Merge branch 'main' into erwann.masson/ddr-merge-attributes

.ddqa/config.toml

@@ -48,7 +48,7 @@ jira_issue_type = "Task"
 jira_statuses = ["To Do", "In Progress", "Done"]
 github_team = "agent-delivery"
 github_labels = ["team/agent-delivery"]
-exclude_members = ["hithwen"]
+exclude_members = ["KSerrania"]
 
 [teams."Universal Service Monitoring"]
 jira_project = "USMON"
@@ -176,12 +176,12 @@ jira_statuses = ["To Do", "In Progress", "Done"]
 github_team = "agent-cspm"
 github_labels = ["team/agent-cspm"]
 
-[teams."Processes"]
-jira_project = "PROCS"
+[teams."Container Intake"]
+jira_project = "CTK"
 jira_issue_type = "Task"
 jira_statuses = ["TRIAGE", "In Progress", "Done"]
-github_team = "processes"
-github_labels = ["team/processes"]
+github_team = "container-intake"
+github_labels = ["team/container-intake"]
 
 [teams."Windows Agent"]
 jira_project = "WINA"

.gitattributes

@@ -10,7 +10,7 @@ go.sum -diff -merge linguist-generated=true
 pkg/security/probe/constantfetch/btfhub/constants.json -diff -merge linguist-generated=true
 pkg/security/seclwin/** -diff -merge linguist-generated=true
 # Fixtures should have LF line endings because they are checked against OCI packages built on Linux
-pkg/fleet/internal/fixtures/** text=auto eol=lf
+pkg/fleet/installer/fixtures/** text=auto eol=lf
 
 # Fix `git diff` when running on the below file formats.
 # Our windows build image uses MinGit which tries to use the astextplain diff algorithm (https://git-scm.com/docs/gitattributes#_setting_the_internal_diff_algorithm).
@@ -27,26 +27,25 @@ pkg/fleet/internal/fixtures/** text=auto eol=lf
 #	textconv = astextplain
 # ```
 
-
-*.doc	diff
-*.DOC	diff
-*.docx	diff
-*.DOCX	diff
-*.docm	diff
-*.DOCM	diff
-*.dot	diff
-*.DOT	diff
-*.dotx	diff
-*.DOTX	diff
-*.dotm	diff
-*.DOTM	diff
-*.pdf	diff
-*.PDF	diff
-*.rtf	diff
-*.RTF	diff
-*.ods	diff
-*.ODS	diff
-*.odf	diff
-*.ODF	diff
-*.odt	diff
-*.ODT	diff
+*.doc diff
+*.DOC diff
+*.docx diff
+*.DOCX diff
+*.docm diff
+*.DOCM diff
+*.dot diff
+*.DOT diff
+*.dotx diff
+*.DOTX diff
+*.dotm diff
+*.DOTM diff
+*.pdf diff
+*.PDF diff
+*.rtf diff
+*.RTF diff
+*.ods diff
+*.ODS diff
+*.odf diff
+*.ODF diff
+*.odt diff
+*.ODT diff

.github/dependabot.yaml

@@ -27,6 +27,11 @@ updates:
       - dependency-name: github.com/ugorji/go
       # Ignore internal modules
       - dependency-name: github.com/DataDog/datadog-agent/*
+      # Ignore golang.org/x/... deps to avoid noise, they are updated together, pretty regularly
+      - dependency-name: golang.org/x/*
+      # OpenTelemetry collector packages need to be updated with inv rather than dependabot
+      - dependency-name: go.opentelemetry.io/collector/*
+      - dependency-name: github.com/open-telemetry/opentelemetry-collector-contrib/*
     schedule:
       interval: weekly
     open-pull-requests-limit: 100
@@ -52,6 +57,11 @@ updates:
       - dependency-name: github.com/DataDog/datadog-agent/*
       # See https://github.com/DataDog/datadog-agent/pull/10112
       - dependency-name: github.com/mailru/easyjson
+      # Ignore golang.org/x/... deps to avoid noise, they are updated together, pretty regularly
+      - dependency-name: golang.org/x/*
+      # OpenTelemetry collector packages need to be updated with inv rather than dependabot
+      - dependency-name: go.opentelemetry.io/collector/*
+      - dependency-name: github.com/open-telemetry/opentelemetry-collector-contrib/*
     schedule:
       interval: weekly
     open-pull-requests-limit: 100
@@ -67,6 +77,8 @@ updates:
       - dependency-name: github.com/DataDog/datadog-agent/*
       # See https://github.com/DataDog/datadog-agent/pull/10112
       - dependency-name: github.com/mailru/easyjson
+      # Ignore golang.org/x/... deps to avoid noise, they are updated together, pretty regularly
+      - dependency-name: golang.org/x/*
     schedule:
       interval: weekly
     open-pull-requests-limit: 100
@@ -82,6 +94,8 @@ updates:
       - dependency-name: github.com/DataDog/datadog-agent/*
       # See https://github.com/DataDog/datadog-agent/pull/10112
       - dependency-name: github.com/mailru/easyjson
+      # Ignore golang.org/x/... deps to avoid noise, they are updated together, pretty regularly
+      - dependency-name: golang.org/x/*
     schedule:
       interval: weekly
     open-pull-requests-limit: 100
@@ -95,6 +109,8 @@ updates:
     ignore:
       # Ignore internal modules
       - dependency-name: github.com/DataDog/datadog-agent/*
+      # Ignore golang.org/x/... deps to avoid noise, they are updated together, pretty regularly
+      - dependency-name: golang.org/x/*
     schedule:
       interval: weekly
     open-pull-requests-limit: 100
@@ -113,6 +129,9 @@ updates:
       - qa/no-code-change
     schedule:
       interval: monthly
+    ignore:
+      # Ignore golang.org/x/... deps to avoid noise, they are updated together, pretty regularly
+      - dependency-name: golang.org/x/*
     open-pull-requests-limit: 100
   - package-ecosystem: gomod
     directory: /pkg/networkdevice/profile
@@ -124,6 +143,8 @@ updates:
     ignore:
       # Ignore internal modules
       - dependency-name: github.com/DataDog/datadog-agent/*
+      # Ignore golang.org/x/... deps to avoid noise, they are updated together, pretty regularly
+      - dependency-name: golang.org/x/*
     schedule:
       interval: weekly
     open-pull-requests-limit: 100
@@ -144,6 +165,8 @@ updates:
       # Do not bump dependencies that come from test-infra-definitions, they will be bumped when we'll bump the version
       # https://datadoghq.atlassian.net/browse/ADXT-375
       - dependency-name: github.com/pulumi*
+      # Ignore golang.org/x/... deps to avoid noise, they are updated together, pretty regularly
+      - dependency-name: golang.org/x/*
 
     schedule:
       interval: weekly
@@ -160,6 +183,9 @@ updates:
     schedule:
       interval: weekly
     open-pull-requests-limit: 100
+    ignore:
+      # Ignore golang.org/x/... deps to avoid noise, they are updated together, pretty regularly
+      - dependency-name: golang.org/x/*
   - package-ecosystem: docker
     directory: /test/fakeintake
     labels:

.github/workflows/assign_issue.yml

@@ -26,5 +26,6 @@ jobs:
     - name: Assign issue
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        SLACK_API_TOKEN : ${{ secrets.SLACK_DATADOG_AGENT_BOT_TOKEN }}
       run: |
-        inv -e issue.assign-owner --issue ${{ github.event.issue.number }}
+        inv -e issue.assign-owner -i ${{ github.event.issue.number }}

.github/workflows/codeql-analysis.yml

@@ -45,7 +45,7 @@ jobs:
           go-version-file: ".go-version"
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
+        uses: github/codeql-action/init@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9
         with:
           languages: ${{ matrix.language }}
           config: |
@@ -67,4 +67,4 @@ jobs:
           invoke agent.build --build-exclude=systemd
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
+        uses: github/codeql-action/analyze@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9

.github/workflows/collector-generate-and-update.yml

@@ -11,62 +11,37 @@ jobs:
     permissions:
       pull-requests: write
     steps:
-      - name: Set date
-        id: date
-        run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
-
       - name: Checkout repository
         uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
 
+      - name: Read tool versions
+        id: tool-versions
+        run: |
+          echo "PYTHON_VERSION=$(cat .python-version)" >> $GITHUB_ENV
+          echo "GO_VERSION=$(cat .go-version)" >> $GITHUB_ENV
+
       - name: Set up Python
         uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
-          python-version: '3.12.6'
+          python-version: ${{ env.PYTHON_VERSION }}
+          cache: 'pip'
 
-      - name: Install dependencies
+      - name: Set up Go
+        uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
+      - name: Install Dependencies
         run: |
-          python -m pip install --upgrade pip
+          python3 -m pip install --upgrade pip
           pip install -r requirements.txt
 
-      - name: Run update task
-        env: 
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: inv -e collector.update
-
-      - name: Run generate task
+      - name: Run Collector Update Script
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: inv -e collector.generate
-
-      - name: Check for changes
-        id: check_changes
-        run: |
-          git config --global user.name "github-actions[bot]"
-          git config --global user.email "github-actions[bot]@users.noreply.github.com"
-          git add .
-          if git diff-index --quiet HEAD; then
-            echo "No changes detected"
-            echo "changes_detected=false" >> $GITHUB_OUTPUT
-          else
-            echo "Changes detected"
-            echo "changes_detected=true" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Commit changes
-        if: steps.check_changes.outputs.changes_detected == 'true'
-        run: |
-          git switch -c update-otel-collector-dependencies-${{ steps.date.outputs.date }}
-          git commit -m "Update OTel Collector dependencies and generate OTel Agent"
-          git push -u origin update-otel-collector-dependencies-${{ steps.date.outputs.date }}
-
-      - name: Install GitHub CLI
-        if: steps.check_changes.outputs.changes_detected == 'true'
-        run: |
-          sudo apt-get update
-          sudo apt-get install gh
-
-      - name: Create draft pull request
-        if: steps.check_changes.outputs.changes_detected == 'true'
         run: |
-          gh auth login --with-token <<< ${{ secrets.GITHUB_TOKEN }}
-          gh pr create --title "Update OTel collector dependencies" --body "This PR updates the OTel Collector dependencies to the latest version. Please ensure that all tests pass before marking ready for review." --base main --head update-otel-collector-dependencies-${{ steps.date.outputs.date }} --draft
+          inv -e install-tools
+          inv -e collector.update
+          inv -e collector.generate
+          inv -e generate-licenses
+          inv -e collector.pull-request

.github/workflows/create_rc_pr.yml

@@ -5,10 +5,12 @@ on:
   schedule:
     - cron: '0 14 * * 1,3,5' # Run on Monday, Wednesday, and Friday at 14:00 UTC
     - cron: '0 8 * * 1,3,5' # Same as above but at 08:00 UTC, to warn agent-integrations team about releasing
+    - cron: '0 9 * * 1' # Run Agent 6 workflow on Monday at 09:00 UTC
 
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
+  AGENT6_RELEASE_BRANCH: '6.53.x'
+  IS_AGENT6_RELEASE: ${{ github.event.schedule == '0 9 * * 1' }}
 permissions: {}
 
 jobs:
@@ -19,18 +21,21 @@ jobs:
           warning: ${{ steps.warning.outputs.value }}
         steps:
             - name: Checkout repository
+              if: ${{ env.IS_AGENT6_RELEASE == 'false' }}
               uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
               with:
                 sparse-checkout: 'tasks'
                 persist-credentials: false
 
             - name: Install python
+              if: ${{ env.IS_AGENT6_RELEASE == 'false' }}
               uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
               with:
                 python-version: 3.11
                 cache: "pip"
 
             - name: Install Python dependencies
+              if: ${{ env.IS_AGENT6_RELEASE == 'false' }}
               run: |
                 python -m pip install --upgrade pip
                 pip install -r requirements.txt
@@ -40,7 +45,11 @@ jobs:
             - name: Determine the release active branches
               id: branches
               run: |
-                echo "value=$(inv release.get-unreleased-release-branches)" >> $GITHUB_OUTPUT
+                if ${{ env.IS_AGENT6_RELEASE == 'true' }}; then
+                  echo "value=[\"$AGENT6_RELEASE_BRANCH\"]" >> $GITHUB_OUTPUT
+                else
+                  echo "value=$(inv release.get-unreleased-release-branches)" >> $GITHUB_OUTPUT
+                fi
 
             - name: Set the warning option
               id: warning
@@ -59,11 +68,9 @@ jobs:
           value: ${{fromJSON(needs.find_release_branches.outputs.branches)}}
         fail-fast: false
       steps:
-            - name: Checkout release branch
+            - name: Checkout the main branch
               uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
               with:
-                ref: ${{ matrix.value }}
-                fetch-depth: 0
                 persist-credentials: true
 
             - name: Install python
@@ -95,9 +102,12 @@ jobs:
                 fi
 
             - name: Create RC PR
-              if: ${{ steps.check_for_changes.outputs.CHANGES == 'true'}}
+              if: ${{ steps.check_for_changes.outputs.CHANGES == 'true' || env.IS_AGENT6_RELEASE == 'true' }}
+              env:
+                MATRIX: ${{ matrix.value }}
               run: |
-                git config user.name "github-actions[bot]"
-                git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-                git fetch
-                inv -e release.create-rc --slack-webhook=${{ secrets.AGENT_RELEASE_SYNC_SLACK_WEBHOOK }}
+                if ${{ env.IS_AGENT6_RELEASE == 'true' }}; then
+                  inv -e release.create-rc -r "$MATRIX" --slack-webhook=${{ secrets.AGENT_RELEASE_SYNC_SLACK_WEBHOOK }} --patch-version
+                else
+                  inv -e release.create-rc -r "$MATRIX" --slack-webhook=${{ secrets.AGENT_RELEASE_SYNC_SLACK_WEBHOOK }}
+                fi

.github/workflows/cws-btfhub-sync.yml

@@ -97,7 +97,7 @@ jobs:
           inv -e security-agent.generate-btfhub-constants --archive-path=./dev/dist/archive --output-path=./"$ARTIFACT_NAME".json --force-refresh
 
       - name: Upload artifact
-        uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: ${{ steps.artifact-name.outputs.ARTIFACT_NAME }}
           path: ./${{ steps.artifact-name.outputs.ARTIFACT_NAME }}.json
@@ -127,7 +127,7 @@ jobs:
           go-version-file: '.go-version'
 
       - name: Download All Artifacts
-        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           path: ./dev/dist/constants
           pattern: constants-*

.github/workflows/docs-dev.yml

@@ -50,7 +50,7 @@ jobs:
     - name: Build documentation
       run: invoke docs.build
 
-    - uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
+    - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
       with:
         name: documentation
         path: site
@@ -65,7 +65,7 @@ jobs:
     - build
 
     steps:
-    - uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
+    - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
       with:
         name: documentation
         path: site