Add OTLP `github-app` pre-setup token minting, setup input wiring, and OIDC permission validation by Copilot · Pull Request #35089 · github/gh-aw

Copilot · 2026-05-27T00:39:19Z

This change adds OTLP runtime auth configuration in frontmatter so workflows can mint a bearer credential for telemetry export before actions/setup, then pass it into setup for OTLP Authorization header injection early in job execution.

Frontmatter + schema
- Added observability.otlp.github-app with support for:
  - GitHub App credentials (app-id/client-id + private-key) to mint a token via actions/create-github-app-token
  - Implicit OIDC mode when the github-app block is present without credentials
- Simplified OTLP github-app schema by removing the OTLP-specific oneOf branch and removing audience support.
- Removed legacy type: github-oidc syntax support for OTLP github-app.
- Updated typed config/docs/schema to recognize this github-app auth block and helper flow.
Workflow generation
- Added a compiler-generated pre-setup mint step (mint-otlp-oidc-token) that now:
  - mints via actions/create-github-app-token when OTLP github-app credentials are provided
  - mints via actions/github-script + core.getIDToken(...) for OIDC mode
- Wired setup step inputs/env to receive the minted token:
  - action mode: with.otlp-oidc-token
  - script mode: INPUT_OTLP_OIDC_TOKEN
- Added validation that permissions.id-token: write is required for OTLP OIDC mode.
Setup action behavior
- Added new setup input otlp-oidc-token in actions/setup/action.yml.
- In action_setup_otlp.cjs, when provided, merges Authorization=****** into OTEL_EXPORTER_OTLP_HEADERS (without overriding an existing Authorization header) and exports it via GITHUB_ENV.
- Also merges Authorization into each GH_AW_OTLP_ENDPOINTS endpoint headers value (without overriding existing Authorization) and persists updated endpoints via GITHUB_ENV, so setup/conclusion span export paths use the minted token.
Docs + tests
- Updated syntax docs to show OTLP github-app credential usage and OIDC permission guidance.
- Added/updated test coverage for endpoint header propagation through GH_AW_OTLP_ENDPOINTS, OIDC permission validation behavior, OTLP GitHub App helper extraction, schema acceptance of implicit OIDC (github-app: {}), schema rejection of OTLP github-app.audience, schema rejection of legacy type: github-oidc, and integration fixtures asserting emitted actions/create-github-app-token usage.

Example

observability:
  otlp:
    endpoint: ${{ secrets.GH_AW_OTEL_ENDPOINT }}
    github-app:
      app-id: ${{ vars.APP_ID }}
      private-key: ${{ secrets.APP_PRIVATE_KEY }}

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-05-27T00:39:54Z

 - **`observability:`** - Workflow observability and telemetry configuration (object)
  - **`otlp:`** - Export OpenTelemetry spans to any OTLP-compatible backend (Honeycomb, Grafana Tempo, Sentry, etc.) (object)
    - `endpoint:` - OTLP collector endpoint URL. When a static URL is provided, its hostname is added to the AWF firewall allowlist automatically. Supports GitHub Actions expressions.
+    - `auth:` - Optional runtime auth configuration.


@copilot rename auth to github-app

Updated in 4d286c7. OTLP frontmatter now uses github-app instead of auth (docs, schema, typed config, and related tests).

Copilot

Pull request overview

This PR adds an observability.otlp.auth frontmatter block to support minting a GitHub Actions OIDC token before actions/setup, then wiring that token into the setup action/script so OTLP exports can include an Authorization: Bearer <token> header early in job execution.

Changes:

Extend workflow frontmatter/types/schema/docs to support observability.otlp.auth.type: github-oidc (+ optional audience).
Generate a compiler-managed pre-setup step (mint-otlp-oidc-token) and pass its output into setup (action + script modes).
Update setup action runtime to accept otlp-oidc-token and merge it into OTEL_EXPORTER_OTLP_HEADERS.

Show a summary per file

File	Description
pkg/workflow/setup_step_version_test.go	Adds compiler tests asserting the OIDC mint step is injected and ordered before setup (action + script modes).
pkg/workflow/observability_otlp.go	Adds helpers to detect `github-oidc` auth and read optional `audience` from parsed/raw frontmatter.
pkg/workflow/observability_otlp_test.go	Adds unit tests for the new OTLP auth parsing helpers.
pkg/workflow/frontmatter_types.go	Introduces `OTLPAuthConfig` and wires it into `OTLPConfig`.
pkg/workflow/compiler_yaml_step_generation.go	Emits the pre-setup OIDC mint step and wires its token into setup inputs/env.
pkg/workflow/codex_engine.go	Formatting-only change in env map alignment.
pkg/parser/schemas/main_workflow_schema.json	Extends the JSON schema with `observability.otlp.auth`.
actions/setup/js/action_setup_otlp.test.cjs	Adds tests for OIDC token -> header injection behavior.
actions/setup/js/action_setup_otlp.cjs	Merges OIDC token into `OTEL_EXPORTER_OTLP_HEADERS` and writes it to `GITHUB_ENV`.
actions/setup/index.js	Plumbs `otlp-oidc-token` input to `setup.sh` and the OTLP span sender.
actions/setup/action.yml	Adds the new `otlp-oidc-token` action input.
.github/workflows/dead-code-remover.lock.yml	Regenerated lock workflow metadata/manifest.
.github/aw/syntax.md	Documents the new `observability.otlp.auth` fields and example usage.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 12/13 changed files
Comments generated: 4

+  const inputOTLPOIDCToken = getActionInput("OTLP_OIDC_TOKEN");
+  if (inputOTLPOIDCToken) {
+    const existingHeaders = process.env.OTEL_EXPORTER_OTLP_HEADERS || "";
+    const hasAuthorizationHeader = /(^|,)\s*authorization\s*=/i.test(existingHeaders);
+    const mergedHeaders = hasAuthorizationHeader ? existingHeaders : (existingHeaders ? `${existingHeaders},` : "") + "Authorization=Bearer " + inputOTLPOIDCToken;
+
+    process.env.OTEL_EXPORTER_OTLP_HEADERS = mergedHeaders;
+    writeEnvLine(process.env.GITHUB_ENV, "OTEL_EXPORTER_OTLP_HEADERS", mergedHeaders, "OTEL_EXPORTER_OTLP_HEADERS", "GITHUB_ENV");
+  }


+func (c *Compiler) generateOTLPOIDCMintStep(data *WorkflowData) []string {
+	if data == nil || !hasOTLPGitHubOIDCAuth(data.ParsedFrontmatter, data.RawFrontmatter) {
+		return nil
+	}


  - **`otlp:`** - Export OpenTelemetry spans to any OTLP-compatible backend (Honeycomb, Grafana Tempo, Sentry, etc.) (object)
    - `endpoint:` - OTLP collector endpoint URL. When a static URL is provided, its hostname is added to the AWF firewall allowlist automatically. Supports GitHub Actions expressions.
+    - `auth:` - Optional runtime auth configuration.
+      - `type:` - `github-oidc` to mint a GitHub Actions OIDC credential before `actions/setup` and use it for OTLP Authorization headers.
+      - `audience:` - Optional OIDC audience passed to `core.getIDToken(audience)`.


+  describe("OTLP OIDC token header injection", () => {
+    it("injects Authorization header and exports it to GITHUB_ENV when INPUT_OTLP_OIDC_TOKEN is set", async () => {
+      const minted = "oidc" + "-" + "token" + "-" + "value";
+      process.env.INPUT_OTLP_OIDC_TOKEN = minted;
+
+      await run();
+
+      expect(process.env.OTEL_EXPORTER_OTLP_HEADERS).toContain("Authorization=Bearer ");
+      expect(process.env.OTEL_EXPORTER_OTLP_HEADERS).toContain(minted);
+      expect(readFileSync(envFile, "utf8")).toContain("OTEL_EXPORTER_OTLP_HEADERS=Authorization=Bearer ");
+    });
+
+    it("does not override existing Authorization header", async () => {
+      process.env.INPUT_OTLP_OIDC_TOKEN = "oidc" + "-second" + "-value";
+      process.env.OTEL_EXPORTER_OTLP_HEADERS = "Authorization=******";
+
+      await run();
+
+      expect(process.env.OTEL_EXPORTER_OTLP_HEADERS).toBe("Authorization=******");
+    });
+  });


Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-05-27T02:32:08Z

@copilot review all comments
Please address the unresolved OTLP feedback and re-request review.

Generated by 👨‍🍳 PR Sous Chef · gpt54 14.6M · ◷

github-actions · 2026-05-27T02:32:09Z

Please fix the OTLP header propagation gap in GH_AW_OTLP_ENDPOINTS, then re-request review.

Generated by 👨‍🍳 PR Sous Chef · gpt54 14.6M · ◷

pelikhan · 2026-05-27T04:50:34Z

@copilot review all comments and reviews

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-05-27T05:07:24Z

@copilot review all comments and reviews

Addressed the actionable review items in commits f2b547b and 33994c6:

OTLP OIDC token now propagates into GH_AW_OTLP_ENDPOINTS endpoint headers (and persists via GITHUB_ENV) so setup/conclusion spans use Authorization headers.
Added compiler validation requiring permissions.id-token: write when observability.otlp.github-app.type: github-oidc is configured.
Added tests for endpoint header propagation and permission validation.
Updated syntax docs to call out the id-token: write requirement.

pelikhan · 2026-05-27T10:09:54Z

@copilot reuse Go type to represent GitHub-app data and helper functions to generate action create GitHub app step . Type GitHub-oidc is implicit and does not need to be in frontmatter .

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-05-27T11:42:22Z

🛠️ Agentic Maintenance updated this pull request branch.

View workflow run

pelikhan · 2026-05-27T11:42:25Z

@copilot the sample should look like this:

observability:
  otlp:
    endpoint: ${{ secrets.GH_AW_OTEL_ENDPOINT }}
    github-app:
      app-id: ${{ vars.APP_ID }}
      private-key: ${{ secrets.APP_PRIVATE_KEY }}

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-05-27T12:08:33Z

@copilot the sample should look like this:

...

Updated in bda3c0c. The OTLP github-app sample now uses app-id and private-key as requested, and the integration workflow fixture/test coverage was updated to validate actions/create-github-app-token wiring for that shape.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-05-27T12:17:32Z

+                {
+                  "$ref": "#/$defs/github_app"
+                },
+                {


@copilot remove type: github-oidc syntax support, no legacy support.

Implemented in d6b640b (with follow-up commits in this stack): removed OTLP observability.otlp.github-app.type: github-oidc legacy syntax support from main_workflow_schema.json, updated syntax docs to describe implicit OIDC without type, and added parser schema tests to ensure audience-only config is accepted while legacy type syntax is rejected.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-05-27T12:54:41Z

@copilot simplify GitHub-app type in schema. Remove oneof, audience,

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-05-27T13:11:24Z

@copilot simplify GitHub-app type in schema. Remove oneof, audience,

Done in 81dd667. I simplified observability.otlp.github-app in the schema by removing the OTLP-specific oneOf branch and dropping audience support, while keeping implicit OIDC via an empty github-app object. I also updated parser schema tests accordingly to validate implicit OIDC and reject audience/legacy type.

github-actions · 2026-05-27T14:08:20Z

``
@copilot review all comments

Please address the unresolved OIDC/token wiring feedback and validate the id-token: write permission before minting.

Generated by 👨‍🍳 PR Sous Chef · gpt54 3.6M · ◷

Copilot AI and others added 3 commits May 26, 2026 23:11

Plan OTLP OIDC minting support

6ada218

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Add OTLP github-oidc pre-setup minting wiring

32c3594

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Format action_setup_otlp after OIDC changes

e77321d

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI assigned Copilot and pelikhan May 27, 2026

Copilot created this pull request from a session on behalf of pelikhan May 27, 2026 00:39 View session

pelikhan marked this pull request as ready for review May 27, 2026 00:39

Copilot AI review requested due to automatic review settings May 27, 2026 00:39

Copilot started reviewing on behalf of pelikhan May 27, 2026 00:39 View session

pelikhan reviewed May 27, 2026

View reviewed changes

Copilot started work on behalf of pelikhan May 27, 2026 00:44 View session

Copilot AI reviewed May 27, 2026

View reviewed changes

Copilot AI and others added 2 commits May 27, 2026 00:56

Rename OTLP auth key to github-app

97c83f7

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Align OTLP typed field with github-app key

4d286c7

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~Add OTLP github-oidc pre-setup token minting and setup input wiring~~ Add OTLP github-app (github-oidc) pre-setup token minting and setup input wiring May 27, 2026

Copilot finished work on behalf of pelikhan May 27, 2026 00:59

Copilot AI requested a review from pelikhan May 27, 2026 00:59

Copilot started work on behalf of pelikhan May 27, 2026 04:50 View session

Copilot AI and others added 2 commits May 27, 2026 05:05

Fix OTLP OIDC header propagation and permission validation

f2b547b

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Refine OTLP endpoint header merge helper

33994c6

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~Add OTLP github-app (github-oidc) pre-setup token minting and setup input wiring~~ Add OTLP github-app (github-oidc) pre-setup token minting, setup input wiring, and OIDC permission validation May 27, 2026

Copilot finished work on behalf of pelikhan May 27, 2026 05:08

github-actions Bot mentioned this pull request May 27, 2026

[aw] PR Sous Chef failed #35073

Closed

Copilot started work on behalf of pelikhan May 27, 2026 10:10 View session

Simplify OTLP github-app OIDC frontmatter

fc85da6

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan May 27, 2026 11:30

Merge branch 'main' into copilot/add-github-app-oidc-token-support

1cf8d45

Copilot started work on behalf of pelikhan May 27, 2026 11:42 View session

Copilot AI and others added 3 commits May 27, 2026 12:02

Support OTLP github-app credential sample and token minting

f529e28

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Refine OTLP github-app mint-step generation and tests

216e475

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Tighten OTLP GitHub App integration assertions

bda3c0c

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Clean up OTLP GitHub App helper nil handling

f2c6376

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~Add OTLP github-app pre-setup OIDC token minting, setup input wiring, and OIDC permission validation~~ Add OTLP github-app pre-setup token minting, setup input wiring, and OIDC permission validation May 27, 2026

Copilot finished work on behalf of pelikhan May 27, 2026 12:13

Merge branch 'main' into copilot/add-github-app-oidc-token-support

fe961a3

pelikhan reviewed May 27, 2026

View reviewed changes

Copilot started work on behalf of pelikhan May 27, 2026 12:20 View session

Copilot AI and others added 5 commits May 27, 2026 12:34

Remove legacy OTLP github-oidc type syntax

a302629

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Clarify implicit OTLP OIDC wording

1b53d4d

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Tighten legacy OTLP type rejection test

a450fe4

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Harden OTLP legacy schema error assertion

8ec1253

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Simplify legacy OTLP type error assertion

d6b640b

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan May 27, 2026 12:39

Copilot AI requested a review from pelikhan May 27, 2026 12:39

Copilot started work on behalf of pelikhan May 27, 2026 12:54 View session

Copilot AI and others added 2 commits May 27, 2026 13:07

Simplify OTLP github-app schema shape

1208417

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Refine OTLP github-app schema validation tests

81dd667

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan May 27, 2026 13:12

github-actions Bot mentioned this pull request May 27, 2026

[aw] No-Op Runs #34919

Open

Conversation

Copilot AI commented May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pelikhan May 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

github-actions Bot commented May 27, 2026

Uh oh!

github-actions Bot commented May 27, 2026

Uh oh!

pelikhan commented May 27, 2026

Uh oh!

Copilot AI commented May 27, 2026

Uh oh!

pelikhan commented May 27, 2026

Uh oh!

github-actions Bot commented May 27, 2026

Uh oh!

pelikhan commented May 27, 2026

Uh oh!

Copilot AI commented May 27, 2026

Uh oh!

pelikhan May 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 27, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan commented May 27, 2026

Uh oh!

Copilot AI commented May 27, 2026

Uh oh!

github-actions Bot commented May 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented May 27, 2026 •

edited

Loading