chore(deps): bump github.com/steadybit/extension-kit from 1.11.2 to 1.12.1 in /go/action_kit_sdk

[dependabot]

Bumps github.com/steadybit/extension-kit from 1.11.2 to 1.12.1.

Changelog

Sourced from github.com/steadybit/extension-kit's changelog.

1.12.1

• Behaviour change — extotel now defaults the OTLP protocol to grpc instead of the specification's http/protobuf. Every Steadybit deployment points at an OTLP/gRPC endpoint on port 4317 and the agent's own SDK defaults to gRPC, so an extension configured the way the agent is configured used to POST to a gRPC port and export nothing, silently. An endpoint copied from the agent now works as written; http/protobuf (port 4318) remains available by setting OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf explicitly.
• feat(extotel): extension spans record experiment.execution.id. The platform puts it into OpenTelemetry baggage and the agent propagates it on every call, but extensions never recorded it — so their spans could only be reached by opening the agent's trace, never by querying a tracing backend for everything a given run did. They are now queryable on their own with { span.experiment.execution.id = "<id>" }. Only that one key is copied; baggage is arbitrary caller-supplied data, and copying all of it would put whatever an upstream service happened to set into the extension's telemetry.
• docs: the README documents OpenTelemetry tracing — what you get, how an extension author enables it, and the full OTEL_* table, including which port goes with which protocol and what an extension that configures the SDK itself has to do.

1.12.0

• feat: new extotel package initializes the OpenTelemetry SDK from the standard OTEL_* environment variables — call extotel.InitOpenTelemetry() once from main(); it returns an idempotent shutdown/flush function and registers an extsignals handler that flushes on SIGTERM/SIGINT. exthttp.RegisterHttpHandler now wraps every handler with otelhttp, so each incoming request produces a METHOD /path span. Tracing stays a noop — and free, a filter short-circuits ahead of the middleware's attribute and span work — until an OTLP endpoint is configured, so existing extensions are unaffected: set OTEL_EXPORTER_OTLP_TRACES_ENDPOINT (or the generic OTEL_EXPORTER_OTLP_ENDPOINT) plus OTEL_SERVICE_NAME to enable it. The transport defaults to http/protobuf per the OpenTelemetry specification, so exporting over gRPC (endpoint port 4317) requires OTEL_EXPORTER_OTLP_PROTOCOL=grpc. SDK errors and logs go through zerolog rather than plain text on stderr.
• feat(extquery): the query language supports // line comments, on their own line or trailing a query; the grammar change is copied from the platform, so every query that parsed before parses identically. Worth knowing: a query made up of nothing but comments has no tokens left, which makes it the empty query — and an empty query matches everything, so commenting a query out widens it rather than emptying it.
• fix(exthttp): WaitForServe could block forever once the server was already up. A waiter that had not acquired the lock before listen() broadcast missed the broadcast and then waited for an event that had already happened; it now loops on a serving predicate, so a late waiter observes the state instead.
• chore(deps): github.com/klauspost/compress 1.19.2 → 1.20.0, github.com/stretchr/testify 1.11.1 → 1.12.1, golang.org/x/sys 0.47.0 → 0.48.0

1.11.1

• feat: new extquery package parses and evaluates Steadybit target query language strings. extquery.Validate(query) / ValidateAll(queries...) return a *ParseError with line and column — intended for the queries extensions embed in their advice and action definitions (AssessmentQueryApplicable, AssessmentQueryExclude, TargetSelection.TargetQuery, TargetSelectionTemplate.Query), which are otherwise only checked by the platform once the extension is released. extquery.Parse(query) returns a reusable, concurrency-safe Predicate that matches against a target's attributes, so extensions can filter targets before they reach the agent; adapt attributes with MapAttributes or AttributesFunc. The parser is generated from the platform's ANTLR grammar and matching behaviour is pinned by a conformance corpus shared with the platform; see extquery/README.md.

1.11.0

• Requires Go 1.26.5 (up from 1.25.0). Extensions must raise their own go directive and toolchain to build against this version.
• feat: exthttp.Revision()/BumpRevision() and exthttp.RegisterRevisionedHandler centralize the extension index ETag. The revision is seeded with a startup nonce and bumped whenever a kit registers/clears a describable element, so the agent's index-response cache invalidates on registration changes without relying on a process restart. Extensions can replace the hand-rolled startedAt + IfNoneMatchHandler boilerplate with exthttp.RegisterRevisionedHandler("/", getExtensionList).
• chore(deps): github.com/elastic/go-sysinfo 1.15.4 → 1.15.5, github.com/klauspost/compress 1.18.6 → 1.19.0, golang.org/x/sys 0.45.0 → 0.46.0

1.10.8

• fix: reject a request with a 400 and stop processing when its body can't be read, instead of falling through and running the handler with a nil body after the response was already written (exthttp request-logging middleware)
• fix: extutil.ToString/ToBool/ToKeyValue/ToStringArray no longer panic on malformed (agent-supplied) config values — they return the zero value (or an error, for ToKeyValue) on a type mismatch, matching the other To* converters
• fix: exthealth no longer has a data race on the probes HTTP server pointer — it is assigned before the serving goroutine starts, so StopProbes and the shutdown signal handler can't race the assignment or read a nil server
• fix: extsignals recovers panics per signal handler (one misbehaving handler can no longer crash the dispatch goroutine and abort the remaining ordered shutdown handlers) and no longer panics on a non-syscall.Signal

1.10.7

• feat: add extheartbeat — a concurrency-safe heartbeat watchdog (Monitor/Notify) shared by the action- and preflight-kit SDKs, which previously each carried their own identical copy

1.10.6

• feat: add CmdState.Wait() and CmdState.ExitCode() to extcmd so extensions can read a command's exit code without racing the goroutine that reaps the process

1.10.5

• feat: add extruntime.AdjustOOMScoreAdj() to protect extensions from the Linux OOM killer
• Bump Go to 1.25.9

1.10.4

• fix: support pre-release identifiers in version strings returned by extbuild.GetSemverVersionStringOrUnknown()

1.10.3

• feat: apply timeout on requests with "Request-Timeout" header is present

... (truncated)

Commits

• d50edf9 chore: prepare release v1.12.1
• 446216c feat(extotel): record the experiment execution id on extension spans (#180)
• ce429db fix(extotel): default the OTLP protocol to gRPC (#179)
• e020ddd docs: document OpenTelemetry tracing (#178)
• a18766f chore: prepare release v1.12.0
• e7799d6 Merge pull request #177 from steadybit/dependabot/go_modules/google.golang.or...
• 24dd951 chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2
• cf481f1 feat: add OpenTelemetry HTTP tracing support (#114)
• ad985fe fix(exthttp): WaitForServe could block forever once the server was up (#176)
• bb7ba98 Merge pull request #175 from steadybit/dependabot/go_modules/golang.org/x/sys...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud