Merge branch 'master' into mhlidd/fix_grpc_status_codes

Author: mhlidd

.github/workflows/README.md

@@ -151,8 +151,9 @@ find .github/workflows -name "*.yaml" -exec  awk '/uses:/{print $2 ","}' {} \; |
 ## Testing
 
 Workflows can be locally tested using the [`act` CLI](https://github.com/nektos/act/).
+Docker and [GiHub CLI](https://cli.github.com/) need also to be installed.
 The [.github/workflows/tests/](./tests) folder contains test scripts and event payloads to locally trigger workflows.
 
 > [!WARNING]
-> Locally running workflows will still query GitHub backend and will update the GitHub project accordingly.
+> Local workflow tests run against the repository and will potentially alter existing issues, milestones and releases.  
 > Pay extra attention to the workflow jobs you trigger to not create development disruption.

.github/workflows/analyze-changes.yaml

@@ -35,7 +35,7 @@ jobs:
             ${{ runner.os }}-gradle-
         
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@76621b61decf072c1cee8dd1ce2d2a82d33c17ed # v3.29.5
+        uses: github/codeql-action/init@96f518a34f7a870018057716cc4d7a5c014bd61c # v3.29.5
         with:
           languages: 'java'
           build-mode: 'manual'
@@ -52,7 +52,7 @@ jobs:
             --build-cache --parallel --stacktrace --no-daemon --max-workers=4
 
       - name: Perform CodeQL Analysis and upload results to GitHub Security tab
-        uses: github/codeql-action/analyze@76621b61decf072c1cee8dd1ce2d2a82d33c17ed # v3.29.5
+        uses: github/codeql-action/analyze@96f518a34f7a870018057716cc4d7a5c014bd61c # v3.29.5
 
   trivy:
     name: Analyze changes with Trivy
@@ -115,7 +115,7 @@ jobs:
           TRIVY_JAVA_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-java-db,public.ecr.aws/aquasecurity/trivy-java-db
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@76621b61decf072c1cee8dd1ce2d2a82d33c17ed # v3.29.5
+        uses: github/codeql-action/upload-sarif@96f518a34f7a870018057716cc4d7a5c014bd61c # v3.29.5
         if: always()
         with:
           sarif_file: 'trivy-results.sarif'

.gitlab-ci.yml

@@ -950,12 +950,13 @@ verify_maven_central_deployment:
       done
 
 publishing-gate:
+  stage: publish
   needs:
     - job: verify_maven_central_deployment
-      optional: true
+      optional: true # Required for releases only
   rules:
     - if: '$POPULATE_CACHE'
-      when: never
+      when: on_success
     - if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+$/'
       when: on_success
     - when: manual

communication/src/main/java/datadog/communication/ddagent/DDAgentFeaturesDiscovery.java

@@ -365,7 +365,7 @@ public boolean supportsDebuggerDiagnostics() {
     return debuggerDiagnosticsEndpoint != null;
   }
 
-  boolean supportsDropping() {
+  public boolean supportsDropping() {
     return supportsDropping;
   }
 

dd-java-agent/agent-bootstrap/src/jmh/java/datadog/trace/bootstrap/instrumentation/decorator/HttpServerDecoratorBenchmark.java

@@ -1,14 +1,15 @@
 package datadog.trace.bootstrap.instrumentation.decorator;
 
+import static datadog.context.Context.root;
 import static datadog.trace.bootstrap.instrumentation.api.AgentSpan.fromContext;
+import static java.util.Collections.emptyMap;
 import static java.util.concurrent.TimeUnit.MICROSECONDS;
 import static java.util.concurrent.TimeUnit.SECONDS;
 
 import datadog.context.Context;
 import datadog.trace.api.GlobalTracer;
 import datadog.trace.bootstrap.instrumentation.api.AgentPropagation;
 import datadog.trace.bootstrap.instrumentation.api.AgentSpan;
-import datadog.trace.bootstrap.instrumentation.api.AgentSpanContext;
 import datadog.trace.bootstrap.instrumentation.api.ContextVisitors;
 import datadog.trace.bootstrap.instrumentation.api.URIDataAdapter;
 import datadog.trace.bootstrap.instrumentation.api.URIDefaultDataAdapter;
@@ -17,7 +18,6 @@
 import datadog.trace.core.CoreTracer;
 import datadog.trace.core.DDSpan;
 import java.net.URI;
-import java.util.Collections;
 import java.util.List;
 import java.util.Map;
 import org.openjdk.jmh.annotations.Benchmark;
@@ -59,13 +59,13 @@ public void setUp() {
             .build();
     GlobalTracer.forceRegister(tracer);
     decorator = new BenchmarkHttpServerDecorator();
-    Context context = decorator.startSpan(Collections.emptyMap(), Context.root());
+    Context context = decorator.startSpan(emptyMap(), root());
     span = fromContext(context);
   }
 
   @Benchmark
   public AgentSpan onRequest() {
-    return decorator.onRequest(span, null, request, (AgentSpanContext.Extracted) null);
+    return decorator.onRequest(span, null, request, root());
   }
 
   public static class Request {

dd-java-agent/agent-bootstrap/src/main/java/datadog/trace/bootstrap/instrumentation/decorator/HttpServerDecorator.java

@@ -4,6 +4,7 @@
 import static datadog.trace.api.cache.RadixTreeCache.UNSET_STATUS;
 import static datadog.trace.api.datastreams.DataStreamsContext.forHttpServer;
 import static datadog.trace.api.gateway.Events.EVENTS;
+import static datadog.trace.bootstrap.ActiveSubsystems.APPSEC_ACTIVE;
 import static datadog.trace.bootstrap.instrumentation.api.AgentTracer.traceConfig;
 import static datadog.trace.bootstrap.instrumentation.decorator.http.HttpResourceDecorator.HTTP_RESOURCE_DECORATOR;
 
@@ -17,11 +18,11 @@
 import datadog.trace.api.gateway.BlockResponseFunction;
 import datadog.trace.api.gateway.CallbackProvider;
 import datadog.trace.api.gateway.Flow;
+import datadog.trace.api.gateway.Flow.Action.RequestBlockingAction;
 import datadog.trace.api.gateway.IGSpanInfo;
 import datadog.trace.api.gateway.RequestContext;
 import datadog.trace.api.gateway.RequestContextSlot;
 import datadog.trace.api.naming.SpanNaming;
-import datadog.trace.bootstrap.ActiveSubsystems;
 import datadog.trace.bootstrap.instrumentation.api.AgentPropagation;
 import datadog.trace.bootstrap.instrumentation.api.AgentSpan;
 import datadog.trace.bootstrap.instrumentation.api.AgentSpanContext;
@@ -146,12 +147,12 @@ public Context startSpan(REQUEST_CARRIER carrier, Context context) {
         instrumentationNames != null && instrumentationNames.length > 0
             ? instrumentationNames[0]
             : DEFAULT_INSTRUMENTATION_NAME;
-    AgentSpanContext.Extracted extracted = callIGCallbackStart(context);
+    AgentSpanContext.Extracted extracted = callIGCallbackStart(getExtractedSpanContext(context));
     AgentSpan span =
         tracer().startSpan(instrumentationName, spanName(), extracted).setMeasured(true);
     Flow<Void> flow = callIGCallbackRequestHeaders(span, carrier);
-    if (flow.getAction() instanceof Flow.Action.RequestBlockingAction) {
-      span.setRequestBlockingAction((Flow.Action.RequestBlockingAction) flow.getAction());
+    if (flow.getAction() instanceof RequestBlockingAction) {
+      span.setRequestBlockingAction((RequestBlockingAction) flow.getAction());
     }
     AgentPropagation.ContextVisitor<REQUEST_CARRIER> getter = getter();
     if (null != carrier && null != getter) {
@@ -165,25 +166,9 @@ public AgentSpan onRequest(
       final CONNECTION connection,
       final REQUEST request,
       final Context context) {
-    return onRequest(span, connection, request, getExtractedSpanContext(context));
-  }
-
-  public AgentSpanContext.Extracted getExtractedSpanContext(Context context) {
-    AgentSpan extractedSpan = AgentSpan.fromContext(context);
-    return extractedSpan == null ? null : (AgentSpanContext.Extracted) extractedSpan.context();
-  }
-
-  public AgentSpan onRequest(
-      final AgentSpan span,
-      final CONNECTION connection,
-      final REQUEST request,
-      @Nullable final AgentSpanContext.Extracted context) {
     Config config = Config.get();
-    boolean clientIpResolverEnabled =
-        config.isClientIpEnabled()
-            || traceClientIpResolverEnabled && ActiveSubsystems.APPSEC_ACTIVE;
 
-    if (ActiveSubsystems.APPSEC_ACTIVE) {
+    if (APPSEC_ACTIVE) {
       RequestContext requestContext = span.getRequestContext();
       if (requestContext != null) {
         BlockResponseFunction brf = createBlockResponseFunction(request, connection);
@@ -193,35 +178,38 @@ public AgentSpan onRequest(
       }
       Flow<Void> flow = callIGCallbackRequestSessionId(span, request);
       Flow.Action action = flow.getAction();
-      if (action instanceof Flow.Action.RequestBlockingAction) {
-        span.setRequestBlockingAction((Flow.Action.RequestBlockingAction) flow.getAction());
+      if (action instanceof RequestBlockingAction) {
+        span.setRequestBlockingAction((RequestBlockingAction) flow.getAction());
       }
     }
 
-    if (context != null) {
+    AgentSpanContext.Extracted extracted = getExtractedSpanContext(context);
+    boolean clientIpResolverEnabled =
+        config.isClientIpEnabled() || traceClientIpResolverEnabled && APPSEC_ACTIVE;
+    if (extracted != null) {
       if (clientIpResolverEnabled) {
-        String forwarded = context.getForwarded();
+        String forwarded = extracted.getForwarded();
         if (forwarded != null) {
           span.setTag(Tags.HTTP_FORWARDED, forwarded);
         }
-        String forwardedProto = context.getXForwardedProto();
+        String forwardedProto = extracted.getXForwardedProto();
         if (forwardedProto != null) {
           span.setTag(Tags.HTTP_FORWARDED_PROTO, forwardedProto);
         }
-        String forwardedHost = context.getXForwardedHost();
+        String forwardedHost = extracted.getXForwardedHost();
         if (forwardedHost != null) {
           span.setTag(Tags.HTTP_FORWARDED_HOST, forwardedHost);
         }
-        String forwardedIp = context.getXForwardedFor();
+        String forwardedIp = extracted.getXForwardedFor();
         if (forwardedIp != null) {
           span.setTag(Tags.HTTP_FORWARDED_IP, forwardedIp);
         }
-        String forwardedPort = context.getXForwardedPort();
+        String forwardedPort = extracted.getXForwardedPort();
         if (forwardedPort != null) {
           span.setTag(Tags.HTTP_FORWARDED_PORT, forwardedPort);
         }
       }
-      String userAgent = context.getUserAgent();
+      String userAgent = extracted.getUserAgent();
       if (userAgent != null) {
         span.setTag(Tags.HTTP_USER_AGENT, userAgent);
       }
@@ -245,8 +233,8 @@ public AgentSpan onRequest(
           } else if (supportsRaw) {
             span.setTag(Tags.HTTP_URL, URIUtils.lazyInvalidUrl(url.raw()));
           }
-          if (context != null && context.getXForwardedHost() != null) {
-            span.setTag(Tags.HTTP_HOSTNAME, context.getXForwardedHost());
+          if (extracted != null && extracted.getXForwardedHost() != null) {
+            span.setTag(Tags.HTTP_HOSTNAME, extracted.getXForwardedHost());
           } else if (url.host() != null) {
             span.setTag(Tags.HTTP_HOSTNAME, url.host());
           }
@@ -258,8 +246,8 @@ public AgentSpan onRequest(
             span.setTag(DDTags.HTTP_FRAGMENT, url.fragment());
           }
           Flow<Void> flow = callIGCallbackURI(span, url, method);
-          if (flow.getAction() instanceof Flow.Action.RequestBlockingAction) {
-            span.setRequestBlockingAction((Flow.Action.RequestBlockingAction) flow.getAction());
+          if (flow.getAction() instanceof RequestBlockingAction) {
+            span.setRequestBlockingAction((RequestBlockingAction) flow.getAction());
           }
           if (valid && SHOULD_SET_URL_RESOURCE_NAME) {
             HTTP_RESOURCE_DECORATOR.withServerPath(span, method, path, encoded);
@@ -280,8 +268,8 @@ public AgentSpan onRequest(
     }
 
     String inferredAddressStr = null;
-    if (clientIpResolverEnabled && context != null) {
-      InetAddress inferredAddress = ClientIpAddressResolver.resolve(context, span);
+    if (clientIpResolverEnabled && extracted != null) {
+      InetAddress inferredAddress = ClientIpAddressResolver.resolve(extracted, span);
       // the peer address should be used if:
       // 1. the headers yield nothing, regardless of whether it is public or not
       // 2. it is public and the headers yield a private address
@@ -300,9 +288,9 @@ public AgentSpan onRequest(
         span.setTag(Tags.HTTP_CLIENT_IP, inferredAddressStr);
       }
     } else if (clientIpResolverEnabled && span.getLocalRootSpan() != span) {
-      // in this case context == null
-      // If there is no context we can't do anything but use the peer addr.
-      // Additionally, context == null arises on subspans for which the resolution
+      // in this case extracted == null
+      // If there is no extracted we can't do anything but use the peer addr.
+      // Additionally, extracted == null arises on subspans for which the resolution
       // likely already happened on the top span, so we don't need to do the resolution
       // again. Instead, copy from the top span, should it exist
       AgentSpan localRootSpan = span.getLocalRootSpan();
@@ -321,13 +309,18 @@ public AgentSpan onRequest(
     }
     setPeerPort(span, peerPort);
     Flow<Void> flow = callIGCallbackAddressAndPort(span, peerIp, peerPort, inferredAddressStr);
-    if (flow.getAction() instanceof Flow.Action.RequestBlockingAction) {
-      span.setRequestBlockingAction((Flow.Action.RequestBlockingAction) flow.getAction());
+    if (flow.getAction() instanceof RequestBlockingAction) {
+      span.setRequestBlockingAction((RequestBlockingAction) flow.getAction());
     }
 
     return span;
   }
 
+  protected static AgentSpanContext.Extracted getExtractedSpanContext(Context context) {
+    AgentSpan extractedSpan = AgentSpan.fromContext(context);
+    return extractedSpan == null ? null : (AgentSpanContext.Extracted) extractedSpan.context();
+  }
+
   protected BlockResponseFunction createBlockResponseFunction(
       REQUEST request, CONNECTION connection) {
     return null;
@@ -388,8 +381,8 @@ public AgentSpan onResponse(final AgentSpan span, final RESPONSE response) {
     return span;
   }
 
-  private AgentSpanContext.Extracted callIGCallbackStart(final Context context) {
-    AgentSpanContext.Extracted extracted = getExtractedSpanContext(context);
+  private AgentSpanContext.Extracted callIGCallbackStart(
+      @Nullable final AgentSpanContext.Extracted extracted) {
     AgentTracer.TracerAPI tracer = tracer();
     Supplier<Flow<Object>> startedCbAppSec =
         tracer.getCallbackProvider(RequestContextSlot.APPSEC).getCallback(EVENTS.requestStarted());