NH-137757 Lambda: recent Go and Prometheus-related vulnerabilities reported

.github/workflows/ci-collector.yml

@@ -25,7 +25,7 @@ jobs:
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: collector/go.mod
-      - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/go/pkg/mod
           key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
@@ -48,7 +48,7 @@ jobs:
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: collector/go.mod
-      - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/go/pkg/mod
           key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
@@ -67,3 +67,9 @@ jobs:
         working-directory: collector/build/extensions
         run: |
           grep ${{ env.LAMBDA_LAYER_ARCHITECTURE }} <<< "$(file collector)"
+      - name: Output artifact size to job summary
+        working-directory: collector/build
+        run: |
+          echo "### Collector size (${{ matrix.architecture }})" >> $GITHUB_STEP_SUMMARY
+          echo "- Binary: $(du -h extensions/collector | cut -f1)" >> $GITHUB_STEP_SUMMARY
+          echo "- Layer zip: $(du -h opentelemetry-collector-layer-*.zip | cut -f1)" >> $GITHUB_STEP_SUMMARY

.github/workflows/codeql.yml

@@ -59,7 +59,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v3.29.5
+      uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v3.29.5
       with:
         languages: ${{ matrix.target.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -73,7 +73,7 @@ jobs:
     # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@c10b8064de6f491fea524254123dbe5e09572f13 # v3.29.5
+      uses: github/codeql-action/autobuild@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v3.29.5
       with:
         working-directory: ${{ matrix.target.directory }}
       # There are no array literals in GHA that is why we need to use fromJson.
@@ -95,6 +95,6 @@ jobs:
       if: ${{ matrix.target.language == 'go' }}
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v3.29.5
+      uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v3.29.5
       with:
         category: "/language:${{matrix.target.language}}"

.github/workflows/layer-publish.yml

@@ -94,7 +94,7 @@ jobs:
         with:
           name: ${{ inputs.artifact-name }}
 
-      - uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+      - uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
         with:
           role-to-assume: ${{ inputs.release-group == 'prod' && secrets.PROD_LAMBDA_ROLE_ARN || secrets.STAGING_LAMBDA_ROLE_ARN }}
           role-duration-seconds: 1200

.github/workflows/ossf-scorecard.yml

@@ -42,6 +42,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v3.29.5
+        uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v3.29.5
         with:
           sarif_file: results.sarif

collector/Makefile

@@ -95,7 +95,6 @@ gofmt:
 install-tools:
 	cd $(TOOLS_MOD_DIR) && $(GOCMD) install github.com/golangci/golangci-lint/cmd/golangci-lint
 	cd $(TOOLS_MOD_DIR) && $(GOCMD) install github.com/google/addlicense
-	cd $(TOOLS_MOD_DIR) && $(GOCMD) install github.com/ory/go-acc
 	cd $(TOOLS_MOD_DIR) && $(GOCMD) install github.com/pavius/impi/cmd/impi
 	cd $(TOOLS_MOD_DIR) && $(GOCMD) install github.com/tcnksm/ghr
 	cd $(TOOLS_MOD_DIR) && $(GOCMD) install github.com/wadey/gocovmerge

collector/Makefile.Common

@@ -1,7 +1,6 @@
 GOTEST_OPT?= -race -timeout 120s
 GOCMD?= go
 GOTEST=$(GOCMD) test
-GO_ACC=go-acc
 LINT=golangci-lint
 IMPI=impi
 
@@ -15,7 +14,7 @@ test:
 
 .PHONY: test-with-cover
 test-with-cover:
-	$(GO_ACC) --output=coverage.out ./...
+	$(GOTEST) -covermode=atomic -coverpkg=./... -coverprofile=coverage.out ./...
 
 .PHONY: benchmark
 benchmark:

collector/README.md

@@ -3,6 +3,19 @@
 The OpenTelemetry Collector Lambda Extension provides a mechanism to export telemetry aynchronously from AWS Lambdas. It does this by embedding a stripped-down version of [OpenTelemetry Collector Contrib](https://github.com/open-telemetry/opentelemetry-collector-contrib) inside an [AWS Extension Layer](https://aws.amazon.com/blogs/compute/introducing-aws-lambda-extensions-in-preview/). This allows lambdas to use the OpenTelemetry Collector Exporter to send traces and metrics to any configured backend.
 
 
+## Deprecation Notice
+
+The `attributes`, `resource`, and `span` processors are considered **deprecated** in the default collector layer build and will be removed in an upcoming release. The [`transform` processor](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/processor/transformprocessor), which covers the same functionality through [OTTL](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/pkg/ottl), has been added to the default build and should be used instead.
+
+**If your collector configuration references `attributes`, `resource`, or `span`**, you have two options before upgrading past the removal release:
+
+1. **Migrate to the `transform` processor.** It uses OTTL on the `resource`, `span`, and `spanevent` contexts 
+   and covers the full capabilities of the three deprecated processors.
+
+2. **Build a custom layer that re-includes them via build tags.**
+   See [Customized collector build](#experimental-customized-collector-build) below.
+
+
 ## Build your OpenTelemetry Collector Lambda layer from scratch
 At the moment users have to build Collector Lambda layer by themselves, we will provide sharing Lambda layer in the future.
 - Download a local copy of the [opentelemetry-lambda repository from Github](https://github.com/open-telemetry/opentelemetry-lambda).