_coords = baseline_lockfiles.get(relative_path, set())
         for old_gav, (new_gav, hours_remaining) in replacements.items():
-            if old_gav not in seen:
-                seen.add(old_gav)
-                if new_gav in baseline_coords:
-                    lines.append(f"- `{old_gav}` is {hours_remaining}h away from meeting {min_age_hours}h cooldown, reverted")
-                else:
-                    new_version = new_gav.rsplit(":", 1)[1]
-                    lines.append(f"- `{old_gav}` is {hours_remaining}h away from meeting {min_age_hours}h cooldown, updated to `{new_version}`")
+            if old_gav in seen:
+                continue
+            seen.add(old_gav)
+            if new_gav in baseline_coords:
+                # the only eligible version was the baseline, so this is effectively a revert
+                cooldown_reverted.append(f"- `{old_gav}` is {hours_remaining}h away from meeting cooldown")
+            else:
+                new_version = new_gav.rsplit(":", 1)[1]
+                cooldown_updated.append(f"- `{old_gav}` is {hours_remaining}h away from meeting cooldown, updated to `{new_version}`")
     for relative_path, entries in violations_by_file.items():
         if not path_filter(relative_path):
             continue
         for gav, kind, hours_remaining in entries:
-            if gav not in seen:
-                seen.add(gav)
-                if kind == "unverified":
-                    lines.append(f"- `{gav}` — cannot verify age, reverted")
-                else:
-                    lines.append(f"- `{gav}` is {hours_remaining}h away from meeting {min_age_hours}h cooldown, reverted")
-    if len(lines) == len(header):  # nothing matched the filter
+            if gav in seen:
+                continue
+            seen.add(gav)
+            if kind == "unverified":
+                unverified.append(f"- `{gav}`")
+            else:
+                cooldown_reverted.append(f"- `{gav}` is {hours_remaining}h away from meeting cooldown")
+
+    blocks: list[str] = []
+    if unverified:
+        blocks.append(
+            "### :warning: Cannot verify age, reverted\n\n"
+            "The age of these dependencies could not be verified, so the lockfiles were reverted. "
+            "This likely means that the following dependencies are published to a repo not yet configured in the workflow. "
+            "If this is the case, add the missing repository as a `--repo-url` in the `Validate changed lock files` step of `.github/workflows/update-gradle-dependencies.yaml`. "
+            "**This needs to be resolved manually.**\n\n"
+            + "\n".join(sorted(unverified))
+        )
+    if cooldown_reverted:
+        blocks.append(
+            f"### {min_age_hours}h cooldown, reverted\n\n"
+            "Too new and no older eligible version exists, so the lockfiles were reverted to the baseline.\n\n"
+            + "\n".join(sorted(cooldown_reverted))
+        )
+    if cooldown_updated:
+        blocks.append(
+            f"### {min_age_hours}h cooldown, updated to the previous version\n\n"
+            "Too new, so an older eligible version was used instead.\n\n"
+            + "\n".join(sorted(cooldown_updated))
+        )
+    if not blocks:  # nothing matched the filter
         return ""
-    return "\n".join(lines)
+    return "## Dependency age policy\n\n" + "\n\n".join(blocks)
 
 
 # replace specific coordinates in lockfiles (for version downgrades)
@@ -644,6 +678,15 @@ def fetch_available_versions(group_id: str, artifact_id: str, repo_urls: list[st
     return []
 
 
+# select the highest baseline version of group:artifact present in a lockfile.
+def highest_baseline_version(baseline_coords: set[str], group_id: str, artifact_id: str) -> str | None:
+    prefix = f"{group_id}:{artifact_id}:"
+    versions = [coord[len(prefix):] for coord in baseline_coords if coord.startswith(prefix)]
+    if not versions:
+        return None
+    return max(versions, key=_version_sort_key)
+
+
 # for a too-new coordinate, walk backward through available versions to find the newest one
 # that meets the age cutoff and is newer than the baseline version
 def find_eligible_version(

.github/scripts/tests/test_dependency_age.py

@@ -1,3 +1,6 @@
+import argparse
+import contextlib
+import io
 import json
 import os
 import re
@@ -6,7 +9,9 @@
 import sys
 import tempfile
 import unittest
+from datetime import datetime, timezone
 from pathlib import Path
+from unittest import mock
 
 REPO_ROOT = Path(__file__).resolve().parents[3]
 SCRIPT = REPO_ROOT / ".github/scripts/dependency_age.py"
@@ -424,6 +429,82 @@ def test_summary_is_empty_when_filter_matches_nothing(self) -> None:
         )
         self.assertEqual(empty, "")
 
+    def test_summary_groups_outcomes_into_sections(self) -> None:
+        # one of each outcome: unverified, too-new revert, replacement-as-revert, replacement-as-update
+        summary = dependency_age.build_validation_summary(
+            violations_by_file={
+                "core/gradle.lockfile": [
+                    ("com.example:unverified-lib:1.0.0", "unverified", 0),
+                    ("com.example:too-new-lib:2.0.0", "too_new", 5),
+                ],
+            },
+            replacements_by_file={
+                "core/gradle.lockfile": {
+                    # eligible version equals the baseline -> effectively a revert
+                    "com.example:revert-lib:3.0.0": ("com.example:revert-lib:2.9.0", 7),
+                    # eligible version is newer than the baseline -> an update to a previous version
+                    "com.example:update-lib:4.0.0": ("com.example:update-lib:3.9.0", 9),
+                },
+            },
+            baseline_lockfiles={
+                "core/gradle.lockfile": {"com.example:revert-lib:2.9.0"},
+            },
+            min_age_hours=48,
+            path_filter=lambda p: True,
+        )
+
+        # three section headings present, in priority order
+        unverified_idx = summary.index("### :warning: Cannot verify age, reverted")
+        reverted_idx = summary.index("### 48h cooldown, reverted")
+        updated_idx = summary.index("### 48h cooldown, updated to the previous version")
+        self.assertLess(unverified_idx, reverted_idx)
+        self.assertLess(reverted_idx, updated_idx)
+
+        # unverified entry lives under the manual-resolution section
+        self.assertIn("**This needs to be resolved manually.**", summary)
+        self.assertIn("- `com.example:unverified-lib:1.0.0`", summary)
+
+        # both the too-new violation and the revert-style replacement land in the reverted section
+        reverted_block = summary[reverted_idx:updated_idx]
+        self.assertIn("com.example:too-new-lib:2.0.0", reverted_block)
+        self.assertIn("com.example:revert-lib:3.0.0", reverted_block)
+
+        # the update names the older version that was used instead
+        updated_block = summary[updated_idx:]
+        self.assertIn("com.example:update-lib:4.0.0", updated_block)
+        self.assertIn("updated to `3.9.0`", updated_block)
+
+    def test_highest_baseline_version_picks_newest_of_coexisting_pins(self) -> None:
+        # A single lockfile can pin the same artifact at several versions (one per Gradle
+        # configuration). The baseline should be the newest so that only versions higher than
+        # the highest existing version are considered upgrades.
+        baseline_coords = {
+            "ch.qos.logback:logback-core:1.1.11",
+            "ch.qos.logback:logback-core:1.2.13",
+            "ch.qos.logback:logback-core:1.5.34",
+            "com.example:unrelated:9.9.9",
+        }
+        self.assertEqual(
+            dependency_age.highest_baseline_version(baseline_coords, "ch.qos.logback", "logback-core"),
+            "1.5.34",
+        )
+        self.assertIsNone(
+            dependency_age.highest_baseline_version(baseline_coords, "ch.qos.logback", "logback-classic")
+        )
+
+    def test_summary_omits_empty_sections(self) -> None:
+        # only too-new violations -> only the "reverted" section should appear
+        summary = dependency_age.build_validation_summary(
+            violations_by_file={"core/gradle.lockfile": [("com.example:core-lib:2.0.0", "too_new", 5)]},
+            replacements_by_file={},
+            baseline_lockfiles={},
+            min_age_hours=48,
+            path_filter=lambda p: True,
+        )
+        self.assertIn("### 48h cooldown, reverted", summary)
+        self.assertNotIn("Cannot verify age", summary)
+        self.assertNotIn("updated to the previous version", summary)
+
 
 if __name__ == "__main__":
     unittest.main()

.github/workflows/add-release-to-cloudfoundry.yaml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout "cloudfoundry" branch
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 7.0.0
         with:
           ref: cloudfoundry
       - name: Get release version

.github/workflows/analyze-changes.yaml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 7.0.0
         with:
           submodules: 'recursive'
       - name: Cache Gradle dependencies
@@ -55,7 +55,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 7.0.0
         with:
           submodules: 'recursive'
 

.github/workflows/create-release-branch.yaml

@@ -43,7 +43,7 @@ jobs:
           echo "branch=release/${TAG%.0}.x" >> "$GITHUB_OUTPUT"
 
       - name: Check out repo at tag
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 7.0.0
         with:
           ref: ${{ steps.determine-tag.outputs.tag }}
 
@@ -82,7 +82,7 @@ jobs:
           policy: self.pin-system-tests.create-pr
 
       - name: Check out repo at release branch
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 7.0.0
         with:
           ref: ${{ needs.create-release-branch.outputs.release-branch-name }}
 

.github/workflows/run-system-tests.yaml

@@ -24,7 +24,7 @@ jobs:
       group: APM Larger Runners
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 7.0.0
         with:
           submodules: 'recursive'
           fetch-depth: 0

.github/workflows/update-gradle-dependencies.yaml

@@ -21,11 +21,11 @@ jobs:
           policy: self.update-gradle-dependencies.create-pr
 
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 7.0.0
         with:
           submodules: "recursive"
 
-      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
         with:
           distribution: 'temurin'
           java-version: '21'
@@ -68,14 +68,22 @@ jobs:
             --min-age-hours "${MIN_DEPENDENCY_AGE_HOURS}" \
             --repo-url "https://repo1.maven.org/maven2" \
             --repo-url "https://repo.akka.io/${AKKA_REPO_TOKEN}/secure" \
+            --repo-url "https://packages.confluent.io/maven" \
+            --repo-url "https://repository.mulesoft.org/releases" \
+            --repo-url "https://repository.mulesoft.org/nexus/content/repositories/public" \
             --github-output "$GITHUB_OUTPUT"
 
       - name: Save instrumentation lock files
         run: |
           mkdir -p /tmp/instrumentation-lockfiles
           find dd-smoke-tests dd-java-agent/instrumentation -name 'gradle.lockfile' -exec cp --parents {} /tmp/instrumentation-lockfiles/ \;
-          # Restore instrumentation dirs to original state (keep only core changes)
+          # Restore instrumentation dirs to original state (keep only core changes).
+          # git restore only reverts tracked files; brand-new lock files are untracked
+          # and would otherwise leak into the core PR, so delete the untracked ones too.
           git restore -- 'dd-smoke-tests/' 'dd-java-agent/instrumentation/'
+          git ls-files --others --exclude-standard -- \
+            'dd-smoke-tests/*gradle.lockfile' 'dd-java-agent/instrumentation/*gradle.lockfile' \
+            | xargs -r rm -f
 
       # ==================== Core modules PR ====================
       - name: Check if core changes exist

.github/workflows/update-jmxfetch-submodule.yaml

@@ -19,7 +19,7 @@ jobs:
           policy: self.update-jmxfetch-submodule.create-pr
 
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 7.0.0
 
       - name: Update Submodule
         run: |

.github/workflows/update-smoke-test-latest-versions.yaml

@@ -21,7 +21,7 @@ jobs:
           policy: self.update-smoke-test-latest-versions.create-pr
 
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # 6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 7.0.0
 
       - name: Define branch name
         id: define-branch
@@ -68,6 +68,8 @@ jobs:
             --artifact-id maven-surefire-plugin \
             --prerelease-pattern alpha \
             --prerelease-pattern beta \
+            --prerelease-pattern rc \
+            --prerelease-pattern '-m\d' \
             --min-age-hours "${MIN_DEPENDENCY_AGE_HOURS}" \
             --current-version "${{ steps.current.outputs.surefire_version }}" \
             --github-output "$GITHUB_OUTPUT"