Merge branch 'main' into dotty/test-updates-2025-Jun-15

Author: nr-ahemsath

.github/dependabot.yml

@@ -23,15 +23,16 @@ updates:
 #      docker:
 #        patterns:
 #          - "*"
-          
+
+  # Update all NuGet packages used by core agent projects
   - package-ecosystem: nuget
     directories: # not recursive - only the specified directory will be scanned for .csproj or .sln files
+      - /build # BuildTools.sln
       - /src/Agent/NewRelic/Agent/Core # Core.csproj
       - /src/Agent/NewRelic.Api.Agent # NewRelic.Api.Agent.csproj
-      - /build # BuildTools.sln
-      - /src/Agent/MsiInstaller # MsiInstaller.sln
-      # We do not scan the /src/Agent/NewRelic/Agent/Extensions folder, as those projects
-      # intentionally reference old versions of the Nuget packages they instrument.
+      - /src/Agent/NewRelic/Agent/Extensions/NewRelic.Agent.Extensions # NewRelic.Agent.Extensions.csproj
+      # Do not scan the /src/Agent/NewRelic/Agent/Extensions/Providers folder, as those projects intentionally reference old versions of the Nuget packages they instrument.
+      # Do not scan the src/Agent/MsiInstaller folder. We are not updating Wix packages to v6.x currently and there are no non-Wix packages referenced there.
     schedule:
       interval: weekly
     commit-message:
@@ -40,9 +41,6 @@ updates:
       nuget-agent:
         patterns:
           - "*"
-    ignore:
-      - dependency-name: "WixToolset*"
-        versions: [ "6.*" ] # WIX 6.0+ requires payment for commerical projects, avoiding upgrade for now
 
   # Update a specific set of packages for unit and integration tests
   - package-ecosystem: nuget

.github/workflows/all_solutions.yml

@@ -42,7 +42,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
         with:
           disable-sudo: true
           egress-policy: audit
@@ -568,7 +568,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
         with:
           disable-sudo: true
           egress-policy: audit
@@ -635,7 +635,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
         with:
           disable-sudo: true
           egress-policy: audit
@@ -746,7 +746,7 @@ jobs:
     if: always()
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
         with:
           disable-sudo: true
           egress-policy: audit

.github/workflows/build_profiler.yml

@@ -191,7 +191,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
         with:
           egress-policy: audit
 
@@ -344,7 +344,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
         with:
           egress-policy: audit
 

.github/workflows/check_modified_files.yml

@@ -22,7 +22,7 @@ jobs:
           non-workflow-files-changed: ${{ steps.filter.outputs.non-workflow-files-changed }}
         steps:
           - name: Harden Runner
-            uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+            uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
             with:
               disable-sudo: true
               egress-policy: audit

.github/workflows/codeql.yml

@@ -52,7 +52,7 @@ jobs:
         fetch-depth: 0
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
+      uses: github/codeql-action/init@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0
       with:
         languages: csharp
         config-file: ./.github/codeql/codeql-config.yml
@@ -63,7 +63,7 @@ jobs:
       shell: powershell
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
+      uses: github/codeql-action/analyze@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0
       with:
         category: "/language:csharp"
 
@@ -88,7 +88,7 @@ jobs:
         fetch-depth: 0
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
+      uses: github/codeql-action/init@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0
       with:
         languages: c-cpp
         config-file: ./.github/codeql/codeql-config.yml
@@ -105,6 +105,6 @@ jobs:
       shell: powershell
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
+      uses: github/codeql-action/analyze@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0
       with:
         category: "/language:c-cpp"

.github/workflows/deploy_agent.yml

@@ -61,7 +61,7 @@ jobs:
       workflow_run_id: ${{ steps.step2.outputs.workflow_run_id }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
         with:
           disable-sudo: true
           egress-policy: audit
@@ -155,7 +155,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
         with:
           disable-sudo: true
           egress-policy: audit
@@ -350,7 +350,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
         with:
           egress-policy: audit
 
@@ -371,19 +371,25 @@ jobs:
           name: deploy-artifacts
           path: ${{ github.workspace }}/
 
-      - name: Get GPG Key
-        id: write_gpgkey
+      - name: Get GPG Keys
+        id: write_gpgkeys
         run: |
-          filePath="/tmp/gpg.tar.bz2"
-          echo "${{ secrets.GPG_KEY }}" | base64 -d > $filePath
-          echo "filePath=$filePath" >> $GITHUB_OUTPUT
+          # old signing key
+          old_key_file="/tmp/old-secret-key.gpg"
+          echo "${{ secrets.OLD_GPG_KEY }}" | base64 -d > $old_key_file
+          echo "old_key_file=$old_key_file" >> $GITHUB_OUTPUT
+          # new signing key
+          new_key_file="/tmp/new-secret-key.gpg"
+          echo "${{ secrets.NEW_GPG_KEY }}" | base64 -d > $new_key_file
+          echo "new_key_file=$new_key_file" >> $GITHUB_OUTPUT
         shell: bash
 
-      - name: Move Artifacts and GPG Key to Staging Location
+      - name: Move Artifacts and GPG Keys to Staging Location
         run: |
           cp LinuxRpm/*.rpm ${{ github.workspace }}/deploy/linux/packages
           cp LinuxDeb/*.deb ${{ github.workspace }}/deploy/linux/packages
-          cp -f ${{ steps.write_gpgkey.outputs.filePath }} ${{ github.workspace }}/deploy/linux/deploy_scripts/gpg.tar.bz2
+          cp -f ${{ steps.write_gpgkeys.outputs.old_key_file }} ${{ github.workspace }}/deploy/linux/deploy_scripts/old-private-key.gpg
+          cp -f ${{ steps.write_gpgkeys.outputs.new_key_file }} ${{ github.workspace }}/deploy/linux/deploy_scripts/new-private-key.gpg
         shell: bash
 
       - name: Prepare docker.env
@@ -414,7 +420,11 @@ jobs:
             echo "AWS_ACCESS_KEY_ID=${{ secrets.TEST_BUCKET_AWS_ACCESS_KEY_ID }}" >> docker.env
             echo "AWS_SECRET_ACCESS_KEY=${{ secrets.TEST_BUCKET_AWS_SECRET_ACCESS_KEY }}" >> docker.env
           fi
-          echo "GPG_KEYS=/data/deploy_scripts/gpg.tar.bz2" >> docker.env
+          echo "OLD_PRIVATE_KEY=/data/deploy_scripts/old-private-key.gpg" >> docker.env
+          echo "NEW_PRIVATE_KEY=/data/deploy_scripts/new-private-key.gpg" >> docker.env
+          echo "NEW_PRIVATE_KEY_PASSPHRASE=${{ secrets.NEW_GPG_KEY_PASSPHRASE }}" >> docker.env
+          echo "OLD_KEY_ID=${{ secrets.OLD_GPG_KEY_ID }}" >> docker.env
+          echo "NEW_KEY_ID=${{ secrets.NEW_GPG_KEY_ID }}" >> docker.env
         shell: bash
 
       - name: Build and Run Container

.github/workflows/dotty.yml

@@ -35,7 +35,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
         with:
           egress-policy: audit # Leave it audit mode
 

.github/workflows/linux_container_tests.yml

@@ -42,7 +42,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
         with:
           egress-policy: audit
 
@@ -105,7 +105,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
         with:
           egress-policy: audit
 

.github/workflows/markdowncheck.yml

@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
         with:
           egress-policy: audit # Leave it audit mode
 

.github/workflows/post_deploy_agent.yml

@@ -40,12 +40,12 @@ env:
   DOTNET_NOLOGO: true
 
 jobs:
-  validate-apt-repo:
+  validate-apt-repo-ubuntu-latest:
     name: Validate APT-based repo
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
         with:
           disable-sudo: false
           egress-policy: audit
@@ -54,7 +54,40 @@ jobs:
         run: |
           echo "Sleeping 5 minutes to wait for apt to update itself"
           sleep 300
-        shell: bash      
+        shell: bash
+      - name: Validate
+        run: |
+          echo 'deb [signed-by=/usr/share/keyrings/newrelic-apt.gpg] https://apt.newrelic.com/debian/ newrelic non-free' | sudo tee /etc/apt/sources.list.d/newrelic.list
+          wget -O- https://download.newrelic.com/NEWRELIC_APT_2DAD550E.public | sudo gpg --dearmor -o /usr/share/keyrings/newrelic-apt.gpg
+          sudo apt-get update
+          sudo apt-get install newrelic-dotnet-agent
+          installed_version=$(dpkg -s newrelic-dotnet-agent | grep -i version)
+          if [ "$AGENT_VERSION" = "$installed_version" ]; then
+              echo "Versions match."
+              exit 0
+          else
+              echo "ERROR: Version mismatch: Expected $AGENT_VERSION was $installed_version"
+              exit 1
+          fi
+        shell: bash
+        env:
+          AGENT_VERSION: "Version: ${{ inputs.agent_version }}"
+
+  validate-apt-repo-ubuntu-2204:
+    name: Validate APT-based repo
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+        with:
+          disable-sudo: false
+          egress-policy: audit
+      - name: Wait for APT to update
+        if: ${{ inputs.wait_for_apt_and_yum }} # only wait if requested
+        run: |
+          echo "Sleeping 5 minutes to wait for apt to update itself"
+          sleep 300
+        shell: bash
       - name: Validate
         run: |
           echo 'deb https://apt.newrelic.com/debian/ newrelic non-free' | sudo tee /etc/apt/sources.list.d/newrelic.list
@@ -70,15 +103,15 @@ jobs:
               exit 1
           fi
         shell: bash
-        env: 
+        env:
           AGENT_VERSION: "Version: ${{ inputs.agent_version }}"
 
   validate-yum-repo:
     name: Validate YUM-based repo
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
         with:
           disable-sudo: true
           egress-policy: audit
@@ -119,7 +152,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
         with:
           disable-sudo: true
           egress-policy: audit
@@ -143,7 +176,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
         with:
           disable-sudo: true
           egress-policy: audit
@@ -171,7 +204,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
         with:
           disable-sudo: true
           egress-policy: audit
@@ -195,7 +228,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
         with:
           disable-sudo: true
           egress-policy: audit