[Infra] Fix issue templates (#6455)

Co-authored-by: Piotr Kiełkowicz <pkiekowicz@splunk.com>

.clomonitor.yml

@@ -0,0 +1,4 @@
+# see https://github.com/cncf/clomonitor/blob/main/docs/checks.md#exemptions
+exemptions:
+  - check: artifacthub_badge
+    reason: "Artifact Hub doesn't support .NET packages"

.editorconfig

@@ -10,6 +10,9 @@ indent_size = 2
 insert_final_newline = true
 trim_trailing_whitespace = true
 
+[*.sh]
+end_of_line = lf
+
 [*.{cs,cshtml,htm,html,md,py,sln,xml}]
 indent_size = 4
 
@@ -156,7 +159,14 @@ dotnet_diagnostic.IDE0005.severity = warning
 # RS0041: Public members should not use oblivious types
 dotnet_diagnostic.RS0041.severity = suggestion
 
-[obj/**.cs]
+[*Tests.cs]
+# CA1515: Disable making types internal for Tests classes. It is required by xunit
+dotnet_diagnostic.CA1515.severity = none
+
+# CA2007: Disable Consider calling ConfigureAwait on the awaited task. It is not working with xunit
+dotnet_diagnostic.CA2007.severity = none
+
+[**/obj/**.cs]
 generated_code = true
 
 [*.csproj]

.gitattributes

@@ -0,0 +1 @@
+*.sh eol=lf

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -62,7 +62,7 @@ body:
   - type: textarea
     attributes:
       label: Steps to Reproduce
-      description: Provide a [minimal reproducible example](https://stackoverflow.com/help/minimal-reproducible-example). We will close the issue if the repro project you share with us is complex or we cannot reproduce the behavior you are reporting. We cannot investigate custom projects, so don't point us to such, please.
+      description: Provide a [minimal, reproducible example](https://stackoverflow.com/help/minimal-reproducible-example). We will close the issue if the repro project you share with us is complex or we cannot reproduce the behavior you are reporting. We cannot investigate custom projects, so don't point us to such, please.
     validations:
       required: true
 
@@ -84,3 +84,11 @@ body:
     attributes:
       label: Additional Context
       description: Any additional information you think may be relevant to this issue.
+
+  - type: dropdown
+    attributes:
+      label: Tip
+      description: This element is static, used to render a helpful sub-heading for end-users and community members to help prioritize issues. Please leave as is.
+      options:
+        - "<sub>[React](https://github.blog/news-insights/product-news/add-reactions-to-pull-requests-issues-and-comments/) with :+1: to help prioritize this issue. Please use comments to provide useful context, avoiding `+1` or `me too`, to help us triage it. Learn more [here](https://opentelemetry.io/community/end-user/issue-participation/).</sub>"
+      default: 0

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -53,3 +53,11 @@ body:
     attributes:
       label: Additional context
       description: Any additional information you think may be relevant to this feature request.
+
+  - type: dropdown
+    attributes:
+      label: Tip
+      description: This element is static, used to render a helpful sub-heading for end-users and community members to help prioritize issues. Please leave as is.
+      options:
+        - "<sub>[React](https://github.blog/news-insights/product-news/add-reactions-to-pull-requests-issues-and-comments/) with :+1: to help prioritize this issue. Please use comments to provide useful context, avoiding `+1` or `me too`, to help us triage it. Learn more [here](https://opentelemetry.io/community/end-user/issue-participation/).</sub>"
+      default: 0

.github/dependabot.yml

@@ -6,3 +6,70 @@ updates:
       interval: "daily"
     labels:
       - "infra"
+  - package-ecosystem: "docker"
+    directory: "/examples/MicroserviceExample/WebApi"
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+    labels:
+      - "infra"
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-major"
+          - "version-update:semver-minor"
+  - package-ecosystem: "docker"
+    directory: "examples/MicroserviceExample/WorkerService"
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+    labels:
+      - "infra"
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-major"
+          - "version-update:semver-minor"
+  - package-ecosystem: "docker"
+    directory: "test/OpenTelemetry.Exporter.OpenTelemetryProtocol.Tests/IntegrationTest"
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+    labels:
+      - "infra"
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-major"
+          - "version-update:semver-minor"
+  - package-ecosystem: "docker"
+    directory: "test/OpenTelemetry.Instrumentation.W3cTraceContext.Tests"
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+    labels:
+      - "infra"
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-major"
+          - "version-update:semver-minor"
+  - package-ecosystem: "dotnet-sdk"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+    labels:
+      - "infra"
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-major"
+          - "version-update:semver-minor"
+  - package-ecosystem: "pip"
+    directory: "test/OpenTelemetry.Instrumentation.W3cTraceContext.Tests"
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+    labels:
+      - "infra"

.github/workflows/Component.BuildTest.yml

@@ -20,7 +20,7 @@ on:
         required: false
         type: string
       os-list:
-        default: '[ "windows-latest", "ubuntu-latest", "otel-linux-arm64" ]'
+        default: '[ "windows-latest", "ubuntu-22.04", "ubuntu-22.04-arm" ]'
         required: false
         type: string
       tfm-list:
@@ -28,6 +28,9 @@ on:
         required: false
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   build-test:
 
@@ -37,24 +40,30 @@ jobs:
         os: ${{ fromJSON(inputs.os-list) }}
         version: ${{ fromJSON(inputs.tfm-list) }}
         exclude:
-        - os: ubuntu-latest
+        - os: ubuntu-22.04
           version: net462
-        - os: otel-linux-arm64
+        - os: ubuntu-22.04-arm
           version: net462
-        - os: otel-linux-arm64
+        - os: ubuntu-22.04-arm
           version: net8.0
 
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         # Note: By default GitHub only fetches 1 commit. MinVer needs to find
         # the version tag which is typically NOT on the first commit so we
         # retrieve them all.
         fetch-depth: 0
 
-    - name: Setup dotnet
-      uses: actions/setup-dotnet@v4
+    - name: Setup previous .NET runtimes
+      uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
+      with:
+        dotnet-version: |
+          8.0.x
+
+    - name: Setup .NET
+      uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
 
     - name: dotnet restore ${{ inputs.project-name }}
       run: dotnet restore ${{ inputs.project-name }} ${{ inputs.project-build-commands }}
@@ -63,7 +72,18 @@ jobs:
       run: dotnet build ${{ inputs.project-name }} --configuration Release --no-restore ${{ inputs.project-build-commands }}
 
     - name: dotnet test ${{ inputs.project-name }}
-      run: dotnet test ${{ inputs.project-name }} --collect:"Code Coverage" --results-directory:TestResults --framework ${{ matrix.version }} --configuration Release --no-restore --no-build --logger:"console;verbosity=detailed" -- RunConfiguration.DisableAppDomain=true
+      run: >
+        dotnet test ${{ inputs.project-name }}
+        --collect:"Code Coverage"
+        --results-directory:TestResults
+        --framework ${{ matrix.version }}
+        --configuration Release
+        --no-restore
+        --no-build
+        --logger:"console;verbosity=detailed"
+        --logger:"GitHubActions;report-warnings=false"
+        --logger:"junit;LogFilePath=TestResults/junit.xml"
+        -- RunConfiguration.DisableAppDomain=true
 
     - name: Install coverage tool
       run: dotnet tool install -g dotnet-coverage
@@ -72,15 +92,24 @@ jobs:
       run: dotnet-coverage merge -f cobertura -o ./TestResults/Cobertura.xml ./TestResults/**/*.coverage
 
     - name: Upload code coverage ${{ inputs.code-cov-prefix }}-${{ inputs.code-cov-name }}
-      uses: codecov/codecov-action@v4
+      uses: codecov/codecov-action@fdcc8476540edceab3de004e990f80d881c6cc00 # v5.5.0
       continue-on-error: true # Note: Don't fail for upload failures
       env:
         OS: ${{ matrix.os }}
         TFM: ${{ matrix.version }}
-        token: ${{ secrets.CODECOV_TOKEN }}
       with:
-        file: TestResults/Cobertura.xml
+        files: TestResults/Cobertura.xml
         env_vars: OS,TFM
         flags: ${{ inputs.code-cov-prefix }}-${{ inputs.code-cov-name }}
         name: Code Coverage for ${{ inputs.code-cov-prefix }}-${{ inputs.code-cov-name }} on [${{ matrix.os }}.${{ matrix.version }}]
         codecov_yml_path: .github/codecov.yml
+        token: ${{ secrets.CODECOV_TOKEN }}
+
+    - name: Upload test results ${{ inputs.code-cov-prefix }}-${{ inputs.code-cov-name }}
+      if: ${{ !cancelled() && hashFiles('./**/TestResults/junit.xml') != '' }}
+      uses: codecov/test-results-action@47f89e9acb64b76debcd5ea40642d25a4adced9f # v1.1.1
+      with:
+        env_vars: OS,TFM
+        flags: ${{ inputs.code-cov-prefix }}-${{ inputs.code-cov-name }}
+        name: Test results for ${{ inputs.code-cov-prefix }}-${{ inputs.code-cov-name }} on [${{ matrix.os }}.${{ matrix.version }}]
+        token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/add-labels.yml

@@ -7,18 +7,19 @@ on:
     branches: [ 'main*' ]
 
 permissions:
-  issues: write
-  pull-requests: write
+  contents: read
 
 jobs:
   add-labels-on-issues:
+    permissions:
+      issues: write
     if: github.event_name == 'issues' && !github.event.issue.pull_request
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
 
     steps:
       - name: check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Add labels for package found in bug issue descriptions
         shell: pwsh
@@ -33,13 +34,15 @@ jobs:
           ISSUE_BODY: ${{ github.event.issue.body }}
 
   add-labels-on-pull-requests:
+    permissions:
+      pull-requests: write
     if: github.event_name == 'pull_request_target'
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
 
     steps:
       - name: check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           ref: ${{ github.event.repository.default_branch }} # Note: Do not run on the PR branch we want to execute add-labels.psm1 from main on the base repo only because pull_request_target can see secrets
 

.github/workflows/automation.yml

@@ -15,10 +15,13 @@ on:
       OPENTELEMETRYBOT_GITHUB_TOKEN:
         required: false
 
+permissions:
+  contents: read
+
 jobs:
   resolve-automation:
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
 
     outputs:
       enabled: ${{ steps.evaluate.outputs.enabled }}

.github/workflows/ci.yml

@@ -9,6 +9,9 @@ on:
   pull_request:
     branches: [ 'main*' ]
 
+permissions:
+  contents: read
+
 jobs:
   lint-misspell-sanitycheck:
     uses: ./.github/workflows/sanitycheck.yml
@@ -18,13 +21,13 @@ jobs:
     outputs:
       changes: ${{ steps.changes.outputs.changes }}
     steps:
-    - uses: actions/checkout@v4
-    - uses: AurorNZ/paths-filter@v4
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+    - uses: AurorNZ/paths-filter@3b1f3abc3371cca888d8eb03dfa70bc8a9867629 # v4.0.0
       id: changes
       with:
         filters: |
           md: ['**.md']
-          build: ['build/**', '.github/**/*.yml', '**/*.targets', '**/*.props']
+          build: ['build/**', '.github/**/*.yml', '**/*.targets', '**/*.props', 'global.json']
           shared: ['src/Shared/**']
           code: ['**.cs', '**.csproj', '.editorconfig']
           solution: ['OpenTelemetry.sln']
@@ -107,13 +110,13 @@ jobs:
       || contains(needs.detect-changes.outputs.changes, 'otlp')
       || contains(needs.detect-changes.outputs.changes, 'build')
       || contains(needs.detect-changes.outputs.changes, 'shared')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     strategy:
       fail-fast: false
       matrix:
         version: [ net8.0, net9.0 ]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Run OTLP Exporter docker compose
         run: docker compose --file=test/OpenTelemetry.Exporter.OpenTelemetryProtocol.Tests/IntegrationTest/docker-compose.yml --file=build/docker-compose.${{ matrix.version }}.yml --project-directory=. up --exit-code-from=tests --build
 
@@ -125,13 +128,13 @@ jobs:
       || contains(needs.detect-changes.outputs.changes, 'instrumentation')
       || contains(needs.detect-changes.outputs.changes, 'build')
       || contains(needs.detect-changes.outputs.changes, 'shared')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     strategy:
       fail-fast: false
       matrix:
         version: [ net8.0, net9.0 ]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Run W3C Trace Context docker compose
         run: docker compose --file=test/OpenTelemetry.Instrumentation.W3cTraceContext.Tests/docker-compose.yml --file=build/docker-compose.${{ matrix.version }}.yml --project-directory=. up --exit-code-from=tests --build
 
@@ -187,7 +190,7 @@ jobs:
       concurrency-tests
       ]
     if: always() && !cancelled()
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
     - run: |
           if ( ${{ contains(needs.*.result, 'failure') }} == true ); then echo 'build failed'; exit 1; else echo 'build complete'; fi

.github/workflows/codeql-analysis.yml

@@ -1,46 +1,71 @@
-# For most projects, this workflow file will not need changing; you simply need
-# to commit it to your repository.
-#
-# You may wish to alter this file to override the set of languages analyzed,
-# or to provide custom queries or build logic.
 name: "CodeQL"
 
 on:
+  push:
+    branches: [ 'main' ]
+  pull_request:
+    branches: [ 'main' ]
   schedule:
     - cron: '0 0 * * *' # once in a day at 00:00
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   analyze:
-    name: Analyze
+    permissions:
+      actions: read  # for github/codeql-action/init to get workflow details
+      contents: read  # for actions/checkout to fetch code
+      security-events: write  # for github/codeql-action/analyze to upload SARIF results
     runs-on: windows-latest
 
     strategy:
       fail-fast: false
       matrix:
-        language: ['csharp']
+        language: ['actions', 'csharp']
 
     steps:
-    - name: configure Pagefile
-      uses: al-cheb/configure-pagefile-action@v1.4
+    - name: Configure Pagefile
+      if: matrix.language == 'csharp'
+      uses: al-cheb/configure-pagefile-action@a3b6ebd6b634da88790d9c58d4b37a7f4a7b8708 # v1.4
       with:
         minimum-size: 8GB
         maximum-size: 32GB
         disk-root: "D:"
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        filter: 'tree:0'
+        persist-credentials: false
+        show-progress: false
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@2d92b76c45b91eb80fc44c74ce3fce0ee94e8f9d # v3.30.0
       with:
+        build-mode: none
         languages: ${{ matrix.language }}
 
-    - name: Setup dotnet
-      uses: actions/setup-dotnet@v4
-
-    - name: dotnet pack
-      run: dotnet pack ./build/OpenTelemetry.proj --configuration Release
-
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@2d92b76c45b91eb80fc44c74ce3fce0ee94e8f9d # v3.30.0
+      with:
+        category: '/language:${{ matrix.language }}'
+
+  codeql:
+    if: ${{ !cancelled() }}
+    needs: [ analyze ]
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Report status
+      shell: bash
+      env:
+        SCAN_SUCCESS: ${{ !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled') }}
+      run: |
+        if [ "${SCAN_SUCCESS}" == "true" ]
+        then
+          echo 'CodeQL analysis successful'
+        else
+          echo 'CodeQL analysis failed'
+          exit 1
+        fi

.github/workflows/concurrency-tests.yml

@@ -5,22 +5,25 @@ name: Concurrency Tests
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   run-concurrency-tests:
 
     strategy:
       fail-fast: false  # ensures the entire test matrix is run, even if one permutation fails
       matrix:
-        os: [ windows-latest, ubuntu-latest ]
+        os: [ windows-latest, ubuntu-22.04 ]
         version: [ net8.0 ]
         project: [ OpenTelemetry.Tests, OpenTelemetry.Api.Tests ]
 
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
     - name: Setup dotnet
-      uses: actions/setup-dotnet@v4
+      uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
 
     - name: Run Coyote Tests
       shell: pwsh
@@ -28,7 +31,7 @@ jobs:
 
     - name: Publish Artifacts
       if: always() && !cancelled()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: ${{ matrix.os }}-${{ matrix.project }}-${{ matrix.version }}-coyoteoutput
         path: '**/*_CoyoteOutput.*'

.github/workflows/docfx.yml

@@ -5,16 +5,19 @@ name: Build docfx
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   run-docfx-build:
     runs-on: windows-latest
 
     steps:
     - name: check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
     - name: Setup dotnet
-      uses: actions/setup-dotnet@v4
+      uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
 
     - name: install docfx
       run: dotnet tool install -g docfx

.github/workflows/dotnet-format.yml

@@ -5,16 +5,19 @@ name: Lint - dotnet format
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   run-dotnet-format-stable:
     runs-on: windows-latest
 
     steps:
     - name: check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
     - name: Setup dotnet
-      uses: actions/setup-dotnet@v4
+      uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
 
     - name: dotnet restore
       run: dotnet restore OpenTelemetry.sln
@@ -29,10 +32,10 @@ jobs:
 
     steps:
     - name: check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
     - name: Setup dotnet
-      uses: actions/setup-dotnet@v4
+      uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
 
     - name: dotnet restore
       run: dotnet restore OpenTelemetry.sln

.github/workflows/fossa.yml

@@ -0,0 +1,20 @@
+name: FOSSA scanning
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  fossa:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - uses: fossas/fossa-action@3ebcea1862c6ffbd5cf1b4d0bd6b3fe7bd6f2cac # v1.7.0
+        with:
+          api-key: ${{secrets.FOSSA_API_KEY}}
+          team: OpenTelemetry

.github/workflows/markdownlint.yml

@@ -5,16 +5,19 @@ name: Lint - Markdown
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   run-markdownlint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
 
     steps:
     - name: check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
     - name: run markdownlint
-      uses: DavidAnson/markdownlint-cli2-action@v16.0.0
+      uses: DavidAnson/markdownlint-cli2-action@992badcdf24e3b8eb7e87ff9287fe931bcb00c6e # v20.0.0
       with:
         globs: |
           **/*.md

.github/workflows/ossf-scorecard.yml

@@ -0,0 +1,47 @@
+name: OSSF Scorecard
+
+on:
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: "24 5 * * 0" # once a week
+  workflow_dispatch:
+
+permissions: read-all
+
+jobs:
+  analysis:
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed for Code scanning upload
+      security-events: write
+      # Needed for GitHub OIDC token if publish_results is true
+      id-token: write
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
+
+      - uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable
+      # uploads of run results in SARIF format to the repository Actions tab.
+      # https://docs.github.com/en/actions/advanced-guides/storing-workflow-data-as-artifacts
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard (optional).
+      # Commenting out will disable upload of results to your repo's Code Scanning dashboard
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@2d92b76c45b91eb80fc44c74ce3fce0ee94e8f9d # v3.30.0
+        with:
+          sarif_file: results.sarif

.github/workflows/package-validation.yml

@@ -5,12 +5,15 @@ name: Package Validation
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   run-package-validation-stable:
     runs-on: windows-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         # Note: By default GitHub only fetches 1 commit. MinVer needs to find
         # the version tag which is typically NOT on the first commit so we
@@ -18,16 +21,23 @@ jobs:
         fetch-depth: 0
 
     - name: Setup dotnet
-      uses: actions/setup-dotnet@v4
+      uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
 
     - name: dotnet pack
       run: dotnet pack ./build/OpenTelemetry.proj --configuration Release /p:EnablePackageValidation=true /p:ExposeExperimentalFeatures=false /p:RunningDotNetPack=true
 
+    - name: Publish stable NuGet packages to Artifacts
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      with:
+        name: packages-stable
+        path: ./artifacts/package/release
+        if-no-files-found: error
+
   run-package-validation-experimental:
     runs-on: windows-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         # Note: By default GitHub only fetches 1 commit. MinVer needs to find
         # the version tag which is typically NOT on the first commit so we
@@ -35,7 +45,14 @@ jobs:
         fetch-depth: 0
 
     - name: Setup dotnet
-      uses: actions/setup-dotnet@v4
+      uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
 
     - name: dotnet pack
       run: dotnet pack ./build/OpenTelemetry.proj --configuration Release /p:EnablePackageValidation=true /p:ExposeExperimentalFeatures=true /p:RunningDotNetPack=true
+
+    - name: Publish experimental NuGet packages to Artifacts
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      with:
+        name: packages-experimental
+        path: ./artifacts/package/release
+        if-no-files-found: error

.github/workflows/post-release.yml

@@ -16,13 +16,16 @@ on:
     types:
     - created
 
+permissions:
+  contents: read
+
 jobs:
   automation:
     uses: ./.github/workflows/automation.yml
     secrets: inherit
 
   push-packages-and-publish-release:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
 
     needs: automation
 
@@ -41,7 +44,7 @@ jobs:
 
     steps:
     - name: check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         token: ${{ secrets[needs.automation.outputs.token-secret-name] }}
         ref: ${{ github.event.repository.default_branch }}
@@ -62,7 +65,7 @@ jobs:
           -pushToNuget '${{ secrets.NUGET_TOKEN != '' }}'
 
   post-release-published:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
 
     needs:
     - automation
@@ -75,7 +78,7 @@ jobs:
       GH_TOKEN: ${{ secrets[needs.automation.outputs.token-secret-name] }}
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         # Note: By default GitHub only fetches 1 commit. We need all the tags
         # for this work.
@@ -84,7 +87,7 @@ jobs:
         token: ${{ secrets[needs.automation.outputs.token-secret-name] }}
 
     - name: Setup dotnet
-      uses: actions/setup-dotnet@v4
+      uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
 
     - name: Create GitHub Pull Request to update stable build version in props
       if: |

.github/workflows/prepare-release.yml

@@ -23,13 +23,16 @@ on:
     types:
     - created
 
+permissions:
+  contents: read
+
 jobs:
   automation:
     uses: ./.github/workflows/automation.yml
     secrets: inherit
 
   prepare-release-pr:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
 
     needs: automation
 
@@ -40,7 +43,7 @@ jobs:
 
     steps:
     - name: check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         token: ${{ secrets[needs.automation.outputs.token-secret-name] }}
 
@@ -59,7 +62,7 @@ jobs:
           -gitUserEmail '${{ needs.automation.outputs.email }}'
 
   lock-pr-and-post-notice-to-create-release-tag:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
 
     needs: automation
 
@@ -76,7 +79,7 @@ jobs:
 
     steps:
     - name: check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         token: ${{ secrets[needs.automation.outputs.token-secret-name] }}
 
@@ -91,7 +94,7 @@ jobs:
           -botUserName '${{ needs.automation.outputs.username }}'
 
   create-release-tag-pr-post-notice:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
 
     needs: automation
 
@@ -110,7 +113,7 @@ jobs:
 
     steps:
     - name: check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         # Note: By default GitHub only fetches 1 commit which fails the git tag operation below
         fetch-depth: 0
@@ -130,7 +133,7 @@ jobs:
           -gitUserEmail '${{ needs.automation.outputs.email }}'
 
   update-changelog-release-dates-on-prepare-pr-post-notice:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
 
     needs: automation
 
@@ -149,14 +152,13 @@ jobs:
 
     steps:
     - name: check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         # Note: By default GitHub only fetches 1 commit which fails the git tag operation below
         fetch-depth: 0
         token: ${{ secrets[needs.automation.outputs.token-secret-name] }}
 
     - name: Update release date
-      id: create-tag
       shell: pwsh
       run: |
         Import-Module .\build\scripts\prepare-release.psm1
@@ -169,3 +171,44 @@ jobs:
           -gitUserName '${{ needs.automation.outputs.username }}' `
           -gitUserEmail '${{ needs.automation.outputs.email }}'
 
+  update-releasenotes-on-prepare-pr-post-notice:
+    runs-on: ubuntu-22.04
+
+    needs: automation
+
+    if: |
+      github.event_name == 'issue_comment'
+      && github.event.issue.pull_request
+      && github.event.issue.state == 'open'
+      && github.event.comment.user.login != needs.automation.outputs.username
+      && contains(github.event.comment.body, '/UpdateReleaseNotes')
+      && startsWith(github.event.issue.title, '[release] Prepare release ')
+      && github.event.issue.pull_request.merged_at == null
+      && needs.automation.outputs.enabled
+
+    env:
+      GH_TOKEN: ${{ secrets[needs.automation.outputs.token-secret-name] }}
+
+    steps:
+    - name: check out code
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        # Note: By default GitHub only fetches 1 commit which fails the git tag operation below
+        fetch-depth: 0
+        token: ${{ secrets[needs.automation.outputs.token-secret-name] }}
+
+    - name: Update release notes
+      env:
+        COMMENT_BODY: ${{ github.event.comment.body }}
+      shell: pwsh
+      run: |
+        Import-Module .\build\scripts\prepare-release.psm1
+
+        UpdateReleaseNotesAndPostNoticeOnPullRequest `
+          -gitRepository '${{ github.repository }}' `
+          -pullRequestNumber '${{ github.event.issue.number }}' `
+          -botUserName '${{ needs.automation.outputs.username }}' `
+          -commentUserName '${{ github.event.comment.user.login }}' `
+          -commentBody $Env:COMMENT_BODY `
+          -gitUserName '${{ needs.automation.outputs.username }}' `
+          -gitUserEmail '${{ needs.automation.outputs.email }}'

.github/workflows/publish-packages-1.0.yml

@@ -16,6 +16,9 @@ on:
   schedule:
     - cron: '0 0 * * *' # once in a day at 00:00
 
+permissions:
+  contents: read
+
 jobs:
   automation:
     uses: ./.github/workflows/automation.yml
@@ -23,13 +26,19 @@ jobs:
 
   build-pack-publish:
     runs-on: windows-latest
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      COSIGN_YES: "yes"
 
     outputs:
       artifact-url: ${{ steps.upload-artifacts.outputs.artifact-url }}
       artifact-id: ${{ steps.upload-artifacts.outputs.artifact-id }}
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         # Note: By default GitHub only fetches 1 commit. MinVer needs to find
         # the version tag which is typically NOT on the first commit so we
@@ -37,7 +46,12 @@ jobs:
         fetch-depth: 0
 
     - name: Setup dotnet
-      uses: actions/setup-dotnet@v4
+      uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
+
+    - name: Install Cosign
+      uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
+      with:
+        cosign-release: v2.5.3
 
     - name: dotnet restore
       run: dotnet restore ./build/OpenTelemetry.proj -p:RunningDotNetPack=true
@@ -45,15 +59,32 @@ jobs:
     - name: dotnet build
       run: dotnet build ./build/OpenTelemetry.proj --configuration Release --no-restore -p:Deterministic=true -p:BuildNumber=${{ github.run_number }} -p:RunningDotNetPack=true
 
+    - name: Sign DLLs with Cosign Keyless
+      shell: pwsh
+      run: |
+        $projectFiles = Get-ChildItem -Path src/*/*.csproj -File
+
+        foreach ($projectFile in $projectFiles) {
+            $projectName = [System.IO.Path]::GetFileNameWithoutExtension($projectFile)
+
+            Get-ChildItem -Path artifacts/bin/$projectName/release_*/$projectName.dll -File | ForEach-Object {
+                $fileFullPath = $_.FullName
+                Write-Host "Signing $fileFullPath"
+
+                cosign.exe sign-blob $fileFullPath --yes --output-signature $fileFullPath-keyless.sig --output-certificate $fileFullPath-keyless.pem
+            }
+        }
+
     - name: dotnet pack
       run: dotnet pack ./build/OpenTelemetry.proj --configuration Release --no-restore --no-build -p:PackTag=${{ github.ref_type == 'tag' && github.ref_name || '' }}
 
     - name: Publish Artifacts
       id: upload-artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: ${{ github.ref_name }}-packages
-        path: 'src/**/*.*nupkg'
+        path: ./artifacts/package/release
+        if-no-files-found: error
 
     - name: Publish MyGet
       env:
@@ -61,10 +92,10 @@ jobs:
       if: env.MYGET_TOKEN_EXISTS == 'true' # Skip MyGet publish if run on a fork without the secret
       run: |
         nuget setApiKey ${{ secrets.MYGET_TOKEN }} -Source https://www.myget.org/F/opentelemetry/api/v2/package
-        nuget push src/**/*.nupkg -Source https://www.myget.org/F/opentelemetry/api/v2/package
+        nuget push ./artifacts/package/release/*.nupkg -Source https://www.myget.org/F/opentelemetry/api/v2/package
 
   post-build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
 
     needs:
     - automation
@@ -77,7 +108,7 @@ jobs:
 
     steps:
     - name: check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         token: ${{ secrets[needs.automation.outputs.token-secret-name] }}
 

.github/workflows/sanitycheck.yml

@@ -5,13 +5,16 @@ name: Lint - Spelling & Encoding
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   run-misspell:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
 
     steps:
     - name: check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
     - name: install misspell
       run: |
@@ -22,11 +25,11 @@ jobs:
       run: ./bin/misspell -error .
 
   run-sanitycheck:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
 
     steps:
     - name: check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
     - name: detect non-ASCII encoding and trailing space
       run: python3 ./build/scripts/sanitycheck.py

.github/workflows/stale.yml

@@ -6,11 +6,17 @@ on:
   schedule:
     - cron: "12 3 * * *"  # arbitrary time not to DDOS GitHub
 
+permissions:
+  contents: read
+
 jobs:
   stale:
-    runs-on: ubuntu-latest
+    permissions:
+      issues: write  # for actions/stale to close stale issues
+      pull-requests: write  # for actions/stale to close stale PRs
+    runs-on: ubuntu-22.04
     steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
         with:
           stale-issue-message: 'This issue was marked stale due to lack of activity and will be closed in 7 days. Commenting will instruct the bot to automatically remove the label. This bot runs once per day.'
           close-issue-message: 'Closed as inactive. Feel free to reopen if this issue is still a concern.'
@@ -18,8 +24,9 @@ jobs:
           close-pr-message: 'Closed as inactive. Feel free to reopen if this PR is still being worked on.'
           operations-per-run: 400
           days-before-pr-stale: 7
-          days-before-issue-stale: 600
+          days-before-issue-stale: 300
           days-before-pr-close: 7
           days-before-issue-close: 7
           exempt-all-issue-milestones: true
-          exempt-issue-labels: needs-triage
+          exempt-issue-labels: 'keep-open,needs-triage'
+          exempt-pr-labels: 'keep-open'

.github/workflows/verifyaotcompat.yml

@@ -5,21 +5,24 @@ name: Publish & Verify AOT Compatibility
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   run-verify-aot-compat:
 
     strategy:
       fail-fast: false # ensures the entire test matrix is run, even if one permutation fails
       matrix:
-        os: [ ubuntu-latest, windows-latest ]
+        os: [ ubuntu-22.04, windows-latest ]
         version: [ net8.0, net9.0 ]
 
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
     - name: Setup dotnet
-      uses: actions/setup-dotnet@v4
+      uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
 
     - name: publish AOT testApp, assert static analysis warning count, and run the app
       shell: pwsh

.gitignore

@@ -21,6 +21,7 @@
 x64/
 x86/
 bld/
+[Aa]rtifacts/
 [Bb]in/
 [Oo]bj/
 [Ll]og/
@@ -351,3 +352,6 @@ tempo-data/
 
 # Coyote Rewrite Files
 rewrite.coyote.json
+
+# Test results
+TestResults/

.markdownlint.yaml

@@ -10,3 +10,6 @@ MD013:
 MD033:
   # Allowed elements
   allowed_elements: [ 'details', 'summary' ]
+
+# MD059/link-text-should-be-descriptive : Inline HTML : https://github.com/DavidAnson/markdownlint/blob/v0.38.0/doc/md059.md
+MD059: false

CONTRIBUTING.md

@@ -14,10 +14,33 @@ Anyone may contribute but there are benefits of being a member of our community.
 See the [community membership
 document](https://github.com/open-telemetry/community/blob/main/community-membership.md)
 on how to become a
-[**Member**](https://github.com/open-telemetry/community/blob/main/community-membership.md#member),
-[**Approver**](https://github.com/open-telemetry/community/blob/main/community-membership.md#approver)
+[**Member**](https://github.com/open-telemetry/community/blob/main/guides/contributor/membership.md#member),
+[**Triager**](https://github.com/open-telemetry/community/blob/main/guides/contributor/membership.md#triager),
+[**Approver**](https://github.com/open-telemetry/community/blob/main/guides/contributor/membership.md#approver),
 and
-[**Maintainer**](https://github.com/open-telemetry/community/blob/main/community-membership.md#maintainer).
+[**Maintainer**](https://github.com/open-telemetry/community/blob/main/guides/contributor/membership.md#maintainer).
+
+## Give feedback
+
+We are always looking for your feedback.
+
+You can do this by [submitting a GitHub issue](https://github.com/open-telemetry/opentelemetry-dotnet/issues/new).
+
+You may also prefer writing on [#otel-dotnet Slack channel](https://cloud-native.slack.com/archives/C01N3BC2W7Q).
+
+### Report a bug
+
+Reporting bugs is an important contribution. Please make sure to include:
+
+* Expected and actual behavior;
+* OpenTelemetry, OS, and .NET versions you are using;
+* Steps to reproduce;
+* [Minimal, reproducible example](https://stackoverflow.com/help/minimal-reproducible-example).
+
+### Request a feature
+
+If you would like to work on something that is not listed as an issue
+(e.g. a new feature or enhancement) please create an issue and describe your proposal.
 
 ## Find a buddy and get started quickly
 
@@ -203,13 +226,19 @@ Open a pull request against the main `opentelemetry-dotnet` repo.
 * If the PR is not ready for review, please mark it as
   [`draft`](https://github.blog/2019-02-14-introducing-draft-pull-requests/).
 * Make sure CLA is signed and all required CI checks are clear.
-* Submit small, focused PRs addressing a single
-  concern/issue.
+* Submit small, focused PRs addressing a single concern/issue.
 * Make sure the PR title reflects the contribution.
 * Write a summary that helps understand the change.
 * Include usage examples in the summary, where applicable.
 * Include benchmarks (before/after) in the summary, for contributions that are
   performance enhancements.
+* We are open to bot generated PRs or AI/LLM assisted PRs. Actually, we are
+  using
+  [dependabot](https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates)
+  to automate the security updates. However, if you use bots to generate spam
+  PRs (e.g. incorrect, noisy, non-improvements, unintelligible, trying to sell
+  your product, etc.), we might close the PR right away with a warning, and if
+  you keep doing so, we might block your user account.
 
 ### How to get pull requests merged
 
@@ -294,31 +323,11 @@ types](https://learn.microsoft.com/dotnet/csharp/language-reference/builtin-type
 * Pass [static
 analysis](https://learn.microsoft.com/dotnet/fundamentals/code-analysis/overview).
 
-   New projects MUST enable static analysis by specifying
-   `<AnalysisLevel>latest-all</AnalysisLevel>` in the project file (`.csproj`).
-
 > [!NOTE]
 > There are other project-level features enabled automatically via
 [Common.props](https://github.com/open-telemetry/opentelemetry-dotnet/blob/main/build/Common.props)
 new projects must NOT manually override these settings.
 
-## New code
-
-New code files MUST enable [nullable reference
-types](https://learn.microsoft.com/dotnet/csharp/language-reference/builtin-types/nullable-reference-types)
-manually in projects where it is not automatically enabled project-wide. This is
-done by specifying `#nullable enable` towards the top of the file (usually after
-the copyright header). We are currently working towards enabling nullable
-context in every project by updating code as it is worked on, this requirement
-is to make sure the surface area of code needing updates is shrinking and not
-expanding.
-
-> [!NOTE]
-> The first time a project is updated to use nullable context in public APIs
-some housekeeping needs to be done in public API definitions (`.publicApi`
-folder). This can be done automatically via a code fix offered by the public API
-analyzer.
-
 ## License requirements
 
 OpenTelemetry .NET is licensed under the [Apache License, Version

Directory.Build.props

@@ -0,0 +1,6 @@
+<Project>
+  <PropertyGroup>
+    <ArtifactsPath>$([System.IO.Path]::Combine('$(MSBuildThisFileDirectory)', 'artifacts'))</ArtifactsPath>
+    <UseArtifactsOutput>true</UseArtifactsOutput>
+  </PropertyGroup>
+</Project>

Directory.Packages.props

@@ -1,7 +1,19 @@
 <Project>
+
   <PropertyGroup>
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
-    <OTelLatestStableVer>1.9.0</OTelLatestStableVer>
+    <OTelLatestStableVer>1.12.0</OTelLatestStableVer>
+
+    <!--
+        This is typically the latest annual release of .NET. Use this wherever
+        possible and only deviate (use a specific version) when a package has a
+        more specific patch which must be reference directly.
+    -->
+    <LatestRuntimeOutOfBandVer>9.0.0</LatestRuntimeOutOfBandVer>
+
+    <!-- Mitigate https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43485. -->
+    <SystemTextEncodingsWebOutOfBandMinimumCoreAppVer>8.0.0</SystemTextEncodingsWebOutOfBandMinimumCoreAppVer>
+    <SystemTextJsonOutOfBandMinimumCoreAppVer>8.0.5</SystemTextJsonOutOfBandMinimumCoreAppVer>
   </PropertyGroup>
 
   <!--
@@ -10,12 +22,6 @@
       vulnerability in the NuGet packages that are published from this repository.
   -->
   <ItemGroup>
-    <PackageVersion Include="Google.Protobuf" Version="[3.22.5,4.0)" />
-    <PackageVersion Include="Grpc" Version="[2.44.0,3.0)" />
-    <PackageVersion Include="Grpc.Net.Client" Version="[2.52.0,3.0)" />
-    <PackageVersion Include="Microsoft.AspNetCore.Http.Abstractions" Version="[2.1.1,6.0)" />
-    <PackageVersion Include="Microsoft.AspNetCore.Http.Features" Version="[2.1.1,6.0)" />
-
     <!--
         Typically, for the Microsoft.Extensions.* packages relating to DI Abstractions, Hosting Abstractions, and Logging,
         the latest stable version should be used because:
@@ -25,16 +31,14 @@
         3) Since version 3.1.0, the .NET runtime team is holding a high bar for backward compatibility on
           these packages even during major version bumps, so compatibility is not a concern here.
     -->
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="$(LatestRuntimeOutOfBandVer)" />
+    <PackageVersion Include="Microsoft.Extensions.Diagnostics.Abstractions" Version="$(LatestRuntimeOutOfBandVer)" />
+    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="$(LatestRuntimeOutOfBandVer)" />
+    <PackageVersion Include="Microsoft.Extensions.Logging.Configuration" Version="$(LatestRuntimeOutOfBandVer)" />
 
-    <PackageVersion Include="Microsoft.Extensions.Configuration" Version="9.0.0-rc.1.24431.7" />
-    <PackageVersion Include="Microsoft.Extensions.Configuration.Binder" Version="9.0.0-rc.1.24431.7" />
-    <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="9.0.0-rc.1.24431.7" />
-    <PackageVersion Include="Microsoft.Extensions.Diagnostics.Abstractions" Version="9.0.0-rc.1.24431.7" />
-    <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="9.0.0-rc.1.24431.7" />
-    <PackageVersion Include="Microsoft.Extensions.Logging" Version="9.0.0-rc.1.24431.7" />
-    <PackageVersion Include="Microsoft.Extensions.Logging.Configuration" Version="9.0.0-rc.1.24431.7" />
-    <PackageVersion Include="Microsoft.Extensions.Options" Version="9.0.0-rc.1.24431.7" />
-
+    <!--
+        OTel packages always point to latest stable release.
+    -->
     <PackageVersion Include="OpenTelemetry" Version="[$(OTelLatestStableVer),2.0)" />
     <PackageVersion Include="OpenTelemetry.Api" Version="[$(OTelLatestStableVer),2.0)" />
     <PackageVersion Include="OpenTelemetry.Api.ProviderBuilderExtensions" Version="[$(OTelLatestStableVer),2.0)" />
@@ -45,47 +49,62 @@
 
     <!--
         Typically, the latest stable version of System.Diagnostics.DiagnosticSource should be used here because:
-        1) Each major version bump will have some new OpenTelemetry API capabilities (e.g. .NET 6 introduced Meter
-          API, .NET 7 added UpDownCounter, .NET 8 is adding Meter/Instrument level attributes support, .NET 9 might
-          add Advice/Hint API) that the OpenTelemetry components rely on.
+        1) Each major version bump will likely have some new OpenTelemetry capabilities (e.g. .NET 6 introduced Meter
+          API, .NET 7 added UpDownCounter, .NET 8 added Meter/Instrument level attributes support, .NET 9 added
+          Advice/Hint API, etc.).
         2) Each minor version bump is normally security hotfixes or critical bug fixes.
         3) The .NET runtime team provides extra backward compatibility guarantee to System.Diagnostics.DiagnosticSource
           even during major version bumps, so compatibility is not a concern here.
     -->
-    <PackageVersion Include="System.Diagnostics.DiagnosticSource" Version="9.0.0-rc.1.24431.7" />
+    <PackageVersion Include="System.Diagnostics.DiagnosticSource" Version="$(LatestRuntimeOutOfBandVer)" />
+  </ItemGroup>
 
-    <!-- A conservative version of System.Text.Encodings.Web must be used here since there is no backward compatibility guarantee during major version bumps. -->
+  <ItemGroup>
+    <!--
+        Note: See TargetFrameworksRequiringSystemTextJsonDirectReference for the
+        list of targets where System.Text.Json direct reference is applied.
+    -->
+
+    <!--
+        We use conservative versions of these packages for older runtimes where
+        an upgrade might introduce breaking changes. For example see:
+        https://devblogs.microsoft.com/dotnet/system-text-json-in-dotnet-7/#breaking-changes.
+    -->
     <PackageVersion Include="System.Text.Encodings.Web" Version="4.7.2" />
-
-    <!-- A conservative version of System.Text.Json must be used here since there is no backward compatibility guarantee during major version bumps. -->
     <PackageVersion Include="System.Text.Json" Version="4.7.2" />
 
-    <!-- A conservative version of System.Threading.Tasks.Extensions must be used here since there is no backward compatibility guarantee during major version bumps. -->
-    <PackageVersion Include="System.Threading.Tasks.Extensions" Version="4.5.4" />
+    <!-- Newer NETCoreApp runtimes need to be redirected to safe versions. -->
+    <PackageVersion Update="System.Text.Encodings.Web" Version="$(SystemTextEncodingsWebOutOfBandMinimumCoreAppVer)" Condition="'$(TargetFrameworkIdentifier)' == '.NETCoreApp'" />
+    <PackageVersion Update="System.Text.Json" Version="$(SystemTextJsonOutOfBandMinimumCoreAppVer)" Condition="'$(TargetFrameworkIdentifier)' == '.NETCoreApp'" />
   </ItemGroup>
 
   <!--
       This section covers packages that are **not** directly referenced by the NuGet packages published from this repository.
-      For example, these packages are used in the tests, examples or referenced as "PrivateAssets", but not in the NuGet packages themselves.
+      These packages are referenced as "PrivateAssets" or used in tests/examples.
   -->
-  <!-- 'net9.0' is the default `TargetFramework`. Use `VersionOverride` in the project to override the package versions from a different `TargetFramework` -->
   <ItemGroup>
-    <PackageVersion Include="BenchmarkDotNet" Version="[0.13.12,0.14)" />
+    <PackageVersion Include="BenchmarkDotNet" Version="0.15.2" />
     <PackageVersion Include="CommandLineParser" Version="[2.9.1,3.0)" />
+    <PackageVersion Include="GitHubActionsTestLogger" Version="2.4.1" />
     <PackageVersion Include="Grpc.AspNetCore" Version="[2.59.0,3.0)" />
     <PackageVersion Include="Grpc.AspNetCore.Server" Version="[2.59.0, 3.0)" />
     <PackageVersion Include="Grpc.Tools" Version="[2.59.0,3.0)" />
+    <PackageVersion Include="Google.Protobuf" Version="[3.22.5,4.0)" />
+    <PackageVersion Include="Grpc" Version="[2.44.0,3.0)" />
+    <PackageVersion Include="Grpc.Net.Client" Version="[2.52.0,3.0)" />
+    <PackageVersion Include="JunitXml.TestLogger" Version="6.1.0" />
     <PackageVersion Include="Microsoft.CSharp" Version="[4.7.0]" />
     <PackageVersion Include="Microsoft.CodeAnalysis.PublicApiAnalyzers" Version="[3.11.0-beta1.23525.2]" />
-    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="[9.0.0-rc.1.24431.7,)" />
-    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="[9.0.0-rc.1.24431.7,)" />
-    <PackageVersion Include="Microsoft.Extensions.Http" Version="[9.0.0-rc.1.24431.7,)" />
-    <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="[9.0.0-rc.1.24431.7,)" />
-    <PackageVersion Include="Microsoft.Extensions.Telemetry.Abstractions" Version="[9.0.0-preview.8.24460.1,)" />
+    <PackageVersion Include="Microsoft.Coyote" Version="1.7.11" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="$(LatestRuntimeOutOfBandVer)" />
+    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="$(LatestRuntimeOutOfBandVer)" />
+    <PackageVersion Include="Microsoft.Extensions.Http" Version="$(LatestRuntimeOutOfBandVer)" />
+    <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="$(LatestRuntimeOutOfBandVer)" />
+    <PackageVersion Include="Microsoft.Extensions.Telemetry.Abstractions" Version="[9.0.0,)" />
     <PackageVersion Include="Microsoft.NETFramework.ReferenceAssemblies" Version="[1.0.3,2.0)" />
-    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="[17.11.0,18.0.0)" />
-    <PackageVersion Include="Microsoft.SourceLink.GitHub" Version="[8.0.0,9.0)" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="[17.13.0,18.0.0)" />
     <PackageVersion Include="MinVer" Version="[5.0.0,6.0)" />
+    <PackageVersion Include="NuGet.Versioning" Version="6.11.0" />
     <PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="[1.9.0,2.0)" />
     <PackageVersion Include="OpenTelemetry.Instrumentation.GrpcNetClient" Version="[1.9.0-beta.1,2.0)" />
     <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="[1.9.0,2.0)" />
@@ -93,14 +112,17 @@
     <PackageVersion Include="RabbitMQ.Client" Version="[6.8.1,7.0)" />
     <PackageVersion Include="StyleCop.Analyzers" Version="[1.2.0-beta.556,2.0)" />
     <PackageVersion Include="Swashbuckle.AspNetCore" Version="[6.7.3,)" />
-    <PackageVersion Include="xunit" Version="[2.9.0,3.0)" />
+    <PackageVersion Include="System.Runtime.InteropServices.RuntimeInformation" Version="4.3.0" />
+    <PackageVersion Include="xunit" Version="[2.9.3,3.0)" />
     <PackageVersion Include="xunit.runner.visualstudio" Version="[2.8.2,3.0)" />
   </ItemGroup>
 
   <ItemGroup Condition="'$(TargetFramework)' == 'net8.0'">
     <PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="8.0.8" />
   </ItemGroup>
+
   <ItemGroup Condition="'$(TargetFramework)' == 'net9.0'">
-    <PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="9.0.0-rc.1.24452.1" />
+    <PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="9.0.0" />
   </ItemGroup>
+
 </Project>

NuGet.config

@@ -3,19 +3,14 @@
   <packageSources>
     <clear />
     <add key="NuGet" value="https://api.nuget.org/v3/index.json" />
-    <add key="dotnet8" value="https://dnceng.pkgs.visualstudio.com/public/_packaging/dotnet8/nuget/v3/index.json" />
   </packageSources>
 
   <!-- Define mappings by adding package patterns beneath the target source. -->
-  <!-- *.Tools packages will be restored from ".Net Core Tools", everything else from nuget.org. -->
   <packageSourceMapping>
     <!-- key value for <packageSource> should match key values from <packageSources> element -->
     <packageSource key="NuGet">
       <package pattern="*" />
     </packageSource>
-    <packageSource key="dotnet8">
-      <package pattern="Microsoft.CodeAnalysis.PublicApiAnalyzers" />
-    </packageSource>
   </packageSourceMapping>
 
   <disabledPackageSources />

OpenTelemetry.sln

@@ -12,7 +12,6 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution Items", "Solution
 		.dockerignore = .dockerignore
 		.editorconfig = .editorconfig
 		.gitignore = .gitignore
-		.github\workflows\ci-concurrency.yml = .github\workflows\ci-concurrency.yml
 		CONTRIBUTING.md = CONTRIBUTING.md
 		global.json = global.json
 		LICENSE.TXT = LICENSE.TXT
@@ -28,6 +27,7 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "build", "build", "{7CB2F02E
 		build\Common.nonprod.props = build\Common.nonprod.props
 		build\Common.prod.props = build\Common.prod.props
 		build\Common.props = build\Common.props
+		build\Common.targets = build\Common.targets
 		build\debug.snk = build\debug.snk
 		Directory.Packages.props = Directory.Packages.props
 		build\docfx.cmd = build\docfx.cmd
@@ -73,6 +73,7 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = ".github", ".github", "{F1D0
 	ProjectSection(SolutionItems) = preProject
 		.github\codecov.yml = .github\codecov.yml
 		.github\CODEOWNERS = .github\CODEOWNERS
+		.github\dependabot.yml = .github\dependabot.yml
 		.github\PULL_REQUEST_TEMPLATE.md = .github\PULL_REQUEST_TEMPLATE.md
 	EndProjectSection
 EndProject
@@ -112,7 +113,6 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "test", "test", "{D2E73927-5
 	ProjectSection(SolutionItems) = preProject
 		test\Directory.Build.props = test\Directory.Build.props
 		test\Directory.Build.targets = test\Directory.Build.targets
-		test\Directory.Packages.props = test\Directory.Packages.props
 	EndProjectSection
 EndProject
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Examples.Console", "examples\Console\Examples.Console.csproj", "{FF3E6E08-E8E4-4523-B526-847CD989279F}"
@@ -129,7 +129,7 @@ EndProject
 Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "examples", "examples", "{2C7DD1DA-C229-4D9E-9AF0-BCD5CD3E4948}"
 	ProjectSection(SolutionItems) = preProject
 		examples\Directory.Build.props = examples\Directory.Build.props
-		examples\Directory.Packages.props = examples\Directory.Packages.props
+		examples\Directory.Build.targets = examples\Directory.Build.targets
 	EndProjectSection
 EndProject
 Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "trace", "trace", "{5B7FB835-3FFF-4BC2-99C5-A5B5FAE3C818}"
@@ -254,7 +254,6 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Shared", "Shared", "{A49299
 		src\Shared\ExceptionExtensions.cs = src\Shared\ExceptionExtensions.cs
 		src\Shared\Guard.cs = src\Shared\Guard.cs
 		src\Shared\MathHelper.cs = src\Shared\MathHelper.cs
-		src\Shared\PeerServiceResolver.cs = src\Shared\PeerServiceResolver.cs
 		src\Shared\PeriodicExportingMetricReaderHelper.cs = src\Shared\PeriodicExportingMetricReaderHelper.cs
 		src\Shared\PooledList.cs = src\Shared\PooledList.cs
 		src\Shared\ResourceSemanticConventions.cs = src\Shared\ResourceSemanticConventions.cs
@@ -305,7 +304,6 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "experimental-apis", "experi
 	ProjectSection(SolutionItems) = preProject
 		docs\diagnostics\experimental-apis\OTEL1000.md = docs\diagnostics\experimental-apis\OTEL1000.md
 		docs\diagnostics\experimental-apis\OTEL1001.md = docs\diagnostics\experimental-apis\OTEL1001.md
-		docs\diagnostics\experimental-apis\OTEL1003.md = docs\diagnostics\experimental-apis\OTEL1003.md
 		docs\diagnostics\experimental-apis\OTEL1004.md = docs\diagnostics\experimental-apis\OTEL1004.md
 		docs\diagnostics\experimental-apis\README.md = docs\diagnostics\experimental-apis\README.md
 	EndProjectSection
@@ -346,6 +344,11 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "scripts", "scripts", "{4498
 EndProject
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "exemplars", "docs\metrics\exemplars\exemplars.csproj", "{79C12C80-B27B-41FB-AE79-A3BB74CFA782}"
 EndProject
+Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Proto", "Proto", "{02EA681E-C7D8-13C7-8484-4AC65E1B71E8}"
+	ProjectSection(SolutionItems) = preProject
+		src\Shared\Proto\README.md = src\Shared\Proto\README.md
+	EndProjectSection
+EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|Any CPU = Debug|Any CPU
@@ -662,6 +665,7 @@ Global
 		{993E65E5-E71B-40FD-871C-60A9EBD59724} = {A49299FB-C5CD-4E0E-B7E1-B7867BBD67CC}
 		{44982E0D-C8C6-42DC-9F8F-714981F27CE6} = {7CB2F02E-03FA-4FFF-89A5-C51F107623FD}
 		{79C12C80-B27B-41FB-AE79-A3BB74CFA782} = {3277B1C0-BDFE-4460-9B0D-D9A661FB48DB}
+		{02EA681E-C7D8-13C7-8484-4AC65E1B71E8} = {A49299FB-C5CD-4E0E-B7E1-B7867BBD67CC}
 	EndGlobalSection
 	GlobalSection(ExtensibilityGlobals) = postSolution
 		SolutionGuid = {55639B5C-0770-4A22-AB56-859604650521}

README.md

@@ -6,6 +6,11 @@
 [![NuGet](https://img.shields.io/nuget/dt/OpenTelemetry.svg)](https://www.nuget.org/profiles/OpenTelemetry)
 [![Build](https://github.com/open-telemetry/opentelemetry-dotnet/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/open-telemetry/opentelemetry-dotnet/actions/workflows/ci.yml)
 
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/open-telemetry/opentelemetry-dotnet/badge)](https://scorecard.dev/viewer/?uri=github.com/open-telemetry/opentelemetry-dotnet)
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/10017/badge)](https://www.bestpractices.dev/projects/10017)
+[![FOSSA License Status](https://app.fossa.com/api/projects/custom%2B162%2Fgithub.com%2Fopen-telemetry%2Fopentelemetry-dotnet.svg?type=shield&issueType=license)](https://app.fossa.com/projects/custom%2B162%2Fgithub.com%2Fopen-telemetry%2Fopentelemetry-dotnet?ref=badge_shield&issueType=license)
+[![FOSSA Security Status](https://app.fossa.com/api/projects/custom%2B162%2Fgithub.com%2Fopen-telemetry%2Fopentelemetry-dotnet.svg?type=shield&issueType=security)](https://app.fossa.com/projects/custom%2B162%2Fgithub.com%2Fopen-telemetry%2Fopentelemetry-dotnet?ref=badge_shield&issueType=security)
+
 The .NET [OpenTelemetry](https://opentelemetry.io/) implementation.
 
 <details>
@@ -179,6 +184,37 @@ Nightly builds from this repo are published to [MyGet](https://www.myget.org),
 and can be installed using the
 `https://www.myget.org/F/opentelemetry/api/v3/index.json` source.
 
+### Digital signing
+
+Starting with the `1.10.0` release the DLLs included in the packages pushed to
+NuGet are digitally signed using [Sigstore](https://www.sigstore.dev/). Within
+each NuGet package the digital signature and its corresponding certificate file
+are placed alongside the shipped DLL(s) in the `/lib` folder. When a project
+targets multiple frameworks each target outputs a dedicated DLL and signing
+artifacts into a sub folder based on the
+[TFM](https://learn.microsoft.com/dotnet/standard/frameworks).
+
+The digitial signature and certificate files share the same name prefix as the
+DLL to ensure easy identification and association.
+
+To verify the integrity of a DLL inside a NuGet package use the
+[cosign](https://github.com/sigstore/cosign) tool from Sigstore:
+
+```bash
+cosign verify-blob \
+    --signature OpenTelemetry.dll-keyless.sig \
+    --certificate OpenTelemetry.dll-keyless.pem.cer \
+    --certificate-identity "https://github.com/open-telemetry/opentelemetry-dotnet/.github/workflows/publish-packages-1.0.yml@refs/tags/core-1.10.0-rc.1" \
+    --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
+    OpenTelemetry.dll
+```
+
+> [!NOTE]
+> A successful verification outputs `Verify OK`.
+
+For more verification options please refer to the [cosign
+documentation](https://github.com/sigstore/cosign/blob/main/doc/cosign_verify-blob.md).
+
 ## Contributing
 
 For information about contributing to the project see:
@@ -200,39 +236,55 @@ regardless of your experience level. Whether you're a seasoned OpenTelemetry
 developer, just starting your journey, or simply curious about the work we do,
 you're more than welcome to participate!
 
-[Maintainers](https://github.com/open-telemetry/community/blob/main/guides/contributor/membership.md#maintainer)
-([@open-telemetry/dotnet-maintainers](https://github.com/orgs/open-telemetry/teams/dotnet-maintainers)):
+### Maintainers
 
 * [Alan West](https://github.com/alanwest), New Relic
-* [Mikel Blanchard](https://github.com/CodeBlanch), Microsoft
+* [Rajkumar Rangaraj](https://github.com/rajkumar-rangaraj), Microsoft
 
-[Approvers](https://github.com/open-telemetry/community/blob/main/guides/contributor/membership.md#approver)
-([@open-telemetry/dotnet-approvers](https://github.com/orgs/open-telemetry/teams/dotnet-approvers)):
+For more information about the maintainer role, see the [community repository](https://github.com/open-telemetry/community/blob/main/guides/contributor/membership.md#maintainer).
+
+### Approvers
 
 * [Cijo Thomas](https://github.com/cijothomas), Microsoft
+* [Martin Costello](https://github.com/martincostello), Grafana Labs
+* [Mikel Blanchard](https://github.com/CodeBlanch), Microsoft
 * [Piotr Kie&#x142;kowicz](https://github.com/Kielek), Splunk
-* [Reiley Yang](https://github.com/reyang), Microsoft
-* [Utkarsh Umesan Pillai](https://github.com/utpilla), Microsoft
 
-[Triagers](https://github.com/open-telemetry/community/blob/main/guides/contributor/membership.md#triager)
-([@open-telemetry/dotnet-triagers](https://github.com/orgs/open-telemetry/teams/dotnet-triagers)):
+For more information about the approver role, see the [community repository](https://github.com/open-telemetry/community/blob/main/guides/contributor/membership.md#approver).
+
+### Triagers
 
 * [Martin Thwaites](https://github.com/martinjt), Honeycomb
-* [Timothy "Mothra" Lee](https://github.com/TimothyMothra), Microsoft
+* [Timothy "Mothra" Lee](https://github.com/TimothyMothra)
 
-[Emeritus
-Maintainer/Approver/Triager](https://github.com/open-telemetry/community/blob/main/guides/contributor/membership.md#emeritus-maintainerapprovertriager):
+For more information about the triager role, see the [community repository](https://github.com/open-telemetry/community/blob/main/guides/contributor/membership.md#triager).
+
+### Emeritus Maintainers
+
+* [Mike Goldsmith](https://github.com/MikeGoldsmith)
+* [Sergey Kanzhelev](https://github.com/SergeyKanzhelev)
+* [Utkarsh Umesan Pillai](https://github.com/utpilla)
+
+For more information about the emeritus role, see the [community repository](https://github.com/open-telemetry/community/blob/main/guides/contributor/membership.md#emeritus-maintainerapprovertriager).
+
+### Emeritus Approvers
 
 * [Bruno Garcia](https://github.com/bruno-garcia)
 * [Eddy Nakamura](https://github.com/eddynaka)
 * [Liudmila Molkova](https://github.com/lmolkova)
-* [Mike Goldsmith](https://github.com/MikeGoldsmith)
 * [Paulo Janotti](https://github.com/pjanotti)
+* [Reiley Yang](https://github.com/reyang)
 * [Robert Paj&#x105;k](https://github.com/pellared)
-* [Sergey Kanzhelev](https://github.com/SergeyKanzhelev)
-* [Victor Lu](https://github.com/victlu)
 * [Vishwesh Bankwar](https://github.com/vishweshbankwar)
 
+For more information about the emeritus role, see the [community repository](https://github.com/open-telemetry/community/blob/main/guides/contributor/membership.md#emeritus-maintainerapprovertriager).
+
+### Emeritus Triagers
+
+* [Victor Lu](https://github.com/victlu)
+
+For more information about the emeritus role, see the [community repository](https://github.com/open-telemetry/community/blob/main/guides/contributor/membership.md#emeritus-maintainerapprovertriager).
+
 ### Thanks to all the people who have contributed
 
 [![contributors](https://contributors-img.web.app/image?repo=open-telemetry/opentelemetry-dotnet)](https://github.com/open-telemetry/opentelemetry-dotnet/graphs/contributors)

RELEASENOTES.md

@@ -4,8 +4,84 @@ This file contains highlights and announcements covering all components.
 For more details see `CHANGELOG.md` files maintained in the root source
 directory of each individual package.
 
+## 1.12.0
+
+Release details: [1.12.0](https://github.com/open-telemetry/opentelemetry-dotnet/releases/tag/core-1.12.0)
+
+* **Breaking Change**: `OpenTelemetry.Exporter.OpenTelemetryProtocol` now
+  defaults to using OTLP/HTTP instead of OTLP/gRPC when targeting .NET Framework
+  and .NET Standard. This change may cause telemetry export to fail unless
+  appropriate adjustments are made. Explicitly setting OTLP/gRPC may result in a
+  `NotSupportedException` unless further configuration is applied. See
+  [#6209](https://github.com/open-telemetry/opentelemetry-dotnet/issues/6209) for
+  full details and mitigation guidance. [#6229](https://github.com/open-telemetry/opentelemetry-dotnet/pull/6229)
+
+## 1.11.1
+
+Release details: [1.11.1](https://github.com/open-telemetry/opentelemetry-dotnet/releases/tag/core-1.11.1)
+
+* Fixed a bug preventing `OpenTelemetry.Exporter.OpenTelemetryProtocol` from
+  exporting telemetry on .NET Framework.
+
+## 1.11.0
+
+Release details: [1.11.0](https://github.com/open-telemetry/opentelemetry-dotnet/releases/tag/core-1.11.0)
+
+* `OpenTelemetry.Exporter.OpenTelemetryProtocol` no longer depends on the
+  `Google.Protobuf`, `Grpc`, or `Grpc.Net.Client` packages. Serialization and
+  transmission of outgoing data is now performed manually to improve the overall
+  performance.
+
+## 1.10.0
+
+Release details: [1.10.0](https://github.com/open-telemetry/opentelemetry-dotnet/releases/tag/core-1.10.0)
+
+* Bumped the package versions of `System.Diagnostic.DiagnosticSource` and other
+  Microsoft.Extensions.* packages to `9.0.0`.
+
+* Added support for new APIs introduced in `System.Diagnostics.DiagnosticSource`
+  `9.0.0`:
+
+  * [InstrumentAdvice<T>](https://learn.microsoft.com/dotnet/api/system.diagnostics.metrics.instrumentadvice-1)
+
+    For details see: [Explicit bucket histogram
+    aggregation](./docs/metrics/customizing-the-sdk/README.md#explicit-bucket-histogram-aggregation).
+
+  * [Gauge<T>](https://learn.microsoft.com/dotnet/api/system.diagnostics.metrics.gauge-1)
+
+  * [ActivitySource.Tags](https://learn.microsoft.com/dotnet/api/system.diagnostics.activitysource.tags)
+    (supported in OtlpExporter & ConsoleExporter)
+
+* Experimental features promoted to stable:
+
+  * `CardinalityLimit` can now be managed for individual metrics via the View
+    API. For details see: [Changing cardinality limit for a
+    Metric](./docs/metrics/customizing-the-sdk/README.md#changing-the-cardinality-limit-for-a-metric).
+
+  * The [overflow
+    attribute](https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/metrics/sdk.md#overflow-attribute)
+    (`otel.metric.overflow`) behavior is now enabled by default. The
+    `OTEL_DOTNET_EXPERIMENTAL_METRICS_EMIT_OVERFLOW_ATTRIBUTE` environment
+    variable is no longer required. For details see: [Cardinality
+    Limits](./docs/metrics/README.md#cardinality-limits).
+
+  * The MetricPoint reclaim behavior is now enabled by default when Delta
+    aggregation temporality is used. The
+    `OTEL_DOTNET_EXPERIMENTAL_METRICS_RECLAIM_UNUSED_METRIC_POINTS` environment
+    variable is no longer required. For details see: [Cardinality
+    Limits](./docs/metrics/README.md#cardinality-limits).
+
+* Added `OpenTelemetrySdk.Create` API for configuring OpenTelemetry .NET signals
+  (logging, tracing, and metrics) via a single builder. This new API simplifies
+  bootstrap and teardown, and supports cross-cutting extensions targeting
+  `IOpenTelemetryBuilder`.
+
+* Removed out of support `net6.0` target and added `net9.0` target.
+
 ## 1.9.0
 
+Release details: [1.9.0](https://github.com/open-telemetry/opentelemetry-dotnet/releases/tag/core-1.9.0)
+
 * `Exemplars` are now part of the stable API! For details see: [customizing
   exemplars
   collection](https://github.com/open-telemetry/opentelemetry-dotnet/tree/main/docs/metrics/customizing-the-sdk#exemplars).
@@ -16,6 +92,8 @@ directory of each individual package.
 
 ## 1.8.0
 
+Release details: [1.8.0](https://github.com/open-telemetry/opentelemetry-dotnet/releases/tag/core-1.8.0)
+
 * `TracerProvider` sampler can now be configured via the `OTEL_TRACES_SAMPLER` &
   `OTEL_TRACES_SAMPLER_ARG` envvars.
 
@@ -28,6 +106,8 @@ directory of each individual package.
 
 ## 1.7.0
 
+Release details: [1.7.0](https://github.com/open-telemetry/opentelemetry-dotnet/releases/tag/core-1.7.0)
+
 * Bumped the package versions of System.Diagnostic.DiagnosticSource and other
   Microsoft.Extensions.* packages to `8.0.0`.
 

THIRD-PARTY-NOTICES.TXT

@@ -29,3 +29,20 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
+
+License notice for gRPC for .NET (https://github.com/grpc/grpc-dotnet)
+----------------------------------------------------------------------------------------------
+
+Copyright 2019 The gRPC Authors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

build/Common.nonprod.props

@@ -2,7 +2,7 @@
   <Import Project=".\Common.props" />
 
   <PropertyGroup>
-    <NoWarn>$(NoWarn),1574,1591</NoWarn>
+    <NoWarn>$(NoWarn),CS1574,CS1591</NoWarn>
     <IsPackable>false</IsPackable>
     <CodeAnalysisRuleSet>$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), 'OpenTelemetry.sln'))\build\OpenTelemetry.test.ruleset</CodeAnalysisRuleSet>
   </PropertyGroup>
@@ -21,6 +21,18 @@
     </Content>
   </ItemGroup>
 
+  <ItemGroup Condition="'$(IsTestProject)' == 'true'">
+    <PackageReference Include="GitHubActionsTestLogger" />
+    <PackageReference Include="JunitXml.TestLogger" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" />
+    <PackageReference Include="xunit" />
+    <PackageReference Include="xunit.runner.visualstudio" PrivateAssets="All" />
+  </ItemGroup>
+
+  <ItemGroup Condition="'$(IsTestProject)' == 'true'">
+    <Compile Include="$(RepoRoot)\test\Shared\StrongNameTests.cs" Link="StrongNameTests.cs" />
+  </ItemGroup>
+
   <PropertyGroup>
     <!-- Running unit tests from VSCode does not work with .NET SDK 6.0.200 without ProduceReferenceAssemblyInOutDir -->
     <!-- Related breaking change: https://docs.microsoft.com/en-us/dotnet/core/compatibility/sdk/6.0/write-reference-assemblies-to-obj -->

build/Common.prod.props

@@ -18,13 +18,15 @@
     <PackageProjectUrl>https://opentelemetry.io</PackageProjectUrl>
     <Authors>OpenTelemetry Authors</Authors>
     <Copyright>Copyright The OpenTelemetry Authors</Copyright>
-    <PackageOutputPath Condition="$(Build_ArtifactStagingDirectory) != ''">$(Build_ArtifactStagingDirectory)</PackageOutputPath>
     <IncludeSymbols>true</IncludeSymbols>
     <SymbolPackageFormat>snupkg</SymbolPackageFormat>
     <PackageLicenseExpression>Apache-2.0</PackageLicenseExpression>
     <PackageRequireLicenseAcceptance>true</PackageRequireLicenseAcceptance>
     <PackagePrimaryLicenseFile>$(RepoRoot)\LICENSE.TXT</PackagePrimaryLicenseFile>
     <PackageThirdPartyNoticesFile>$(RepoRoot)\THIRD-PARTY-NOTICES.TXT</PackageThirdPartyNoticesFile>
+    <PackageReadmeFile>README.md</PackageReadmeFile>
+    <PackageChangelogFile>CHANGELOG.md</PackageChangelogFile>
+    <PackageReleaseNotesFile>$(RepoRoot)\RELEASENOTES.md</PackageReleaseNotesFile>
   </PropertyGroup>
 
   <PropertyGroup Label="SourceLinkProperties">
@@ -33,16 +35,8 @@
     <ContinuousIntegrationBuild Condition="'$(Deterministic)'=='true'">true</ContinuousIntegrationBuild>
   </PropertyGroup>
 
-  <ItemGroup>
-    <!-- Note: Disable net6.0 target for package validation because it has been
-    removed. It should be possible to remove this once a stable version has been
-    released to NuGet without net6.0. -->
-    <PackageValidationBaselineFrameworkToIgnore Include="net6.0" />
-  </ItemGroup>
-
   <ItemGroup>
     <PackageReference Include="MinVer" PrivateAssets="All" Condition="'$(IntegrationBuild)' != 'true'" />
-    <PackageReference Include="Microsoft.SourceLink.GitHub" PrivateAssets="All" Condition="'$(IntegrationBuild)' != 'true'" />
     <PackageReference Include="Microsoft.CodeAnalysis.PublicApiAnalyzers" PrivateAssets="All" />
   </ItemGroup>
 
@@ -57,7 +51,20 @@
     <None Include=".publicApi\**\PublicAPI.*.txt" />
   </ItemGroup>
 
-  <Target Name="AssemblyVersionTarget" AfterTargets="MinVer" Condition="'$(MinVerVersion)'!='' AND '$(BuildNumber)' != ''">
+  <Target Name="IncludeSigningSignaturesInPackages" BeforeTargets="_GetTargetFrameworksOutput">
+    <!-- Note: This target adds any signatures found to nuget packages -->
+    <ItemGroup>
+      <SignatureFiles Include="$(RepoRoot)\src\$(MSBuildProjectName)\bin\$(Configuration)\*\$(MSBuildProjectName).dll-keyless.sig" />
+      <Content Include="@(SignatureFiles)" Link="%(RecursiveDir)%(Filename)%(Extension)" PackagePath="lib" />
+      <CertificateFiles Include="$(RepoRoot)\src\$(MSBuildProjectName)\bin\$(Configuration)\*\$(MSBuildProjectName).dll-keyless.pem" />
+      <Content Include="@(CertificateFiles)" Link="%(RecursiveDir)%(Filename)%(Extension)" PackagePath="lib" />
+    </ItemGroup>
+
+    <Message Importance="high" Text="**IncludeSignaturesInPackagesDebug** SignatureFiles: @(SignatureFiles)" />
+    <Message Importance="high" Text="**IncludeCertificatesInPackagesDebug** SignatureFiles: @(CertificateFiles)" />
+  </Target>
+
+  <Target Name="AssemblyVersionTarget" AfterTargets="MinVer" Condition="'$(MinVerVersion)' != '' AND '$(BuildNumber)' != ''">
     <!-- Note: $(BuildNumber) is typically only set for builds initiated by the
     publish workflow. The goal here is to set the assembly FileVersion and
     resolve ExposeExperimentalFeatures based on the version MinVer resolved from
@@ -87,6 +94,66 @@
     <Error Text="Cannot perform package validation without a baseline package version." />
   </Target>
 
+  <Target Name="IncludeReadmeAndReleaseNotesInPackages" BeforeTargets="_GetTargetFrameworksOutput">
+    <!-- Note: This target runs during pack to convert relative links in
+    markdowns into github permalinks which will work when rendered on Nuget. -->
+
+    <Exec
+      Command="git rev-parse HEAD"
+      ConsoleToMsBuild="True"
+      IgnoreExitCode="True"
+      StandardOutputImportance="low">
+      <Output PropertyName="GitCommitConsoleOutput" TaskParameter="ConsoleOutput"/>
+      <Output PropertyName="GitCommitExitCode" TaskParameter="ExitCode"/>
+    </Exec>
+
+    <Exec
+      Command="git remote get-url origin"
+      ConsoleToMsBuild="True"
+      IgnoreExitCode="True"
+      StandardOutputImportance="low">
+      <Output PropertyName="GitOriginConsoleOutput" TaskParameter="ConsoleOutput"/>
+      <Output PropertyName="GitOriginExitCode" TaskParameter="ExitCode"/>
+    </Exec>
+
+    <PropertyGroup>
+      <MarkdownCommentRegex>\[([^]]+?)\]\(\.(.+?)\)</MarkdownCommentRegex>
+      <GitHubRepoUrl>$(GitOriginConsoleOutput.Replace('.git',''))</GitHubRepoUrl>
+      <GitHubPermalinkUrl Condition="'$(PackTag)' != ''">$(GitHubRepoUrl)/blob/$(PackTag)</GitHubPermalinkUrl>
+      <GitHubPermalinkUrl Condition="'$(PackTag)' == ''">$(GitHubRepoUrl)/blob/$(GitCommitConsoleOutput)</GitHubPermalinkUrl>
+    </PropertyGroup>
+
+    <Message Importance="high" Text="**GitInformationDebug** GitCommitConsoleOutput: $(GitCommitConsoleOutput), GitCommitExitCode: $(GitCommitExitCode), GitOriginConsoleOutput: $(GitOriginConsoleOutput), GitOriginExitCode: $(GitOriginExitCode), GitHubPermalinkUrl: $(GitHubPermalinkUrl)" />
+
+    <ItemGroup>
+      <PackageMarkdownFiles Include="README.md" />
+    </ItemGroup>
+
+    <ItemGroup>
+      <PackageMarkdownFiles Update="@(PackageMarkdownFiles)" Path="$([MSBuild]::ValueOrDefault('%(FullPath)','').Replace('$(RepoRoot)', '').Replace('%(FileName)%(Extension)', ''))" />
+    </ItemGroup>
+
+    <WriteLinesToFile
+        File="$(IntermediateOutputPath)%(PackageMarkdownFiles.Filename)%(PackageMarkdownFiles.Extension)"
+        Lines="$([System.Text.RegularExpressions.Regex]::Replace($([System.IO.File]::ReadAllText(%(PackageMarkdownFiles.FullPath))), '$(MarkdownCommentRegex)', '[$1]($(GitHubPermalinkUrl)%(PackageMarkdownFiles.Path).$2)').Replace('\', '/'))"
+        Overwrite="true"
+        Encoding="UTF-8"/>
+
+    <PropertyGroup>
+      <_PackageReleaseNotesFilePath>$([System.IO.Path]::GetFullPath('$(PackageReleaseNotesFile)').Replace('$(RepoRoot)', '').Replace('\', '/'))</_PackageReleaseNotesFilePath>
+      <_PackageChangelogFilePath>$([System.IO.Path]::GetFullPath('$(PackageChangelogFile)').Replace('$(RepoRoot)', '').Replace('\', '/'))</_PackageChangelogFilePath>
+      <PackageReleaseNotes>
+        For highlights and announcements see: $(GitHubPermalinkUrl)$(_PackageReleaseNotesFilePath).
+
+        For detailed changes see: $(GitHubPermalinkUrl)$(_PackageChangelogFilePath).
+      </PackageReleaseNotes>
+    </PropertyGroup>
+
+    <ItemGroup>
+      <Content Include="$(IntermediateOutputPath)*.md" PackagePath="/" />
+    </ItemGroup>
+  </Target>
+
   <Target Name="ResolveExposeExperimentalFeatures" BeforeTargets="CoreCompile" DependsOnTargets="AssemblyVersionTarget">
     <!-- Note: This runs for all builds. The goal here is to set the
     EXPOSE_EXPERIMENTAL_FEATURES compiler constant if

build/Common.props

@@ -4,7 +4,6 @@
     <SignAssembly>true</SignAssembly>
     <RepoRoot>$([System.IO.Directory]::GetParent($(MSBuildThisFileDirectory)).Parent.FullName)</RepoRoot>
     <AssemblyOriginatorKeyFile>$(MSBuildThisFileDirectory)debug.snk</AssemblyOriginatorKeyFile>
-    <DefineConstants>$(DefineConstants);SIGNED</DefineConstants>
     <EnforceCodeStyleInBuild>true</EnforceCodeStyleInBuild>
     <GenerateDocumentationFile>true</GenerateDocumentationFile>
     <Nullable>enable</Nullable>
@@ -13,9 +12,12 @@
     <NuGetAuditMode>all</NuGetAuditMode>
     <NuGetAuditLevel>low</NuGetAuditLevel>
     <!-- Suppress warnings for repo code using experimental features -->
-    <NoWarn>$(NoWarn);OTEL1000;OTEL1001;OTEL1002;OTEL1003;OTEL1004</NoWarn>
-    <!--temporarily disable. See 3958-->
-    <!--<AnalysisLevel>latest-All</AnalysisLevel>-->
+    <NoWarn>$(NoWarn);OTEL1000;OTEL1001;OTEL1002;OTEL1004</NoWarn>
+    <AnalysisLevel>latest-All</AnalysisLevel>
+  </PropertyGroup>
+
+  <PropertyGroup Condition=" '$(SignAssembly)' == 'true' ">
+    <StrongNamePublicKey>002400000480000094000000060200000024000052534131000400000100010051C1562A090FB0C9F391012A32198B5E5D9A60E9B80FA2D7B434C9E5CCB7259BD606E66F9660676AFC6692B8CDC6793D190904551D2103B7B22FA636DCBB8208839785BA402EA08FC00C8F1500CCEF28BBF599AA64FFB1E1D5DC1BF3420A3777BADFE697856E9D52070A50C3EA5821C80BEF17CA3ACFFA28F89DD413F096F898</StrongNamePublicKey>
   </PropertyGroup>
 
   <PropertyGroup Label="BuildFlags">
@@ -31,6 +33,7 @@
     <TargetFrameworksForLibraries>net9.0;net8.0;netstandard2.0;$(NetFrameworkMinimumSupportedVersion)</TargetFrameworksForLibraries>
     <TargetFrameworksForLibrariesExtended>net9.0;net8.0;netstandard2.1;netstandard2.0;$(NetFrameworkMinimumSupportedVersion)</TargetFrameworksForLibrariesExtended>
     <TargetFrameworksForPrometheusAspNetCore>net9.0;net8.0</TargetFrameworksForPrometheusAspNetCore>
+    <TargetFrameworksRequiringSystemTextJsonDirectReference>net8.0;netstandard2.1;netstandard2.0;$(NetFrameworkMinimumSupportedVersion)</TargetFrameworksRequiringSystemTextJsonDirectReference>
 
     <!-- non-production TFMs -->
     <TargetFrameworksForAspNetCoreTests>net9.0;net8.0</TargetFrameworksForAspNetCoreTests>

build/Common.targets

@@ -0,0 +1,12 @@
+<Project>
+
+  <ItemGroup Condition="'$(ReferenceSystemTextJsonPackages)' == 'true' AND $(TargetFrameworksRequiringSystemTextJsonDirectReference.Contains('$(TargetFramework)'))">
+    <!-- Note: System.Text.Encodings.Web is referenced on NET Framework & NET
+    Standard targets because System.Text.Json v4.7.2 uses
+    System.Text.Encodings.Web >= v4.7.1 but System.Text.Encodings.Web needs to
+    be at v4.7.2 to be safe. -->
+    <PackageReference Include="System.Text.Encodings.Web" Condition="'$(TargetFrameworkIdentifier)' != '.NETCoreApp'" />
+    <PackageReference Include="System.Text.Json" />
+  </ItemGroup>
+
+</Project>

build/RELEASING.md

@@ -80,11 +80,21 @@ Maintainers (admins) are needed to merge PRs and for the push to NuGet.**
        for the projects being released.
     </details
 
- 3. :stop_sign: The PR opened by [Prepare for a
+ 3. For stable releases, use the `/UpdateReleaseNotes` command on the PR opened
+    by [Prepare for a
+    release](https://github.com/open-telemetry/opentelemetry-dotnet/actions/workflows/prepare-release.yml)
+    workflow in step 2 to update [Release Notes](../RELEASENOTES.md) with any
+    big or interesting new features.
+
+    * The `/UpdateReleaseDates` command may also be used to update dates in
+      `CHANGELOG.md` files. This is useful when the PR is opened a few days
+      before the planned release date to review public API changes.
+
+ 4. :stop_sign: The PR opened by [Prepare for a
     release](https://github.com/open-telemetry/opentelemetry-dotnet/actions/workflows/prepare-release.yml)
     workflow in step 2 has to be merged.
 
- 4. Once the PR opened by [Prepare for a
+ 5. Once the PR opened by [Prepare for a
     release](https://github.com/open-telemetry/opentelemetry-dotnet/actions/workflows/prepare-release.yml)
     workflow in step 2 has been merged a trigger will automatically add a
     comment and lock the PR. Post a comment with "/CreateReleaseTag" in the
@@ -123,7 +133,7 @@ Maintainers (admins) are needed to merge PRs and for the push to NuGet.**
     workflow.
     </details>
 
- 5. :stop_sign: Wait for the [Build, pack, and publish to
+ 6. :stop_sign: Wait for the [Build, pack, and publish to
     MyGet](https://github.com/open-telemetry/opentelemetry-dotnet/actions/workflows/publish-packages-1.0.yml)
     workflow to complete. When complete a trigger will automatically add a
     comment on the PR opened by [Prepare for a
@@ -187,14 +197,14 @@ Maintainers (admins) are needed to merge PRs and for the push to NuGet.**
        draft Release and click `Publish release`.
     </details>
 
- 6. If a new stable version of the core packages was released, a PR should have
+ 7. If a new stable version of the core packages was released, a PR should have
     been automatically created by the [Complete
     release](https://github.com/open-telemetry/opentelemetry-dotnet/actions/workflows/post-release.yml)
     workflow to update the `OTelLatestStableVer` property in
     `Directory.Packages.props` to the just released stable version. Merge that
     PR once the build passes (this requires the packages be available on NuGet).
 
- 7. The [Complete
+ 8. The [Complete
     release](https://github.com/open-telemetry/opentelemetry-dotnet/actions/workflows/post-release.yml)
     workflow should have invoked the [Core version
     update](https://github.com/open-telemetry/opentelemetry-dotnet-contrib/actions/workflows/core-version-update.yml)
@@ -203,7 +213,6 @@ Maintainers (admins) are needed to merge PRs and for the push to NuGet.**
     repository which opens a PR to update dependencies. Verify this PR was
     opened successfully.
 
- 8. For stable releases, update [Release Notes](../RELEASENOTES.md) with any big
-    or interesting new features and then post an announcement in the [Slack
-    channel](https://cloud-native.slack.com/archives/C01N3BC2W7Q) with the same
-    information.
+ 9. For stable releases post an announcement in the [Slack
+    channel](https://cloud-native.slack.com/archives/C01N3BC2W7Q) announcing the
+    release and link to the release notes.

build/docker-compose.net8.0.yml

@@ -1,5 +1,3 @@
-version: '3.7'
-
 services:
   tests:
     build:

build/docker-compose.net9.0.yml

@@ -1,5 +1,3 @@
-version: '3.7'
-
 services:
   tests:
     build:

build/scripts/add-labels.psm1

@@ -38,7 +38,7 @@ function AddLabelsOnPullRequestsBasedOnFilesChanged {
   # it automatically in order to also allow manual inclusion after reviewing files
   $managedLabels = 'infra', 'documentation', 'dependencies'
   $rootInfraFiles = 'global.json', 'NuGet.config', 'codeowners'
-  $documentationFiles = 'readme.md', 'contributing.md', 'releasing.md', 'versioning.md'
+  $documentationFiles = 'readme.md', 'contributing.md', 'releasing.md', 'versioning.md', 'releasenotes.md'
 
   foreach ($fileChanged in $filesChangedOnPullRequest)
   {

build/scripts/prepare-release.psm1

@@ -15,6 +15,7 @@ function CreatePullRequestToUpdateChangelogsAndPublicApis {
       throw 'Input version did not match expected format'
   }
 
+  $isPrerelease = $version -match '-alpha' -or $version -match '-beta' -or $version -match '-rc'
   $tag="${minVerTagPrefix}${version}"
   $branch="release/prepare-${tag}-release"
 
@@ -48,7 +49,7 @@ Requested by: @$requestedByUserName
   & ./build/scripts/update-changelogs.ps1 -minVerTagPrefix $minVerTagPrefix -version $version
 
   # Update publicApi files for stable releases
-  if ($version -notlike "*-alpha*" -and $version -notlike "*-beta*" -and $version -notlike "*-rc*")
+  if ($isPrerelease -ne $true)
   {
     & ./build/scripts/finalize-publicapi.ps1 -minVerTagPrefix $minVerTagPrefix
 
@@ -61,6 +62,20 @@ Requested by: @$requestedByUserName
 ## Commands
 
 ``/UpdateReleaseDates``: Use to update release dates in CHANGELOGs before merging [``approvers``, ``maintainers``]
+"@
+
+  if ($minVerTagPrefix -eq 'core-' -and $isPrerelease -ne $true)
+  {
+    $body +=
+@"
+
+``/UpdateReleaseNotes``: Use to update ``RELEASENOTES.md`` before merging [``approvers``, ``maintainers``]
+"@
+  }
+
+  $body +=
+@"
+
 ``/CreateReleaseTag``: Use after merging to push the release tag and trigger the job to create packages [``approvers``, ``maintainers``]
 ``/PushPackages``: Use after the created packages have been validated to push to NuGet [``maintainers``]
 "@
@@ -77,12 +92,42 @@ Requested by: @$requestedByUserName
       throw 'git push failure'
   }
 
-  gh pr create `
+  $createPullRequestResponse = gh pr create `
     --title "[release] Prepare release $tag" `
     --body $body `
     --base $targetBranch `
     --head $branch `
     --label release
+
+  Write-Host $createPullRequestResponse
+
+  $match = [regex]::Match($createPullRequestResponse, "\/pull\/(.*)$")
+  if ($match.Success -eq $false)
+  {
+      throw 'Could not parse pull request number from gh pr create response'
+  }
+
+  $pullRequestNumber = $match.Groups[1].Value
+
+  if ($minVerTagPrefix -eq 'core-' -and $isPrerelease -ne $true)
+  {
+    $found = Select-String -Path "RELEASENOTES.md" -Pattern "## $version" -Quiet
+    if ($found -eq $false)
+    {
+      $body =
+@"
+I noticed this PR is releasing a stable version of core packages but there isn't any content in ``RELEASENOTES.md`` for the version being released.
+
+It is important to update ``RELEASENOTES.md`` before creating the release tag because a permalink will become part of the package(s).
+
+Post a comment with "/UpdateReleaseNotes" in the body if you would like me to update release notes.
+
+Note: In the comment everything below "/UpdateReleaseNotes" will be added to ``RELEASENOTES.md`` for the version being released. If something is already there it will be replaced.
+"@
+
+      gh pr comment $pullRequestNumber --body $body
+    }
+  }
 }
 
 Export-ModuleMember -Function CreatePullRequestToUpdateChangelogsAndPublicApis
@@ -294,3 +339,125 @@ Released $(Get-Date -UFormat '%Y-%b-%d')
 }
 
 Export-ModuleMember -Function UpdateChangelogReleaseDatesAndPostNoticeOnPullRequest
+
+function UpdateReleaseNotesAndPostNoticeOnPullRequest {
+  param(
+    [Parameter(Mandatory=$true)][string]$gitRepository,
+    [Parameter(Mandatory=$true)][string]$pullRequestNumber,
+    [Parameter(Mandatory=$true)][string]$botUserName,
+    [Parameter(Mandatory=$true)][string]$commentUserName,
+    [Parameter(Mandatory=$true)][string]$commentBody,
+    [Parameter()][string]$gitUserName,
+    [Parameter()][string]$gitUserEmail
+  )
+
+  $prViewResponse = gh pr view $pullRequestNumber --json headRefName,author,title | ConvertFrom-Json
+
+  if ($prViewResponse.author.login -ne $botUserName)
+  {
+      throw 'PR author was unexpected'
+  }
+
+  $match = [regex]::Match($prViewResponse.title, '^\[release\] Prepare release (.*)$')
+  if ($match.Success -eq $false)
+  {
+      throw 'Could not parse tag from PR title'
+  }
+
+  $tag = $match.Groups[1].Value
+
+  $match = [regex]::Match($tag, '^(.*?-)(.*)$')
+  if ($match.Success -eq $false)
+  {
+      throw 'Could not parse prefix or version from tag'
+  }
+
+  $tagPrefix = $match.Groups[1].Value
+  $version = $match.Groups[2].Value
+  $isPrerelease = $version -match '-alpha' -or $version -match '-beta' -or $version -match '-rc'
+
+  $commentUserPermission = gh api "repos/$gitRepository/collaborators/$commentUserName/permission" | ConvertFrom-Json
+  if ($commentUserPermission.permission -ne 'admin' -and $commentUserPermission.permission -ne 'write')
+  {
+    gh pr comment $pullRequestNumber `
+      --body "I'm sorry @$commentUserName but you don't have permission to update this PR. Only maintainers and approvers can update this PR."
+    return
+  }
+
+  if ($tagPrefix -ne 'core-' -or $isPrerelease -eq $true)
+  {
+    gh pr comment $pullRequestNumber `
+      --body "I'm sorry @$commentUserName but we don't typically add release notes for prereleases or unstable packages."
+    return
+  }
+
+  if ([string]::IsNullOrEmpty($gitUserName) -eq $false)
+  {
+    git config user.name $gitUserName
+  }
+  if ([string]::IsNullOrEmpty($gitUserEmail) -eq $false)
+  {
+    git config user.email $gitUserEmail
+  }
+
+  git switch $prViewResponse.headRefName 2>&1 | % ToString
+  if ($LASTEXITCODE -gt 0)
+  {
+      throw 'git switch failure'
+  }
+
+  $releaseNotesContent = (Get-Content -Path "RELEASENOTES.md" -Raw)
+
+  $match = [regex]::Match($commentBody, '[\w\W\s]*\/UpdateReleaseNotes.*$([\w\W\s]*)', [Text.RegularExpressions.RegexOptions]::Multiline)
+  if ($match.Success -eq $false)
+  {
+      throw 'Could not find release notes content'
+  }
+
+  $content = $match.Groups[1].Value.Trim() -replace "`r`n", "`n"
+
+  $body =
+@"
+## $version
+
+Release details: [$version](https://github.com/$gitRepository/releases/tag/$tagPrefix$version)
+
+$content
+
+##
+"@
+
+  $match = [regex]::Match($releaseNotesContent, "(## $version[\w\W\s]*?)##", [Text.RegularExpressions.RegexOptions]::Multiline)
+  if ($match.Success -eq $true)
+  {
+    $content = [regex]::Replace($releaseNotesContent, "(## $version[\w\W\s]*?)##", $body, [Text.RegularExpressions.RegexOptions]::Multiline)
+    Set-Content -Path "RELEASENOTES.md" -Value $content.TrimEnd()
+  }
+  else {
+    $match = [regex]::Match($releaseNotesContent, '(# Release Notes[\w\W\s]*?)##', [Text.RegularExpressions.RegexOptions]::Multiline)
+    if ($match.Success -eq $false)
+    {
+      throw 'Could not find release notes header'
+    }
+
+    $body = $match.Groups[1].Value + $body
+    $content = [regex]::Replace($releaseNotesContent, '(# Release Notes[\w\W\s]*?)##', $body, [Text.RegularExpressions.RegexOptions]::Multiline)
+    Set-Content -Path "RELEASENOTES.md" -Value $content.TrimEnd()
+  }
+
+  git commit -a -m "Update RELEASENOTES for $tag." 2>&1 | % ToString
+  if ($LASTEXITCODE -gt 0)
+  {
+      throw 'git commit failure'
+  }
+
+  git push -u origin $prViewResponse.headRefName 2>&1 | % ToString
+  if ($LASTEXITCODE -gt 0)
+  {
+      throw 'git push failure'
+  }
+
+  gh pr comment $pullRequestNumber --body "I updated ``RELEASENOTES.md``."
+}
+
+Export-ModuleMember -Function UpdateReleaseNotesAndPostNoticeOnPullRequest

build/scripts/test-aot-compatibility.ps1

@@ -24,10 +24,9 @@ if ($LastExitCode -ne 0)
     Write-Host $publishOutput
 }
 
-$runtime = $IsWindows ? "win-x64" : ($IsMacOS ? "macos-x64" : "linux-x64")
 $app = $IsWindows ? "./OpenTelemetry.AotCompatibility.TestApp.exe" : "./OpenTelemetry.AotCompatibility.TestApp"
 
-Push-Location $rootDirectory/test/OpenTelemetry.AotCompatibility.TestApp/bin/Release/$targetNetFramework/$runtime
+Push-Location $rootDirectory/artifacts/publish/OpenTelemetry.AotCompatibility.TestApp/release_$targetNetFramework
 
 Write-Host "Executing test App..."
 $app

build/scripts/test-threadSafety.ps1

@@ -1,22 +1,32 @@
 param(
-  [Parameter()][string]$coyoteVersion="1.7.10",
+  [Parameter()][string]$coyoteVersion="1.7.11",
   [Parameter(Mandatory=$true)][string]$testProjectName,
   [Parameter(Mandatory=$true)][string]$targetFramework,
   [Parameter()][string]$categoryName="CoyoteConcurrencyTests",
   [Parameter()][string]$configuration="Release"
 )
 
+$ErrorActionPreference = "Stop"
+
 $env:OTEL_RUN_COYOTE_TESTS = 'true'
 
 $rootDirectory = Get-Location
 
 Write-Host "Install Coyote CLI."
-dotnet tool install --global Microsoft.Coyote.CLI
+dotnet tool install --global Microsoft.Coyote.CLI --version $coyoteVersion
+
+if ($LASTEXITCODE -ne 0) {
+    throw "Microsoft.Coyote.CLI installation failed with exit code $LASTEXITCODE"
+}
 
 Write-Host "Build $testProjectName project."
 dotnet build "$rootDirectory/test/$testProjectName/$testProjectName.csproj" --configuration $configuration
 
-$artifactsPath = Join-Path $rootDirectory "test/$testProjectName/bin/$configuration/$targetFramework"
+if ($LASTEXITCODE -ne 0) {
+    throw "dotnet build failed with exit code $LASTEXITCODE"
+}
+
+$artifactsPath = Join-Path $rootDirectory "artifacts/bin/$testProjectName/$($configuration.ToLowerInvariant())_$targetFramework"
 
 Write-Host "Generate Coyote rewriting options JSON file."
 $assemblies = Get-ChildItem $artifactsPath -Filter OpenTelemetry*.dll | ForEach-Object {$_.Name}
@@ -29,6 +39,13 @@ $RewriteOptionsJson | ConvertTo-Json -Compress | Set-Content -Path "$rootDirecto
 Write-Host "Run Coyote rewrite."
 coyote rewrite "$rootDirectory/test/$testProjectName/rewrite.coyote.json"
 
+if ($LASTEXITCODE -ne 0) {
+    throw "coyote rewrite failed with exit code $LASTEXITCODE"
+}
+
 Write-Host "Execute re-written binary."
 dotnet test "$artifactsPath/$testProjectName.dll" --framework $targetFramework --filter CategoryName=$categoryName
 
+if ($LASTEXITCODE -ne 0) {
+    throw "dotnet test failed with exit code $LASTEXITCODE"
+}

docs/Directory.Build.props

@@ -1,8 +1,11 @@
 <Project>
+  <Import Project="$([System.IO.Path]::Combine($(MSBuildThisFileDirectory), '..', 'Directory.Build.props'))" />
   <Import Project="$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildProjectDirectory), 'OpenTelemetry.sln'))\build\Common.nonprod.props" />
 
   <PropertyGroup>
     <OutputType>Exe</OutputType>
     <TargetFrameworks>$(TargetFrameworksForDocs)</TargetFrameworks>
+    <!-- Opt-out of Artifacts Output for docs as there are duplicated project names -->
+    <UseArtifactsOutput>false</UseArtifactsOutput>
   </PropertyGroup>
 </Project>

docs/README.md

@@ -102,7 +102,7 @@ To obtain an `ILogger` instance for emitting logs when using the
 the returned `OpenTelemetrySdk` instance:
 
 ```csharp
-var logger = sdk.GetLoggerFactory().CreateLogger<Program>()
+var logger = sdk.GetLoggerFactory().CreateLogger<Program>();
 logger.LogInformation("Application started");
 ```
 

docs/diagnostics/experimental-apis/OTEL1003.md

@@ -1,47 +0,0 @@
-# OpenTelemetry .NET Diagnostic: OTEL1003
-
-## Overview
-
-This is an Experimental API diagnostic covering the following API:
-
-* `MetricStreamConfiguration.CardinalityLimit.get`
-* `MetricStreamConfiguration.CardinalityLimit.set`
-
-Experimental APIs may be changed or removed in the future.
-
-## Details
-
-From the specification:
-
-> The cardinality limit for an aggregation is defined in one of three ways:
->
-> 1. A view with criteria matching the instrument an aggregation is created for
->    has an `aggregation_cardinality_limit` value defined for the stream, that
->    value SHOULD be used.
-> 2. If there is no matching view, but the `MetricReader` defines a default
->    cardinality limit value based on the instrument an aggregation is created
->    for, that value SHOULD be used.
-> 3. If none of the previous values are defined, the default value of 2000
->    SHOULD be used.
-
-We are exposing these APIs experimentally until the specification declares them
-stable.
-
-### Setting cardinality limit for a specific Metric via the View API
-
-The OpenTelemetry Specification defines the [cardinality
-limit](https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/metrics/sdk.md#cardinality-limits)
-of a metric can be set by the matching view.
-
-```csharp
-using var meterProvider = Sdk.CreateMeterProviderBuilder()
-    .AddView(
-        instrumentName: "MyFruitCounter",
-        new MetricStreamConfiguration { CardinalityLimit = 10 })
-    .Build();
-```
-
-### Setting cardinality limit for a specific MetricReader
-
-[This is not currently supported by OpenTelemetry
-.NET.](https://github.com/open-telemetry/opentelemetry-dotnet/issues/5331)

docs/diagnostics/experimental-apis/README.md

@@ -27,12 +27,6 @@ Description: Logs Bridge API
 
 Details: [OTEL1001](./OTEL1001.md)
 
-### OTEL1003
-
-Description: MetricStreamConfiguration CardinalityLimit Support
-
-Details: [OTEL1003](./OTEL1003.md)
-
 ### OTEL1004
 
 Description: ExemplarReservoir Support
@@ -58,3 +52,11 @@ Description: Metrics Exemplar Support
 Details: [OTEL1002](https://github.com/open-telemetry/opentelemetry-dotnet/blob/b8ea807bae1a5d9b0f3d6d23b1e1e10f5e096a25/docs/diagnostics/experimental-apis/OTEL1002.md)
 
 Released stable: `1.9.0`
+
+### OTEL1003
+
+Description: MetricStreamConfiguration CardinalityLimit Support
+
+Details: [OTEL1003](https://github.com/open-telemetry/opentelemetry-dotnet/blob/9f41eadf03f3dcc5e76c686b61fb39849f046312/docs/diagnostics/experimental-apis/OTEL1003.md)
+
+Released stable: `1.10.0`

docs/logs/README.md

@@ -25,33 +25,17 @@ OpenTelemetry .NET:
 * [Getting Started - Console Application](./getting-started-console/README.md)
 * [Logging with Complex Objects](./complex-objects/README.md)
 
-## Structured Logging
+## Logging API
 
-:heavy_check_mark: You should use structured logging.
+### ILogger
 
-* Structured logging is more efficient than unstructured logging.
-  * Filtering and redaction can happen on individual key-value pairs instead of
-    the entire log message.
-  * Storage and indexing are more efficient.
-* Structured logging makes it easier to manage and consume logs.
+.NET supports high performance, structured logging via the
+[`Microsoft.Extensions.Logging.ILogger`](https://docs.microsoft.com/dotnet/api/microsoft.extensions.logging.ilogger)
+interface (including
+[`ILogger<TCategoryName>`](https://learn.microsoft.com/dotnet/api/microsoft.extensions.logging.ilogger-1))
+to help monitor application behavior and diagnose issues.
 
-:stop_sign: You should avoid string interpolation.
-
-> [!WARNING]
-> The following code has bad performance due to [string
-  interpolation](https://learn.microsoft.com/dotnet/csharp/tutorials/string-interpolation):
-
-```csharp
-var food = "tomato";
-var price = 2.99;
-
-logger.LogInformation($"Hello from {food} {price}.");
-```
-
-Refer to the [logging performance
-benchmark](../../test/Benchmarks/Logs/LogBenchmarks.cs) for more details.
-
-## Package Version
+#### Package Version
 
 :heavy_check_mark: You should always use the
 [`ILogger`](https://docs.microsoft.com/dotnet/api/microsoft.extensions.logging.ilogger)
@@ -69,16 +53,6 @@ package, regardless of the .NET runtime version being used:
   backward compatibility on `Microsoft.Extensions.Logging` even during major
   version bumps, so compatibility is not a concern here.
 
-## Logging API
-
-### ILogger
-
-.NET supports high performance, structured logging via the
-[`Microsoft.Extensions.Logging.ILogger`](https://docs.microsoft.com/dotnet/api/microsoft.extensions.logging.ilogger)
-interface (including
-[`ILogger<TCategoryName>`](https://learn.microsoft.com/dotnet/api/microsoft.extensions.logging.ilogger-1))
-to help monitor application behavior and diagnose issues.
-
 #### Get Logger
 
 In order to use the `ILogger` interface, you need to first get a logger. How to
@@ -125,7 +99,38 @@ are not super expensive, they still come with CPU and memory cost, and are meant
 to be reused throughout the application. Refer to the [logging performance
 benchmark](../../test/Benchmarks/Logs/LogBenchmarks.cs) for more details.
 
-#### Use Logger
+#### Write log messages
+
+:heavy_check_mark: You should use structured logging.
+
+* Structured logging is more efficient than unstructured logging.
+  * Filtering and redaction can happen on individual key-value pairs instead of
+    the entire log message.
+  * Storage and indexing are more efficient.
+* Structured logging makes it easier to manage and consume logs.
+
+```csharp
+var food = "tomato";
+var price = 2.99;
+
+logger.LogInformation("Hello from {food} {price}.", food, price);
+```
+
+:stop_sign: You should avoid string interpolation.
+
+> [!WARNING]
+> The following code has bad performance due to [string
+  interpolation](https://learn.microsoft.com/dotnet/csharp/tutorials/string-interpolation):
+
+```csharp
+var food = "tomato";
+var price = 2.99;
+
+logger.LogInformation($"Hello from {food} {price}.");
+```
+
+Refer to the [logging performance
+benchmark](../../test/Benchmarks/Logs/LogBenchmarks.cs) for more details.
 
 :heavy_check_mark: You should use [compile-time logging source
 generation](https://docs.microsoft.com/dotnet/core/extensions/logger-message-generator)
@@ -222,6 +227,111 @@ code is now depending on which logger is being enabled, not to mention the
 argument evaluation might have significant side effects that are now depending
 on the logging configuration.
 
+:heavy_check_mark: You should use a dedicated parameter to log exceptions when
+using the compile-time source generator.
+
+```csharp
+var food = "tomato";
+var price = 2.99;
+
+try
+{
+    // Execute some logic
+
+    logger.SayHello(food, price);
+}
+catch (Exception ex)
+{
+    logger.SayHelloFailure(ex, food, price);
+}
+
+internal static partial class LoggerExtensions
+{
+    [LoggerMessage(Level = LogLevel.Information, Message = "Hello from {food} {price}.")]
+    public static partial void SayHello(this ILogger logger, string food, double price);
+
+    [LoggerMessage(Level = LogLevel.Error, Message = "Could not say hello from {food} {price}.")]
+    public static partial void SayHelloFailure(this ILogger logger, Exception exception, string food, double price);
+}
+```
+
+> [!NOTE]
+> When using the compile-time source generator the first `Exception` parameter
+> detected is automatically given special handling. It **SHOULD NOT** be part of
+> the message template. For details see: [Log method
+> anatomy](https://learn.microsoft.com/dotnet/core/extensions/logger-message-generator#log-method-anatomy).
+
+:heavy_check_mark: You should use the dedicated overloads to log exceptions when
+using the logging extensions methods.
+
+```csharp
+var food = "tomato";
+var price = 2.99;
+
+try
+{
+    // Execute some logic
+
+    logger.LogInformation("Hello from {food} {price}.", food, price);
+}
+catch (Exception ex)
+{
+    logger.LogError(ex, "Could not say hello from {food} {price}.", food, price);
+}
+```
+
+:stop_sign: You should avoid adding exception details into the message template.
+
+You want to use the correct `Exception` APIs because the OpenTelemetry
+Specification [defines dedicated
+attributes](https://github.com/open-telemetry/semantic-conventions/blob/main/docs/exceptions/exceptions-logs.md)
+for `Exception` details. The following examples show what **NOT** to do. In
+these cases the details won't be lost, but the dedicated attributes also won't
+be added.
+
+```csharp
+var food = "tomato";
+var price = 2.99;
+
+try
+{
+    // Execute some logic
+
+    logger.SayHello(food, price);
+}
+catch (Exception ex)
+{
+    logger.SayHelloFailure(food, price, ex.Message);
+}
+
+internal static partial class LoggerExtensions
+{
+    [LoggerMessage(Level = LogLevel.Information, Message = "Hello from {food} {price}.")]
+    public static partial void SayHello(this ILogger logger, string food, double price);
+
+    // BAD - Exception should not be part of the message template. Use the dedicated parameter.
+    [LoggerMessage(Level = LogLevel.Error, Message = "Could not say hello from {food} {price} {message}.")]
+    public static partial void SayHelloFailure(this ILogger logger, string food, double price, string message);
+}
+```
+
+```csharp
+var food = "tomato";
+var price = 2.99;
+
+try
+{
+    // Execute some logic
+
+    logger.LogInformation("Hello from {food} {price}.", food, price);
+}
+catch (Exception ex)
+{
+    // BAD - Exception should not be part of the message template. Use the dedicated parameter.
+    logger.LogError("Could not say hello from {food} {price} {message}.", food, price, ex.Message);
+}
+```
+
 ## LoggerFactory
 
 In many cases, you can use [ILogger](#ilogger) without having to interact with

docs/logs/complex-objects/FoodRecallNotice.cs

@@ -1,7 +1,9 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-public struct FoodRecallNotice
+namespace ComplexObjects;
+
+internal struct FoodRecallNotice
 {
     public string? BrandName { get; set; }
 

docs/logs/complex-objects/Program.cs

@@ -1,6 +1,7 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
+using ComplexObjects;
 using Microsoft.Extensions.Logging;
 using OpenTelemetry.Logs;
 

docs/logs/correlation/Program.cs

@@ -7,7 +7,9 @@ using OpenTelemetry;
 using OpenTelemetry.Logs;
 using OpenTelemetry.Trace;
 
-public class Program
+namespace Correlation;
+
+internal sealed class Program
 {
     private static readonly ActivitySource MyActivitySource = new("MyCompany.MyProduct.MyLibrary");
 

docs/logs/dedicated-pipeline/DedicatedLogging/DedicatedLoggingServiceCollectionExtensions.cs

@@ -6,7 +6,7 @@ using OpenTelemetry.Logs;
 
 namespace DedicatedLogging;
 
-public static class DedicatedLoggingServiceCollectionExtensions
+internal static class DedicatedLoggingServiceCollectionExtensions
 {
     public static IServiceCollection AddDedicatedLogging(
         this IServiceCollection services,

docs/logs/dedicated-pipeline/DedicatedLogging/IDedicatedLogger.cs

@@ -3,10 +3,10 @@
 
 namespace DedicatedLogging;
 
-public interface IDedicatedLogger : ILogger
+internal interface IDedicatedLogger : ILogger
 {
 }
 
-public interface IDedicatedLogger<out TCategoryName> : IDedicatedLogger
+internal interface IDedicatedLogger<out TCategoryName> : IDedicatedLogger
 {
 }

docs/logs/dedicated-pipeline/dedicated-pipeline.csproj

@@ -1,4 +1,8 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
+  <PropertyGroup>
+    <NoWarn>$(NoWarn);CA1812;CA2213</NoWarn>
+  </PropertyGroup>
+
   <ItemGroup>
     <ProjectReference Include="$(RepoRoot)\src\OpenTelemetry.Exporter.Console\OpenTelemetry.Exporter.Console.csproj" />
     <ProjectReference Include="$(RepoRoot)\src\OpenTelemetry.Extensions.Hosting\OpenTelemetry.Extensions.Hosting.csproj" />

docs/logs/extending-the-sdk/MyExporter.cs

@@ -5,7 +5,7 @@ using System.Text;
 using OpenTelemetry;
 using OpenTelemetry.Logs;
 
-internal class MyExporter : BaseExporter<LogRecord>
+internal sealed class MyExporter : BaseExporter<LogRecord>
 {
     private readonly string name;
 
@@ -59,6 +59,7 @@ internal class MyExporter : BaseExporter<LogRecord>
 
     protected override void Dispose(bool disposing)
     {
+        base.Dispose(disposing);
         Console.WriteLine($"{this.name}.Dispose({disposing})");
     }
 }

docs/logs/extending-the-sdk/MyProcessor.cs

@@ -4,7 +4,7 @@
 using OpenTelemetry;
 using OpenTelemetry.Logs;
 
-internal class MyProcessor : BaseProcessor<LogRecord>
+internal sealed class MyProcessor : BaseProcessor<LogRecord>
 {
     private readonly string name;
 
@@ -32,6 +32,7 @@ internal class MyProcessor : BaseProcessor<LogRecord>
 
     protected override void Dispose(bool disposing)
     {
+        base.Dispose(disposing);
         Console.WriteLine($"{this.name}.Dispose({disposing})");
     }
 }

docs/logs/extending-the-sdk/Program.cs

@@ -6,7 +6,7 @@ using OpenTelemetry;
 
 namespace ExtendingTheSdk;
 
-public class Program
+internal sealed class Program
 {
     public static void Main()
     {
@@ -29,16 +29,16 @@ public class Program
         // logger.LogInformation($"Hello from potato {0.99}.");
 
         // structured log with template
-        logger.LogInformation("Hello from {name} {price}.", "tomato", 2.99);
+        logger.LogInformation("Hello from {Name} {Price}.", "tomato", 2.99);
 
         // structured log with strong type
-        logger.LogInformation("{food}", new Food { Name = "artichoke", Price = 3.99 });
+        logger.LogInformation("{Food}", new Food { Name = "artichoke", Price = 3.99 });
 
         // structured log with anonymous type
-        logger.LogInformation("{food}", new { Name = "pumpkin", Price = 5.99 });
+        logger.LogInformation("{Food}", new { Name = "pumpkin", Price = 5.99 });
 
         // structured log with general type
-        logger.LogInformation("{food}", new Dictionary<string, object>
+        logger.LogInformation("{Food}", new Dictionary<string, object>
         {
             ["Name"] = "truffle",
             ["Price"] = 299.99,
@@ -48,11 +48,11 @@ public class Program
         using (logger.BeginScope("[operation]"))
         using (logger.BeginScope("[hardware]"))
         {
-            logger.LogError("{name} is broken.", "refrigerator");
+            logger.LogError("{Name} is broken.", "refrigerator");
         }
 
         // message will be redacted by MyRedactionProcessor
-        logger.LogInformation("OpenTelemetry {sensitiveString}.", "<secret>");
+        logger.LogInformation("OpenTelemetry {SensitiveString}.", "<secret>");
     }
 
     internal struct Food

docs/logs/extending-the-sdk/extending-the-sdk.csproj

@@ -1,4 +1,8 @@
 <Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <NoWarn>$(NoWarn);CA2000;CA1848;CA1510;CA1305</NoWarn>
+  </PropertyGroup>
+
   <ItemGroup>
     <ProjectReference Include="$(RepoRoot)\src\OpenTelemetry\OpenTelemetry.csproj" />
   </ItemGroup>

docs/logs/redaction/MyRedactionProcessor.cs

@@ -15,18 +15,18 @@ internal sealed class MyRedactionProcessor : BaseProcessor<LogRecord>
         }
     }
 
-    internal sealed class MyClassWithRedactionEnumerator : IReadOnlyList<KeyValuePair<string, object>>
+    internal sealed class MyClassWithRedactionEnumerator : IReadOnlyList<KeyValuePair<string, object?>>
     {
-        private readonly IReadOnlyList<KeyValuePair<string, object>> state;
+        private readonly IReadOnlyList<KeyValuePair<string, object?>> state;
 
-        public MyClassWithRedactionEnumerator(IReadOnlyList<KeyValuePair<string, object>> state)
+        public MyClassWithRedactionEnumerator(IReadOnlyList<KeyValuePair<string, object?>> state)
         {
             this.state = state;
         }
 
         public int Count => this.state.Count;
 
-        public KeyValuePair<string, object> this[int index]
+        public KeyValuePair<string, object?> this[int index]
         {
             get
             {
@@ -34,14 +34,14 @@ internal sealed class MyRedactionProcessor : BaseProcessor<LogRecord>
                 var entryVal = item.Value?.ToString();
                 if (entryVal != null && entryVal.Contains("<secret>"))
                 {
-                    return new KeyValuePair<string, object>(item.Key, "newRedactedValueHere");
+                    return new KeyValuePair<string, object?>(item.Key, "newRedactedValueHere");
                 }
 
                 return item;
             }
         }
 
-        public IEnumerator<KeyValuePair<string, object>> GetEnumerator()
+        public IEnumerator<KeyValuePair<string, object?>> GetEnumerator()
         {
             for (var i = 0; i < this.Count; i++)
             {

docs/logs/redaction/redaction.csproj

@@ -1,8 +1,8 @@
 <Project Sdk="Microsoft.NET.Sdk">
   <PropertyGroup>
-    <!-- this is temporary. will remove in future PR. -->
-    <Nullable>disable</Nullable>
+    <NoWarn>$(NoWarn);CA2213;CA1812;CA1307</NoWarn>
   </PropertyGroup>
+
   <ItemGroup>
     <ProjectReference Include="$(RepoRoot)\src\OpenTelemetry.Exporter.Console\OpenTelemetry.Exporter.Console.csproj" />
   </ItemGroup>

docs/metrics/README.md

@@ -10,11 +10,13 @@
   * [Instruments](#instruments)
 * [MeterProvider Management](#meterprovider-management)
 * [Memory Management](#memory-management)
+  * [Example](#example)
   * [Pre-Aggregation](#pre-aggregation)
   * [Cardinality Limits](#cardinality-limits)
   * [Memory Preallocation](#memory-preallocation)
 * [Metrics Correlation](#metrics-correlation)
 * [Metrics Enrichment](#metrics-enrichment)
+* [Common issues that lead to missing metrics](#common-issues-that-lead-to-missing-metrics)
 
 </details>
 
@@ -57,7 +59,7 @@ too frequently. `Meter` is fairly expensive and meant to be reused throughout
 the application. For most applications, it can be modeled as static readonly
 field (e.g. [Program.cs](./getting-started-console/Program.cs)) or singleton via
 dependency injection (e.g.
-[Instrumentation.cs](../../examples/AspNetCore/Instrumentation.cs)).
+[InstrumentationSource.cs](../../examples/AspNetCore/InstrumentationSource.cs)).
 
 :heavy_check_mark: You should use dot-separated
 [UpperCamelCase](https://en.wikipedia.org/wiki/Camel_case) as the
@@ -95,7 +97,7 @@ frequently. Instruments are fairly expensive and meant to be reused throughout
 the application. For most applications, instruments can be modeled as static
 readonly fields (e.g. [Program.cs](./getting-started-console/Program.cs)) or
 singleton via dependency injection (e.g.
-[Instrumentation.cs](../../examples/AspNetCore/Instrumentation.cs)).
+[InstrumentationSource.cs](../../examples/AspNetCore/InstrumentationSource.cs)).
 
 :stop_sign: You should avoid invalid instrument names.
 
@@ -386,37 +388,25 @@ and the `MetricStreamConfiguration.CardinalityLimit` setting. Refer to this
 [doc](../../docs/metrics/customizing-the-sdk/README.md#changing-the-cardinality-limit-for-a-metric)
 for more information.
 
-Given a metric, once the cardinality limit is reached, any new measurement which
-cannot be independently aggregated because of the limit will be dropped or
+As of `1.10.0` once a metric has reached the cardinality limit, any new
+measurement that could not be independently aggregated will be automatically
 aggregated using the [overflow
-attribute](https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/metrics/sdk.md#overflow-attribute)
-(if enabled). When NOT using the overflow attribute feature a warning is written
-to the [self-diagnostic log](../../src/OpenTelemetry/README.md#self-diagnostics)
-the first time an overflow is detected for a given metric.
+attribute](https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/metrics/sdk.md#overflow-attribute).
 
 > [!NOTE]
-> Overflow attribute was introduced in OpenTelemetry .NET
-  [1.6.0-rc.1](../../src/OpenTelemetry/CHANGELOG.md#160-rc1). It is currently an
-  experimental feature which can be turned on by setting the environment
-  variable `OTEL_DOTNET_EXPERIMENTAL_METRICS_EMIT_OVERFLOW_ATTRIBUTE=true`. Once
-  the [OpenTelemetry
-  Specification](https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/metrics/sdk.md#overflow-attribute)
-  become stable, this feature will be turned on by default.
+> In SDK versions `1.6.0` - `1.9.0` the overflow attribute was an experimental
+  feature that could be enabled by setting the environment variable
+  `OTEL_DOTNET_EXPERIMENTAL_METRICS_EMIT_OVERFLOW_ATTRIBUTE=true`.
 
-When [Delta Aggregation
+As of `1.10.0` when [Delta Aggregation
 Temporality](https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/metrics/data-model.md#temporality)
-is used, it is possible to choose a smaller cardinality limit by allowing the
-SDK to reclaim unused metric points.
+is used, it is possible to choose a smaller cardinality limit because the SDK
+will reclaim unused metric points.
 
 > [!NOTE]
-> Reclaim unused metric points feature was introduced in OpenTelemetry .NET
-  [1.7.0-alpha.1](../../src/OpenTelemetry/CHANGELOG.md#170-alpha1). It is
-  currently an experimental feature which can be turned on by setting the
-  environment variable
-  `OTEL_DOTNET_EXPERIMENTAL_METRICS_RECLAIM_UNUSED_METRIC_POINTS=true`. Once the
-  [OpenTelemetry
-  Specification](https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/metrics/sdk.md#overflow-attribute)
-  become stable, this feature will be turned on by default.
+> In SDK versions `1.7.0` - `1.9.0`, metric point reclaim was an experimental
+  feature that could be enabled by setting the environment variable
+  `OTEL_DOTNET_EXPERIMENTAL_METRICS_RECLAIM_UNUSED_METRIC_POINTS=true`.
 
 ### Memory Preallocation
 

docs/metrics/customizing-the-sdk/Program.cs

@@ -8,7 +8,7 @@ using OpenTelemetry.Resources;
 
 namespace CustomizingTheSdk;
 
-public class Program
+internal static class Program
 {
     private static readonly Meter Meter1 = new("CompanyA.ProductA.Library1", "1.0");
     private static readonly Meter Meter2 = new("CompanyA.ProductB.Library2", "1.0");
@@ -29,17 +29,23 @@ public class Program
             .AddView(instrumentName: "MyCounter", name: "MyCounterRenamed")
 
             // Change Histogram boundaries using the Explicit Bucket Histogram aggregation.
-            .AddView(instrumentName: "MyHistogram", new ExplicitBucketHistogramConfiguration() { Boundaries = new double[] { 10, 20 } })
+            .AddView(instrumentName: "MyHistogram", new ExplicitBucketHistogramConfiguration() { Boundaries = [10.0, 20.0] })
 
             // Change Histogram to use the Base2 Exponential Bucket Histogram aggregation.
             .AddView(instrumentName: "MyExponentialBucketHistogram", new Base2ExponentialBucketHistogramConfiguration())
 
             // For the instrument "MyCounterCustomTags", aggregate with only the keys "tag1", "tag2".
-            .AddView(instrumentName: "MyCounterCustomTags", new MetricStreamConfiguration() { TagKeys = new string[] { "tag1", "tag2" } })
+            .AddView(instrumentName: "MyCounterCustomTags", new MetricStreamConfiguration() { TagKeys = ["tag1", "tag2"] })
 
             // Drop the instrument "MyCounterDrop".
             .AddView(instrumentName: "MyCounterDrop", MetricStreamConfiguration.Drop)
 
+            // Configure the Explicit Bucket Histogram aggregation with custom boundaries and new name.
+            .AddView(instrumentName: "histogramWithMultipleAggregations", new ExplicitBucketHistogramConfiguration() { Boundaries = [10.0, 20.0], Name = "MyHistogramWithExplicitHistogram" })
+
+            // Use Base2 Exponential Bucket Histogram aggregation and new name.
+            .AddView(instrumentName: "histogramWithMultipleAggregations", new Base2ExponentialBucketHistogramConfiguration() { Name = "MyHistogramWithBase2ExponentialBucketHistogram" })
+
             // An instrument which does not match any views
             // gets processed with default behavior. (SDK default)
             // Uncommenting the following line will
@@ -70,6 +76,12 @@ public class Program
             exponentialBucketHistogram.Record(random.Next(1, 1000), new("tag1", "value1"), new("tag2", "value2"));
         }
 
+        var histogramWithMultipleAggregations = Meter1.CreateHistogram<long>("histogramWithMultipleAggregations");
+        for (int i = 0; i < 20000; i++)
+        {
+            histogramWithMultipleAggregations.Record(random.Next(1, 1000), new("tag1", "value1"), new("tag2", "value2"));
+        }
+
         var counterCustomTags = Meter1.CreateCounter<long>("MyCounterCustomTags");
         for (int i = 0; i < 20000; i++)
         {

docs/metrics/customizing-the-sdk/README.md

@@ -200,29 +200,56 @@ used.
 
 ##### Explicit bucket histogram aggregation
 
-By default, the boundaries used for a Histogram are [`{ 0, 5, 10, 25, 50, 75,
-100, 250, 500, 750, 1000, 2500, 5000, 7500, 10000}`](https://github.com/open-telemetry/opentelemetry-specification/blob/v1.14.0/specification/metrics/sdk.md#explicit-bucket-histogram-aggregation).
-Views can be used to provide custom boundaries for a Histogram. The measurements
-are then aggregated using the custom boundaries provided instead of the
-default boundaries. This requires the use of
-`ExplicitBucketHistogramConfiguration`.
+By default, the [OpenTelemetry
+Specification](https://github.com/open-telemetry/opentelemetry-specification/blob/v1.14.0/specification/metrics/sdk.md#explicit-bucket-histogram-aggregation)
+defines explicit buckets (aka boundaries) for Histograms as: `[ 0, 5, 10, 25,
+50, 75, 100, 250, 500, 750, 1000, 2500, 5000, 7500, 10000 ]`.
 
-```csharp
-    // Change Histogram boundaries to count measurements under the following buckets:
-    // (-inf, 10]
-    // (10, 20]
-    // (20, +inf)
-    .AddView(
-        instrumentName: "MyHistogram",
-        new ExplicitBucketHistogramConfiguration { Boundaries = new double[] { 10, 20 } })
+###### Customizing explicit buckets when using histogram aggregation
 
-    // If you provide an empty `double` array as `Boundaries` to the `ExplicitBucketHistogramConfiguration`,
-    // the SDK will only export the sum, count, min and max for the measurements.
-    // There are no buckets exported in this case.
-    .AddView(
-        instrumentName: "MyHistogram",
-        new ExplicitBucketHistogramConfiguration { Boundaries = Array.Empty<double>() })
-```
+There are two mechanisms available to configure explicit buckets when using
+histogram aggregation:
+
+* View API - Part of the OpenTelemetry .NET SDK.
+* Advice API - Part of the `System.Diagnostics.DiagnosticSource` package
+  starting with version `9.0.0`.
+
+> [!IMPORTANT]
+> When both the View API and Advice API are used, the View API takes precedence.
+  If explicit buckets are not provided by either the View API or the Advice API
+  then the SDK defaults apply.
+
+* View API
+
+  Views can be used to provide custom explicit buckets for a Histogram. This
+  requires the use of `ExplicitBucketHistogramConfiguration`.
+
+  ```csharp
+   // Change Histogram boundaries to count measurements under the following buckets:
+   // (-inf, 10]
+   // (10, 20]
+   // (20, +inf)
+   .AddView(
+       instrumentName: "MyHistogram",
+       new ExplicitBucketHistogramConfiguration { Boundaries = new double[] { 10, 20 } })
+
+   // If you provide an empty `double` array as `Boundaries` to the `ExplicitBucketHistogramConfiguration`,
+   // the SDK will only export the sum, count, min and max for the measurements.
+   // There are no buckets exported in this case.
+   .AddView(
+       instrumentName: "MyHistogram",
+       new ExplicitBucketHistogramConfiguration { Boundaries = Array.Empty<double>() })
+  ```
+
+* Advice API
+
+  Starting with the `1.10.0` SDK, explicit buckets for a Histogram may be provided
+  by instrumentation authors when the instrument is created. This is generally
+  recommended to be used by library authors when the SDK defaults don't match the
+  required granularity for the histogram being emitted.
+
+  See: [Using Advice to customize Histogram
+  instruments](https://learn.microsoft.com/dotnet/core/diagnostics/metrics-instrumentation#using-advice-to-customize-histogram-instruments).
 
 ##### Base2 exponential bucket histogram aggregation
 
@@ -245,6 +272,90 @@ within the maximum number of buckets defined by `MaxSize`. The default
         new Base2ExponentialBucketHistogramConfiguration { MaxSize = 40 })
 ```
 
+#### Produce multiple metrics from single instrument
+
+When an instrument matches multiple views, it can generate multiple metrics. For
+instance, if an instrument is matched by two different view configurations, it
+will result in two separate metrics being produced from that single instrument.
+Below is an example demonstrating how to leverage this capability to create two
+independent metrics from a single instrument. In this example, a histogram
+instrument is used to report measurements, and views are configured to produce
+two metrics : one aggregated using `ExplicitBucketHistogramConfiguration` and the
+other using `Base2ExponentialBucketHistogramConfiguration`.
+
+```csharp
+    var histogramWithMultipleAggregations = meter.CreateHistogram<long>("HistogramWithMultipleAggregations");
+
+    // Configure the Explicit Bucket Histogram aggregation with custom boundaries and new name.
+    .AddView(instrumentName: "HistogramWithMultipleAggregations", new ExplicitBucketHistogramConfiguration() { Boundaries = new double[] { 10, 20 }, Name = "MyHistogramWithExplicitHistogram" })
+
+    // Use Base2 Exponential Bucket Histogram aggregation and new name.
+    .AddView(instrumentName: "HistogramWithMultipleAggregations", new Base2ExponentialBucketHistogramConfiguration() { Name = "MyHistogramWithBase2ExponentialBucketHistogram" })
+
+    // Both views rename the metric to avoid name conflicts. However, in this case,
+    // renaming one would be sufficient.
+
+    // This measurement will be aggregated into two separate metrics.
+    histogramWithMultipleAggregations.Record(10, new("tag1", "value1"), new("tag2", "value2"));
+```
+
+When using views that produce multiple metrics from single instrument, it's
+crucial to rename the metric to prevent conflicts. In the event of conflict,
+OpenTelemetry will emit an internal warning but will still export both metrics.
+The impact of this behavior depends on the backend or receiver being used. You
+can refer to [OpenTelemetry's
+specification](https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/metrics/data-model.md#opentelemetry-protocol-data-model-consumer-recommendations)
+for more details.
+
+Below example is showing the *BAD* practice. DO NOT FOLLOW it.
+
+```csharp
+    var histogram = meter.CreateHistogram<long>("MyHistogram");
+
+    // Configure a view to aggregate based only on the "location" tag.
+    .AddView(instrumentName: "MyHistogram", metricStreamConfiguration: new MetricStreamConfiguration
+        {
+            TagKeys = new string[] { "location" },
+        })
+
+    // Configure another view to aggregate based only on the "status" tag.
+    .AddView(instrumentName: "MyHistogram", metricStreamConfiguration: new MetricStreamConfiguration
+        {
+            TagKeys = new string[] { "status" },
+        })
+
+    // The measurement below will be aggregated into two metric streams, but both will have the same name.
+    // OpenTelemetry will issue a warning about this conflict and pass both streams to the exporter.
+    // However, this may cause issues depending on the backend.
+    histogram.Record(10, new("location", "seattle"), new("status", "OK"));
+```
+
+The modified version, avoiding name conflict is shown below:
+
+```csharp
+    var histogram = meter.CreateHistogram<long>("MyHistogram");
+
+    // Configure a view to aggregate based only on the "location" tag,
+    // and rename the metric.
+    .AddView(instrumentName: "MyHistogram", metricStreamConfiguration: new MetricStreamConfiguration
+        {
+            Name = "MyHistogramWithLocation",
+            TagKeys = new string[] { "location" },
+        })
+
+    // Configure a view to aggregate based only on the "status" tag,
+    // and rename the metric.
+    .AddView(instrumentName: "MyHistogram", metricStreamConfiguration: new MetricStreamConfiguration
+        {
+            Name = "MyHistogramWithStatus",
+            TagKeys = new string[] { "status" },
+        })
+
+    // The measurement below will be aggregated into two separate metrics, "MyHistogramWithLocation"
+    // and "MyHistogramWithStatus".
+    histogram.Record(10, new("location", "seattle"), new("status", "OK"));
+```
+
 > [!NOTE]
 > The SDK currently does not support any changes to `Aggregation` type
 by using Views.
@@ -319,9 +430,8 @@ metrics managed by a given `MeterProvider`, use the
 
 > [!CAUTION]
 > `MeterProviderBuilder.SetMaxMetricPointsPerMetricStream` is marked `Obsolete`
-  in pre-release builds and has been replaced by
-  `MetricStreamConfiguration.CardinalityLimit`. For details see:
-  [OTEL1003](../../diagnostics/experimental-apis/OTEL1003.md).
+  in stable builds since 1.10.0 and has been replaced by
+  `MetricStreamConfiguration.CardinalityLimit`.
 
 ```csharp
 using var meterProvider = Sdk.CreateMeterProviderBuilder()
@@ -337,11 +447,6 @@ To set the [cardinality limit](../README.md#cardinality-limits) for an
 individual metric, use the `MetricStreamConfiguration.CardinalityLimit` property
 on the View API:
 
-> [!NOTE]
-> `MetricStreamConfiguration.CardinalityLimit` is an experimental API only
-  available in pre-release builds. For details see:
-  [OTEL1003](../../diagnostics/experimental-apis/OTEL1003.md).
-
 ```csharp
 var meterProvider = Sdk.CreateMeterProviderBuilder()
     .AddMeter("MyCompany.MyProduct.MyLibrary")

docs/metrics/customizing-the-sdk/customizing-the-sdk.csproj

@@ -1,4 +1,8 @@
 <Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <NoWarn>$(NoWarn);CA5394</NoWarn>
+  </PropertyGroup>
+
   <ItemGroup>
     <ProjectReference Include="$(RepoRoot)\src\OpenTelemetry.Exporter.Console\OpenTelemetry.Exporter.Console.csproj" />
   </ItemGroup>

docs/metrics/exemplars/Program.cs

@@ -8,7 +8,9 @@ using OpenTelemetry.Exporter;
 using OpenTelemetry.Metrics;
 using OpenTelemetry.Trace;
 
-public class Program
+namespace Exemplars;
+
+internal static class Program
 {
     private static readonly ActivitySource MyActivitySource = new("OpenTelemetry.Demo.Exemplar");
     private static readonly Meter MyMeter = new("OpenTelemetry.Demo.Exemplar");

docs/metrics/exemplars/README.md

@@ -58,7 +58,7 @@ and
 enabled:
 
 ```sh
-./prometheus --enable-feature=exemplar-storage --enable-feature=otlp-write-receiver
+./prometheus --enable-feature=exemplar-storage --web.enable-otlp-receiver
 ```
 
 ## Install and configure Grafana

docs/metrics/exemplars/exemplars.csproj

@@ -1,4 +1,8 @@
 <Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <NoWarn>$(NoWarn);CA5394</NoWarn>
+  </PropertyGroup>
+
   <ItemGroup>
     <ProjectReference Include="$(RepoRoot)\src\OpenTelemetry.Exporter.OpenTelemetryProtocol\OpenTelemetry.Exporter.OpenTelemetryProtocol.csproj" />
   </ItemGroup>

docs/metrics/extending-the-sdk/MyExporter.cs

@@ -5,7 +5,7 @@ using System.Text;
 using OpenTelemetry;
 using OpenTelemetry.Metrics;
 
-internal class MyExporter : BaseExporter<Metric>
+internal sealed class MyExporter : BaseExporter<Metric>
 {
     private readonly string name;
 
@@ -28,7 +28,7 @@ internal class MyExporter : BaseExporter<Metric>
                 sb.Append(", ");
             }
 
-            sb.Append($"{metric.Name}");
+            sb.Append(metric.Name);
 
             foreach (ref readonly var metricPoint in metric.GetMetricPoints())
             {
@@ -52,6 +52,7 @@ internal class MyExporter : BaseExporter<Metric>
 
     protected override void Dispose(bool disposing)
     {
+        base.Dispose(disposing);
         Console.WriteLine($"{this.name}.Dispose({disposing})");
     }
 }

docs/metrics/extending-the-sdk/Program.cs

@@ -8,7 +8,7 @@ using OpenTelemetry.Metrics;
 
 namespace ExtendingTheSdk;
 
-public class Program
+internal static class Program
 {
     private static readonly Meter MyMeter = new("MyCompany.MyProduct.MyLibrary", "1.0");
     private static readonly Counter<long> MyFruitCounter = MyMeter.CreateCounter<long>("MyFruitCounter");

docs/metrics/extending-the-sdk/extending-the-sdk.csproj

@@ -1,4 +1,8 @@
 <Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <NoWarn>$(NoWarn);CA2000;CA1510;CA1305</NoWarn>
+  </PropertyGroup>
+
   <ItemGroup>
     <ProjectReference Include="$(RepoRoot)\src\OpenTelemetry\OpenTelemetry.csproj" />
   </ItemGroup>

docs/metrics/getting-started-console/Program.cs

@@ -5,7 +5,9 @@ using System.Diagnostics.Metrics;
 using OpenTelemetry;
 using OpenTelemetry.Metrics;
 
-public class Program
+namespace GettingStartedConsole;
+
+internal static class Program
 {
     private static readonly Meter MyMeter = new("MyCompany.MyProduct.MyLibrary", "1.0");
     private static readonly Counter<long> MyFruitCounter = MyMeter.CreateCounter<long>("MyFruitCounter");

docs/metrics/getting-started-prometheus-grafana/Program.cs

@@ -6,7 +6,9 @@ using OpenTelemetry;
 using OpenTelemetry.Exporter;
 using OpenTelemetry.Metrics;
 
-public class Program
+namespace GettingStartedPrometheusGrafana;
+
+internal static class Program
 {
     private static readonly Meter MyMeter = new("MyCompany.MyProduct.MyLibrary", "1.0");
     private static readonly Counter<long> MyFruitCounter = MyMeter.CreateCounter<long>("MyFruitCounter");

docs/metrics/getting-started-prometheus-grafana/README.md

@@ -88,7 +88,7 @@ access. Run the `prometheus(.exe)` server executable with feature flag
 enabled:
 
 ```sh
-./prometheus --enable-feature=otlp-write-receiver
+./prometheus --web.enable-otlp-receiver
 ```
 
 ### View results in Prometheus

docs/metrics/learning-more-instruments/Program.cs

@@ -8,7 +8,7 @@ using OpenTelemetry.Metrics;
 
 namespace LearningMoreInstruments;
 
-public class Program
+internal static class Program
 {
     private static readonly Meter MyMeter = new("MyCompany.MyProduct.MyLibrary", "1.0");
     private static readonly Histogram<long> MyHistogram = MyMeter.CreateHistogram<long>("MyHistogram");

docs/metrics/learning-more-instruments/learning-more-instruments.csproj

@@ -1,4 +1,8 @@
 <Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <NoWarn>$(NoWarn);CA5394</NoWarn>
+  </PropertyGroup>
+
   <ItemGroup>
     <ProjectReference Include="$(RepoRoot)\src\OpenTelemetry\OpenTelemetry.csproj" />
     <ProjectReference Include="$(RepoRoot)\src\OpenTelemetry.Exporter.Console\OpenTelemetry.Exporter.Console.csproj" />

docs/resources/extending-the-sdk/LoggerExtensions.cs

@@ -0,0 +1,12 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+using Microsoft.Extensions.Logging;
+
+namespace ExtendingTheSdk;
+
+internal static partial class LoggerExtensions
+{
+    [LoggerMessage(LogLevel.Information, "Hello from {Name} {Price}")]
+    public static partial void HelloFrom(this ILogger logger, string name, double price);
+}

docs/resources/extending-the-sdk/MyResourceDetector.cs

@@ -3,7 +3,7 @@
 
 using OpenTelemetry.Resources;
 
-internal class MyResourceDetector : IResourceDetector
+internal sealed class MyResourceDetector : IResourceDetector
 {
     public Resource Detect()
     {

docs/resources/extending-the-sdk/Program.cs

@@ -11,7 +11,7 @@ using OpenTelemetry.Trace;
 
 namespace ExtendingTheSdk;
 
-public class Program
+internal static class Program
 {
     private static readonly ActivitySource DemoSource = new("OTel.Demo");
     private static readonly Meter MeterDemoSource = new("OTel.Demo");
@@ -55,7 +55,6 @@ public class Program
         }
 
         var logger = loggerFactory.CreateLogger("OTel.Demo");
-        logger
-            .LogInformation("Hello from {Name} {Price}", "tomato", 2.99);
+        logger.HelloFrom("tomato", 2.99);
     }
 }

docs/trace/README.md

@@ -49,7 +49,7 @@ too frequently. `ActivitySource` is fairly expensive and meant to be reused
 throughout the application. For most applications, it can be modeled as static
 readonly field (e.g. [Program.cs](./getting-started-console/Program.cs)) or
 singleton via dependency injection (e.g.
-[Instrumentation.cs](../../examples/AspNetCore/Instrumentation.cs)).
+[InstrumentationSource.cs](../../examples/AspNetCore/InstrumentationSource.cs)).
 
 :heavy_check_mark: You should use dot-separated
 [UpperCamelCase](https://en.wikipedia.org/wiki/Camel_case) as the

docs/trace/customizing-the-sdk/Program.cs

@@ -8,7 +8,7 @@ using OpenTelemetry.Trace;
 
 namespace CustomizingTheSdk;
 
-public class Program
+internal static class Program
 {
     private static readonly ActivitySource MyLibraryActivitySource = new(
         "MyCompany.MyProduct.MyLibrary");

docs/trace/customizing-the-sdk/README.md

@@ -477,8 +477,8 @@ When using the `AddOpenTelemetry` & `WithTracing` extension methods the
 into an existing collection (typically the collection used is the one managed by
 the application host). The `TracerProviderBuilder` will be able to access all
 services registered into that collection. For lifecycle management, the
-`AddOpenTelemetry` registers an [IHostedService
-](https://learn.microsoft.com/dotnet/api/microsoft.extensions.hosting.ihostedservice)
+`AddOpenTelemetry` registers an
+[IHostedService](https://learn.microsoft.com/dotnet/api/microsoft.extensions.hosting.ihostedservice)
 which is used to automatically start the `TracerProvider` when the host starts
 and the host will automatically shutdown and dispose the `TracerProvider` when
 it is shutdown.

docs/trace/customizing-the-sdk/customizing-the-sdk.csproj

@@ -1,8 +1,4 @@
 <Project Sdk="Microsoft.NET.Sdk">
-  <PropertyGroup>
-    <!-- this is temporary. will remove in future PR. -->
-    <Nullable>disable</Nullable>
-  </PropertyGroup>
   <ItemGroup>
     <ProjectReference Include="$(RepoRoot)\src\OpenTelemetry.Exporter.Console\OpenTelemetry.Exporter.Console.csproj" />
   </ItemGroup>

docs/trace/extending-the-sdk/MyEnrichingProcessor.cs

@@ -4,7 +4,7 @@
 using System.Diagnostics;
 using OpenTelemetry;
 
-internal class MyEnrichingProcessor : BaseProcessor<Activity>
+internal sealed class MyEnrichingProcessor : BaseProcessor<Activity>
 {
     public override void OnEnd(Activity activity)
     {

docs/trace/extending-the-sdk/MyExporter.cs

@@ -5,7 +5,7 @@ using System.Diagnostics;
 using System.Text;
 using OpenTelemetry;
 
-internal class MyExporter : BaseExporter<Activity>
+internal sealed class MyExporter : BaseExporter<Activity>
 {
     private readonly string name;
 
@@ -43,6 +43,7 @@ internal class MyExporter : BaseExporter<Activity>
 
     protected override void Dispose(bool disposing)
     {
+        base.Dispose(disposing);
         Console.WriteLine($"{this.name}.Dispose({disposing})");
     }
 }

docs/trace/extending-the-sdk/MyProcessor.cs

@@ -4,7 +4,7 @@
 using System.Diagnostics;
 using OpenTelemetry;
 
-internal class MyProcessor : BaseProcessor<Activity>
+internal sealed class MyProcessor : BaseProcessor<Activity>
 {
     private readonly string name;
 
@@ -37,6 +37,7 @@ internal class MyProcessor : BaseProcessor<Activity>
 
     protected override void Dispose(bool disposing)
     {
+        base.Dispose(disposing);
         Console.WriteLine($"{this.name}.Dispose({disposing})");
     }
 }

docs/trace/extending-the-sdk/MyResourceDetector.cs

@@ -3,7 +3,7 @@
 
 using OpenTelemetry.Resources;
 
-internal class MyResourceDetector : IResourceDetector
+internal sealed class MyResourceDetector : IResourceDetector
 {
     public Resource Detect()
     {

docs/trace/extending-the-sdk/MySampler.cs

@@ -3,7 +3,7 @@
 
 using OpenTelemetry.Trace;
 
-internal class MySampler : Sampler
+internal sealed class MySampler : Sampler
 {
     public override SamplingResult ShouldSample(in SamplingParameters param)
     {

docs/trace/extending-the-sdk/Program.cs

@@ -8,7 +8,7 @@ using OpenTelemetry.Trace;
 
 namespace ExtendingTheSdk;
 
-public class Program
+internal static class Program
 {
     private static readonly ActivitySource DemoSource = new("OTel.Demo");
 

docs/trace/extending-the-sdk/extending-the-sdk.csproj

@@ -1,4 +1,8 @@
 <Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <NoWarn>$(NoWarn);CA2000;CA1812;CA1510</NoWarn>
+  </PropertyGroup>
+
   <ItemGroup>
     <ProjectReference Include="$(RepoRoot)\src\OpenTelemetry\OpenTelemetry.csproj" />
   </ItemGroup>

docs/trace/getting-started-console/Program.cs

@@ -5,7 +5,9 @@ using System.Diagnostics;
 using OpenTelemetry;
 using OpenTelemetry.Trace;
 
-public class Program
+namespace GettingStartedConsole;
+
+internal static class Program
 {
     private static readonly ActivitySource MyActivitySource = new("MyCompany.MyProduct.MyLibrary");
 
@@ -18,9 +20,10 @@ public class Program
 
         using (var activity = MyActivitySource.StartActivity("SayHello"))
         {
+            int[] intArray = [1, 2, 3];
             activity?.SetTag("foo", 1);
             activity?.SetTag("bar", "Hello, World!");
-            activity?.SetTag("baz", new int[] { 1, 2, 3 });
+            activity?.SetTag("baz", intArray);
             activity?.SetStatus(ActivityStatusCode.Ok);
         }
 

docs/trace/getting-started-jaeger/Program.cs

@@ -11,7 +11,7 @@ using OpenTelemetry.Trace;
 
 namespace GettingStartedJaeger;
 
-public class Program
+internal static class Program
 {
     private static readonly ActivitySource MyActivitySource = new("OpenTelemetry.Demo.Jaeger");
 
@@ -33,13 +33,13 @@ public class Program
         {
             using (var slow = MyActivitySource.StartActivity("SomethingSlow"))
             {
-                await client.GetStringAsync("https://httpstat.us/200?sleep=1000");
-                await client.GetStringAsync("https://httpstat.us/200?sleep=1000");
+                await client.GetStringAsync(new Uri("https://httpstat.us/200?sleep=1000")).ConfigureAwait(false);
+                await client.GetStringAsync(new Uri("https://httpstat.us/200?sleep=1000")).ConfigureAwait(false);
             }
 
             using (var fast = MyActivitySource.StartActivity("SomethingFast"))
             {
-                await client.GetStringAsync("https://httpstat.us/301");
+                await client.GetStringAsync(new Uri("https://httpstat.us/301")).ConfigureAwait(false);
             }
         }
     }

docs/trace/links-based-sampler/LinksAndParentBasedSampler.cs

@@ -13,7 +13,7 @@ namespace LinksAndParentBasedSamplerExample;
 ///  links based sampler. If either of these samplers decide to sample,
 ///  this composite sampler decides to sample.
 /// </summary>
-internal class LinksAndParentBasedSampler : Sampler
+internal sealed class LinksAndParentBasedSampler : Sampler
 {
     private readonly ParentBasedSampler parentBasedSampler;
     private readonly LinksBasedSampler linksBasedSampler;

docs/trace/links-based-sampler/LinksBasedSampler.cs

@@ -10,7 +10,7 @@ namespace LinksAndParentBasedSamplerExample;
 ///  A non-probabilistic sampler that samples an activity if ANY of the linked activities
 ///  is sampled.
 /// </summary>
-internal class LinksBasedSampler : Sampler
+internal sealed class LinksBasedSampler : Sampler
 {
     public override SamplingResult ShouldSample(in SamplingParameters samplingParameters)
     {

docs/trace/links-based-sampler/Program.cs

@@ -7,7 +7,7 @@ using OpenTelemetry.Trace;
 
 namespace LinksAndParentBasedSamplerExample;
 
-internal class Program
+internal static class Program
 {
     private static readonly ActivitySource MyActivitySource = new("LinksAndParentBasedSampler.Example");
 
@@ -37,7 +37,7 @@ internal class Program
     /// Generates a list of activity links. A linked activity is sampled with a probability of 0.1.
     /// </summary>
     /// <returns>A list of links.</returns>
-    private static IEnumerable<ActivityLink> GetActivityLinks(int seed)
+    private static List<ActivityLink> GetActivityLinks(int seed)
     {
         var random = new Random(seed);
         var linkedActivitiesList = new List<ActivityLink>();

docs/trace/links-based-sampler/links-sampler.csproj

@@ -1,4 +1,8 @@
 <Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <NoWarn>$(NoWarn);CA5394</NoWarn>
+  </PropertyGroup>
+
   <ItemGroup>
     <ProjectReference Include="$(RepoRoot)\src\OpenTelemetry.Exporter.Console\OpenTelemetry.Exporter.Console.csproj" />
   </ItemGroup>

docs/trace/links-creation-with-new-activities/Program.cs

@@ -7,7 +7,7 @@ using OpenTelemetry.Trace;
 
 namespace LinksCreationWithNewRootActivitiesDemo;
 
-internal class Program
+internal static class Program
 {
     private static readonly ActivitySource MyActivitySource = new("LinksCreationWithNewRootActivities");
 
@@ -21,7 +21,7 @@ internal class Program
         using (var activity = MyActivitySource.StartActivity("OrchestratingActivity"))
         {
             activity?.SetTag("foo", 1);
-            await DoFanoutAsync();
+            await DoFanoutAsync().ConfigureAwait(false);
 
             using (var nestedActivity = MyActivitySource.StartActivity("WrapUp"))
             {
@@ -77,7 +77,7 @@ internal class Program
         }
 
         // Wait for all tasks to complete
-        await Task.WhenAll(tasks);
+        await Task.WhenAll(tasks).ConfigureAwait(false);
 
         // Reset to the previous activity now that we are done with the fanout
         // This will ensure that the rest of the code executes in the context of the original activity.

docs/trace/reporting-exceptions/Program.cs

@@ -7,7 +7,7 @@ using OpenTelemetry.Trace;
 
 namespace ReportingExceptions;
 
-public class Program
+internal static class Program
 {
     private static readonly ActivitySource MyActivitySource = new(
         "MyCompany.MyProduct.MyLibrary");
@@ -27,7 +27,7 @@ public class Program
             {
                 using (MyActivitySource.StartActivity("Bar"))
                 {
-                    throw new Exception("Oops!");
+                    throw new InvalidOperationException("Oops!");
                 }
             }
         }

docs/trace/stratified-sampling-example/Program.cs

@@ -7,7 +7,7 @@ using OpenTelemetry.Trace;
 
 namespace StratifiedSamplingByQueryTypeDemo;
 
-internal class Program
+internal sealed class Program
 {
     private static readonly ActivitySource MyActivitySource = new("StratifiedSampling.POC");