chore: bump libdatadog

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @DataDog/dd-trace-js @DataDog/libdatadog

.github/actions/build-test-wasm/action.yaml

@@ -0,0 +1,39 @@
+name: 'Build/Test WASM'
+description: 'A simple composite GitHub Action sets-up WASM; then test & build relevant crates'
+inputs:
+  crate:
+    description: 'The crate name. Must be in ./crates'
+    required: true
+runs:
+  using: 'composite'
+  steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - name: Setup Node.js
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+      - run: yarn install
+        shell: bash
+      - name: Install wasm-pack
+        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
+        shell: bash
+      - name: Build WASM
+        run: |
+          mkdir -p ./prebuilds/${{ inputs.crate }}
+          wasm-pack build --target nodejs ./crates/${{ inputs.crate }} --out-dir ../../prebuilds/${{ inputs.crate }}
+        shell: bash
+      - name: Test WASM
+        # The pipeline crate's tests are top-level node:test suites that need
+        # --test-force-exit (the wasm exporter keeps the event loop alive after
+        # a flush); the other wasm crates use plain test/wasm/<crate>/ scripts.
+        run: |
+          if [ "${{ inputs.crate }}" = "pipeline" ]; then
+            node --test --test-force-exit test/pipeline.js
+          else
+            node test-wasm.js ${{ inputs.crate }}
+          fi
+        shell: bash
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: prebuilds-wasm-${{ inputs.crate }}
+          if-no-files-found: ignore
+          path: ./prebuilds/*

.github/chainguard/self.github.release.push-tags.sts.yaml

@@ -0,0 +1,12 @@
+issuer: https://token.actions.githubusercontent.com
+
+subject: repo:DataDog/libdatadog-nodejs:environment:npm
+
+claim_pattern:
+  event_name: push
+  job_workflow_ref: DataDog/libdatadog-nodejs/\.github/workflows/release\.yml@refs/heads/v[0-9]+\.x
+  ref: refs/heads/v[0-9]+\.x
+  repository: DataDog/libdatadog-nodejs
+
+permissions:
+  contents: write

.github/dependabot.yml

@@ -0,0 +1,70 @@
+# Dependabot version updates
+# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 5
+      exclude:
+        - "@datadog/*"
+    groups:
+      gh-actions-packages:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    versioning-strategy: "increase"
+    labels:
+      - dependabot
+      - dependencies
+      - javascript
+      - semver-patch
+    groups:
+      patch-updates:
+        update-types:
+          - "patch"
+      minor-updates:
+        update-types:
+          - "minor"
+
+  - package-ecosystem: "npm"
+    directory: "/test/crashtracker"
+    schedule:
+      interval: "weekly"
+    versioning-strategy: "increase"
+    labels:
+      - dependabot
+      - dependencies
+      - javascript
+      - semver-patch
+    groups:
+      patch-updates:
+        update-types:
+          - "patch"
+      minor-updates:
+        update-types:
+          - "minor"
+
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    labels:
+      - dependabot
+      - dependencies
+      - rust
+      - semver-patch
+    groups:
+      patch-updates:
+        update-types:
+          - "patch"
+      minor-updates:
+        update-types:
+          - "minor"

.github/workflows/build.yml

@@ -7,26 +7,57 @@ on:
       - main
 
 jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Setup Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - run: yarn install
+      - run: yarn install
+        working-directory: test/crashtracker
+      - run: yarn lint
+
+  build-test-wasm:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        crate:
+          - library_config
+          - datadog-js-zstd
+          - pipeline
+          - sketches
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: 'Use composite action'
+        uses: ./.github/actions/build-test-wasm
+        with:
+          crate: '${{ matrix.crate }}'
+
   build:
     uses: Datadog/action-prebuildify/.github/workflows/build.yml@main
+    needs: build-test-wasm
     with:
-      package-manager: 'npm'
+      package-manager: 'yarn'
       cache: false
-      min-node-version: 14
+      min-node-version: 18
       rust: true
-      only: linux-arm64,linux-x64,linuxmusl-arm64,linuxmusl-x64
+      only: darwin-arm64,darwin-x64,linux-arm64,linux-x64
+      # Need this, now that libdatadog packages libunwind as a submodule
+      prebuild: '(command -v apk >/dev/null && apk add autoconf automake libtool) || (command -v apt-get >/dev/null && apt-get update && apt-get install -y autoconf automake libtool) || true'
+
   package-size:
     runs-on: ubuntu-latest
     needs: build
     permissions:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       - name: Setup Node.js
-        uses: actions/setup-node@v4
-      - run: yarn
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - run: yarn install
       - name: Compute module size tree and report
         uses: qard/heaviest-objects-in-the-universe@v1
         with:

.github/workflows/release.yml

@@ -5,28 +5,65 @@ on:
     branches:
       - v0.x
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
-  cancel-in-progress: true
-
 jobs:
+  build-test-wasm:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        crate:
+          - library_config
+          - datadog-js-zstd
+          - pipeline
+          - sketches
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: 'Use composite action'
+        uses: ./.github/actions/build-test-wasm
+        with:
+          crate: '${{ matrix.crate }}'
+
+  build:
+    uses: Datadog/action-prebuildify/.github/workflows/build.yml@main
+    needs: build-test-wasm
+    with:
+      package-manager: 'yarn'
+      cache: false
+      min-node-version: 18
+      rust: true
+      only: darwin-arm64,darwin-x64,linux-arm64,linux-x64
+
   publish:
     runs-on: ubuntu-latest
+    needs: build
     environment: npm
-    env:
-      NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+    permissions:
+      id-token: write  # Required for OIDC
+      contents: read
     outputs:
       pkgjson: ${{ steps.pkg.outputs.json }}
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v3
+      - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
+        id: octo-sts
+        with:
+          scope: DataDog/libdatadog-nodejs
+          policy: self.github.release.push-tags
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false # drop GITHUB_TOKEN so the dd-octo-sts token is used for the tag push
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: prebuilds
+          path: prebuilds
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
+          node-version: '24'
           registry-url: 'https://registry.npmjs.org'
+      - run: chmod -R +x ./prebuilds
       - run: npm publish
       - id: pkg
         run: |
           content=`cat ./package.json | tr '\n' ' '`
-          echo "::set-output name=json::$content"
+          echo "json=$content" >> $GITHUB_OUTPUT
       - run: |
           git tag v${{ fromJson(steps.pkg.outputs.json).version }}
-          git push origin v${{ fromJson(steps.pkg.outputs.json).version }}
+          git push https://x-access-token:${{ steps.octo-sts.outputs.token }}@github.com/${{ github.repository }}.git v${{ fromJson(steps.pkg.outputs.json).version }}

.yarnrc

@@ -0,0 +1 @@
+--ignore-engines true