Merge upstream 2026-02-12

.codespellignore

@@ -1,4 +1,7 @@
 ba
+crate
 fo
+mapp
 opne
 optimyze
+prevEnd

.codespellrc

@@ -4,7 +4,7 @@ builtin = clear,rare,informal
 check-filenames =
 check-hidden =
 ignore-words = .codespellignore
-interactive = 1
-skip = .git,AUTHORS.md,go.mod,go.sum,LICENSES,zydis
+ignore-regex = \b[a-z]+[A-Z][a-zA-Z0-9]*\b|\b[a-z_]+_[a-z_]+\b|\b0x[0-9a-fA-F]+\b|^\s*(package|import|use|include|#include)\s
+interactive = 0
+skip = .git,AUTHORS.md,go.mod,go.sum,LICENSES,zydis,tools.mod,tools.sum
 uri-ignore-words-list = *
-write =

.github/renovate.json5

@@ -1,42 +1,69 @@
 {
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "config:best-practices",
-    "helpers:pinGitHubActionDigestsToSemver"
+  $schema: 'https://docs.renovatebot.com/renovate-schema.json',
+  extends: [
+    'config:best-practices',
+    'helpers:pinGitHubActionDigestsToSemver',
   ],
-  "postUpdateOptions" : [
-    "gomodTidy"
+  postUpdateOptions: [
+    'gomodTidy',
   ],
-  "ignorePaths": ["LICENSES/**"],
-  "packageRules": [
+  ignorePaths: [
+    'LICENSES/**',
+  ],
+  gomod: {
+    managerFilePatterns: [
+      '//(^|/)go\\.mod$//',
+      '//(^|/)tools\\.mod$//',
+    ],
+  },
+  packageRules: [
     {
-      "groupName": "Go dependencies",
-      "matchManagers": ["gomod"],
-      "schedule": ["before 8am every weekday"],
-      "automerge": true
+      groupName: 'Go dependencies',
+      matchManagers: [
+        'gomod',
+      ],
+      schedule: [
+        'before 8am every weekday',
+      ],
+      automerge: true,
     },
     {
-      "groupName": "Docker related dependencies",
-      "matchManagers": ["buildpacks", "devcontainer", "docker-compose", "dockerfile"],
-      "schedule": ["before 8am every weekday"],
-      "automerge": true
+      groupName: 'Docker related dependencies',
+      matchManagers: [
+        'buildpacks',
+        'devcontainer',
+        'docker-compose',
+        'dockerfile',
+      ],
+      schedule: [
+        'before 8am every weekday',
+      ],
+      automerge: true,
     },
     {
-      "groupName": "GitHub Actions",
-      "matchManagers": ["github-actions"],
-      "schedule": ["before 8am every weekday"],
-      "automerge": true
+      groupName: 'GitHub Actions',
+      matchManagers: [
+        'github-actions',
+      ],
+      schedule: [
+        'before 8am every weekday',
+      ],
+      automerge: true,
     },
     {
-      "groupName": "Rust dependencies",
-      "matchManagers": ["cargo"],
-      "schedule": ["before 8am every weekday"]
-    }
+      groupName: 'Rust dependencies',
+      matchManagers: [
+        'cargo',
+      ],
+      schedule: [
+        'before 8am every weekday',
+      ],
+    },
+  ],
+  ignoreDeps: [
+    'golangci/golangci-lint-action',
   ],
-  "ignoreDeps": [
-    "golangci/golangci-lint-action"
+  labels: [
+    'dependencies',
   ],
-  "labels": [
-    "dependencies"
-  ]
 }

.github/workflows/auto-tag.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 

.github/workflows/codeql.yml

@@ -14,33 +14,28 @@ jobs:
   analyze:
     permissions:
       security-events: write # for github/codeql-action/analyze to upload SARIF results
-    name: Analyze Go (${{ matrix.target_arch }})
+    name: Analyze Go
     if: ${{ github.actor != 'dependabot[bot]' && github.repository == 'open-telemetry/opentelemetry-ebpf-profiler' }}
-    runs-on: ubuntu-24.04
-    strategy:
-      matrix:
-        target_arch: [amd64, arm64]
+    runs-on: ubuntu-24.04  # CodeQL CLI only supports x86_64 Linux
     steps:
       - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: 'false'
+
       - name: Set up environment
         uses: ./.github/workflows/env
-        with:
-          target_arch: ${{ matrix.target_arch }}
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
+        uses: github/codeql-action/init@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2
         with:
           languages: go
 
       - name: Build Artifact
-        run: |
-          make TARGET_ARCH=${{ matrix.target_arch }}
+        run: make
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
+        uses: github/codeql-action/analyze@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2
         with:
             category: "/language:Go"
         timeout-minutes: 10

.github/workflows/codespell.yml

@@ -13,7 +13,7 @@ jobs:
       - name: Install codespell
         run: sudo apt-get install codespell
       - name: Checkout Repo
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: 'false'
       - name: Codespell

.github/workflows/collector-tests.yml

@@ -18,17 +18,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Set up environment
         uses: ./.github/workflows/env
       - name: Set up Go Stable
-        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
           go-version: stable
       - name: Cache coredump modules
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: tools/coredump/modulecache
           key: coredumps-collector-${{ hashFiles('tools/coredump/testdata/*/*.json') }}

.github/workflows/env/action.yml

@@ -1,11 +1,5 @@
 name: Common environment setup
 
-inputs:
-  target_arch:
-    description: 'Target architecture'
-    required: false
-    default: amd64
-
 runs:
   using: composite
   steps:
@@ -14,35 +8,18 @@ runs:
       run: |
         echo "set man-db/auto-update false" | sudo debconf-communicate
         sudo dpkg-reconfigure man-db
-    - name: Install dependencies (arm64)
-      if: ${{ inputs.target_arch == 'arm64' }}
+    - name: Install build dependencies
       shell: bash
       run: |
-        # Ubuntu has ARM64 packages in an entirely different repo, so we can't just
-        # `dpkg --add-architecture arm64` here: we have to add a custom sources.list first.
-        sudo tee /etc/apt/sources.list.d/ubuntu.sources <<EOF > /dev/null
-        Types: deb
-        URIs: http://azure.archive.ubuntu.com/ubuntu/
-        Suites: noble noble-updates noble-backports
-        Components: main universe restricted multiverse
-        Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
-        Architectures: amd64
-
-        Types: deb
-        URIs: http://azure.ports.ubuntu.com/ubuntu-ports/
-        Suites: noble noble-updates noble-backports
-        Components: main universe restricted multiverse
-        Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
-        Architectures: arm64
-        EOF
-
-        sudo dpkg --add-architecture arm64
-        sudo apt-get update -y
-        sudo apt-get install -y gcc-aarch64-linux-gnu \
-          libc6-arm64-cross qemu-user-binfmt libc6:arm64 \
-          binutils-aarch64-linux-gnu
+        # Skip translations to speed up apt-get update
+        echo 'Acquire::Languages "none";' | sudo tee /etc/apt/apt.conf.d/99no-translations > /dev/null
+        # Makefile expects ARCH-linux-gnu-gcc; install if not available
+        case "$(uname -m)" in
+          x86_64)  command -v x86_64-linux-gnu-gcc  >/dev/null || { sudo apt-get update && sudo apt-get install -y gcc-x86-64-linux-gnu; } ;;
+          aarch64) command -v aarch64-linux-gnu-gcc >/dev/null || { sudo apt-get update && sudo apt-get install -y gcc-aarch64-linux-gnu; } ;;
+        esac
     - name: Set up Go
-      uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
+      uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
       with:
         go-version-file: go.mod
         cache-dependency-path: go.sum

.github/workflows/fossa.yml

@@ -13,10 +13,11 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'open-telemetry/opentelemetry-ebpf-profiler'
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: 'false'
-      - uses: fossas/fossa-action@3ebcea1862c6ffbd5cf1b4d0bd6b3fe7bd6f2cac # v1.7.0
+
+      - uses: fossas/fossa-action@c414b9ad82eaad041e47a7cf62a4f02411f427a0 # v1.8.0
         with:
           api-key: ${{secrets.FOSSA_API_KEY}}
           team: OpenTelemetry

.github/workflows/ossf-scorecard.yml

@@ -19,7 +19,7 @@ jobs:
       # Needed for GitHub OIDC token if publish_results is true
       id-token: write
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
@@ -42,6 +42,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
+        uses: github/codeql-action/upload-sarif@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2
         with:
           sarif_file: results.sarif

.github/workflows/protoc/action.yml

@@ -7,9 +7,23 @@ runs:
       shell: bash
       env:
         PB_URL: "https://github.com/protocolbuffers/protobuf/releases/download/v24.4/"
-        PB_FILE: "protoc-24.4-linux-x86_64.zip"
         INSTALL_DIR: "/usr/local"
       run: |
+        # Detect architecture
+        ARCH=$(uname -m)
+        case "$ARCH" in
+          x86_64)
+            PB_FILE="protoc-24.4-linux-x86_64.zip"
+            ;;
+          aarch64|arm64)
+            PB_FILE="protoc-24.4-linux-aarch_64.zip"
+            ;;
+          *)
+            echo "Unsupported architecture: $ARCH"
+            exit 1
+            ;;
+        esac
+
         wget -nv "$PB_URL/$PB_FILE"
         sudo unzip "$PB_FILE" -d "$INSTALL_DIR" 'bin/*' 'include/*'
         sudo chmod +xr "$INSTALL_DIR/bin/protoc"

.github/workflows/push-docker-image.yml

@@ -16,11 +16,11 @@ jobs:
     if: github.repository == 'open-telemetry/opentelemetry-ebpf-profiler'
     steps:
       - name: Checkout code
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: 'false'
       - name: Login to Docker Hub
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
@@ -33,7 +33,7 @@ jobs:
         run: |
           echo "tag=$(date +%Y%m%d%H%M)" >> $GITHUB_OUTPUT
       - name: Build and push
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        uses: docker/build-push-action@601a80b39c9405e50806ae38af30926f9d957c47 # v6.19.1
         with:
           push: true
           file: Dockerfile

.github/workflows/unit-test-ebpf.yml

@@ -23,7 +23,7 @@ jobs:
         shell: bash --login {0}
     steps:
       - name: Clone code
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Hash binary blobs