Merge upstream changes March 25

.github/workflows/codeql.yml

@@ -11,7 +11,7 @@ on:
 jobs:
   analyze:
     name: Analyze Go (${{ matrix.target_arch }})
-    if: ${{ github.actor != 'dependabot[bot]' }}
+    if: ${{ github.actor != 'dependabot[bot]' && github.repository == 'open-telemetry/opentelemetry-ebpf-profiler' }}
     runs-on: ubuntu-24.04
     strategy:
       matrix:

.github/workflows/env/action.yml

@@ -30,6 +30,12 @@ runs:
         sudo apt-get install -y curl unzip gcc-aarch64-linux-gnu \
           libc6-arm64-cross qemu-user-binfmt libc6:arm64 \
           musl-dev:amd64 musl-dev:arm64 musl-tools binutils-aarch64-linux-gnu
+    - name: Set up Go
+      uses: actions/setup-go@v5
+      with:
+        go-version-file: go.mod
+        cache-dependency-path: go.sum
+      id: go
     - name: Install Rust
       uses: dtolnay/rust-toolchain@stable
       with:

.github/workflows/fossa.yml

@@ -11,6 +11,7 @@ permissions:
 jobs:
   fossa:
     runs-on: ubuntu-latest
+    if: github.repository == 'open-telemetry/opentelemetry-ebpf-profiler'
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 

.github/workflows/ossf-scorecard.yml

@@ -0,0 +1,47 @@
+name: OSSF Scorecard
+
+on:
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: "31 6 * * 4" # once a week
+  workflow_dispatch:
+
+permissions: read-all
+
+jobs:
+  analysis:
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed for Code scanning upload
+      security-events: write
+      # Needed for GitHub OIDC token if publish_results is true
+      id-token: write
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable
+      # uploads of run results in SARIF format to the repository Actions tab.
+      # https://docs.github.com/en/actions/advanced-guides/storing-workflow-data-as-artifacts
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard (optional).
+      # Commenting out will disable upload of results to your repo's Code Scanning dashboard
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@5f8171a638ada777af81d42b55959a643bb29017 # v3.28.12
+        with:
+          sarif_file: results.sarif

.github/workflows/push-docker-image.yml

@@ -9,6 +9,7 @@ on:
 jobs:
   build-and-push:
     runs-on: ubuntu-latest
+    if: github.repository == 'open-telemetry/opentelemetry-ebpf-profiler'
     steps:
       - name: Checkout code
         uses: actions/checkout@v4

.github/workflows/unit-test-on-pull-request.yml

@@ -15,13 +15,6 @@ jobs:
         uses: actions/checkout@v4
       - name: Set up environment
         uses: ./.github/workflows/env
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version-file: go.mod
-          check-latest: true
-          cache-dependency-path: go.sum
-        id: go
       - name: Check for changes in licenses of dependencies
         run: |
           make legal
@@ -41,13 +34,6 @@ jobs:
         uses: actions/checkout@v4
       - name: Set up environment
         uses: ./.github/workflows/env
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version-file: go.mod
-          check-latest: true
-          cache-dependency-path: go.sum
-        id: go
       - name: Get linter version
         id: linter-version
         run: (echo -n "version="; make linter-version) >> "$GITHUB_OUTPUT"
@@ -75,13 +61,6 @@ jobs:
         uses: actions/checkout@v4
       - name: Set up environment
         uses: ./.github/workflows/env
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version-file: go.mod
-          check-latest: true
-          cache-dependency-path: go.sum
-        id: go
       - name: Cache coredump modules
         uses: actions/cache@v4
         with:
@@ -95,45 +74,46 @@ jobs:
       - name: Tests
         run: make test TARGET_ARCH=${{ matrix.target_arch }}
 
-  check-ebpf-blobs:
-    name: Check for differences in the eBPF binary blobs
+  check-binary-blobs:
+    name: Check for differences in the eBPF and Rust binary blobs
     runs-on: ubuntu-24.04
     container: otel/opentelemetry-ebpf-profiler-dev:latest
+    defaults:
+      run:
+        shell: bash --login {0}
     steps:
       - name: Clone code
         uses: actions/checkout@v4
-      - name: Hash eBPF blobs
+      - name: Hash binary blobs
         run: |
-          sha256sum support/ebpf/tracer.ebpf.release.* > ebpf-blobs.hash
+          sha256sum support/ebpf/tracer.ebpf.release.* > binary-blobs.hash
+          sha256sum target/x86_64-unknown-linux-musl/release/libsymblib_capi.a >> binary-blobs.hash
+          sha256sum target/aarch64-unknown-linux-musl/release/libsymblib_capi.a >> binary-blobs.hash
       - name: Rebuild eBPF blobs
         run: |
           rm support/ebpf/tracer.ebpf.release.*
           make amd64 -C support/ebpf
           make arm64 -C support/ebpf
+      - name: Rebuild Rust blobs
+        run: |
+          rm -rf target/
+          make rust-components TARGET_ARCH=amd64
+          make rust-components TARGET_ARCH=arm64
       - name: Check for differences
         run: |
-          if ! sha256sum --check ebpf-blobs.hash; then
-            echo "Please rebuild and commit the updated eBPF binary blobs."
+          if ! sha256sum --check binary-blobs.hash; then
+            echo "Please rebuild and commit the updated binary blobs."
             exit 1
           fi
 
-
   build-integration-test-binaries:
-    name: Build integration test binaries (${{ matrix.target_arch }}-${{ matrix.go_version}})
+    name: Build integration test binaries (${{ matrix.target_arch }})
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     strategy:
       matrix:
         target_arch: [amd64, arm64]
-        go_version: [1.23, 1.24]
     steps:
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: ${{ matrix.go_version }}
-          check-latest: true
-          cache-dependency-path: go.sum
-        id: go
       - name: Clone code
         uses: actions/checkout@v4
       - name: Set up environment
@@ -143,17 +123,16 @@ jobs:
       - name: Upload integration test binaries
         uses: actions/upload-artifact@v4
         with:
-          name: integration-test-binaries-${{ matrix.target_arch }}-${{ matrix.go_version}}
+          name: integration-test-binaries-${{ matrix.target_arch }}
           path: support/*.test
 
   integration-tests:
-    name: Integration tests (v${{ matrix.kernel }} ${{ matrix.target_arch }} ${{ matrix.go_version}})
+    name: Integration tests (v${{ matrix.kernel }} ${{ matrix.target_arch }})
     runs-on: ubuntu-24.04
     needs: build-integration-test-binaries
     timeout-minutes: 10
     strategy:
       matrix:
-        go_version: [1.23, 1.24]
         include:
           # List of available kernels here:
           # https://github.com/cilium/ci-kernels/pkgs/container/ci-kernels/versions?filters%5Bversion_type%5D=tagged
@@ -177,13 +156,6 @@ jobs:
     steps:
       - name: Clone code
         uses: actions/checkout@v4
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: ${{ matrix.go_version }}
-          check-latest: true
-          cache-dependency-path: go.sum
-        id: go
       - name: Install dependencies
         run: |
           sudo apt-get update -y
@@ -196,7 +168,7 @@ jobs:
           sudo mv ~/go/bin/bluebox /usr/local/bin/.
       - name: Fetch integration test binaries
         uses: actions/download-artifact@v4
-        with: { name: "integration-test-binaries-${{ matrix.target_arch }}-${{ matrix.go_version}}" }
+        with: { name: "integration-test-binaries-${{ matrix.target_arch }}" }
       - name: Fetch precompiled kernel
         run: |
           install -d ci-kernels

.gitignore

@@ -5,4 +5,8 @@
 /go
 ebpf-profiler
 ci-kernels
-/target
+# Ignore target directory
+target/*
+# But not these specific paths
+!target/x86_64-unknown-linux-musl/release/libsymblib_capi.a
+!target/aarch64-unknown-linux-musl/release/libsymblib_capi.a

.golangci.yml

@@ -91,8 +91,6 @@ linters:
     - wastedassign
     - wsl
     - wrapcheck
-    # the following linters are deprecated
-    - exportloopref
     # we don't want to change code to Go 1.22+ yet
     - intrange
     - copyloopvar

Dockerfile

@@ -2,14 +2,17 @@ FROM debian:testing-20241223-slim
 
 WORKDIR /agent
 
+RUN dpkg --add-architecture amd64 && dpkg --add-architecture arm64
+
 # cross_debian_arch: amd64 or arm64
 # cross_pkg_arch: x86-64 or aarch64
 RUN cross_debian_arch=$(uname -m | sed -e 's/aarch64/amd64/'  -e 's/x86_64/arm64/'); \
     cross_pkg_arch=$(uname -m | sed -e 's/aarch64/x86-64/' -e 's/x86_64/aarch64/'); \
     apt-get update -y && \
     apt-get dist-upgrade -y && \
     apt-get install -y curl wget make git cmake clang-17 unzip libc6-dev g++ gcc pkgconf \
-        gcc-${cross_pkg_arch}-linux-gnu libc6-${cross_debian_arch}-cross musl-dev && \
+        gcc-${cross_pkg_arch}-linux-gnu libc6-${cross_debian_arch}-cross \
+        musl-dev:amd64 musl-dev:arm64 && \
     apt-get clean autoclean && \
     apt-get autoremove --yes