Skip to content

feat: emit gh-aw.detection.conclusion and gh-aw.detection.reason as OTLP span attributes#30273

Merged
pelikhan merged 2 commits intomainfrom
copilot/grafana-otel-improvement-add-detection-attributes
May 5, 2026
Merged

feat: emit gh-aw.detection.conclusion and gh-aw.detection.reason as OTLP span attributes#30273
pelikhan merged 2 commits intomainfrom
copilot/grafana-otel-improvement-add-detection-attributes

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented May 5, 2026

GH_AW_DETECTION_CONCLUSION and GH_AW_DETECTION_REASON were injected into the conclusion job but never forwarded to the telemetry layer, making threat-detection outcomes invisible in OTel backends. Without these attributes, a span with gh-aw.agent.conclusion=success and a detection warning looks identical to a clean run.

Changes

  • send_otlp_span.cjs — reads GH_AW_DETECTION_CONCLUSION and GH_AW_DETECTION_REASON in sendJobConclusionSpan and conditionally emits them as gh-aw.detection.conclusion and gh-aw.detection.reason span attributes (mirrors the existing pattern for gh-aw.agent.conclusion); updates JSDoc to document both new env vars
  • send_otlp_span.test.cjs — adds three cases: both attributes set, only conclusion set, neither set

Example span attributes after this change:

{ "key": "gh-aw.agent.conclusion",     "value": { "stringValue": "success" } },
{ "key": "gh-aw.detection.conclusion", "value": { "stringValue": "warning" } },
{ "key": "gh-aw.detection.reason",     "value": { "stringValue": "threat_detected" } }

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh gh repo view --json owner,name --jq .owner.login + "/" + .name k (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw --format=format:config --end-of-optionsuser.email ache/go/1.25.8/xtest@example.com sRem�� PyK4/g7QMEKbK4lJ57aRqPyK4 **/*.cjs .cfg **/*.json --ignore-path ../../../.pretti--show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw er_test (http block)
  • https://api.github.com/orgs/test-owner/actions/secrets
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name on' --ignore-path ../../../.prettierignore --global ules/.bin/sh http.https://git/opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name xterm-color git /sh (http block)
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name h ../../../.prettierignore scripts/**/*.js ache/node/24.14.1/x64/bin/node .prettierignore --log-level=erro/home/REDACTED/work/gh-aw/gh-aw/actions/setup/js/node_modules/.bin/pre�� bject.type] | @t--write gcc oces�� w/js/**/*.json' --ignore-path c /usr/bin/gh - git /usr/bin/git gh (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile sv 973934762/001 -buildtags 4974612/b445=> git rev-�� --show-toplevel git /usr/bin/git ithub-script/gitgh -tests bject.type] | @t/repos/actions/github-script/git/ref/tags/v9 git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv WorkflowFiles_WithImports3996024738/001 64/pkg/tool/linux_amd64/vet /usr/bin/git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv 0144-14242/test-187271985 -buildtags 64/pkg/tool/linux_amd64/vet -errorsas -ifaceassert -nilfunc 64/pkg/tool/linux_amd64/vet estP�� -unreachable=false tname) /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet h ../../../.pretinfocmp (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel x_amd64/compile /usr/bin/git k/gh-aw/gh-aw/.ggit git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv k/_tool gh /usr/bin/infocmp /repos/actions/ggit --jq /usr/bin/infocmp--show-toplevel infocmp -1 xterm-color infocmp /home/REDACTED/.local/bin/node xterm-color /opt/hostedtoolcrev-parse /usr/bin/git node (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv t0 -tests ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet m0s (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv -bool l /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile -errorsas -ifaceassert -nilfunc /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linuremote -o runs/20260505-050144-14242/test-3153010693 -trimpath /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile -p github.com/githurev-parse -lang=go1.25 /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv -test.paniconexit0 -test.v=true /usr/bin/git -test.timeout=10git -test.run=^Test -test.short=true--show-toplevel git conf�� --get remote.origin.url /usr/bin/git test.go t.go x_amd64/vet git (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv /repos/actions/setup-node/git/ref/tags/v4 --jq /usr/bin/git --get remote.origin.urrev-parse /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --git-dir resolved$ /usr/bin/git git (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v9
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv t.cjs --reporter=verbose (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv submodules | head -n 10 (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v9.0.0
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv submodules | head -n 10 (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv go1.25.8 -c=4 -nolocalimports -importcfg /tmp/go-build4094974612/b411/importcfg -pack /tmp/go-build4094974612/b411/_testmain.go tion�� th .prettierigno-errorsas --local 1/x64/bin/bash (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel /opt/hostedtoolcrev-parse /usr/bin/gh 3153010693 /tmp/go-build409api 4974612/b366/vet/repos/actions/github-script/git/ref/tags/v9 gh api /repos/actions/github-script/git/ref/tags/v9 --jq /usr/bin/git -unreachable=falgit =develop 1/x64/bin/node git (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --get remote.origin.url /usr/bin/git te 'scripts/**/*git HEAD x_amd64/vet git rev-�� --git-dir resolved$ /usr/bin/git --exclude-standagit --others 64/pkg/tool/linu--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv xterm-color 64/pkg/tool/linux_amd64/compile /usr/bin/infocmp g_.a /tmp/go-build409api (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv ithub-script/git/ref/tags/v9 ache/node/24.14.1/x64/bin/node bject.type] | @tsv /tmp/TestGuardPogit config /opt/hostedtoolc--show-toplevel git rev-�� /ref/tags/v9 node sv /tmp/TestHashStainfocmp x_amd64/vet logs/runs.json"}xterm-color gh (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv bility_SameInputSameOutput2372701237/001/stability-test.md -importcfg (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv ry=1 /home/REDACTED/work/gh-aw/gh-aw/pkg/logger/logger.nonexistent-workflow-test-12345 4974612/b473/_pkg_.a yphen432028170/0git yphen432028170/0rev-parse x_amd64/compile /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile -o /tmp/go-build4094974612/b459/_pkg_.a -trimpath /usr/bin/git -p github.com/githurev-parse -lang=go1.25 git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv uts.enforce_all == 'true' && 'full-sweep (enforc-p -buildtags /usr/bin/git -errorsas -ifaceassert -nilfunc git rev-�� --show-toplevel -tests /usr/bin/git Gitmaster_branchgit Gitmaster_branchrev-parse x_amd64/vet git (http block)
  • https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 /tmp/go-build4094974612/b114/vet.cfg sv */*.ts' '**/*.jsgit committer.email x_amd64/vet /opt/hostedtoolcache/node/24.14.1/x64/bin/node /tmp�� github.repository x_amd64/vet /usr/bin/git ub/workflows (http block)
  • https://api.github.com/repos/aws-actions/configure-aws-credentials/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/aws-actions/configure-aws-credentials/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git /tmp/TestGuardPogit remote /usr/bin/git git rev-�� --show-toplevel git /usr/bin/gh --show-toplevel x_amd64/vet _id":200}] gh (http block)
    • Triggering command: /usr/bin/gh gh api /repos/aws-actions/configure-aws-credentials/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git /tmp/TestGuardPogh remote /opt/hostedtoolc/repos/actions/github-script/git/ref/tags/v9 git rev-�� /ref/tags/v9 node sv /tmp/TestHashCongit x_amd64/vet /usr/bin/git gh (http block)
  • https://api.github.com/repos/azure/login/git/ref/tags/v2
    • Triggering command: /usr/bin/gh gh api /repos/azure/login/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git /tmp/TestGuardPogit rev-parse ps git rev-�� --show-toplevel ps /usr/bin/infocmp git --jq kflow.test infocmp (http block)
  • https://api.github.com/repos/docker/login-action/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/docker/login-action/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv --show-toplevel node /usr/bin/git /tmp/TestHashCongit git /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /usr/bin/git /tmp/go-build409infocmp -trimpath 64/pkg/tool/linuxterm-color git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv --show-toplevel /opt/hostedtoolcconfig /usr/bin/git st-1179689929/.ggit -buildtags e/git git rev-�� --show-toplevel e/git /usr/bin/git 3 -buildtags /opt/hostedtoolcxterm-color git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-04-28 -j ACCEPT 64/pkg/tool/linu-extld=gcc /hom�� te 'scripts/**/*.js' --ignore-path .prettierigno-errorsas **/*.cjs 64/pkg/tool/linux_amd64/vet **/*.json --ignore-path ../../../.pretti--show-current 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-04-05 (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-02-04 (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name .cfg ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /../../.prettiergit erignore (http block)
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 .cfg ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name infocmp (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name rkflow/js/**/*.json ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet erignore (http block)
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 on ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /../../.prettiergh erignore th: .path, creatlist ache/go/1.25.8/x--json (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name git /usr/bin/git --show-toplevel gh /usr/bin/gh git tion�� mpiledOutput3284026694/001 gh son ignore --jq sv git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1234567890
    • Triggering command: /usr/bin/gh gh api repos/{owner}/{repo}/actions/runs/1234567890 --jq {databaseId: .id, number: .run_number, url: .html_url, status: .status, conclusion: .conclusion, workflowName: .name, workflowPath: .path, createdAt: .created_at, startedAt: .run_started_at, updatedAt: .updated_at, event: .event, headBranch: .head_branch, 43020384/001' 43020384/001' es/.bin/sh (http block)
    • Triggering command: /usr/bin/gh gh api repos/{owner}/{repo}/actions/runs/1234567890 --jq {databaseId: .id, number: .run_number, url: .html_url, status: .status, conclusion: .conclusion, workflowName: .name, workflowPath: .path, createdAt: .created_at, startedAt: .run_started_at, updatedAt: .updated_at, event: .event, headBranch: .head_branch, ys.md git /usr/bin/git --show-toplevel ache/node/24.14./home/REDACTED/work/gh-aw/gh-aw/actions/setup/js/node_modules/.bin/pre�� /usr/bin/infocmp--write git rev-�� w/js/**/*.json' --ignore-path infocmp /usr/bin/infocmp xterm-color git /usr/bin/git infocmp (http block)
    • Triggering command: /usr/bin/gh gh api repos/{owner}/{repo}/actions/runs/1234567890 --jq {databaseId: .id, number: .run_number, url: .html_url, status: .status, conclusion: .conclusion, workflowName: .name, workflowPath: .path, createdAt: .created_at, startedAt: .run_started_at, updatedAt: .updated_at, event: .event, headBranch: .head_branch, h ../../../.pret.prettierignore git /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet user.name Test User /usr/bin/gh /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -ato�� -bool -buildtags t -errorsas -ifaceassert -nilfunc git-upload-pack (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name (http block)
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 on ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /../../.prettier/usr/bin/unpigz erignore (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name --jq (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name on 64/pkg/tool/linux_amd64/vet /../../.prettiergit erignore (http block)
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name gh 64/bin/node ithub-script/gitgh --jq bject.type] | @tlist git tion�� edOutput17055334--limit git son ignore gh /usr/bin/git infocmp (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name on ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /../../.prettiergit erignore (http block)
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 4974612/b013/vet.cfg ache/go/1.25.8/x64/pkg/tool/linu-importcfg (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name gh l_url, status: .status, conclusion: .conclusion, workflowName: .name, workflowPath: .path, creat--show-toplevel /repos/actions/ginfocmp --jq /usr/bin/git git tion�� edOutput1705533492/001 git son ignore infocmp /usr/bin/gh git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name on ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /../../.prettiergit erignore (http block)
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 .cfg ache/go/1.25.8/x64/pkg/tool/linu-buildmode=exe (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name git /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� edOutput1705533492/001 git 1/x64/bin/node ignore git sv gh (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name on ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /../../.prettiergit erignore (http block)
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 (http block)
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path on' --ignore-path ../../../.prettierignore --global h (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 (http block)
  • https://api.github.com/repos/github/gh-aw/contents/.github/workflows/shared/reporting.md
    • Triggering command: /tmp/go-build4094974612/b404/cli.test /tmp/go-build4094974612/b404/cli.test -test.testlogfile=/tmp/go-build4094974612/b404/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true (http block)
    • Triggering command: /tmp/go-build3295808022/b404/cli.test /tmp/go-build3295808022/b404/cli.test -test.testlogfile=/tmp/go-build3295808022/b404/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true ithub-script/gitsh git bject.type] | @t"prettier" --write '**/*.cjs' '**/*.ts' '**/*.json' --ignore-path ../../../.prettierignore infocmp -1 xterm-color git modules/@npmcli/run-script/lib/node-gyp-bin/node --show-toplevel git (http block)
    • Triggering command: /tmp/go-build1234174575/b404/cli.test /tmp/go-build1234174575/b404/cli.test -test.testlogfile=/tmp/go-build1234174575/b404/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true --show-toplevel git /usr/bin/git node /hom�� '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitcustom_branch1319212230/001' '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitcustom_branch1319212230/001' /home/REDACTED/work/node_modules/.bin/sh **/*.json --ignore-path ../../../.prettiprettier sh (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel /opt/hostedtoolcache/go/1.25.8/x--jq (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv sRemoteWithRealGitmaster_branch2858418883/001 sRemoteWithRealGitmaster_branch2858418883/002/work ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet **/*.json --ignore-path ../../../.prettixterm-color ache/go/1.25.8/x64/pkg/tool/linutest@example.com -c pkg/mod/github.com/aymanbagabas/go-udiff@v0.4.1/-s pkg/mod/github.com/aymanbagabas/go-udiff@v0.4.1/-w 64/pkg/tool/linux_amd64/vet re --log-level=einfocmp (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv 1979766079 committer.email x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv /repos/actions/github-script/git/ref/tags/v9 --jq (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv --symref (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv */*.ts' '**/*.jsgo1.25.8 committer.email x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv -c=4 -nolocalimports -importcfg /tmp/go-build4094974612/b462/importcfg -pack /home/REDACTED/work/gh-aw/gh-aw/pkg/tty/spec_test.go x_amd64/vet 1/x6�� ub/workflows ew@v1.1.1/spew/common.go x_amd64/compile son (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv */*.ts' '**/*.json' --ignore-path ../../../.prettierignore gpg.program x_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv */*.ts' '**/*.js-c=4 gpg.program x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv xterm-color git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv json' --ignore-path ../../../.pr**/*.json git-upload-pack '/tmp/TestParseD--ignore-path /usr/bin/git ath ../../../.prgit --jq (http block)
  • https://api.github.com/repos/google-github-actions/auth/git/ref/tags/v2
    • Triggering command: /usr/bin/gh gh api /repos/google-github-actions/auth/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git ithub-script/gitgit remote bject.type] | @t--show-toplevel git rev-�� --show-toplevel git /usr/bin/git ub/gh-aw.git l ng.md git (http block)
  • https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv Az8U/kaMeb-gJk5eJuGJHAz8U **/*.cjs .cfg **/*.json --ignore-path ../../../.pretti--get-regexp ache/go/1.25.8/x^remote\..*\.gh-resolved$ -c 0144-14242/test-913832866/.github/workflows pkg/mod/github.com/aymanbagabas/go-udiff@v0.4.1/export.go 4974612/b202/vet.cfg re --log-level=egit (http block)
  • https://api.github.com/repos/nonexistent/repo/actions/runs/12345
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion ./../.prettierig/opt/hostedtoolcache/node/24.14.1/x64/bin/node til (http block)
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion son --jq (http block)
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion son git /usr/bin/git git conf�� user.email test@example.com k/gh-aw/gh-aw/actions/setup/js/node_modules/.bin/prettier --show-toplevel git ules/.bin/node git (http block)
  • https://api.github.com/repos/owner/repo/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo n-dir/sh (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo bin/git (http block)
    • Triggering command: /usr/bin/gh gh workflow list --repo owner/repo --json name,path,state .cfg **/*.ts **/*.json --ignore-path ache/go/1.25.8/x64/pkg/tool/linu/tmp/go-build4094974612/b453/_testmain.go (http block)
  • https://api.github.com/repos/test-owner/test-repo/actions/secrets
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name on' --ignore-path ../../../.pret.prettierignore --global d94b576/node_modules/.bin/sh http.https://git/opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name ed-objects.md --jq /usr/bin/gh /ref/tags/v9 /opt/hostedtoolc-c sv gh api /repos/actions/github-script/git/ref/tags/v9 --jq /usr/bin/gh /ref/tags/v9 git sv gh (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name h ../../../.prettierignore scripts/**/*.js /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/cgo .prettierignore --log-level=erro/home/REDACTED/work/gh-aw/gh-aw/actions/setup/js/node_modules/.bin/pre�� /usr/bin/git /opt/hostedtoolc../../../**/*.json -V=f�� w/js/**/*.json' --ignore-path git /usr/bin/git ithub-script/gitgh git (http block)
  • https://api.github.com/repos/test/repo
    • Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch t3930911796/.github/workflows 4974612/b105/vet.cfg g_.a (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch --show-toplevel git k/gh-aw/gh-aw/actions/setup/js/node_modules/.bin/node ithub-script/gitgit git bject.type] | @t--show-toplevel git k/gh�� efaultBranchFromLsRemoteWithRealGitcustom_branchremote.origin.url efaultBranchFromLsRemoteWithRealGitcustom_branch1319212230/001' k/gh-aw/gh-aw/actions/setup/js/node_modules/.bin/sh --show-toplevel git erignore gh (http block)
    • Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch 3021682912 git k ub/workflows rty ode git sRem�� --show-toplevel git k/gh-aw/gh-aw/actions/setup/js/node_modules/.bin/sh --show-toplevel git erignore git (http block)

If you need me to access, download, or install something from one of these locations, you can either:

…nclusion spans

Read GH_AW_DETECTION_CONCLUSION and GH_AW_DETECTION_REASON env vars in
sendJobConclusionSpan and emit them as OTLP span attributes so DevOps
engineers can distinguish between agent failures, threat-detection warnings,
and detection engine errors in Grafana/Honeycomb/Datadog.

Closes #<issue>

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/0c573227-dccc-4eee-8237-755634a7996e

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot AI changed the title [WIP] Add detection conclusion and reason to conclusion spans feat: emit gh-aw.detection.conclusion and gh-aw.detection.reason as OTLP span attributes May 5, 2026
Copilot AI requested a review from pelikhan May 5, 2026 05:07
@pelikhan pelikhan marked this pull request as ready for review May 5, 2026 05:10
Copilot AI review requested due to automatic review settings May 5, 2026 05:10
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds forwarding of threat-detection outcome metadata into OpenTelemetry (OTLP) job conclusion spans so OTel backends can distinguish “clean success” runs from runs that completed successfully but had detection warnings/failures.

Changes:

  • Update sendJobConclusionSpan to read GH_AW_DETECTION_CONCLUSION / GH_AW_DETECTION_REASON and emit them as gh-aw.detection.conclusion / gh-aw.detection.reason span attributes when present.
  • Document the new environment variables in the sendJobConclusionSpan JSDoc.
  • Add unit tests covering both attributes set, only conclusion set, and neither set.
Show a summary per file
File Description
actions/setup/js/send_otlp_span.cjs Emits gh-aw.detection.conclusion and gh-aw.detection.reason on conclusion spans when the corresponding env vars are provided.
actions/setup/js/send_otlp_span.test.cjs Adds test coverage for presence/absence combinations of the new detection-related span attributes.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 2/2 changed files
  • Comments generated: 0

@pelikhan pelikhan merged commit af6fa6f into main May 5, 2026
4 checks passed
@pelikhan pelikhan deleted the copilot/grafana-otel-improvement-add-detection-attributes branch May 5, 2026 05:27
github-actions Bot added a commit that referenced this pull request May 5, 2026
- Add Model Alias entry (from new model-tables reference, PR #30256)
- Update Observability entry with gh-aw.detection.conclusion and
  gh-aw.detection.reason span attributes (from PR #30273)
- Fix broken link: parameterising → parameterizing (from PR #30265)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[grafana-otel-advisor] OTel improvement: add gh-aw.detection.conclusion and gh-aw.detection.reason to conclusion spans

3 participants