Forward OTEL trace context through nested AWF agent env passthrough by Copilot · Pull Request #6830 · github/gh-aw-firewall

Copilot · 2026-08-02T00:25:41Z

The smoke OTel tracing flow was losing trace configuration before the api-proxy sidecar started: nested AWF runs were not passing GH_AW_OTLP_ENDPOINTS or the GitHub AW trace context into the agent container, so the sidecar could not emit spans under the workflow trace. This PR wires that missing hop and aligns the smoke check with the actual forwarding path.

Agent → sidecar trace-context propagation
- Add the non-OTEL_ tracing vars to src/services/agent-environment/env-passthrough.ts:
  - GH_AW_OTLP_ENDPOINTS
  - GITHUB_AW_OTEL_TRACE_ID
  - GITHUB_AW_OTEL_PARENT_SPAN_ID
- This preserves the existing two-step flow:
  1. host/workflow env → agent container
  2. agent env → api-proxy env via api-proxy-env-config
Regression coverage
- Add a focused unit test proving nested api-proxy tracing vars are forwarded by agent env passthrough.
- Add an explicit GH_AW_OTLP_ENDPOINTS assertion in api-proxy OTEL env config tests.
Smoke workflow validation
- Update smoke-otel-tracing to validate the real implementation path instead of grepping the wrapper service file:
  - src/services/agent-environment/env-passthrough.ts
  - src/services/api-proxy-env-config.ts

const alwaysForwardVars = [
  // ...
  'GH_AW_OTLP_ENDPOINTS',
  'GITHUB_AW_OTEL_TRACE_ID',
  'GITHUB_AW_OTEL_PARENT_SPAN_ID',
] as const;

Fixes [smoke-otel-tracing] api-proxy container does not receive OTEL env vars for tracing #6827

Copilot

Pull request overview

Adds nested AWF OpenTelemetry context propagation from the agent environment to the API proxy.

Changes:

Forwards AW trace endpoint and parent-context variables.
Adds focused regression tests.
Updates smoke workflow validation.

Show a summary per file

File	Description
`src/services/api-proxy-env-config.test.ts`	Tests endpoint forwarding.
`src/services/agent-environment/env-passthrough.ts`	Adds trace variables to passthrough.
`src/services/agent-environment/env-passthrough.test.ts`	Tests nested trace propagation.
`.github/workflows/smoke-otel-tracing.md`	Updates smoke validation path.
`.github/workflows/smoke-otel-tracing.lock.yml`	Regenerates the compiled workflow.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 5/5 changed files
Comments generated: 2
Review effort level: Balanced

    'DOCKER_API_VERSION',
    'DOCKER_DEFAULT_PLATFORM',
    'COPILOT_OTEL_FILE_EXPORTER_PATH',
+    'GH_AW_OTLP_ENDPOINTS',


+      if grep -q 'GH_AW_OTLP_ENDPOINTS\|GITHUB_AW_OTEL_TRACE_ID\|GITHUB_AW_OTEL_PARENT_SPAN_ID' src/services/agent-environment/env-passthrough.ts \
+        && grep -q 'GH_AW_OTLP_ENDPOINTS\|OTEL_EXPORTER_OTLP_ENDPOINT\|GITHUB_AW_OTEL_TRACE_ID' src/services/api-proxy-env-config.ts; then
+        echo "✅ OTEL env vars are forwarded through agent passthrough and into api-proxy"
      else
-        echo "⚠️ OTEL env vars not yet forwarded (expected during development)"
+        echo "⚠️ OTEL env vars not yet forwarded through the full agent → api-proxy path (expected during development)"


lpcox · 2026-08-02T17:34:23Z

@copilot address review feedback

Copilot · 2026-08-02T17:42:02Z

@copilot address review feedback

Addressed both review comments in commit fix: don't forward OTEL collector config to agent env:

GH_AW_OTLP_ENDPOINTS credential exposure — Removed GH_AW_OTLP_ENDPOINTS from alwaysForwardVars in env-passthrough.ts. Per spec §9.2, this variable carries collector credentials ({url, headers}) and must only reach the api-proxy sidecar (via api-proxy-env-config.ts), not the agent container. Updated the passthrough test to assert the variable is withheld from the agent while GITHUB_AW_OTEL_TRACE_ID and GITHUB_AW_OTEL_PARENT_SPAN_ID (non-credential trace context) continue to be forwarded.
Smoke validation false negatives — Replaced the OR-pattern grep with individual grep calls, each followed by || { … ; exit 1; }. Every required symbol in both files is now checked independently, and any missing entry causes the step to exit nonzero. The soft "expected during development" fallback is gone.

github-actions · 2026-08-02T17:45:35Z

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-08-02T17:48:16Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	98.79%	98.82%	📈 +0.03%
Statements	98.72%	98.74%	📈 +0.02%
Functions	99.02%	99.02%	➡️ +0.00%
Branches	95.11%	95.11%	➡️ +0.00%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-08-02T18:02:02Z

🔌 Smoke Services — Service connectivity failed ⚠️

github-actions · 2026-08-02T18:02:08Z

❌ Smoke Copilot BYOK reports failed. BYOK mode investigation needed...

github-actions · 2026-08-02T18:02:09Z

❌ Smoke Claude failed

github-actions · 2026-08-02T18:02:10Z

❌ Smoke Gemini reports failed. Facets need polishing...

github-actions · 2026-08-02T18:02:12Z

❌ Contribution Check failed. Please review the logs for details.

github-actions · 2026-08-02T18:02:12Z

🛡️ Smoke Copilot Network Isolation reports failed while checking network isolation. Investigate the egress model.

github-actions · 2026-08-02T18:02:13Z

🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation...

github-actions · 2026-08-02T18:02:15Z

Chroot tests failed Smoke Chroot failed - See logs for details.

github-actions · 2026-08-02T18:02:18Z

📰 DEVELOPING STORY: Smoke Copilot reports failed. Our correspondents are investigating the incident...

github-actions · 2026-08-02T18:31:50Z

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (api.github.com) reachable: allowed=200
✅ Blocked domain (example.com) denied: proxy returned 403 (CONNECT tunnel failed)

Overall: PASS

@lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-08-02T18:32:01Z

Smoke Test: Claude Engine Validation

Check	Result
API status	✅ PASS
gh check	✅ PASS
File status	✅ PASS

Overall result: ✅ PASS

Generated by Smoke Claude for #6830 · haiku45 · 55 AIC · ⊞ 3.6K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-08-02T18:32:12Z

Smoke Test: Copilot BYOK (Direct) Mode ✅ PASS

✅ GitHub MCP connectivity
✅ GitHub.com connectivity (HTTP 200)
✅ File write/read test
✅ BYOK inference via api-proxy → api.githubcopilot.com

Mode: Direct BYOK (COPILOT_PROVIDER_API_KEY) with api-proxy credential injection.

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-08-02T18:32:17Z

Smoke Test: Copilot Engine — @lpcox

✅ GitHub MCP: PR fix: upgrade cli-proxy gh to 2.97.0 #6845 "fix: upgrade cli-proxy gh to 2.97.0"
✅ GitHub.com connectivity (HTTP 200)
✅ File write/read test passed

Overall: PASS

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-08-02T18:32:59Z

Smoke Test: GitHub Actions Services Connectivity

Redis PING: ❌ (Temporary failure in name resolution)
PostgreSQL pg_isready: ❌ (no response)
PostgreSQL SELECT 1: ❌ (could not translate host name)

Overall: FAIL — host.docker.internal did not resolve from the AWF sandbox.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-08-02T18:33:19Z

✅ fix: upgrade cli-proxy gh to 2.97.0
✅ chore: upgrade gh-aw to v0.84.2 pre-release and recompile workflows
PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

github-actions · 2026-08-02T18:33:24Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.13	✅ YES
Node.js	v24.18.0	v22.23.1	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Overall: FAILED — Node.js version mismatch between host and chroot environments. smoke-chroot label not applied.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions · 2026-08-02T18:34:07Z

Smoke Test: API Proxy OpenTelemetry Tracing — Results

Scenario	Result
1. Module Loading	✅ `otel.js` loads successfully; `isEnabled: true`; exports `startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled, ...`
2. Test Suite	✅ `otel.test.js` + `otel-fanout.test.js` — 59/59 tests passed
3. Env Var Forwarding	✅ `env-passthrough.ts` forwards `GITHUB_AW_OTEL_TRACE_ID`/`GITHUB_AW_OTEL_PARENT_SPAN_ID`; `api-proxy-env-config.ts` forwards `GH_AW_OTLP_ENDPOINTS`, `OTEL_EXPORTER_OTLP_ENDPOINT`, and trace context
4. Token Tracker Integration	✅ `token-tracker-http.js` has `onUsage` callback wired as the OTEL hook point
5. OTEL Diagnostics	✅ No unexpected errors; no `otel.jsonl` present in `api-proxy-logs` for this run (no OTEL-instrumented LLM calls were made), so no spans to export — expected/graceful, not a failure

Summary: All 5 scenarios pass. OTEL integration (module init, span creation code paths, token usage attributes, env var propagation, and test coverage) verified working; graceful degradation confirmed since no live API traffic occurred in this run.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-08-02T18:34:40Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	pass	✅ PASS
Node.js	execa	✅	pass	✅ PASS
Node.js	p-limit	✅	pass	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — PASS

Note: Java Maven builds required -Dmaven.repo.local=/tmp/gh-aw/agent/m2repo since the pre-existing ~/.m2 directory was owned by root and not writable in this environment. All other steps ran exactly as specified.

Generated by Build Test Suite for #6830 · auto · 52.5 AIC · ⊞ 11.4K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-08-02T18:35:19Z

Docker Sbx Smoke Test — @lpcox

✅ GitHub MCP: PR fix: upgrade cli-proxy gh to 2.97.0 #6845 "fix: upgrade cli-proxy gh to 2.97.0", PR chore: upgrade gh-aw to v0.84.2 pre-release and recompile workflows #6844 "chore: upgrade gh-aw to v0.84.2 pre-release and recompile workflows"
✅ GitHub.com connectivity: HTTP 200
✅ File write/read test: verified

Overall: PASS

📰 BREAKING: Report filed by Smoke Docker Sbx
_{Add label ready-for-aw to run again}

github-actions · 2026-08-02T18:36:08Z

@lpcox
fix: upgrade cli-proxy gh to 2.97.0 ✅
chore: upgrade gh-aw to v0.84.2 pre-release and recompile workflows ✅
GitHub.com HTTP ✅
File write/read ✅
BYOK inference ✅
Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra
Overall: PASS

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)
_{Add label ready-for-aw to run again}

github-actions · 2026-08-02T18:36:19Z

@lpcox

MCP connectivity: ✅
GitHub.com connectivity: ✅
File I/O test: ✅
BYOK inference test: ✅

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)
Overall: PASS

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)
_{Add label ready-for-aw to run again}

github-actions · 2026-08-02T18:39:11Z

Gemini Engine Smoke Test Results

GitHub MCP: ✅ (Tool functional, results filtered by secrecy policy)
Connectivity: ✅ (200 OK via proxy)
File Writing: ✅
Bash Tool: ✅

Overall Status: PASS

💎 Faceted by Smoke Gemini
_{Add label ready-for-aw to run again}

Initial plan

50334f1

Copilot AI assigned Copilot and lpcox Aug 2, 2026

Copilot started work on behalf of lpcox August 2, 2026 00:26 View session

Copilot AI linked an issue Aug 2, 2026 that may be closed by this pull request

[smoke-otel-tracing] api-proxy container does not receive OTEL env vars for tracing #6827

Closed

4 tasks

fix: forward OTEL trace context through agent env passthrough

106297a

Copilot AI changed the title ~~[WIP] Fix OTEL env vars for api-proxy container~~ Forward OTEL trace context through nested AWF agent env passthrough Aug 2, 2026

Copilot AI requested a review from lpcox August 2, 2026 00:35

Copilot finished work on behalf of lpcox August 2, 2026 00:35

lpcox marked this pull request as ready for review August 2, 2026 00:39

Copilot AI review requested due to automatic review settings August 2, 2026 00:39

Copilot started reviewing on behalf of lpcox August 2, 2026 00:39 View session

Copilot AI reviewed Aug 2, 2026

View reviewed changes

Copilot started work on behalf of lpcox August 2, 2026 17:34 View session

fix: don't forward OTEL collector config to agent env

ee60fc5

Copilot finished work on behalf of lpcox August 2, 2026 17:42

lpcox added the ready-for-aw label Aug 2, 2026

github-actions Bot added the smoke-copilot-network-isolation Copilot network-isolation egress smoke test label Aug 2, 2026

github-actions Bot added the smoke-claude label Aug 2, 2026

github-actions Bot added the smoke-copilot-byok label Aug 2, 2026

github-actions Bot added the smoke-copilot label Aug 2, 2026

github-actions Bot added the smoke-codex label Aug 2, 2026

github-actions Bot added the build-test label Aug 2, 2026

github-actions Bot mentioned this pull request Aug 2, 2026

[aw] Contribution Check hit engine rate limit (HTTP 429) #6863

Open

github-actions Bot added the smoke-docker-sbx label Aug 2, 2026

lpcox temporarily deployed to aoai-model August 2, 2026 18:35 — with GitHub Actions Inactive

github-actions Bot added the smoke-copilot-byok-aoai-entra label Aug 2, 2026

lpcox temporarily deployed to aoai-model August 2, 2026 18:36 — with GitHub Actions Inactive

github-actions Bot added the smoke-copilot-byok-aoai-apikey label Aug 2, 2026

lpcox enabled auto-merge (squash) August 2, 2026 18:36

github-actions Bot added the smoke-gemini label Aug 2, 2026

lpcox merged commit 7319263 into main Aug 2, 2026
138 of 140 checks passed

lpcox deleted the copilot/smoke-otel-tracing-fix-env-vars branch August 2, 2026 18:40

github-actions Bot mentioned this pull request Aug 2, 2026

Add Runner Doctor D12 for Copilot model: auto failures under gVisor/sbx #6867

Merged

Uh oh!

Conversation

Copilot AI commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

lpcox commented Aug 2, 2026

Uh oh!

Copilot AI commented Aug 2, 2026

Uh oh!

github-actions Bot commented Aug 2, 2026

Uh oh!

github-actions Bot commented Aug 2, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

github-actions Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 2, 2026

Uh oh!

github-actions Bot commented Aug 2, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Aug 2, 2026

Smoke Test: Copilot BYOK (Direct) Mode ✅ PASS

Uh oh!

github-actions Bot commented Aug 2, 2026

Uh oh!

github-actions Bot commented Aug 2, 2026

Smoke Test: GitHub Actions Services Connectivity

Uh oh!

github-actions Bot commented Aug 2, 2026

Uh oh!

github-actions Bot commented Aug 2, 2026

Chroot Version Comparison Results

Uh oh!

github-actions Bot commented Aug 2, 2026

Smoke Test: API Proxy OpenTelemetry Tracing — Results

Uh oh!

github-actions Bot commented Aug 2, 2026

🏗️ Build Test Suite Results

Uh oh!

github-actions Bot commented Aug 2, 2026

Uh oh!

github-actions Bot commented Aug 2, 2026

Uh oh!

github-actions Bot commented Aug 2, 2026

Uh oh!

github-actions Bot commented Aug 2, 2026

Gemini Engine Smoke Test Results

Uh oh!

Copilot AI commented Aug 2, 2026 •

edited

Loading

github-actions Bot commented Aug 2, 2026 •

edited

Loading

github-actions Bot commented Aug 2, 2026 •

edited

Loading

github-actions Bot commented Aug 2, 2026 •

edited

Loading

github-actions Bot commented Aug 2, 2026 •

edited

Loading

github-actions Bot commented Aug 2, 2026 •

edited

Loading

github-actions Bot commented Aug 2, 2026 •

edited

Loading

github-actions Bot commented Aug 2, 2026 •

edited

Loading

github-actions Bot commented Aug 2, 2026 •

edited

Loading

github-actions Bot commented Aug 2, 2026 •

edited

Loading