[trask]

Enrol projects/opentelemetry-java-instrumentation

Enroll OpenTelemetry Java instrumentation with security@opentelemetry.io as the primary contact. Send all vulnerability findings through GitHub private vulnerability reporting, with email findings disabled.

output_format:
  email:
    min_severity: none
  github_security_advisory:
    min_severity: low

I have verified each of the following before submitting this project (tick each box by changing [ ] to [x]):

• I am a core maintainer of this project.
• I accept the OSS Scanner terms.
• I confirm that I believe my project meets the inclusion criteria and is an established project that users depend on.
• project.yaml follows the README (one project per PR; tools/validate.py passes locally).
• tools/check <name> builds the project, and its tests run in the shell that follows.
• primary_contact must be the email address of the primary security contact.
• There is a Dockerfile that builds the project (required) in one of two places: in the project's repository at the path dockerfile: names, or next to project.yaml in this repo.
• threat_model.md is written for this project (recommended but optional), placed in the same way: in the repository at the path threat_model: names, or next to project.yaml in this repo.

The Dockerfile runs classes testClasses :javaagent:assemble without executing tests. It invokes the pinned upstream Thrift compiler directly because Docker is unavailable inside the scanner's build container.

All default-build test runtime dependencies and the JaCoCo coverage agent are downloaded before Gradle defaults to offline. Extra test JDKs and Docker/service dependencies are not prefetched.

python tools\validate.py passed. python tools\check opentelemetry-java-instrumentation --no-shell passed in 37 minutes 26 seconds, including cloning, scanner tooling, and image creation.

In the finished image with Docker networking disabled, 2 CPUs, and 8 GB RAM, ./gradlew --offline --continue --no-daemon --console=plain --no-configuration-cache --max-workers=2 "-Dorg.gradle.jvmargs=-Xmx4g -XX:MaxMetaspaceSize=1g" ossScannerResolveTestRuntime :instrumentation-api:test --tests "*InstrumenterTest" :instrumentation:spring:spring-boot-autoconfigure:test --tests "*OpenTelemetryAutoConfigurationTest" passed in 1 minute 57 seconds. This checks all prefetched runtime dependencies and two selected test groups; the full test suite was not run.

To sign the CLA, post a comment on this pull request that contains only this line: I have read the CLA Document and I hereby sign the CLA

To change an enrolment, edit project.yaml; to pause reports, set disabled: true; to withdraw the project, remove projects/<name>/.

Context (optional): OpenTelemetry Java instrumentation runs inside application processes and instruments libraries that handle untrusted HTTP requests, messaging payloads, and other application inputs.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

0 out of 2 committers have signed the CLA.
❌ @trask
❌ @Copilot
_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[github-actions]

Enrolment triage: projects/opentelemetry-java-instrumentation

Repository: open-telemetry/opentelemetry-java-instrumentation at main · opened by trask

	Check	Result
✅	Repository	created 7 years ago, last push today
ℹ️	Stars / forks	2,658 stars · 1,178 forks · 53 watching
ℹ️	Outside participants	11 people from outside the project opened 14 of the last 100 issues and pull requests
ℹ️	Criticality score	0.81 on the OpenSSF scale of 0 to 1 signals created_since 115, updated_since 0, contributor_count 433, org_count 6, commit_frequency 81.3, recent_releases_count 16, closed_issues_count 1,339, updated_issues_count 1,414, comment_frequency 1.9, dependents_count 5,728
ℹ️	Package rank	by downloads: nothing from this repository found in the top 15,000 on PyPI or the top 10,000 on npm
✅	License	Apache-2.0
✅	Opened by an active maintainer	member of the owning organisation; 100+ commits in the last 12 months; #1 contributor
✅	Contact in SECURITY.md	security@opentelemetry.io is in SECURITY.md of open-telemetry/.github
ℹ️	OSS-Fuzz	no OSS-Fuzz project is for this repository, but opentelemetry there is for https://github.com/open-telemetry/community
ℹ️	.oss-scanner/ in the repository	not present; no threat model (optional); the Dockerfile is in this pull request
✅	Pull request scope	only this project's directory
✅	tools/validate.py	passes
⚠️	Checklist	1 of 7 not ticked: I accept the [OSS Scanner terms](https://red.anthropic.com/oss-scanner/terms/).

_{Automated, from public data, to help reviewers. Enrolment is decided case by case against the criteria. If you think we got something wrong, please tell us in a reply.}