[pull] main from DataDog:main

.circleci/config.yml

@@ -15,7 +15,7 @@ experimental:
 templates:
   job_template: &job_template
     docker:
-      - image: gcr.io/datadoghq/agent-circleci-runner:v50263243-1a30c934
+      - image: gcr.io/datadoghq/agent-circleci-runner:v53759313-14a41bca
         environment:
           USE_SYSTEM_LIBS: "1"
     working_directory: /go/src/github.com/DataDog/datadog-agent

.copyright-overrides.yml

@@ -378,3 +378,15 @@ github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcp/multiendpoint: Copyright 2024
 github.com/NVIDIA/go-nvml/*: Copyright 2023 NVIDIA CORPORATION
 
 github.com/jonboulle/clockwork: Copyright 2014 Nell Boulle
+
+github.com/nozzle/throttler: Copyright 2018 Derek Perkins
+github.com/openvex/discovery/*: Copyright 2023 The OpenVEX Authors
+github.com/sassoftware/relic/*: Copyright (c) SAS Institute Inc.
+github.com/transparency-dev/merkle: Copyright 2017 Google LLC. All Rights Reserved.
+github.com/transparency-dev/merkle/compact: Copyright 2019 Google LLC. All Rights Reserved.
+github.com/transparency-dev/merkle/proof:
+- Copyright 2017 Google LLC. All Rights Reserved.
+- Copyright 2022 Google LLC. All Rights Reserved.
+github.com/transparency-dev/merkle/rfc6962: Copyright 2016 Google LLC. All Rights Reserved.
+
+gopkg.in/go-jose/go-jose.v2: Copyright 2014 Square Inc.

.ddqa/config.toml

@@ -103,14 +103,6 @@ github_team = "agent-integrations"
 github_labels = ["team/integrations"]
 exclude_members = ["ofek", "alopezz"]
 
-[teams."Platform Integrations"]
-jira_project = "PLINT"
-jira_issue_type = "Task"
-jira_statuses = ["To Do", "In Progress", "Done"]
-github_team = "platform-integrations"
-github_labels = ["team/platform-integrations"]
-exclude_members = ["hithwen"]
-
 [teams."APM"]
 jira_project = "APMSP"
 jira_component = "Trace Agent"

.github/dependabot.yaml

@@ -11,20 +11,9 @@ updates:
       # These dependencies are replaced in the main go.mod file.
       # They are ignored since bumping them would have no effect on the build.
       # To update them automatically, it is necessary to remove the `replace` directive.
-      - dependency-name: k8s.io/*
-      - dependency-name: github.com/cihub/seelog
-      - dependency-name: github.com/containerd/cgroups
-      - dependency-name: github.com/containerd/containerd
-      - dependency-name: github.com/coreos/go-systemd
-      # We only replace github.com/docker/distribution but we ignore all Docker dependencies.
-      - dependency-name: github.com/docker/*
-      - dependency-name: github.com/florianl/go-conntrack
-      - dependency-name: github.com/iovisor/gobpf
-      - dependency-name: github.com/lxn/walk
-      - dependency-name: github.com/mholt/archiver
-      - dependency-name: github.com/prometheus/client_golang
+      - dependency-name: github.com/cihub/seelog  # https://github.com/DataDog/datadog-agent/pull/5647
       - dependency-name: github.com/spf13/cast
-      - dependency-name: github.com/ugorji/go
+      # We only replace github.com/docker/distribution but we ignore all Docker dependencies.
       # Ignore internal modules
       - dependency-name: github.com/DataDog/datadog-agent/*
       # Ignore golang.org/x/... deps to avoid noise, they are updated together, pretty regularly
@@ -45,6 +34,11 @@ updates:
       aws-sdk-go-v2:
         patterns:
           - "github.com/aws/aws-sdk-go-v2*"
+      k8s-io:
+        patterns:
+          - "k8s.io/*"
+        update-types:
+          - patch
   - package-ecosystem: gomod
     directory: /pkg/trace
     labels:
@@ -167,6 +161,13 @@ updates:
       - dependency-name: github.com/pulumi*
       # Ignore golang.org/x/... deps to avoid noise, they are updated together, pretty regularly
       - dependency-name: golang.org/x/*
+    groups:
+      aws-sdk-go-v2:
+        patterns:
+          - "github.com/aws/aws-sdk-go-v2*"
+      k8s-io:
+        patterns:
+          - "k8s.io/*"
 
     schedule:
       interval: weekly

.github/workflows/backport-pr.yml

@@ -24,7 +24,7 @@ jobs:
       contents: write
       pull-requests: write
     steps:
-      - uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
+      - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
         id: app-token
         with:
           app-id: ${{ vars.DD_GITHUB_TOKEN_GENERATOR_APP_ID }}

.github/workflows/buildimages-update.yml

@@ -62,8 +62,7 @@ jobs:
       - name: Setup Python and pip
         uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
-          # use Python < 3.12 so that distutil is still available by default
-          python-version: 3.11
+          python-version-file: .python-version
           cache: "pip"
 
       - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0

.github/workflows/chase_release_managers.yml

@@ -22,7 +22,7 @@ jobs:
     - name: Install python
       uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
       with:
-        python-version: 3.11
+        python-version-file: .python-version
         cache: "pip"
     - name: Install Python dependencies
       run: |

.github/workflows/code_review_complexity.yml

@@ -27,7 +27,7 @@ jobs:
       - name: Setup python
         uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
-          python-version: 3.12
+          python-version-file: .python-version
           cache: 'pip'
           cache-dependency-path: '**/requirements*.txt'
       - name: Install dependencies

.github/workflows/codeql-analysis.yml

@@ -31,7 +31,7 @@ jobs:
       - name: Setup Python3
         uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
-          python-version: "3.12.6"
+          python-version-file: .python-version
           cache: "pip"
       - run: pip3 install -r requirements.txt
 

.github/workflows/collector-generate-and-update.yml

@@ -9,27 +9,22 @@ jobs:
   update-and-generate:
     runs-on: ubuntu-latest
     permissions:
+      contents: write
       pull-requests: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
 
-      - name: Read tool versions
-        id: tool-versions
-        run: |
-          echo "PYTHON_VERSION=$(cat .python-version)" >> $GITHUB_ENV
-          echo "GO_VERSION=$(cat .go-version)" >> $GITHUB_ENV
-
       - name: Set up Python
         uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
-          python-version: ${{ env.PYTHON_VERSION }}
+          python-version-file: .python-version
           cache: 'pip'
 
       - name: Set up Go
         uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
         with:
-          go-version: ${{ env.GO_VERSION }}
+          go-version-file: .go-version
 
       - name: Install Dependencies
         run: |

.github/workflows/create_rc_pr.yml

@@ -21,27 +21,34 @@ jobs:
           warning: ${{ steps.warning.outputs.value }}
         steps:
             - name: Checkout repository
-
               uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
               with:
                 sparse-checkout: 'tasks'
                 persist-credentials: false
 
             - name: Install python
-              if: ${{ env.IS_AGENT6_RELEASE == 'false' }}
               uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
               with:
-                python-version: 3.11
+                python-version-file: .python-version
                 cache: "pip"
 
             - name: Install Python dependencies
-              if: ${{ env.IS_AGENT6_RELEASE == 'false' }}
               run: |
                 python -m pip install --upgrade pip
                 pip install -r requirements.txt
                 pip install -r tasks/libs/requirements-github.txt
                 pip install -r tasks/requirements_release_tasks.txt
 
+            - name: Check previous agent 6 RC status
+              if: ${{ env.IS_AGENT6_RELEASE == 'true' }}
+              env:
+                DD_SITE: 'datadoghq.com'
+                DD_API_KEY: ${{ secrets.DD_API_KEY }}
+                DD_APP_KEY: ${{ secrets.DD_APP_KEY }}
+                SLACK_DATADOG_AGENT_CI_WEBHOOK: ${{ secrets.SLACK_DATADOG_AGENT_CI_WEBHOOK }}
+              run: |
+                inv -e release.check-previous-agent6-rc
+
             - name: Determine the release active branches
               id: branches
               run: |
@@ -76,7 +83,7 @@ jobs:
             - name: Install python
               uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
               with:
-                python-version: 3.11
+                python-version-file: .python-version
                 cache: "pip"
 
             - name: Install Python dependencies
@@ -107,7 +114,7 @@ jobs:
                 MATRIX: ${{ matrix.value }}
               run: |
                 if ${{ env.IS_AGENT6_RELEASE == 'true' }}; then
-                  inv -e release.create-rc -r "$MATRIX" --slack-webhook=${{ secrets.AGENT_RELEASE_SYNC_SLACK_WEBHOOK }} --patch-version
+                  inv -e release.create-rc -r "$MATRIX" --slack-webhook=${{ secrets.AGENT6_RELEASE_SLACK_WEBHOOK }} --patch-version
                 else
                   inv -e release.create-rc -r "$MATRIX" --slack-webhook=${{ secrets.AGENT_RELEASE_SYNC_SLACK_WEBHOOK }}
                 fi

.github/workflows/create_release_schedule.yml

@@ -7,8 +7,8 @@ on:
         description: 'Full version of the release to schedule (e.g. 7.31.0)'
         required: true
         type: string
-      freeze_date:
-        description: 'Isoformat date when we freeze CI (e.g. 2023-12-31)'
+      cutoff_date:
+        description: 'Isoformat date when we the cut-off happens (e.g. 2023-12-31)'
         required: true
         type: string
 
@@ -27,7 +27,7 @@ jobs:
     - name: Install python
       uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
       with:
-        python-version: 3.11
+        python-version-file: .python-version
         cache: "pip"
     - name: Install Python dependencies
       run: |
@@ -38,6 +38,6 @@ jobs:
         ATLASSIAN_USERNAME : ${{ secrets.ATLASSIAN_USERNAME }}
         ATLASSIAN_PASSWORD : ${{ secrets.ATLASSIAN_PASSWORD }}
         INPUT_VERSION: ${{ github.event.inputs.version }}
-        FREEZE_DATE: ${{ github.event.inputs.freeze_date }}
+        CUTOFF_DATE: ${{ github.event.inputs.cutoff_date }}
       run: |
-        inv -e release.create-schedule --version "$INPUT_VERSION" --freeze-date "$FREEZE_DATE"
+        inv -e release.create-schedule --version "$INPUT_VERSION" --cutoff-date "$CUTOFF_DATE"

.github/workflows/cws-btfhub-sync.yml

@@ -8,11 +8,6 @@ on:
         required: false
         default: 'main'
         type: string
-      force_refresh:
-        description: 'Force refresh of the constants'
-        required: false
-        default: 'false'
-        type: boolean
   schedule:
     - cron: '30 4 * * 5' # at 4:30 UTC on Friday
 
@@ -68,7 +63,7 @@ jobs:
       - name: Install python
         uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
-          python-version: 3.11
+          python-version-file: .python-version
           cache: 'pip'
       - run: pip install -r requirements.txt
 
@@ -83,19 +78,11 @@ jobs:
           echo "ARTIFACT_NAME=constants-${{ matrix.cone }}" | tr '/' '-' >> $GITHUB_OUTPUT
 
       - name: Sync constants
-        if: ${{ !inputs.force_refresh }}
         env:
           ARTIFACT_NAME: ${{ steps.artifact-name.outputs.ARTIFACT_NAME }}
         run: |
           inv -e security-agent.generate-btfhub-constants --archive-path=./dev/dist/archive --output-path=./"$ARTIFACT_NAME".json
 
-      - name: Force sync constants
-        if: ${{ inputs.force_refresh }}
-        env:
-          ARTIFACT_NAME: ${{ steps.artifact-name.outputs.ARTIFACT_NAME }}
-        run: |
-          inv -e security-agent.generate-btfhub-constants --archive-path=./dev/dist/archive --output-path=./"$ARTIFACT_NAME".json --force-refresh
-
       - name: Upload artifact
         uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
@@ -117,7 +104,7 @@ jobs:
       - name: Install python
         uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
-          python-version: 3.11
+          python-version-file: .python-version
           cache: 'pip'
       - run: pip install -r requirements.txt
 
@@ -136,6 +123,7 @@ jobs:
       - name: Combine constants
         run: |
           inv -e security-agent.combine-btfhub-constants --archive-path=./dev/dist/constants
+          inv -e security-agent.split-btfhub-constants
 
       - name: Compute branch name
         id: branch-name

.github/workflows/datadog-static-analysis.yml

@@ -16,7 +16,7 @@ jobs:
         persist-credentials: false
     - name: Check code meets quality and security standards
       id: datadog-static-analysis
-      uses: DataDog/datadog-static-analyzer-github-action@v1
+      uses: DataDog/datadog-static-analyzer-github-action@06d501a75f56e4075c67a7dbc61a74b6539a05c8 # v1.2.1
       with:
         dd_api_key: ${{ secrets.DD_STATIC_ANALYZER_API_KEY }}
         dd_app_key: ${{ secrets.DD_STATIC_ANALYZER_APP_KEY }}

.github/workflows/docs-dev.yml

@@ -34,7 +34,7 @@ jobs:
     - name: Set up Python
       uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
       with:
-        python-version: '3.12'
+        python-version-file: .python-version
 
     - name: Install dependencies
       run: pip install -r tasks/requirements.txt

.github/workflows/external-contributor.yml

@@ -25,7 +25,7 @@ jobs:
       - name: Setup python
         uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
-          python-version: 3.11
+          python-version-file: .python-version
           cache: 'pip'
           cache-dependency-path: '**/requirements*.txt'
       - name: Install dependencies

.github/workflows/go_mod_tidy.yml

@@ -3,50 +3,37 @@ on:
   pull_request:
     types:
       - labeled
-  workflow_dispatch:
-    inputs:
-      pr_number:
-        description: "PR number"
-        required: true
-        type: number
 
 jobs:
   mod_tidy_and_generate_licenses:
-    if: ${{ github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.actor == 'dependabot[bot]' && contains(github.event.pull_request.labels.*.name, 'dependencies-go')) }}
+    if: ${{ github.repository == 'DataDog/datadog-agent' && github.event.pull_request.user.login == 'dependabot[bot]' && contains(github.event.pull_request.labels.*.name, 'dependencies-go') }}
     runs-on: ubuntu-latest
     permissions:
       contents: write
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: ${{ github.head_ref }}
-      - name: Checkout PR
-        # run only if triggered manually, otherwise we are already on the right branch and we won't have `pr_number`
-        if: ${{ github.event_name == 'workflow_dispatch' }}
-        run: gh pr checkout "$PR_NUMBER"
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_NUMBER: ${{ github.event.inputs.pr_number }}
       - name: Install go
         uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
         with:
           go-version-file: ".go-version"
       - name: Install python
         uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
-          python-version: 3.11
+          python-version-file: .python-version
           cache: "pip"
       - name: Install python requirements.txt
         run: python3 -m pip install -r requirements.txt
       - name: Go mod tidy
         run: inv -e tidy
       - name: Update LICENSE-3rdparty.csv
-        if: ${{ github.event_name == 'workflow_dispatch' || !contains(github.event.pull_request.labels.*.name, 'dependencies-go-tools') }}
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'dependencies-go-tools') }}
         run: |
           inv -e install-tools
           inv -e generate-licenses
       - name: Update mocks
-        if: ${{ github.event_name == 'workflow_dispatch' || !contains(github.event.pull_request.labels.*.name, 'dependencies-go-tools') }}
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'dependencies-go-tools') }}
         run: inv -e security-agent.gen-mocks # generate both security agent and process mocks
       - uses: stefanzweifel/git-auto-commit-action@8621497c8c39c72f3e2a999a26b4ca1b5058a842 # v5.0.1
         id: autocommit