.github/CODEOWNERS

@@ -0,0 +1,16 @@
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Global owners
+* @GoogleCloudPlatform/opentelemetry-ops

.github/header-checker-lint.yml

@@ -4,5 +4,8 @@ sourceFileExtensions:
   - gradle
   - java
   - sh
+  - Dockerfile
 allowedCopyrightHolders:
-  - Google
+  - Google LLC
+ignoreFiles:
+  - buildscripts/*

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,49 @@
+name: "CodeQL Analysis"
+
+on:
+  workflow_dispatch:
+  schedule:
+    #        ┌───────────── minute (0 - 59)
+    #        │  ┌───────────── hour (0 - 23)
+    #        │  │ ┌───────────── day of the month (1 - 31)
+    #        │  │ │ ┌───────────── month (1 - 12 or JAN-DEC)
+    #        │  │ │ │ ┌───────────── day of the week (0 - 6 or SUN-SAT)
+    #        │  │ │ │ │
+    #        │  │ │ │ │
+    #        │  │ │ │ │
+    #        *  * * * *
+    - cron: '30 1 * * *'
+  push:
+    branches: [ main ]
+  pull_request:
+
+jobs:
+  CodeQL-Build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Java 17
+        uses: actions/setup-java@v3
+        with:
+          distribution: temurin
+          java-version: 17
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v2
+        with:
+          languages: java
+          # using "latest" helps to keep up with the latest Kotlin support
+          # see https://github.com/github/codeql-action/issues/1555#issuecomment-1452228433
+          tools: latest
+
+      - uses: gradle/gradle-build-action@v2
+        with:
+          # skipping build cache is needed so that all modules will be analyzed
+          arguments: assemble --no-build-cache
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v2

.github/workflows/pr-build.yml

@@ -6,34 +6,76 @@ on:
       - main
 jobs:
   test:
-    name: Test
+    strategy:
+      matrix:
+        java-version: [11]
+        build-root: [".", "examples/instrumentation-quickstart"]
+        include:
+          - build-root: .
+            name: root
+    name: Test (${{matrix.name || matrix.build-root}}, java-${{matrix.java-version}})
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
         with:
           fetch-depth: 0
-      - id: setup-java-11
-        name: Setup Java 11
+      - id: setup-java
+        name: Setup Java ${{matrix.java-version}}
         uses: actions/setup-java@v1
         with:
-          java-version: 11
+          java-version: ${{matrix.java-version}}
       - uses: burrunan/gradle-cache-action@v1.6
         with:
+          job-id: java-${{matrix.java-version}}
           remote-build-cache-proxy-enabled: false
+          build-root-directory: ${{matrix.build-root}}
           arguments: test
+  shadow:
+    strategy:
+      matrix:
+        java-version: [11]
+    name: Shadow Jar Build (Java ${{matrix.java-version}})
+    runs-on: ubuntu-latest
+    steps:
+      - id: checkout-repo
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+      - id: setup-java
+        name: Setup Java ${{matrix.java-version}}
+        uses: actions/setup-java@v1
+        with:
+          java-version: ${{matrix.java-version}}
+      - id: setup-gradle-cache
+        name: Run Gradle Build with ShadowJar
+        uses: burrunan/gradle-cache-action@v1.6
+        with:
+          job-id: gradle-shadow-java-${{matrix.java-version}}
+          remote-build-cache-proxy-enabled: false
+          build-root-directory: .
+          arguments: shadowJar
   style:
-    name: Stylecheck
+    name: Stylecheck (${{matrix.name || matrix.build-root}})
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        java-version: [11]
+        build-root: [".", "examples/instrumentation-quickstart"]
+        include:
+          - build-root: .
+            name: root
     steps:
       - uses: actions/checkout@v2
         with:
           fetch-depth: 0
-      - id: setup-java-11
-        name: Setup Java 11
+      - id: setup-java
+        name: Setup Java ${{matrix.java-version}}
         uses: actions/setup-java@v1
         with:
-          java-version: 11
+          java-version: ${{matrix.java-version}}
       - uses: burrunan/gradle-cache-action@v1.6
         with:
+          job-id: java-${{matrix.java-version}}
           remote-build-cache-proxy-enabled: false
+          build-root-directory: ${{matrix.build-root}}
           arguments: spotlessCheck

README.md

@@ -4,9 +4,19 @@
 
 Provides OpenTelemetry Exporters for Google Cloud Operations. 
 
+To get started with instrumentation in Google Cloud, see [Generate traces and metrics with
+Java](https://cloud.google.com/stackdriver/docs/instrumentation/setup/java).
+
+To learn more about instrumentation and observability, including opinionated recommendations
+for Google Cloud Observability, visit [Instrumentation and
+observability](https://cloud.google.com/stackdriver/docs/instrumentation/overview).
+
 ## Building
 
-This project requires a mock server for Google Cloud APIs.  To build and test, do the following:
+> [!IMPORTANT]
+> This project requires Java 11 to build and test. All artifacts published from this project support Java 8 or higher, unless otherwise noted.
+
+This project requires a mock server for Google Cloud APIs. To build and test, do the following:
 
 ```
 $ ./gradlew test
@@ -36,8 +46,6 @@ See [Tracing Readme](exporters/trace/README.md) for installation and usage instr
 
 ## Google Cloud Monitoring Exporter
 
-*Note: This is an alpha-release.*
-
 See [Metrics Readme](exporters/metrics/README.md) for installation and usage instructions.
 
 ## Google Cloud Autoconfigure module
@@ -47,5 +55,5 @@ See [Metrics Readme](exporters/metrics/README.md) for installation and usage ins
 See [Autoconfigure Readme](exporters/auto/README.md) for installation and usage instructions.
 
 
-[maven-image]: https://maven-badges.herokuapp.com/maven-central/com.google.cloud.opentelemetry/exporter-trace/badge.svg
-[maven-url]: https://maven-badges.herokuapp.com/maven-central/com.google.cloud.opentelemetry/exporter-trace
+[maven-image]: https://img.shields.io/maven-central/v/com.google.cloud.opentelemetry/exporter-trace?color=dark-green
+[maven-url]: https://central.sonatype.com/artifact/com.google.cloud.opentelemetry/exporter-trace

RELEASING.md

@@ -1,10 +1,5 @@
 # How to Create a Release of OpenTelemetry Operations Java (for Maintainers Only)
 
-## Build Environments  
-
-The system used for build and deploy must be able to run the [mock
-server](https://github.com/googleinterns/cloud-operations-api-mock).
-
 ## Prerequisites
 
 ### Setup OSSRH and Signing
@@ -43,20 +38,32 @@ your OSSRH (OSS Repository Hosting) account and signing keys.
     checkstyle.ignoreFailures=false
     ```
 
+> [!TIP]
+> If your key-generation is failing, checkout the [help section](#help-timeout-during-key-generation-process) at the bottom of this document.
+
 ### Using GPG-Agent for artifact signing
 
+> [!NOTE]
+> These instructions are for modern linux where `gpg` refers to the 2.0 version.
+
 If you're running in linux and would like to use the GPG agent to remember your PGP key passwords instead of keeping them in a plain-text file on your home directory,
 you can configure the following in `<your-home-directory>/.gradle/gradle.properties`:
 
     ```text
+    ossrhUsername=<generated-token-user>
+    ossrhPassword=<generated-token-key>
+
+    signingUseGpgCmd=true
     signing.gnupg.executable=gpg
     signing.gnupg.keyName=<secret key id (large hash)>
-    signing.secretKeyRingFile=<your-home-directory>/.gnupg/pubring.kbx
     ```
+Note: You can retrieve the list of previously created GPG keys on your machine by using `gpg --list-secret-keys`.
 
-Note: these instructions are for modern linux where `gpg` refers to the 2.0 version.
+> [!IMPORTANT]
+> Starting June 2024, due to a change to the OSSRH authentication backend, the maven publish plugin now requires [a user token](https://central.sonatype.org/publish/generate-token/) instead of a typical username and password used in the Nexus UI.
+> Follow the steps in the [link](https://central.sonatype.org/publish/generate-token/) to generate a user token, if not done already - this will provide you with a `tokenuser` and `tokenkey`. Replace `<generated-token-user>` and `<generated-token-key>` with the generated `tokenuser` and `tokenkey` in your `gradle.properties` file to successfully publish artifacts.
 
-### Ensuring you can push tags to Github upstream
+### Ensuring you can push tags to GitHub upstream
 
 Before any push to the upstream repository you need to create a [personal access
 token](https://help.github.com/articles/creating-a-personal-access-token-for-the-command-line/).
@@ -70,7 +77,7 @@ If you've followed the above steps, you can release snapshots for consumption us
 $ ./gradlew snapshot
 ```
 
-## Releasing a Candidate
+## Releasing a Candidate (Optional)
 
 After following the above steps, you can release candidates from `main` or `v<major>.<minor>.x` branches.
 
@@ -102,7 +109,10 @@ $ ./gradlew candidate -Prelease.version=0.14.0
 $ git push origin v0.14.0
 ```
 
-Next follow [Releasing on Maven Central](#releasing-on-maven-central) to close + publish the
+*Note: If you do not have a CredentialsProvider registered for GitHub, the `candidate` task may fail to upload tags to the GitHub repository and the overall command may take a long time to report completion on the task. In this case, before moving forward - check if tags were pushed to GitHub. If not, manually push the tags before continuing.*\
+*Next, check if the staging repository is created on the [nexus repository manager](https://oss.sonatype.org/#stagingRepositories). If the repository is already created, continue with the next steps.*
+
+Follow [Releasing on Maven Central](#releasing-on-maven-central) to close + publish the
 [repository on OSSRH](https://oss.sonatype.org/#stagingRepositories).
 
 After this, follow the [Announcment](#Announcement) documentation to advertise the release and update README files.
@@ -132,14 +142,24 @@ site](http://central.sonatype.org/pages/releasing-the-deployment.html).
 
 Note: This can/will be automated in the future.
 
+### Things to check before 'closing' on Maven Central
+
+Before closing the staging repository, it is important to verify that the contents of all the
+published modules are looking good. Particularly, the version numbers should be what are expected,
+and they include any custom release qualifiers (like 'alpha') which are set. Make sure that:
+ - The generated POM files for the individual module have the correct version number.
+ - The dependencies for an individual module in the POM file are the expected ones & they dependencies have the correct versions.
+ - The module content includes all the artifacts that are expected to be published - for instance, sourcesJar, javadocs, additional variants like a shaded JAR in some cases, etc.
+ - The file sizes for the published artifacts should seem reasonable.
+
 ## Announcement
 
-Once deployment finishes, go to Github [release
+Once deployment finishes, go to GitHub [release
 page](https://github.com/GoogleCloudPlatform/opentelemetry-operations-java/releases),
 press `Draft a new release` to write release notes about the new release.
 
 You can use `git log upstream/v$MAJOR.$((MINOR-1)).x..upstream/v$MAJOR.$MINOR.x
---graph --first-parent` or the Github [compare
+--graph --first-parent` or the GitHub [compare
 tool](https://github.com/GoogleCloudPlatform/opentelemetry-operations-java/compare/)
 to view a summary of all commits since last release as a reference.
 
@@ -155,3 +175,11 @@ command:
 $ COMMIT=1224f0a # Set the right commit hash.
 $ git cherry-pick -x $COMMIT
 ```
+
+### Help: Timeout during key-generation process
+If you see timeout errors when you run `gpg --gen-key` to generate your keys, it maybe because you are running the command on a server and do not have access to a UI. 
+A common example is - running this command on a remote machine over ssh. 
+
+The issue here is that this command opens up a UI dialog asking for you to set a passphrase, waiting for input for a fixed time.
+
+The easiest way to fix this is to run it on a machine for which you have UI access.

SECURITY.md

@@ -0,0 +1,14 @@
+# Security Policy
+
+## Supported Versions
+
+We support only the last minor version of each supported major release: bug fixes are released either as part of the next minor version or as an on-demand patch version. Independent of which version is next, all patch versions are cumulative, meaning that they represent the state of our main branch at the moment of the release. For instance, if the latest version is 0.10.0, bug fixes are released either as part of 0.11.0 or 0.10.1.
+
+Major releases are supported for 12 months after a new major version is released: https://opensource.google/documentation/policies/library-breaking-change.
+
+Security fixes are given priority and might be enough to cause a new version to be released.
+
+## Reporting a Vulnerability
+
+In order for the vulnerability reports to reach maintainers as soon as possible, please use the `Report a vulnerability` button on the `Security` tab in the respective GitHub repository. It creates a private communication channel between the reporter and the maintainers.
+