review: [DEVOPS-2394] full diff since coralogix fork-point (review-only; merge via #7)#8
Open
jmsundar wants to merge 19 commits intoreview/DEVOPS-2394-full-difffrom
Open
Conversation
Scaffolds Extend's in-house OTel Lambda layer diverging from
coralogix-nodejs-autoinstrumentation:
- extend/collector-config-cx-only.yaml — default CX-only config (parity)
- extend/collector-config-cx-arize-s3.yaml — CX + Arize OTLP/gRPC + S3 archival
- collector/lambdacomponents/default.go — register awss3exporter
- extend/README.md — fork rationale + consumer contract
Secret resolution is native via collector's secretsmanagerprovider
(${secretsmanager:<name-or-arn>} syntax resolved at startup). No bash wrapper.
Follow-ups: go.mod upstream breakage (pre-existing), GH Actions publish flow,
SSM layer-version registration.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…e-s3
Three configs for independent opt-in:
- cx-only.yaml — default, CX export only
- cx-arize.yaml — CX + Arize gRPC (no S3 archival)
- cx-arize-s3.yaml — CX + Arize gRPC + S3 archival
S3 prefix now configurable via ARIZE_S3_PREFIX env var with default
fallback to traces/${CX_APPLICATION}/${CX_SUBSYSTEM}.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Split trace pipelines in cx-arize and cx-arize-s3 configs so Mastra AI
spans take a dedicated path to Arize without polluting the
Coralogix/S3 flow:
- New otlp/mastra receiver on localhost:4319/4320 with include_metadata
- headers_setter extension reads api_key/space_id/project_name from
inbound OTLP headers (Lambda-provided) and forwards them upstream to
Arize; api_key/space_id have collector-side defaults from env/secret
- otlp/arize exporter swaps its static header block for
auth: { authenticator: headers_setter }
- traces/mastra pipeline routes otlp/mastra → otlp/arize; the standard
traces pipeline stays Coralogix-only (+ S3 in the -s3 variant)
Registers headerssetterextension in the collector build (v0.150.0,
matching awss3exporter's pin) via default.go and a new custom-build
sibling file mirroring sigv4auth.go.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
- Remove dotnet/, java/, ruby/, go/ language dirs and associated CI workflows (ci-java.yml, release-layer-java.yml, release-layer-ruby.yml). We only ship Node.js and Python Lambda layers; upstream's other language layers are noise. - Rewrite README.md for Extend fork scope: layer name, layout, publish flow, consumer wiring via NodeLambdaBuilder.otelTracingProps. - Add UPSTREAM.md documenting fork-point SHAs for both coralogix/opentelemetry-lambda and coralogix/opentelemetry-js-contrib, plus the manual sync process and the pin-update checklist (publish-sandbox.sh, workflow, UPSTREAM.md all together). Automation tracked in DEVOPS-2502.
Removed unused package ecosystems for gradle, pip, and bundler. Updated npm configuration to include registries and cooldown settings.
Removed unused Java and Ruby sections from release.yml
- Drop opentelemetry-js clone + OPENTELEMETRY_JS_PATH. Unused since cx-js was dropped (we resolve @opentelemetry/instrumentation from npm now). - Pin CX_CONTRIB_SHA to match publish-sandbox.sh and the publish workflow so local builds don't drift from CI. - Unify clone path under .build-cache/opentelemetry-js-contrib so both scripts share one cache on dev machines. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Remove python/ entirely. Only nodejs layers ship; if Python autoinstrumentation is needed later, start from origin/python-instrumentation. Drop the commented-out pip block in dependabot.yml and the python/README.md link in README.md. - UPSTREAM.md: replace the scratch-path reference to the fork-research doc with the Confluence page link. Add remote-setup block (remotes aren't checked in, fresh clones only have origin). Add a third fork-points row for open-telemetry/opentelemetry-lambda with the tag (layer-nodejs/0.10.0, c9e67c4) coralogix last merged in via 436f3d0. Add sync block + note that coralogix absorbs upstream-upstream selectively (tags or cherry-picks) so the sync skill should walk by patch-id, not merge-base. - .gitignore: add .claude/worktrees/ and extend/plan-*.md so transient agent scaffolding doesn't leak into commits again. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
HeatherFlux
reviewed
Apr 20, 2026
Member
HeatherFlux
left a comment
HeatherFlux
left a comment
There was a problem hiding this comment.
Review of non-deleted files. Comments below are organized by priority. Nothing is a blocker for review-only, but flagging a few items to consider before #7 merges.
High priority
extend/README.mdcontradicts the config onARIZE_PROJECT_NAME— docs say env var, configs say per-request header- Publish workflow leaks AWS creds to every step in every job; scope to publish job only
@opentelemetry/instrumentationbumped to 0.214.0 while peer@opentelemetry/*exp packages stay at 0.213.0 — verify against lockfile
Medium
- Merged layer zip size not validated (only the pre-merge nodejs zip is checked)
--compatible-runtimesdrops nodejs20.x (still AWS-supported / LTS) — intentional?UPSTREAM.mdprose says "three places" but lists four bullets- Dependabot CodeArtifact token expires after 12h; static secret will silently break
Low / nits
collector/lambdacomponents/exporter/logging.gonow exportsdebugexporter— rename file- Collector configs don't declare
tls:explicitly (works by default, but explicit is clearer at a security boundary) publish-sandbox.shomits--descriptiononpublish-layer-versionCX_CONTRIB_SHAduplicated in 3 places + UPSTREAM.md; consider a single source file (non-blocking)
Fine as-is: CODEOWNERS, .gitignore, Makefile package-extend, MakeFactoryMap[T] migration in default.go, headerssetter.go registration, processor factory renames (NewTraces/NewMetrics/NewLogs), root README rewrite, deploy-nodejs.sh path update. Go dep bumps not reviewed in depth — assuming #7's CI builds them.
bowlofarugula
approved these changes
Apr 20, 2026
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
Author
|
@HeatherFlux thanks for the thorough review. Threaded replies posted on each inline comment. On the review-body-only nit:
Code fixes for the remaining items land on |
- extend/README.md: split consumer-contract table into collector env vars vs per-request OTLP headers; move ARIZE_PROJECT_NAME to headers (no collector default); note ARIZE_S3_BUCKET_NAME applies to s3 variant only - publish-extend-otel-layer.yml: size-check the merged layer.zip against Lambda's 50MB zipped limit after the collector+nodejs merge step - UPSTREAM.md: "three places" -> "four places" to match the four bullets - collector/lambdacomponents/exporter: rename logging.go -> debug.go and update build tag to lambdacomponents.exporter.debug - collector configs: declare tls.insecure: false on otlp/coralogix and otlp/arize exporters to document intent at the security boundary - cx-wrapper + layer package.json: bump exporter-*-otlp-proto, instrumentation-grpc, instrumentation-http to 0.214.0 so the whole @opentelemetry/* experimental cohort is on one version - publish-sandbox.sh: add --description with cx-contrib SHA + build time to aws lambda publish-layer-version for easier sandbox triage Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
HeatherFlux
approved these changes
Apr 20, 2026
There was a problem hiding this comment.
Actionable comments posted: 4
♻️ Duplicate comments (1)
.github/dependabot.yml (1)
57-62:⚠️ Potential issue | 🟠 MajorDependabot auth can silently break if
CODEARTIFACT_AUTH_TOKENis not rotated.Line 61 still relies on a short-lived CodeArtifact token in Dependabot secrets. If rotation is missing, private package update PRs will stop (401s) without obvious signal.
#!/bin/bash set -euo pipefail echo "Checking for in-repo automation that rotates Dependabot/CodeArtifact secrets..." rg -n -C2 'CODEARTIFACT_AUTH_TOKEN|gh secret set|aws codeartifact get-authorization-token|dependabot.*secret|dependabot.*token' || true echo echo "Checking for runbook/docs that declare external rotation ownership..." rg -n -C2 'CodeArtifact|Dependabot|token|rotation|runbook|401' || trueExpected verification outcome:
- If no rotation automation/runbook is found, treat this as a confirmed reliability gap.
- If rotation is external, add an inline note here with owner/runbook link so this config stays maintainable.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/dependabot.yml around lines 57 - 62, Dependabot is using a short-lived secret token (token: ${{secrets.CODEARTIFACT_AUTH_TOKEN}} under registries -> codeartifact) which will silently fail if not rotated; add an automated rotation workflow named e.g. rotate-dependabot-codeartifact-token that runs on a schedule (or on expiry), calls AWS CLI aws codeartifact get-authorization-token to fetch a fresh token and updates the repository secret (gh secret set or the Actions Secrets REST API) so CODEARTIFACT_AUTH_TOKEN is always current, and add a short runbook link or maintenance comment near the registries/codeartifact block documenting the owner and where the workflow/runbook lives.
🧹 Nitpick comments (10)
UPSTREAM.md (1)
19-21: Add a language specifier to the fenced code block.The URL block is flagged by markdownlint (MD040). Adding a language identifier like
textsilences the warning and improves accessibility.Proposed fix
-``` +```text https://github.com/open-telemetry/opentelemetry-lambda/compare/c9e67c4...main ```🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@UPSTREAM.md` around lines 19 - 21, The fenced code block containing the URL is missing a language specifier, triggering markdownlint MD040; update the triple-backtick fence that surrounds the URL "https://github.com/open-telemetry/opentelemetry-lambda/compare/c9e67c4...main" by adding a language identifier (e.g., use "text" so the opening fence becomes ```text) to silence the warning and improve accessibility.scripts/build_nodejs_layer.sh (1)
80-85: Consider decoupling package.json from hardcoded tarball versions.The
npm installcommands use glob patterns (*-*.tgz) which handle version changes, but thepackage.jsonfiles incx-wrapperandlayerreference exact versioned filenames (e.g.,opentelemetry-instrumentation-aws-lambda-0.65.0.tgz). When contrib package versions are bumped, both the package.json files and this script need to align.This is a pre-existing pattern, but consider centralizing version management to reduce maintenance burden.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@scripts/build_nodejs_layer.sh` around lines 80 - 85, The package.json files in cx-wrapper and layer hardcode exact tarball filenames (e.g., opentelemetry-instrumentation-aws-lambda-0.65.0.tgz) which must be updated when contrib versions bump; instead, centralize version references and decouple from exact filenames: update the cx-wrapper and layer package.json to reference the tarballs using a stable identifier (for example using "file:../path/opentelemetry-instrumentation-aws-lambda-*.tgz" or a package version string that resolves via a root-managed mapping), or move the expected tarball names into a single source of truth (environment variables like OPENTELEMETRY_TARBALL_AWS_LAMBDA or a versions JSON) and change the build_nodejs_layer.sh npm install invocation to consume those variables (OPENTELEMETRY_JS_CONTRIB_PATH and CWD already used) so bumping contrib versions only requires updating the central version map rather than multiple package.json files; locate changes in package.json entries for cx-wrapper and layer and in the npm install block that references OPENTELEMETRY_JS_CONTRIB_PATH and CWD.extend/README.md (1)
64-67: Add language specifier to fenced code block.The code block for upstream sync commands should specify a language (e.g.,
bashorshell) for proper syntax highlighting and to satisfy linting.Fix
-``` +```bash git fetch upstream coralogix-nodejs-autoinstrumentation git merge upstream/coralogix-nodejs-autoinstrumentation ```🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@extend/README.md` around lines 64 - 67, Update the fenced code block containing the two git commands so it includes a language specifier (e.g., bash or shell) after the opening backticks; locate the block showing "git fetch upstream coralogix-nodejs-autoinstrumentation" and "git merge upstream/coralogix-nodejs-autoinstrumentation" in extend/README.md and change the opening ``` to ```bash (or ```shell) to enable proper syntax highlighting and satisfy linting.scripts/publish-sandbox.sh (2)
46-49: Consider cleaning upbuild-sandbox/on success or adding.gitignoreentry.The
build-sandbox/directory is created but not cleaned up after publishing. If this is intentional (for debugging), consider adding it to.gitignore. If not, add cleanup at the end.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@scripts/publish-sandbox.sh` around lines 46 - 49, The script creates a temporary build directory ("build-sandbox") but never removes it; either remove it on successful publish or ensure it is intentionally preserved by adding it to .gitignore. Update the publish flow in scripts/publish-sandbox.sh to delete build-sandbox on success (e.g., run an rm -rf build-sandbox at the end of the script after creating layer.zip) or, if you want to keep it for debugging, add "build-sandbox/" to the repo .gitignore so it is not checked in.
21-21: Same variable-override issue asbuild-nodejs.sh.This script has the same conflation of "user-provided checkout" vs. "auto-cloned cache" for
OPENTELEMETRY_JS_CONTRIB_PATH. Consider applying the same fix suggested forbuild-nodejs.sh.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@scripts/publish-sandbox.sh` at line 21, The assignment conflates a user-provided checkout path (OPENTELEMETRY_JS_CONTRIB_PATH) with the auto-cloned cache; change the cache variable to a distinct name and default only from a cache-specific env var so user checkout isn't overridden. Replace the line setting CX_CONTRIB_CACHE to instead derive from something like OPENTELEMETRY_JS_CONTRIB_CACHE_PATH (fallback to .build-cache/opentelemetry-js-contrib) and leave OPENTELEMETRY_JS_CONTRIB_PATH untouched; update any subsequent uses of CX_CONTRIB_CACHE to the new cache variable name (or vice versa) so code clearly distinguishes user checkout (OPENTELEMETRY_JS_CONTRIB_PATH) from the auto-cloned cache.scripts/build-nodejs.sh (2)
21-21: Clarify variable semantics: override vs. cache path.
CX_CONTRIB_CACHEconflates two concepts: whenOPENTELEMETRY_JS_CONTRIB_PATHis set, it's meant to point at an existing checkout (per the comment on line 10-11), but the script still tries to clone/fetch into that path at lines 24-29. If a user setsOPENTELEMETRY_JS_CONTRIB_PATHto a custom local checkout they're hacking on, the script will mutate it by checking outCX_CONTRIB_SHA.Consider skipping the clone/fetch/checkout logic entirely when
OPENTELEMETRY_JS_CONTRIB_PATHis pre-set, or rename the variable to clarify intent.Suggested approach
-CX_CONTRIB_CACHE="${OPENTELEMETRY_JS_CONTRIB_PATH:-$ROOT_DIR/.build-cache/opentelemetry-js-contrib}" +if [ -n "${OPENTELEMETRY_JS_CONTRIB_PATH:-}" ]; then + echo "==> using provided OPENTELEMETRY_JS_CONTRIB_PATH: $OPENTELEMETRY_JS_CONTRIB_PATH" + # Skip clone/fetch/checkout — user is responsible for the checkout state +else + CX_CONTRIB_CACHE="$ROOT_DIR/.build-cache/opentelemetry-js-contrib" + echo "==> resolving cx-contrib fork at $CX_CONTRIB_SHA" + if [ ! -d "$CX_CONTRIB_CACHE/.git" ]; then + mkdir -p "$(dirname "$CX_CONTRIB_CACHE")" + git clone --filter=blob:none "$CX_CONTRIB_REPO" "$CX_CONTRIB_CACHE" + fi + git -C "$CX_CONTRIB_CACHE" fetch --quiet origin "$CX_CONTRIB_SHA" 2>/dev/null || git -C "$CX_CONTRIB_CACHE" fetch --quiet origin + git -C "$CX_CONTRIB_CACHE" checkout --quiet "$CX_CONTRIB_SHA" + export OPENTELEMETRY_JS_CONTRIB_PATH + OPENTELEMETRY_JS_CONTRIB_PATH="$(cd "$CX_CONTRIB_CACHE" && pwd)" +fi🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@scripts/build-nodejs.sh` at line 21, The variable CX_CONTRIB_CACHE currently conflates a user-provided checkout override (OPENTELEMETRY_JS_CONTRIB_PATH) with a writable cache path and causes the script to mutate an external checkout; update the script so OPENTELEMETRY_JS_CONTRIB_PATH is treated as a read-only override and cloning/fetch/checkout logic is skipped when it is set, leaving CX_CONTRIB_CACHE as the fallback cache path used only when OPENTELEMETRY_JS_CONTRIB_PATH is empty; locate references to CX_CONTRIB_CACHE and the clone/fetch/checkout block (the clone/fetch/checkout logic that checks out CX_CONTRIB_SHA) and add a guard like "if OPENTELEMETRY_JS_CONTRIB_PATH is empty then create/use CX_CONTRIB_CACHE and perform clone/fetch/checkout, else set source_dir=OPENTELEMETRY_JS_CONTRIB_PATH and skip mutating operations" so external checkouts are not modified.
31-32: Export after assignment for clarity.The
exporton line 31 before the assignment on line 32 works but is non-obvious. The more common idiom is to assign then export, or combine them.Minor style fix
-export OPENTELEMETRY_JS_CONTRIB_PATH -OPENTELEMETRY_JS_CONTRIB_PATH="$(cd "$CX_CONTRIB_CACHE" && pwd)" +OPENTELEMETRY_JS_CONTRIB_PATH="$(cd "$CX_CONTRIB_CACHE" && pwd)" +export OPENTELEMETRY_JS_CONTRIB_PATH🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@scripts/build-nodejs.sh` around lines 31 - 32, Move the export to follow the assignment for clarity by assigning OPENTELEMETRY_JS_CONTRIB_PATH first and then exporting it (i.e. OPENTELEMETRY_JS_CONTRIB_PATH="$(cd "$CX_CONTRIB_CACHE" && pwd)"; export OPENTELEMETRY_JS_CONTRIB_PATH), or combine into a single line export OPENTELEMETRY_JS_CONTRIB_PATH="$(cd "$CX_CONTRIB_CACHE" && pwd)"; modify the existing export/assignment using the OPENTELEMETRY_JS_CONTRIB_PATH and CX_CONTRIB_CACHE symbols accordingly.README.md (1)
7-7: Consider if internal references should be in a public README.The Jira ticket link and AWS account ID (line 28) are internal references. If this repository could become public or is already public, consider moving these to an internal document or gating them behind access controls.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@README.md` at line 7, Remove or gate internal references in the public README by either deleting or moving the "Ticket: [DEVOPS-2394]" Jira link and the explicit AWS account ID string out of the README and into an internal document or environment-gated file; update references in the README to a generic placeholder (e.g., "internal ticket" / "internal AWS account") or add instructions pointing to the internal doc, and ensure any CI/docs that previously referenced these exact strings (search for "DEVOPS-2394" and the AWS account ID) are updated to use the new internal location or a secure configuration mechanism.collector/receiver/telemetryapireceiver/go.mod (1)
19-19:semconvversion skew with other collector modules.
go.opentelemetry.io/collector/semconvremains atv0.109.0while other collector modules are upgraded tov0.150.0/v1.56.0. This version gap could cause compatibility issues if semconv types or constants have changed between versions.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@collector/receiver/telemetryapireceiver/go.mod` at line 19, Update the semconv module to match the other OpenTelemetry collector modules by changing the go.mod entry for go.opentelemetry.io/collector/semconv to the same major version used elsewhere (e.g., v0.150.0), then run dependency reconciliation (go mod tidy / go env GOFLAGS as appropriate) and rebuild/tests to ensure no compatibility errors; target the go.mod line containing "go.opentelemetry.io/collector/semconv" and verify imports compile against the updated semconv constants/types..github/workflows/publish-extend-otel-layer.yml (1)
76-79: Static analysis: Inline flow mapping with expressions causes YAML parser errors.The inline syntax
{ name: collector-${{ matrix.architecture }}, ... }confuses YAML linters because${{after{appears to be a nested flow mapping. While GitHub Actions processes this correctly, it prevents standard linting tools from validating the workflow.♻️ Proposed fix: Use block mapping syntax
- uses: actions/download-artifact@v4 - with: { name: collector-${{ matrix.architecture }}, path: dl/collector } + with: + name: collector-${{ matrix.architecture }} + path: dl/collector - uses: actions/download-artifact@v4 - with: { name: nodejs-layer, path: dl/nodejs } + with: + name: nodejs-layer + path: dl/nodejsAlso consider updating line 51 to block mapping syntax for consistency.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/publish-extend-otel-layer.yml around lines 76 - 79, The workflow uses inline flow mappings like the actions/download-artifact@v4 steps with "with: { name: collector-${{ matrix.architecture }}, path: dl/collector }" and "with: { name: nodejs-layer, path: dl/nodejs }" which break YAML linters; change these to block mapping form so linters accept them — e.g., replace the inline "with: { ... }" for the download-artifact steps (and the similar occurrence near the earlier download step referenced in the comment) with block mappings using "with:" then indented "name: <...>" and "path: <...>" entries, preserving the same values (collector-${{ matrix.architecture }}, nodejs-layer, dl/collector, dl/nodejs).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/publish-extend-otel-layer.yml:
- Around line 76-93: The workflow is missing a repository checkout so
./scripts/check_size.sh (and other repo files) aren't present; add an
actions/checkout@v4 step in the package-and-publish job before the step that
runs ./scripts/check_size.sh (i.e., before the step that sets FILE_PATH and
MAX_SIZE and runs ./scripts/check_size.sh) so the script and repo files are
available to the runner.
In `@extend/collector-config-cx-arize-s3.yaml`:
- Line 5: The comment flags an inconsistent property name: the YAML uses
arizeTracingProps while docs reference otelTracingProps; update all occurrences
so the property name is consistent—choose the canonical name (prefer
otelTracingProps to match README) and replace arizeTracingProps in the
NodeLambdaBuilder-related config and any examples, tests or documentation so
references to arizeTracingProps are removed and otelTracingProps is used
everywhere.
In `@extend/README.md`:
- Around line 58-60: The workflow publish-extend-otel-layer.yml currently
publishes layer ARNs but doesn't write the published layer version to SSM;
update the step that extracts the published layer version ARN (the step/variable
that captures the layer version output, e.g., LAYER_VERSION_ARN or similar) to
add a new step using aws-actions/configure-aws-credentials + either aws cli or
aws-actions/ssm to call put-parameter and store the layer version under
/extend/otel-lambda/layer-version/${{ matrix.arch }} (or the equivalent arch
variable used in the job), ensuring the parameter value is the layer version
number or ARN as expected and use --overwrite to update; then remove the first
TODO checkbox line from extend/README.md (or mark it checked) so only the SSM
publish TODO remains.
In `@UPSTREAM.md`:
- Around line 29-33: The git fetch line is incorrect because `git fetch upstream
otel-upstream` treats `otel-upstream` as a refspec on the `upstream` remote;
update the example so it actually fetches both remotes by replacing that single
fetch with two separate fetch invocations (one for the `upstream` remote and one
for the `otel-upstream` remote) or alternatively use a single `git fetch --all`
invocation; modify the block that contains the `git remote add upstream`, `git
remote add otel-upstream`, and `git fetch ...` lines accordingly so the shown
commands correctly fetch from both remotes.
---
Duplicate comments:
In @.github/dependabot.yml:
- Around line 57-62: Dependabot is using a short-lived secret token (token:
${{secrets.CODEARTIFACT_AUTH_TOKEN}} under registries -> codeartifact) which
will silently fail if not rotated; add an automated rotation workflow named e.g.
rotate-dependabot-codeartifact-token that runs on a schedule (or on expiry),
calls AWS CLI aws codeartifact get-authorization-token to fetch a fresh token
and updates the repository secret (gh secret set or the Actions Secrets REST
API) so CODEARTIFACT_AUTH_TOKEN is always current, and add a short runbook link
or maintenance comment near the registries/codeartifact block documenting the
owner and where the workflow/runbook lives.
---
Nitpick comments:
In @.github/workflows/publish-extend-otel-layer.yml:
- Around line 76-79: The workflow uses inline flow mappings like the
actions/download-artifact@v4 steps with "with: { name: collector-${{
matrix.architecture }}, path: dl/collector }" and "with: { name: nodejs-layer,
path: dl/nodejs }" which break YAML linters; change these to block mapping form
so linters accept them — e.g., replace the inline "with: { ... }" for the
download-artifact steps (and the similar occurrence near the earlier download
step referenced in the comment) with block mappings using "with:" then indented
"name: <...>" and "path: <...>" entries, preserving the same values
(collector-${{ matrix.architecture }}, nodejs-layer, dl/collector, dl/nodejs).
In `@collector/receiver/telemetryapireceiver/go.mod`:
- Line 19: Update the semconv module to match the other OpenTelemetry collector
modules by changing the go.mod entry for go.opentelemetry.io/collector/semconv
to the same major version used elsewhere (e.g., v0.150.0), then run dependency
reconciliation (go mod tidy / go env GOFLAGS as appropriate) and rebuild/tests
to ensure no compatibility errors; target the go.mod line containing
"go.opentelemetry.io/collector/semconv" and verify imports compile against the
updated semconv constants/types.
In `@extend/README.md`:
- Around line 64-67: Update the fenced code block containing the two git
commands so it includes a language specifier (e.g., bash or shell) after the
opening backticks; locate the block showing "git fetch upstream
coralogix-nodejs-autoinstrumentation" and "git merge
upstream/coralogix-nodejs-autoinstrumentation" in extend/README.md and change
the opening ``` to ```bash (or ```shell) to enable proper syntax highlighting
and satisfy linting.
In `@README.md`:
- Line 7: Remove or gate internal references in the public README by either
deleting or moving the "Ticket: [DEVOPS-2394]" Jira link and the explicit AWS
account ID string out of the README and into an internal document or
environment-gated file; update references in the README to a generic placeholder
(e.g., "internal ticket" / "internal AWS account") or add instructions pointing
to the internal doc, and ensure any CI/docs that previously referenced these
exact strings (search for "DEVOPS-2394" and the AWS account ID) are updated to
use the new internal location or a secure configuration mechanism.
In `@scripts/build_nodejs_layer.sh`:
- Around line 80-85: The package.json files in cx-wrapper and layer hardcode
exact tarball filenames (e.g.,
opentelemetry-instrumentation-aws-lambda-0.65.0.tgz) which must be updated when
contrib versions bump; instead, centralize version references and decouple from
exact filenames: update the cx-wrapper and layer package.json to reference the
tarballs using a stable identifier (for example using
"file:../path/opentelemetry-instrumentation-aws-lambda-*.tgz" or a package
version string that resolves via a root-managed mapping), or move the expected
tarball names into a single source of truth (environment variables like
OPENTELEMETRY_TARBALL_AWS_LAMBDA or a versions JSON) and change the
build_nodejs_layer.sh npm install invocation to consume those variables
(OPENTELEMETRY_JS_CONTRIB_PATH and CWD already used) so bumping contrib versions
only requires updating the central version map rather than multiple package.json
files; locate changes in package.json entries for cx-wrapper and layer and in
the npm install block that references OPENTELEMETRY_JS_CONTRIB_PATH and CWD.
In `@scripts/build-nodejs.sh`:
- Line 21: The variable CX_CONTRIB_CACHE currently conflates a user-provided
checkout override (OPENTELEMETRY_JS_CONTRIB_PATH) with a writable cache path and
causes the script to mutate an external checkout; update the script so
OPENTELEMETRY_JS_CONTRIB_PATH is treated as a read-only override and
cloning/fetch/checkout logic is skipped when it is set, leaving CX_CONTRIB_CACHE
as the fallback cache path used only when OPENTELEMETRY_JS_CONTRIB_PATH is
empty; locate references to CX_CONTRIB_CACHE and the clone/fetch/checkout block
(the clone/fetch/checkout logic that checks out CX_CONTRIB_SHA) and add a guard
like "if OPENTELEMETRY_JS_CONTRIB_PATH is empty then create/use CX_CONTRIB_CACHE
and perform clone/fetch/checkout, else set
source_dir=OPENTELEMETRY_JS_CONTRIB_PATH and skip mutating operations" so
external checkouts are not modified.
- Around line 31-32: Move the export to follow the assignment for clarity by
assigning OPENTELEMETRY_JS_CONTRIB_PATH first and then exporting it (i.e.
OPENTELEMETRY_JS_CONTRIB_PATH="$(cd "$CX_CONTRIB_CACHE" && pwd)"; export
OPENTELEMETRY_JS_CONTRIB_PATH), or combine into a single line export
OPENTELEMETRY_JS_CONTRIB_PATH="$(cd "$CX_CONTRIB_CACHE" && pwd)"; modify the
existing export/assignment using the OPENTELEMETRY_JS_CONTRIB_PATH and
CX_CONTRIB_CACHE symbols accordingly.
In `@scripts/publish-sandbox.sh`:
- Around line 46-49: The script creates a temporary build directory
("build-sandbox") but never removes it; either remove it on successful publish
or ensure it is intentionally preserved by adding it to .gitignore. Update the
publish flow in scripts/publish-sandbox.sh to delete build-sandbox on success
(e.g., run an rm -rf build-sandbox at the end of the script after creating
layer.zip) or, if you want to keep it for debugging, add "build-sandbox/" to the
repo .gitignore so it is not checked in.
- Line 21: The assignment conflates a user-provided checkout path
(OPENTELEMETRY_JS_CONTRIB_PATH) with the auto-cloned cache; change the cache
variable to a distinct name and default only from a cache-specific env var so
user checkout isn't overridden. Replace the line setting CX_CONTRIB_CACHE to
instead derive from something like OPENTELEMETRY_JS_CONTRIB_CACHE_PATH (fallback
to .build-cache/opentelemetry-js-contrib) and leave
OPENTELEMETRY_JS_CONTRIB_PATH untouched; update any subsequent uses of
CX_CONTRIB_CACHE to the new cache variable name (or vice versa) so code clearly
distinguishes user checkout (OPENTELEMETRY_JS_CONTRIB_PATH) from the auto-cloned
cache.
In `@UPSTREAM.md`:
- Around line 19-21: The fenced code block containing the URL is missing a
language specifier, triggering markdownlint MD040; update the triple-backtick
fence that surrounds the URL
"https://github.com/open-telemetry/opentelemetry-lambda/compare/c9e67c4...main"
by adding a language identifier (e.g., use "text" so the opening fence becomes
```text) to silence the warning and improve accessibility.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 7d9ad144-4c26-401b-a073-38df7bf2d025
⛔ Files ignored due to path filters (7)
collector/go.sumis excluded by!**/*.sumcollector/lambdacomponents/go.sumis excluded by!**/*.sumcollector/processor/coldstartprocessor/go.sumis excluded by!**/*.sumcollector/processor/decoupleprocessor/go.sumis excluded by!**/*.sumcollector/receiver/telemetryapireceiver/go.sumis excluded by!**/*.sumgo/sample-apps/function/go.sumis excluded by!**/*.sumjava/gradle/wrapper/gradle-wrapper.jaris excluded by!**/*.jar
📒 Files selected for processing (172)
.github/CODEOWNERS.github/ISSUE_TEMPLATE/bug_report.md.github/ISSUE_TEMPLATE/feature_request.md.github/dependabot.yml.github/release.yml.github/workflows/ci-collector.yml.github/workflows/ci-java.yml.github/workflows/ci-nodejs.yml.github/workflows/ci-python.yml.github/workflows/ci-shellcheck.yml.github/workflows/ci-terraform.yml.github/workflows/close-stale.yaml.github/workflows/codeql.yml.github/workflows/layer-publish.yml.github/workflows/publish-extend-otel-layer.yml.github/workflows/publish-nodejs.yml.github/workflows/release-layer-collector.yml.github/workflows/release-layer-java.yml.github/workflows/release-layer-nodejs.yml.github/workflows/release-layer-python.yml.github/workflows/release-layer-ruby.yml.gitignoreCONTRIBUTING.mdREADME.mdRELEASE.mdUPSTREAM.mdci-scripts/publish_layer.shci-scripts/publish_production.shci-scripts/publish_test.shcollector/Makefilecollector/Makefile.Commoncollector/config.yamlcollector/go.modcollector/lambdacomponents/default.gocollector/lambdacomponents/exporter/debug.gocollector/lambdacomponents/extension/headerssetter.gocollector/lambdacomponents/go.modcollector/processor/coldstartprocessor/factory.gocollector/processor/coldstartprocessor/go.modcollector/processor/decoupleprocessor/factory.gocollector/processor/decoupleprocessor/go.modcollector/receiver/telemetryapireceiver/go.moddev/build-nodejs.shdocs/design_proposal.mddotnet/README.mddotnet/sample-apps/aws-sdk/deploy/wrapper/main.tfdotnet/sample-apps/aws-sdk/deploy/wrapper/outputs.tfdotnet/sample-apps/aws-sdk/deploy/wrapper/variables.tfdotnet/sample-apps/aws-sdk/wrapper/SampleApps/AwsSdkSample.slndotnet/sample-apps/aws-sdk/wrapper/SampleApps/AwsSdkSample/AwsSdkSample.csprojdotnet/sample-apps/aws-sdk/wrapper/SampleApps/AwsSdkSample/Function.csdotnet/sample-apps/aws-sdk/wrapper/SampleApps/AwsSdkSample/Properties/launchSettings.jsondotnet/sample-apps/aws-sdk/wrapper/SampleApps/build.shextend/README.mdextend/collector-config-cx-arize-s3.yamlextend/collector-config-cx-arize.yamlextend/collector-config-cx-only.yamlgo/README.mdgo/sample-apps/aws-sdk/deploy/wrapper/main.tfgo/sample-apps/aws-sdk/deploy/wrapper/outputs.tfgo/sample-apps/aws-sdk/deploy/wrapper/variables.tfgo/sample-apps/function/build.shgo/sample-apps/function/function.gogo/sample-apps/function/go.modjava/README.mdjava/awssdk-autoconfigure/build.gradle.ktsjava/awssdk-autoconfigure/src/main/java/io/opentelemetry/instrumentation/awssdk/v2_2/autoconfigure/AutoconfiguredTracingExecutionInterceptor.javajava/awssdk-autoconfigure/src/main/resources/software/amazon/awssdk/global/handlers/execution.interceptorsjava/build.gradle.ktsjava/dependencyManagement/build.gradle.ktsjava/gradle.propertiesjava/gradle/wrapper/gradle-wrapper.propertiesjava/gradlewjava/gradlew.batjava/layer-javaagent/build.gradle.ktsjava/layer-javaagent/scripts/otel-handlerjava/layer-wrapper/build.gradle.ktsjava/layer-wrapper/scripts/otel-handlerjava/layer-wrapper/scripts/otel-proxy-handlerjava/layer-wrapper/scripts/otel-sqs-handlerjava/layer-wrapper/scripts/otel-stream-handlerjava/sample-apps/aws-sdk/README.mdjava/sample-apps/aws-sdk/build.gradle.ktsjava/sample-apps/aws-sdk/deploy/agent/main.tfjava/sample-apps/aws-sdk/deploy/agent/outputs.tfjava/sample-apps/aws-sdk/deploy/agent/variables.tfjava/sample-apps/aws-sdk/deploy/wrapper/main.tfjava/sample-apps/aws-sdk/deploy/wrapper/outputs.tfjava/sample-apps/aws-sdk/deploy/wrapper/variables.tfjava/sample-apps/aws-sdk/src/main/java/io/opentelemetry/lambda/sampleapps/awssdk/AwsSdkRequestHandler.javajava/sample-apps/aws-sdk/src/main/resources/log4j2.xmljava/sample-apps/okhttp/README.mdjava/sample-apps/okhttp/build.gradle.ktsjava/sample-apps/okhttp/deploy/wrapper/main.tfjava/sample-apps/okhttp/deploy/wrapper/outputs.tfjava/sample-apps/okhttp/deploy/wrapper/variables.tfjava/sample-apps/okhttp/src/main/java/io/opentelemetry/lambda/sampleapps/okhttp/OkHttpRequestHandler.javajava/sample-apps/okhttp/src/main/resources/log4j2.xmljava/sample-apps/sqs/README.mdjava/sample-apps/sqs/build.gradle.ktsjava/sample-apps/sqs/deploy/agent/main.tfjava/sample-apps/sqs/deploy/agent/outputs.tfjava/sample-apps/sqs/deploy/agent/variables.tfjava/sample-apps/sqs/deploy/wrapper/main.tfjava/sample-apps/sqs/deploy/wrapper/outputs.tfjava/sample-apps/sqs/deploy/wrapper/variables.tfjava/sample-apps/sqs/src/main/java/io/opentelemetry/lambda/sampleapps/sqs/SqsRequestHandler.javajava/sample-apps/sqs/src/main/resources/log4j2.xmljava/settings.gradle.ktsnodejs/.commitlintrc.ymlnodejs/.editorconfignodejs/.gitattributesnodejs/.npmignorenodejs/README.mdnodejs/eslint.config.jsnodejs/lerna.jsonnodejs/packages/cx-wrapper/package.jsonnodejs/packages/layer/package.jsonnodejs/sample-apps/aws-sdk/.eslintignorenodejs/sample-apps/aws-sdk/.eslintrc.jsnodejs/sample-apps/aws-sdk/README.mdnodejs/sample-apps/aws-sdk/config.yamlnodejs/sample-apps/aws-sdk/deploy/wrapper/main.tfnodejs/sample-apps/aws-sdk/deploy/wrapper/outputs.tfnodejs/sample-apps/aws-sdk/deploy/wrapper/variables.tfnodejs/sample-apps/aws-sdk/package.jsonnodejs/sample-apps/aws-sdk/src/index.tsnodejs/sample-apps/aws-sdk/tsconfig.jsonpython/README.mdpython/sample-apps/aws-sdk/deploy/wrapper/main.tfpython/sample-apps/aws-sdk/deploy/wrapper/outputs.tfpython/sample-apps/aws-sdk/deploy/wrapper/variables.tfpython/sample-apps/build.shpython/sample-apps/function/lambda_function.pypython/sample-apps/function/requirements.txtpython/sample-apps/run.shpython/sample-apps/template.ymlpython/src/build.shpython/src/otel/Dockerfilepython/src/otel/Makefilepython/src/otel/otel_sdk/nodeps-requirements.txtpython/src/otel/otel_sdk/otel-instrumentpython/src/otel/otel_sdk/otel_wrapper.pypython/src/otel/otel_sdk/requirements.txtpython/src/otel/tests/mocks/lambda_function.pypython/src/otel/tests/nodeps-requirements.txtpython/src/otel/tests/requirements.txtpython/src/otel/tests/test_otel.pypython/src/run.shpython/src/template.ymlpython/src/tox.iniruby/README.mdruby/sample-apps/function/Gemfileruby/sample-apps/function/lambda_function.rbruby/sample-apps/template.ymlruby/src/build.shruby/src/otel/Dockerfileruby/src/otel/layer/Gemfileruby/src/otel/layer/Makefileruby/src/otel/layer/otel-handlerruby/src/otel/layer/wrapper.rbruby/src/template.ymlruby/src/zip_ruby_layer.shscripts/build-nodejs.shscripts/build_nodejs_layer.shscripts/check_size.shscripts/deploy-nodejs.shscripts/publish-sandbox.shutils/sam/run.shutils/terraform/api-gateway-proxy/main.tfutils/terraform/api-gateway-proxy/outputs.tfutils/terraform/api-gateway-proxy/variables.tf
💤 Files with no reviewable changes (142)
- java/gradle.properties
- java/awssdk-autoconfigure/src/main/resources/software/amazon/awssdk/global/handlers/execution.interceptors
- go/README.md
- nodejs/sample-apps/aws-sdk/.eslintignore
- java/gradle/wrapper/gradle-wrapper.properties
- java/sample-apps/sqs/deploy/agent/outputs.tf
- nodejs/.npmignore
- ci-scripts/publish_production.sh
- python/sample-apps/function/requirements.txt
- go/sample-apps/function/go.mod
- dotnet/sample-apps/aws-sdk/wrapper/SampleApps/AwsSdkSample/Properties/launchSettings.json
- java/sample-apps/aws-sdk/src/main/resources/log4j2.xml
- java/sample-apps/okhttp/src/main/resources/log4j2.xml
- java/awssdk-autoconfigure/build.gradle.kts
- go/sample-apps/function/build.sh
- nodejs/.editorconfig
- collector/config.yaml
- dotnet/sample-apps/aws-sdk/deploy/wrapper/outputs.tf
- python/src/otel/tests/mocks/lambda_function.py
- java/sample-apps/aws-sdk/README.md
- nodejs/sample-apps/aws-sdk/README.md
- python/README.md
- ci-scripts/publish_test.sh
- nodejs/lerna.json
- java/sample-apps/okhttp/deploy/wrapper/outputs.tf
- nodejs/.commitlintrc.yml
- python/sample-apps/aws-sdk/deploy/wrapper/outputs.tf
- java/sample-apps/okhttp/build.gradle.kts
- dotnet/README.md
- ruby/src/otel/layer/wrapper.rb
- python/sample-apps/run.sh
- java/layer-wrapper/build.gradle.kts
- java/sample-apps/sqs/build.gradle.kts
- python/src/run.sh
- ruby/src/otel/layer/Gemfile
- python/src/otel/tests/nodeps-requirements.txt
- java/gradlew
- go/sample-apps/aws-sdk/deploy/wrapper/outputs.tf
- ruby/sample-apps/function/Gemfile
- python/sample-apps/build.sh
- nodejs/.gitattributes
- ruby/src/build.sh
- java/layer-javaagent/scripts/otel-handler
- .github/release.yml
- docs/design_proposal.md
- python/src/build.sh
- go/sample-apps/aws-sdk/deploy/wrapper/variables.tf
- dotnet/sample-apps/aws-sdk/wrapper/SampleApps/build.sh
- nodejs/sample-apps/aws-sdk/deploy/wrapper/outputs.tf
- nodejs/eslint.config.js
- .github/workflows/close-stale.yaml
- .github/workflows/ci-nodejs.yml
- java/build.gradle.kts
- java/layer-wrapper/scripts/otel-stream-handler
- java/README.md
- java/sample-apps/okhttp/README.md
- nodejs/sample-apps/aws-sdk/tsconfig.json
- nodejs/sample-apps/aws-sdk/package.json
- java/sample-apps/aws-sdk/build.gradle.kts
- java/awssdk-autoconfigure/src/main/java/io/opentelemetry/instrumentation/awssdk/v2_2/autoconfigure/AutoconfiguredTracingExecutionInterceptor.java
- java/sample-apps/sqs/src/main/java/io/opentelemetry/lambda/sampleapps/sqs/SqsRequestHandler.java
- python/src/otel/Makefile
- java/sample-apps/aws-sdk/deploy/wrapper/outputs.tf
- java/sample-apps/aws-sdk/deploy/wrapper/main.tf
- python/src/otel/otel_sdk/requirements.txt
- python/src/otel/otel_sdk/otel-instrument
- CONTRIBUTING.md
- python/sample-apps/aws-sdk/deploy/wrapper/main.tf
- nodejs/sample-apps/aws-sdk/deploy/wrapper/main.tf
- python/src/otel/Dockerfile
- java/sample-apps/okhttp/src/main/java/io/opentelemetry/lambda/sampleapps/okhttp/OkHttpRequestHandler.java
- .github/workflows/ci-terraform.yml
- ruby/sample-apps/template.yml
- python/src/template.yml
- .github/workflows/release-layer-python.yml
- java/settings.gradle.kts
- java/sample-apps/aws-sdk/src/main/java/io/opentelemetry/lambda/sampleapps/awssdk/AwsSdkRequestHandler.java
- java/layer-wrapper/scripts/otel-handler
- ruby/src/otel/Dockerfile
- nodejs/sample-apps/aws-sdk/src/index.ts
- ruby/src/template.yml
- RELEASE.md
- ruby/src/otel/layer/Makefile
- python/src/otel/tests/requirements.txt
- ruby/README.md
- java/sample-apps/sqs/README.md
- java/layer-javaagent/build.gradle.kts
- java/sample-apps/aws-sdk/deploy/agent/main.tf
- .github/workflows/ci-shellcheck.yml
- .github/workflows/release-layer-collector.yml
- java/dependencyManagement/build.gradle.kts
- .github/workflows/release-layer-nodejs.yml
- java/sample-apps/sqs/deploy/wrapper/outputs.tf
- .github/workflows/ci-collector.yml
- java/layer-wrapper/scripts/otel-sqs-handler
- java/sample-apps/okhttp/deploy/wrapper/main.tf
- ruby/src/otel/layer/otel-handler
- .github/workflows/ci-java.yml
- .github/workflows/release-layer-java.yml
- java/layer-wrapper/scripts/otel-proxy-handler
- python/sample-apps/function/lambda_function.py
- utils/terraform/api-gateway-proxy/variables.tf
- dotnet/sample-apps/aws-sdk/deploy/wrapper/main.tf
- dotnet/sample-apps/aws-sdk/wrapper/SampleApps/AwsSdkSample/Function.cs
- python/src/otel/otel_sdk/nodeps-requirements.txt
- .github/workflows/codeql.yml
- ruby/src/zip_ruby_layer.sh
- ci-scripts/publish_layer.sh
- nodejs/sample-apps/aws-sdk/.eslintrc.js
- ruby/sample-apps/function/lambda_function.rb
- dotnet/sample-apps/aws-sdk/wrapper/SampleApps/AwsSdkSample/AwsSdkSample.csproj
- .github/workflows/release-layer-ruby.yml
- nodejs/sample-apps/aws-sdk/deploy/wrapper/variables.tf
- java/sample-apps/sqs/deploy/wrapper/variables.tf
- python/sample-apps/template.yml
- java/sample-apps/sqs/src/main/resources/log4j2.xml
- dev/build-nodejs.sh
- go/sample-apps/function/function.go
- .github/workflows/ci-python.yml
- java/sample-apps/aws-sdk/deploy/wrapper/variables.tf
- python/src/tox.ini
- java/gradlew.bat
- utils/sam/run.sh
- dotnet/sample-apps/aws-sdk/wrapper/SampleApps/AwsSdkSample.sln
- dotnet/sample-apps/aws-sdk/deploy/wrapper/variables.tf
- java/sample-apps/okhttp/deploy/wrapper/variables.tf
- java/sample-apps/aws-sdk/deploy/agent/variables.tf
- java/sample-apps/sqs/deploy/wrapper/main.tf
- nodejs/sample-apps/aws-sdk/config.yaml
- .github/ISSUE_TEMPLATE/bug_report.md
- python/src/otel/tests/test_otel.py
- python/sample-apps/aws-sdk/deploy/wrapper/variables.tf
- .github/workflows/publish-nodejs.yml
- .github/ISSUE_TEMPLATE/feature_request.md
- utils/terraform/api-gateway-proxy/outputs.tf
- java/sample-apps/sqs/deploy/agent/main.tf
- utils/terraform/api-gateway-proxy/main.tf
- go/sample-apps/aws-sdk/deploy/wrapper/main.tf
- java/sample-apps/sqs/deploy/agent/variables.tf
- python/src/otel/otel_sdk/otel_wrapper.py
- java/sample-apps/aws-sdk/deploy/agent/outputs.tf
- .github/workflows/layer-publish.yml
Comment on lines
+76
to
+93
| - uses: actions/download-artifact@v4 | ||
| with: { name: collector-${{ matrix.architecture }}, path: dl/collector } | ||
| - uses: actions/download-artifact@v4 | ||
| with: { name: nodejs-layer, path: dl/nodejs } | ||
| - name: Merge collector + nodejs zips | ||
| run: | | ||
| set -euo pipefail | ||
| mkdir -p out | ||
| unzip -o dl/collector/opentelemetry-collector-layer-${{ matrix.architecture }}.zip -d out/ | ||
| unzip -o dl/nodejs/layer.zip -d out/ | ||
| (cd out && zip -r ../layer.zip .) | ||
| # Lambda hard limit is 50MB zipped; the merged artifact (collector + nodejs) | ||
| # is what actually gets published, so size-check here rather than only on | ||
| # the pre-merge nodejs zip in build-nodejs. | ||
| - env: | ||
| FILE_PATH: ./layer.zip | ||
| MAX_SIZE: 52428800 | ||
| run: ./scripts/check_size.sh |
There was a problem hiding this comment.
Missing repository checkout causes check_size.sh to fail.
The package-and-publish job references ./scripts/check_size.sh at line 93, but the job doesn't include an actions/checkout@v4 step. Without checking out the repository, the script won't exist in the runner's workspace and the workflow will fail.
🐛 Proposed fix: Add checkout step before size check
package-and-publish:
needs: [build-collector, build-nodejs]
runs-on: blacksmith-4vcpu-ubuntu-2404
strategy:
fail-fast: false
matrix:
architecture: [amd64, arm64]
region: [us-east-1, us-west-2]
steps:
+ - uses: actions/checkout@v4
+ with:
+ sparse-checkout: scripts
- uses: actions/download-artifact@v4
with: { name: collector-${{ matrix.architecture }}, path: dl/collector }🧰 Tools
🪛 actionlint (1.7.12)
[error] 76-76: could not parse as YAML: did not find expected ',' or '}'
(syntax-check)
🪛 YAMLlint (1.38.0)
[error] 77-77: syntax error: expected ',' or '}', but got '{'
(syntax)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/publish-extend-otel-layer.yml around lines 76 - 93, The
workflow is missing a repository checkout so ./scripts/check_size.sh (and other
repo files) aren't present; add an actions/checkout@v4 step in the
package-and-publish job before the step that runs ./scripts/check_size.sh (i.e.,
before the step that sets FILE_PATH and MAX_SIZE and runs
./scripts/check_size.sh) so the script and repo files are available to the
runner.
| # | ||
| # Consumed by services that integrate Arize tracing. Selected via the | ||
| # OPENTELEMETRY_COLLECTOR_CONFIG_URI env var set by extend-cdk-lib | ||
| # NodeLambdaBuilder when `arizeTracingProps` is provided. |
There was a problem hiding this comment.
Inconsistent prop name: arizeTracingProps vs otelTracingProps.
Line 5 references arizeTracingProps, but README.md (line 40) and the root README document the prop as otelTracingProps. This inconsistency could confuse consumers.
Suggested fix
-# NodeLambdaBuilder when `arizeTracingProps` is provided.
+# NodeLambdaBuilder when `otelTracingProps` is provided.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| # NodeLambdaBuilder when `arizeTracingProps` is provided. | |
| # NodeLambdaBuilder when `otelTracingProps` is provided. |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@extend/collector-config-cx-arize-s3.yaml` at line 5, The comment flags an
inconsistent property name: the YAML uses arizeTracingProps while docs reference
otelTracingProps; update all occurrences so the property name is
consistent—choose the canonical name (prefer otelTracingProps to match README)
and replace arizeTracingProps in the NodeLambdaBuilder-related config and any
examples, tests or documentation so references to arizeTracingProps are removed
and otelTracingProps is used everywhere.
Comment on lines
+58
to
+60
| **Extend-specific follow-ups** (tracked in DEVOPS-2394): | ||
| - [ ] Add GitHub Actions workflow to publish to Extend AWS accounts | ||
| - [ ] Publish layer version to SSM `/extend/otel-lambda/layer-version/{arch}` for CDK lookup |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check if the GitHub Actions workflow already exists
fd -t f 'publish-extend-otel-layer.yml' .github/workflows/
# Check if there's any SSM-related code in the workflow
rg -n 'SSM|ssm|layer-version' .github/workflows/ || echo "No SSM references found in workflows"Repository: helloextend/opentelemetry-lambda
Length of output: 336
🏁 Script executed:
cat -n .github/workflows/publish-extend-otel-layer.ymlRepository: helloextend/opentelemetry-lambda
Length of output: 5264
🏁 Script executed:
wc -l .github/workflows/publish-extend-otel-layer.yml && tail -20 .github/workflows/publish-extend-otel-layer.ymlRepository: helloextend/opentelemetry-lambda
Length of output: 1042
First TODO item can be checked off; second item still pending.
The workflow publish-extend-otel-layer.yml successfully publishes Lambda layers to Extend AWS accounts in us-east-1 and us-west-2 regions. However, it does not publish the layer version ARN to SSM Parameter Store at /extend/otel-lambda/layer-version/{arch} for CDK lookup. Update the workflow to store the published layer version (extracted at line 108) in SSM Parameter Store, then check off the first item and remove it from the TODO list.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@extend/README.md` around lines 58 - 60, The workflow
publish-extend-otel-layer.yml currently publishes layer ARNs but doesn't write
the published layer version to SSM; update the step that extracts the published
layer version ARN (the step/variable that captures the layer version output,
e.g., LAYER_VERSION_ARN or similar) to add a new step using
aws-actions/configure-aws-credentials + either aws cli or aws-actions/ssm to
call put-parameter and store the layer version under
/extend/otel-lambda/layer-version/${{ matrix.arch }} (or the equivalent arch
variable used in the job), ensuring the parameter value is the layer version
number or ARN as expected and use --overwrite to update; then remove the first
TODO checkbox line from extend/README.md (or mark it checked) so only the SSM
publish TODO remains.
Comment on lines
+29
to
+33
| ```bash | ||
| git remote add upstream https://github.com/coralogix/opentelemetry-lambda.git | ||
| git remote add otel-upstream https://github.com/open-telemetry/opentelemetry-lambda.git | ||
| git fetch upstream otel-upstream | ||
| ``` |
There was a problem hiding this comment.
Fix the git fetch command — it won't fetch both remotes.
The command git fetch upstream otel-upstream attempts to fetch a refspec named otel-upstream from the upstream remote, not from two separate remotes.
Proposed fix
git remote add upstream https://github.com/coralogix/opentelemetry-lambda.git
git remote add otel-upstream https://github.com/open-telemetry/opentelemetry-lambda.git
-git fetch upstream otel-upstream
+git fetch upstream
+git fetch otel-upstream📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| ```bash | |
| git remote add upstream https://github.com/coralogix/opentelemetry-lambda.git | |
| git remote add otel-upstream https://github.com/open-telemetry/opentelemetry-lambda.git | |
| git fetch upstream otel-upstream | |
| ``` | |
| git remote add upstream https://github.com/coralogix/opentelemetry-lambda.git | |
| git remote add otel-upstream https://github.com/open-telemetry/opentelemetry-lambda.git | |
| git fetch upstream | |
| git fetch otel-upstream |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@UPSTREAM.md` around lines 29 - 33, The git fetch line is incorrect because
`git fetch upstream otel-upstream` treats `otel-upstream` as a refspec on the
`upstream` remote; update the example so it actually fetches both remotes by
replacing that single fetch with two separate fetch invocations (one for the
`upstream` remote and one for the `otel-upstream` remote) or alternatively use a
single `git fetch --all` invocation; modify the block that contains the `git
remote add upstream`, `git remote add otel-upstream`, and `git fetch ...` lines
accordingly so the shown commands correctly fetch from both remotes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why this PR exists
Review-only. Shows the complete set of changes since the
coralogix/opentelemetry-lambda@coralogix-nodejs-autoinstrumentationfork-point (8838714,CX-34056: Bump all dependencies to latest version, 2026-03-12), giving reviewers the full picture in one diff.The three earliest feat commits (
2ae8674,299cdf9,7cda4ae) landed onmainbefore branch protection was set up and couldn't be rewound — org ruleset blocks non-fast-forward onmain. So the "real" PR for merging is #7 (feat → main), which only shows 15 of the 18 commits. This PR covers the missing 3.Do not merge this PR
Merge via #7 instead. The base branch here (
review/DEVOPS-2394-full-diff) is just the fork-point SHA pushed as a branch for diff purposes. After review, delete this branch.Summary (18 commits, +3070/−8618 across 179 files)
coralogix/opentelemetry-lambdaand shipextend-nodejs-wrapper-and-exporter-{amd64,arm64}as a single Node.js Lambda layer to account 159581800400, org-visible across Extend AWS accounts.NodeLambdaBuilder.otelTracingProps.otlp/mastrareceiver (:4319/:4320) +headers_setterextension routing spans to Arize via inbound-header auth, while the defaulttracespipeline stays Coralogix-only (+ S3 archival when enabled).dotnet/,java/,ruby/,go/,python/) + their CI.python/intentionally removed — start fromorigin/python-instrumentationif Python autoinstrumentation is needed later.package-extendMakefile target + custom build withawss3exporterandheaderssetterextensionpinned at v0.150.0.publish-extend-otel-layer.yml): matrix on{amd64,arm64} × {us-east-1, us-west-2}, uses Blacksmith 4vcpu runners, Node.js + collector zips merged, layer published withorgVisiblepermission too-7ngcsohuq5.scripts/publish-sandbox.sh): auto-clones cx-contrib fork to.build-cache/at pinned SHA3a9691a6….scripts/build-nodejs.sh): same pinned SHA + shared.build-cache/path;OPENTELEMETRY_JS_PATH/ cx-js clone removed (resolve@opentelemetry/instrumentationfrom npm).UPSTREAM.md: fork-points for coralogix/opentelemetry-lambda, coralogix/opentelemetry-js-contrib, and open-telemetry/opentelemetry-lambda (latest absorbed OTel-upstream tag:layer-nodejs/0.10.0→c9e67c4, via coralogix merge commit436f3d0, 2024-10-28). Remote-setup block + manual sync procedure walking all three. Full rationale in the linked Confluence page.ci-scripts/+dev/→scripts/. Delete dead upstream workflows, issue templates,CONTRIBUTING.md,RELEASE.md. TightenCODEOWNERSto@helloextend/devops. Trimdependabot.ymlto shipped ecosystems.Test plan
Same as #7.
🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
${secretsmanager:<name-or-arn>}syntax in collector configuration.Chores