Skip to content

Align OTLP shared import with header-based secret contract#32791

Closed
Copilot wants to merge 6 commits into
mainfrom
copilot/fix-otel-export-error
Closed

Align OTLP shared import with header-based secret contract#32791
Copilot wants to merge 6 commits into
mainfrom
copilot/fix-otel-export-error

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented May 17, 2026 •
edited
Loading

The OTEL smoke test was failing on the local write path with a 401 from one configured OTLP backend. The root cause was a contract mismatch: the shared OTLP import still generated GH_AW_OTEL_*_AUTHORIZATION wiring while the workflow/docs expected GH_AW_OTEL_*_HEADERS.

  • What changed

    • Updated .github/workflows/shared/observability-otlp.md to consume GH_AW_OTEL_SENTRY_HEADERS and GH_AW_OTEL_GRAFANA_HEADERS.
    • Regenerated smoke-otel-backends.lock.yml so the compiled workflow now passes the header secrets through OTEL_EXPORTER_OTLP_HEADERS, GH_AW_OTLP_ALL_HEADERS, and GH_AW_OTLP_ENDPOINTS consistently.

  • Why this addresses the failure

    • The exporter already supports full header strings per endpoint.
    • Using the documented *_HEADERS secrets removes the stale Authorization=... wrapper assumption and restores the intended secret contract for multi-endpoint OTLP fan-out.

  • Regression coverage

    • Added a focused compiler test to ensure imported workflows compile with GH_AW_OTEL_*_HEADERS and no longer reference the deprecated GH_AW_OTEL_*_AUTHORIZATION secrets.
observability:
  otlp:
    endpoint:
      - url: ${{ secrets.GH_AW_OTEL_SENTRY_ENDPOINT }}
        headers: ${{ secrets.GH_AW_OTEL_SENTRY_HEADERS }}
      - url: ${{ secrets.GH_AW_OTEL_GRAFANA_ENDPOINT }}
        headers: ${{ secrets.GH_AW_OTEL_GRAFANA_HEADERS }}

Copilot AI linked an issue May 17, 2026 that may be closed by this pull request
Smoke Test: OTEL Backends - 25986170685 #32782
Closed
Copilot AI and others added 2 commits May 17, 2026 09:35
@mnkiefer
Use OTLP header secrets in shared observability import
1b72bed 
Co-authored-by: mnkiefer <8320933+mnkiefer@users.noreply.github.com>
@mnkiefer
Harden OTLP shared import regression test
040b894 
Co-authored-by: mnkiefer <8320933+mnkiefer@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix OTLP export error in smoke test Align OTLP shared import with header-based secret contract May 17, 2026
Copilot AI requested a review from mnkiefer May 17, 2026 09:40
@mnkiefer
Copy link
Copy Markdown
Collaborator

mnkiefer commented May 17, 2026

@copilot _HEADERS only valuables are outdated. We now have _AUTHORIZATION ones. Don't keep legacy ones.

Copilot AI and others added 2 commits May 17, 2026 09:49
@mnkiefer
chore: start review feedback follow-up
c557ae4 
Co-authored-by: mnkiefer <8320933+mnkiefer@users.noreply.github.com>
@mnkiefer
Restore OTLP shared import authorization contract
1d96d95 
Co-authored-by: mnkiefer <8320933+mnkiefer@users.noreply.github.com>
Copy link
Copy Markdown
Contributor Author

Copilot AI commented May 17, 2026

@copilot _HEADERS only valuables are outdated. We now have _AUTHORIZATION ones. Don't keep legacy ones.

Addressed in 1d96d95. The shared OTLP import, generated smoke workflow, and regression test now all use the _AUTHORIZATION secrets again.

@mnkiefer
Copy link
Copy Markdown
Collaborator

mnkiefer commented May 17, 2026

@copilot Update PR body

@mnkiefer
chore: outline plan
4810ba1 
Co-authored-by: mnkiefer <8320933+mnkiefer@users.noreply.github.com>
Copy link
Copy Markdown
Contributor Author

Copilot AI commented May 17, 2026

@copilot Update PR body

Updated the PR body to reflect the current _AUTHORIZATION contract and the regenerated workflow/test coverage on 4810ba1.

@mnkiefer mnkiefer marked this pull request as ready for review May 17, 2026 10:51
Copilot AI review requested due to automatic review settings May 17, 2026 10:51
Copilot AI reviewed May 17, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR aims to align shared OTLP workflow imports with the documented header-based secret contract for observability backends.

Changes:

  • Adds a compiler regression test for the shared OTLP import.
  • Regenerates selected workflow lock files, mostly updating generated heredoc delimiters and adding OTLP header secrets in some manifests/job secrets.
  • Updates generated secret wiring for selected workflows, though some compiled OTLP env blocks still retain authorization-secret references.
Show a summary per file
File Description
pkg/workflow/observability_shared_import_test.go Adds regression coverage for compiling the shared OTLP import.
.github/workflows/smoke-codex.lock.yml Regenerates generated heredoc delimiters.
.github/workflows/smoke-call-workflow.lock.yml Adds OTLP header secrets to generated metadata/job secrets and regenerates delimiters.
.github/workflows/schema-feature-coverage.lock.yml Regenerates generated heredoc delimiters.
.github/workflows/necromancer.lock.yml Regenerates generated heredoc delimiters.
.github/workflows/issue-arborist.lock.yml Regenerates generated heredoc delimiters.
.github/workflows/grumpy-reviewer.lock.yml Regenerates generated heredoc delimiters.
.github/workflows/duplicate-code-detector.lock.yml Regenerates generated heredoc delimiters.
.github/workflows/dependabot-campaign.lock.yml Adds OTLP header secrets to generated metadata/job secrets.
.github/workflows/daily-observability-report.lock.yml Regenerates generated heredoc delimiters.
.github/workflows/daily-fact.lock.yml Regenerates generated heredoc delimiters.
.github/workflows/daily-cache-strategy-analyzer.lock.yml Regenerates generated heredoc delimiters.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 12/12 changed files
  • Comments generated: 3

Comment thread pkg/workflow/observability_shared_import_test.go
Comment on lines +68 to +69
if !strings.Contains(compiled, "OTEL_EXPORTER_OTLP_HEADERS: Authorization=${{ secrets.GH_AW_OTEL_SENTRY_AUTHORIZATION }}") {
t.Error("Expected compiled workflow to wire OTEL_EXPORTER_OTLP_HEADERS to GH_AW_OTEL_SENTRY_AUTHORIZATION")
Comment thread .github/workflows/smoke-call-workflow.lock.yml
Comment on lines +1027 to +1029
GH_AW_OTEL_GRAFANA_HEADERS: ${{ secrets.GH_AW_OTEL_GRAFANA_HEADERS }}
GH_AW_OTEL_SENTRY_ENDPOINT: ${{ secrets.GH_AW_OTEL_SENTRY_ENDPOINT }}
GH_AW_OTEL_SENTRY_HEADERS: ${{ secrets.GH_AW_OTEL_SENTRY_HEADERS }}
Comment thread .github/workflows/dependabot-campaign.lock.yml
Comment on lines +991 to +993
GH_AW_OTEL_GRAFANA_HEADERS: ${{ secrets.GH_AW_OTEL_GRAFANA_HEADERS }}
GH_AW_OTEL_SENTRY_ENDPOINT: ${{ secrets.GH_AW_OTEL_SENTRY_ENDPOINT }}
GH_AW_OTEL_SENTRY_HEADERS: ${{ secrets.GH_AW_OTEL_SENTRY_HEADERS }}
@mnkiefer mnkiefer closed this May 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@mnkiefer mnkiefer Awaiting requested review from mnkiefer

Assignees

@mnkiefer mnkiefer

Copilot code review Copilot

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Smoke Test: OTEL Backends - 25986170685

3 participants

@mnkiefer