Sync integration branch with next

.buildkite/pipeline.yml

@@ -1,3 +1,6 @@
+agents:
+  queue: opensource
+
 steps:
 
   - label: ':android: Coding standards checks'
@@ -112,6 +115,7 @@ steps:
   - label: 'Publish :rocket:'
     if: build.branch == "main"
     depends_on: 'android-common'
+    timeout_in_minutes: 30
     env:
       BUILDKITE_PLUGIN_S3_SECRETS_BUCKET_PREFIX: bugsnag-android-publish
     plugins:

.github/workflows/scorecard.yml

@@ -0,0 +1,73 @@
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: Scorecard supply-chain security
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  schedule:
+    - cron: '0 0 * * 0'
+  push:
+    branches: [ "next" ]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+      # Uncomment the permissions below if installing in a private repository.
+      # contents: read
+      # actions: read
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+          # - you want to enable the Branch-Protection check on a *public* repository, or
+          # - you are installing Scorecard on a *private* repository
+          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
+          # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+          # Public repositories:
+          #   - Publish results to OpenSSF REST API for easy access by consumers
+          #   - Allows the repository to include the Scorecard badge.
+          #   - See https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories:
+          #   - `publish_results` will always be set to `false`, regardless
+          #     of the value entered here.
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@97a0fba1372883ab732affbe8f94b823f91727db # v3.pre.node20
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard (optional).
+      # Commenting out will disable upload of results to your repo's Code Scanning dashboard
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif

.github/workflows/signing.yml

@@ -0,0 +1,32 @@
+name: Sign release assets
+
+permissions: read-all
+
+on:
+  release:
+    types: [released]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag to sign'
+        required: true
+        type: string
+jobs:
+  sign-assets:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install gpg
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y gnupg
+      - name: Import GPG key
+        run: |
+          echo "${{ secrets.PLATFORMS_GPG_KEY_BASE64 }}" | base64 --decode | gpg --batch --import
+      - name: Sign assets
+        uses: bugsnag/platforms-release-signer@main
+        with:
+          github_token: ${{ secrets.PLATFORMS_SIGNING_GITHUB_TOKEN }}
+          full_repository: ${{ github.repository }}
+          release_tag: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.event.release.tag_name }}
+          key_id: ${{ secrets.PLATFORMS_GPG_KEY_ID }}
+          key_passphrase: ${{ secrets.PLATFORMS_GPG_KEY_PASSPHRASE }}

bugsnag-android-performance/src/main/kotlin/com/bugsnag/android/performance/internal/SpanImpl.kt

@@ -96,9 +96,8 @@ public class SpanImpl internal constructor(
 
     override fun end(endTime: Long) {
         if (state.end()) {
-            this.endTime = endTime
+            markEndTime(endTime)
 
-            startFrameMetrics?.let { framerateMetricsSource?.endMetrics(it, this) }
             if (makeContext) SpanContext.detach(this)
             NotifierIntegration.onSpanEnded(this)
 
@@ -108,7 +107,14 @@ public class SpanImpl internal constructor(
         }
     }
 
-    private fun sendForProcessing() {
+    @JvmName("markEndTime\$internal")
+    internal fun markEndTime(endTime: Long) {
+        this.endTime = endTime
+        startFrameMetrics?.let { framerateMetricsSource?.endMetrics(it, this) }
+    }
+
+    @JvmName("sendForProcessing\$internal")
+    internal fun sendForProcessing() {
         if (state.process()) {
             processor.onEnd(this)
         }

bugsnag-android-performance/src/main/kotlin/com/bugsnag/android/performance/internal/ViewLoadPhase.kt

@@ -8,6 +8,7 @@ public enum class ViewLoadPhase(private val phaseName: String) {
     CREATE("Create"),
     START("Start"),
     RESUME("Resume"),
+    DRAW("Draw"),
     ;
 
     internal fun phaseNameFor(viewType: ViewType): String {

bugsnag-plugin-android-performance-compose/src/main/java/com/bugsnag/android/performance/compose/MeasuredComposable.kt

@@ -14,6 +14,8 @@ import com.bugsnag.android.performance.BugsnagPerformance
 import com.bugsnag.android.performance.SpanContext
 import com.bugsnag.android.performance.SpanOptions
 import com.bugsnag.android.performance.ViewType
+import com.bugsnag.android.performance.internal.BugsnagPerformanceInternals
+import com.bugsnag.android.performance.internal.ViewLoadPhase
 
 @Immutable
 internal data class ValueContainer<T>(var content: T)
@@ -57,9 +59,12 @@ public fun MeasuredComposable(
         Box(
             modifier = modifier then Modifier.drawWithContent {
                 if (span?.isEnded() != true) {
-                    BugsnagPerformance.startSpan("Draw", RENDER_SPAN_OPTIONS.within(span)).use {
-                        drawContent()
-                    }
+                    BugsnagPerformanceInternals.spanFactory.createViewLoadPhaseSpan(
+                        name,
+                        ViewType.COMPOSE,
+                        ViewLoadPhase.DRAW,
+                        RENDER_SPAN_OPTIONS.within(span),
+                    ).use { drawContent() }
                     span?.end()
                 } else {
                     drawContent()