feat: support COMPATIBLE_TLS connectionSpec in OkHttpHttpSender

.github/workflows/benchmark.yml

@@ -65,13 +65,3 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           benchmark-data-dir-path: "benchmarks"
           auto-push: true
-
-  workflow-notification:
-    permissions:
-      issues: write
-    needs:
-      - sdk-benchmark
-    if: always()
-    uses: open-telemetry/shared-workflows/.github/workflows/workflow-failure-issue.yml@62d5939b47144252763c5ff9fffe8c20d76cd806 # v0.4.0
-    with:
-      success: ${{ needs.sdk-benchmark.result == 'success' }}

.github/workflows/build-daily.yml

@@ -42,12 +42,13 @@ jobs:
 
   workflow-notification:
     permissions:
+      contents: read
       issues: write
     needs:
       - link-check
       - publish-snapshots
-    if: always()
-    uses: open-telemetry/shared-workflows/.github/workflows/workflow-failure-issue.yml@62d5939b47144252763c5ff9fffe8c20d76cd806 # v0.4.0
+    if: always() && github.repository == 'open-telemetry/opentelemetry-java'
+    uses: open-telemetry/shared-workflows/.github/workflows/workflow-failure-issue.yml@70659e38ed50e743a5cce6fb40ba336c40154aa1 # v0.3.0
     with:
       success: >-
         ${{

.github/workflows/build-tracecontext-testsuite.yml

@@ -35,13 +35,3 @@ jobs:
           context: integration-tests/tracecontext/docker
           push: true
           tags: ghcr.io/open-telemetry/java-test-containers:w3c-tracecontext-testsuite
-
-  workflow-notification:
-    permissions:
-      issues: write
-    needs:
-      - publish
-    if: always()
-    uses: open-telemetry/shared-workflows/.github/workflows/workflow-failure-issue.yml@62d5939b47144252763c5ff9fffe8c20d76cd806 # v0.4.0
-    with:
-      success: ${{ needs.publish.result == 'success' }}

.github/workflows/build.yml

@@ -115,7 +115,7 @@ jobs:
           - 25 # renovate(graal-java-version)
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: graalvm/setup-graalvm@0def53c0fd8534bc13416c9469f5be45265824fd # v1.6.3
+      - uses: graalvm/setup-graalvm@186d0493a2df5eb62df5ecc498883d18fd58c303 # v1.6.2
         with:
           java-version: ${{ matrix.test-graal-version }}
           distribution: 'graalvm'

.github/workflows/codeql.yml

@@ -64,14 +64,4 @@ jobs:
       - name: Perform CodeQL analysis
         uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
-          category: "/language:${{matrix.language}}"
-
-  workflow-notification:
-    permissions:
-      issues: write
-    needs:
-      - analyze
-    if: always() && github.event_name == 'schedule'
-    uses: open-telemetry/shared-workflows/.github/workflows/workflow-failure-issue.yml@62d5939b47144252763c5ff9fffe8c20d76cd806 # v0.4.0
-    with:
-      success: ${{ needs.analyze.result == 'success' }}
+          category: "/language:${{matrix.language}}"

.github/workflows/fossa.yml

@@ -19,13 +19,3 @@ jobs:
         with:
           api-key: ${{secrets.FOSSA_API_KEY}}
           team: OpenTelemetry
-
-  workflow-notification:
-    permissions:
-      issues: write
-    needs:
-      - fossa
-    if: always()
-    uses: open-telemetry/shared-workflows/.github/workflows/workflow-failure-issue.yml@62d5939b47144252763c5ff9fffe8c20d76cd806 # v0.4.0
-    with:
-      success: ${{ needs.fossa.result == 'success' }}

.github/workflows/issue-management-stale-action.yml

@@ -17,7 +17,7 @@ jobs:
       pull-requests: write  # for actions/stale to close stale PRs
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
+      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-stale: 7
@@ -31,13 +31,3 @@ jobs:
             This has been automatically marked as stale because it has been marked
             as needing author feedback and has not had any activity for 7 days.
             It will be closed if no further activity occurs within 7 days of this comment.
-
-  workflow-notification:
-    permissions:
-      issues: write
-    needs:
-      - stale
-    if: always()
-    uses: open-telemetry/shared-workflows/.github/workflows/workflow-failure-issue.yml@62d5939b47144252763c5ff9fffe8c20d76cd806 # v0.4.0
-    with:
-      success: ${{ needs.stale.result == 'success' }}

.github/workflows/javadoc-crawler.yml

@@ -27,13 +27,3 @@ jobs:
         run: ./gradlew :javadoc-crawler:crawl
         env:
           DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
-
-  workflow-notification:
-    permissions:
-      issues: write
-    needs:
-      - crawl
-    if: always()
-    uses: open-telemetry/shared-workflows/.github/workflows/workflow-failure-issue.yml@62d5939b47144252763c5ff9fffe8c20d76cd806 # v0.4.0
-    with:
-      success: ${{ needs.crawl.result == 'success' }}

.github/workflows/ossf-scorecard.yml

@@ -47,13 +47,3 @@ jobs:
         uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           sarif_file: results.sarif
-
-  workflow-notification:
-    permissions:
-      issues: write
-    needs:
-      - analysis
-    if: always()
-    uses: open-telemetry/shared-workflows/.github/workflows/workflow-failure-issue.yml@62d5939b47144252763c5ff9fffe8c20d76cd806 # v0.4.0
-    with:
-      success: ${{ needs.analysis.result == 'success' }}

.github/workflows/release.yml

@@ -197,11 +197,8 @@ jobs:
           DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
         run: |
           ./gradlew japicmp -PapiBaseVersion=$PRIOR_VERSION -PapiNewVersion=$VERSION
-          # Pin the apidiff baseline to the just-released version.
-          sed -i "s/^val apidiffBaselineVersion = .*/val apidiffBaselineVersion = \"$VERSION\"/" version.gradle.kts
           ./gradlew --refresh-dependencies japicmp
           git add docs/apidiffs
-          git add version.gradle.kts
 
       - name: Update versions in README.md
         env:

.github/workflows/reusable-open-issue-on-failure.yml

@@ -0,0 +1,24 @@
+name: Reusable - Open issue on workflow failure
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  open-issue:
+    permissions:
+      contents: read
+      issues: write # for creating the issue
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Open issue
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh issue create --title "$GITHUB_WORKFLOW #$GITHUB_RUN_NUMBER failed" \
+                          --label Bug \
+                          --body "See [$GITHUB_WORKFLOW #$GITHUB_RUN_NUMBER](https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID)."

.github/workflows/sonatype-guide-dependency-audit-daily.yml

@@ -43,10 +43,11 @@ jobs:
 
   workflow-notification:
     permissions:
+      contents: read
       issues: write
     needs:
       - analyze
-    if: always()
-    uses: open-telemetry/shared-workflows/.github/workflows/workflow-failure-issue.yml@62d5939b47144252763c5ff9fffe8c20d76cd806 # v0.4.0
+    if: always() && github.repository == 'open-telemetry/opentelemetry-java'
+    uses: open-telemetry/shared-workflows/.github/workflows/workflow-failure-issue.yml@70659e38ed50e743a5cce6fb40ba336c40154aa1 # v0.3.0
     with:
       success: ${{ needs.analyze.result == 'success' }}

.github/workflows/survey-on-merged-pr.yml

@@ -1,16 +1,53 @@
 name: Survey on Merged PR by Non-Member
 
 on:
-  pull_request_target: # zizmor: ignore[dangerous-triggers] — this workflow only calls the reusable shared workflow; no PR code is checked out or executed.
+  # pull_request_target is used instead of pull_request so that the workflow has write access
+  # (to post comments) even when triggered by fork PRs.
+  #
+  # SECURITY: this workflow must never checkout or execute any code from the PR branch.
+  # Doing so would allow malicious PRs to exfiltrate secrets. All we use from the PR
+  # is github.event.pull_request.number (an integer) and author metadata, which are safe.
+  pull_request_target:
     types: [closed]
-    branches: [main]
 
 permissions: {}
 
+env:
+  PR_NUM: ${{ github.event.pull_request.number }}
+  SURVEY_URL: https://docs.google.com/forms/d/e/1FAIpQLSf2FfCsW-DimeWzdQgfl0KDzT2UEAqu69_f7F2BVPSxVae1cQ/viewform?entry.1540511742=${{ github.repository }}
+
 jobs:
-  survey:
-    uses: open-telemetry/shared-workflows/.github/workflows/survey-on-merged-pr.yml@9cdb8625f2e5a1d160834bb7f7738d157f22a19c # v0.2.1
-    with:
-      client_id: ${{ vars.OTELBOT_CLIENT_ID }}
-    secrets:
-      private_key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+  comment-on-pr:
+    name: Add survey to PR if author is not a member
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.merged == true && github.repository == 'open-telemetry/opentelemetry-java'
+    steps:
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        id: otelbot-token
+        with:
+          app-id: ${{ vars.OTELBOT_APP_ID }}
+          private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+
+      - name: Add survey comment if author is not a member or bot
+        run: |
+          USERNAME="${{ github.event.pull_request.user.login }}"
+          USER_TYPE="${{ github.event.pull_request.user.type }}"
+          ORG="${{ github.repository_owner }}"
+
+          # Skip if user is a bot
+          if [[ "$USER_TYPE" == "Bot" ]]; then
+            echo "Skipping survey for bot user: $USERNAME"
+            exit 0
+          fi
+
+          # Skip if user is an org member
+          if gh api "orgs/$ORG/members/$USERNAME" --silent; then
+            echo "Skipping survey for org member: $USERNAME"
+            exit 0
+          fi
+
+          # Add survey comment for external contributor
+          echo "Adding survey comment for external contributor: $USERNAME"
+          gh pr comment ${PR_NUM} --repo ${{ github.repository }} --body "Thank you for your contribution @${USERNAME}! 🎉 We would like to hear from you about your experience contributing to OpenTelemetry by taking a few minutes to fill out this [survey](${SURVEY_URL})."
+        env:
+          GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}

docs/apidiffs/current_vs_latest/opentelemetry-exporter-otlp.txt

@@ -1,2 +1,19 @@
 Comparing source compatibility of opentelemetry-exporter-otlp-1.65.0-SNAPSHOT.jar against opentelemetry-exporter-otlp-1.64.0.jar
-No changes.
+***  MODIFIED CLASS: PUBLIC FINAL io.opentelemetry.exporter.otlp.http.logs.OtlpHttpLogRecordExporterBuilder  (not serializable)
+	===  CLASS FILE FORMAT VERSION: 52.0 <- 52.0
+	+++  NEW METHOD: PUBLIC(+) io.opentelemetry.exporter.otlp.http.logs.OtlpHttpLogRecordExporterBuilder setEnabledProtocols(java.util.List<java.lang.String>)
+***  MODIFIED CLASS: PUBLIC FINAL io.opentelemetry.exporter.otlp.http.metrics.OtlpHttpMetricExporterBuilder  (not serializable)
+	===  CLASS FILE FORMAT VERSION: 52.0 <- 52.0
+	+++  NEW METHOD: PUBLIC(+) io.opentelemetry.exporter.otlp.http.metrics.OtlpHttpMetricExporterBuilder setEnabledProtocols(java.util.List<java.lang.String>)
+***  MODIFIED CLASS: PUBLIC FINAL io.opentelemetry.exporter.otlp.http.trace.OtlpHttpSpanExporterBuilder  (not serializable)
+	===  CLASS FILE FORMAT VERSION: 52.0 <- 52.0
+	+++  NEW METHOD: PUBLIC(+) io.opentelemetry.exporter.otlp.http.trace.OtlpHttpSpanExporterBuilder setEnabledProtocols(java.util.List<java.lang.String>)
+***  MODIFIED CLASS: PUBLIC FINAL io.opentelemetry.exporter.otlp.logs.OtlpGrpcLogRecordExporterBuilder  (not serializable)
+	===  CLASS FILE FORMAT VERSION: 52.0 <- 52.0
+	+++  NEW METHOD: PUBLIC(+) io.opentelemetry.exporter.otlp.logs.OtlpGrpcLogRecordExporterBuilder setEnabledProtocols(java.util.List<java.lang.String>)
+***  MODIFIED CLASS: PUBLIC FINAL io.opentelemetry.exporter.otlp.metrics.OtlpGrpcMetricExporterBuilder  (not serializable)
+	===  CLASS FILE FORMAT VERSION: 52.0 <- 52.0
+	+++  NEW METHOD: PUBLIC(+) io.opentelemetry.exporter.otlp.metrics.OtlpGrpcMetricExporterBuilder setEnabledProtocols(java.util.List<java.lang.String>)
+***  MODIFIED CLASS: PUBLIC FINAL io.opentelemetry.exporter.otlp.trace.OtlpGrpcSpanExporterBuilder  (not serializable)
+	===  CLASS FILE FORMAT VERSION: 52.0 <- 52.0
+	+++  NEW METHOD: PUBLIC(+) io.opentelemetry.exporter.otlp.trace.OtlpGrpcSpanExporterBuilder setEnabledProtocols(java.util.List<java.lang.String>)

docs/apidiffs/current_vs_latest/opentelemetry-sdk-common.txt

@@ -1,2 +1,9 @@
 Comparing source compatibility of opentelemetry-sdk-common-1.65.0-SNAPSHOT.jar against opentelemetry-sdk-common-1.64.0.jar
-No changes.
+***  MODIFIED INTERFACE: PUBLIC ABSTRACT io.opentelemetry.sdk.common.export.GrpcSenderConfig  (not serializable)
+	===  CLASS FILE FORMAT VERSION: 52.0 <- 52.0
+	+++  NEW METHOD: PUBLIC(+) java.util.List<java.lang.String> getEnabledProtocols()
+		+++  NEW ANNOTATION: javax.annotation.Nullable
+***  MODIFIED INTERFACE: PUBLIC ABSTRACT io.opentelemetry.sdk.common.export.HttpSenderConfig  (not serializable)
+	===  CLASS FILE FORMAT VERSION: 52.0 <- 52.0
+	+++  NEW METHOD: PUBLIC(+) java.util.List<java.lang.String> getEnabledProtocols()
+		+++  NEW ANNOTATION: javax.annotation.Nullable

exporters/otlp/all/src/jmh/java/io/opentelemetry/exporter/otlp/trace/OltpExporterBenchmark.java

@@ -111,7 +111,8 @@ public void setUp() {
                 null,
                 null,
                 null,
-                Long.MAX_VALUE),
+                Long.MAX_VALUE,
+                null),
             InternalTelemetryVersion.LATEST,
             ComponentId.generateLazy(StandardComponentId.ExporterType.OTLP_GRPC_SPAN_EXPORTER),
             MeterProvider::noop,

exporters/otlp/all/src/main/java/io/opentelemetry/exporter/otlp/http/logs/OtlpHttpLogRecordExporterBuilder.java

@@ -20,6 +20,7 @@
 import io.opentelemetry.sdk.common.export.RetryPolicy;
 import io.opentelemetry.sdk.common.internal.StandardComponentId;
 import java.time.Duration;
+import java.util.List;
 import java.util.Map;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.TimeUnit;
@@ -274,6 +275,22 @@ public OtlpHttpLogRecordExporterBuilder setExecutorService(ExecutorService execu
     return this;
   }
 
+  /**
+   * Sets the TLS protocol versions to enable when connecting to an HTTPS endpoint. Pass {@code
+   * null} to defer to the sender implementation's default.
+   *
+   * <p>Protocol names follow the JSSE convention: {@code "TLSv1.2"}, {@code "TLSv1.3"}, etc.
+   *
+   * <p>Note: enabling legacy protocol versions (TLSv1, TLSv1.1) also requires removing them from
+   * the JVM's {@code jdk.tls.disabledAlgorithms} security property.
+   */
+  public OtlpHttpLogRecordExporterBuilder setEnabledProtocols(List<String> enabledProtocols) {
+    requireNonNull(enabledProtocols, "enabledProtocols");
+    checkArgument(!enabledProtocols.isEmpty(), "enabledProtocols must not be empty");
+    delegate.setEnabledProtocols(enabledProtocols);
+    return this;
+  }
+
   /**
    * Constructs a new instance of the exporter based on the builder's values.
    *

exporters/otlp/all/src/main/java/io/opentelemetry/exporter/otlp/http/metrics/OtlpHttpMetricExporterBuilder.java

@@ -26,6 +26,7 @@
 import io.opentelemetry.sdk.metrics.export.MetricExporter;
 import java.time.Duration;
 import java.util.Collection;
+import java.util.List;
 import java.util.Map;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.TimeUnit;
@@ -333,6 +334,22 @@ public OtlpHttpMetricExporterBuilder setExecutorService(ExecutorService executor
     return this;
   }
 
+  /**
+   * Sets the TLS protocol versions to enable when connecting to an HTTPS endpoint. Pass {@code
+   * null} to defer to the sender implementation's default.
+   *
+   * <p>Protocol names follow the JSSE convention: {@code "TLSv1.2"}, {@code "TLSv1.3"}, etc.
+   *
+   * <p>Note: enabling legacy protocol versions (TLSv1, TLSv1.1) also requires removing them from
+   * the JVM's {@code jdk.tls.disabledAlgorithms} security property.
+   */
+  public OtlpHttpMetricExporterBuilder setEnabledProtocols(List<String> enabledProtocols) {
+    requireNonNull(enabledProtocols, "enabledProtocols");
+    checkArgument(!enabledProtocols.isEmpty(), "enabledProtocols must not be empty");
+    delegate.setEnabledProtocols(enabledProtocols);
+    return this;
+  }
+
   OtlpHttpMetricExporterBuilder exportAsJson() {
     delegate.exportAsJson();
     return this;

exporters/otlp/all/src/main/java/io/opentelemetry/exporter/otlp/http/trace/OtlpHttpSpanExporterBuilder.java

@@ -20,6 +20,7 @@
 import io.opentelemetry.sdk.common.export.RetryPolicy;
 import io.opentelemetry.sdk.common.internal.StandardComponentId;
 import java.time.Duration;
+import java.util.List;
 import java.util.Map;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.TimeUnit;
@@ -275,6 +276,22 @@ public OtlpHttpSpanExporterBuilder setExecutorService(ExecutorService executorSe
     return this;
   }
 
+  /**
+   * Sets the TLS protocol versions to enable when connecting to an HTTPS endpoint. Pass {@code
+   * null} to defer to the sender implementation's default.
+   *
+   * <p>Protocol names follow the JSSE convention: {@code "TLSv1.2"}, {@code "TLSv1.3"}, etc.
+   *
+   * <p>Note: enabling legacy protocol versions (TLSv1, TLSv1.1) also requires removing them from
+   * the JVM's {@code jdk.tls.disabledAlgorithms} security property.
+   */
+  public OtlpHttpSpanExporterBuilder setEnabledProtocols(List<String> enabledProtocols) {
+    requireNonNull(enabledProtocols, "enabledProtocols");
+    checkArgument(!enabledProtocols.isEmpty(), "enabledProtocols must not be empty");
+    delegate.setEnabledProtocols(enabledProtocols);
+    return this;
+  }
+
   /**
    * Constructs a new instance of the exporter based on the builder's values.
    *