This repository was archived by the owner on May 25, 2026. It is now read-only.
[codex] Optimize semantic convention analyzer README #21
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,51 @@ | ||
| name: Supplemental catalog drift | ||
|
|
||
| on: | ||
| push: | ||
| branches: [main] | ||
| paths: | ||
| - 'scripts/regen-supplemental-catalog.csx' | ||
| - 'scripts/.upstream-semconv-version' | ||
| - 'scripts/.upstream-deprecated-extract.txt' | ||
| - '.github/workflows/supplemental-catalog-drift.yml' | ||
| pull_request: | ||
| paths: | ||
| - 'scripts/regen-supplemental-catalog.csx' | ||
| - 'scripts/.upstream-semconv-version' | ||
| - 'scripts/.upstream-deprecated-extract.txt' | ||
| - '.github/workflows/supplemental-catalog-drift.yml' | ||
| schedule: | ||
| # Weekly Monday 04:13 UTC — catches upstream additions of new deprecated | ||
| # entries between releases of this analyzer package. A red scheduled run is | ||
| # the early signal that scripts/.upstream-deprecated-extract.txt needs to | ||
| # be regenerated and the supplemental catalog updated to match. | ||
| - cron: '13 4 * * 1' | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| drift-check: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - uses: actions/setup-dotnet@v4 | ||
| with: | ||
| dotnet-version: '8.0.x' | ||
|
Comment on lines
+31
to
+35
Contributor
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
FILE=".github/workflows/supplemental-catalog-drift.yml"
echo "=== File: $FILE ==="
ls -la "$FILE" || true
echo
echo "=== Lines 1-200 (for context) ==="
nl -ba "$FILE" | sed -n '1,200p'
echo
echo "=== Lines around 31-50 ==="
nl -ba "$FILE" | sed -n '20,60p'Repository: ANcpLua/ANcpLua.OpenTelemetry.SemanticConventions.Analyzers Length of output: 360 🏁 Script executed: #!/bin/bash
set -euo pipefail
FILE=".github/workflows/supplemental-catalog-drift.yml"
echo "=== Grep relevant patterns in $FILE ==="
rg -n "uses:|persist-credentials|dotnet-script|tool\s+install|dotnet tool|dotnet-version" "$FILE" || trueRepository: ANcpLua/ANcpLua.OpenTelemetry.SemanticConventions.Analyzers Length of output: 708 🏁 Script executed: #!/bin/bash
set -euo pipefail
FILE=".github/workflows/supplemental-catalog-drift.yml"
python3 - <<'PY'
import re, pathlib
p=pathlib.Path(".github/workflows/supplemental-catalog-drift.yml")
txt=p.read_text()
print("=== Extracted uses lines ===")
for i,line in enumerate(txt.splitlines(),1):
if re.search(r'^\s*-\s*uses:', line):
print(f"{i}: {line.rstrip()}")
print("\n=== Extracted with sections (best-effort) ===")
# Print blocks around uses/setup-dotnet lines
lines=txt.splitlines()
for i,line in enumerate(lines):
if 'actions/setup-dotnet' in line or 'actions/checkout' in line:
start=max(0,i-2); end=min(len(lines), i+20)
print(f"\n--- context around line {i+1} ---")
for j in range(start,end):
print(f"{j+1}: {lines[j]}")
PYRepository: ANcpLua/ANcpLua.OpenTelemetry.SemanticConventions.Analyzers Length of output: 2474 🏁 Script executed: #!/bin/bash
set -euo pipefail
FILE=".github/workflows/supplemental-catalog-drift.yml"
echo "=== File: $FILE ==="
ls -la "$FILE" || true
echo
echo "=== Lines 1-200 (for context) ==="
nl -ba "$FILE" | sed -n '1,200p'
echo
echo "=== Lines around 31-50 ==="
nl -ba "$FILE" | sed -n '20,60p'Repository: ANcpLua/ANcpLua.OpenTelemetry.SemanticConventions.Analyzers Length of output: 360 🏁 Script executed: #!/bin/bash
set -euo pipefail
FILE=".github/workflows/supplemental-catalog-drift.yml"
echo "=== Grep relevant patterns in $FILE ==="
rg -n "uses:|persist-credentials|dotnet-script|tool\s+install|dotnet tool|dotnet-version" "$FILE" || trueRepository: ANcpLua/ANcpLua.OpenTelemetry.SemanticConventions.Analyzers Length of output: 708 🏁 Script executed: #!/bin/bash
set -euo pipefail
FILE=".github/workflows/supplemental-catalog-drift.yml"
python3 - <<'PY'
import re, pathlib
p=pathlib.Path(".github/workflows/supplemental-catalog-drift.yml")
txt=p.read_text()
print("=== Extracted uses lines ===")
for i,line in enumerate(txt.splitlines(),1):
if re.search(r'^\s*-\s*uses:', line):
print(f"{i}: {line.rstrip()}")
print("\n=== Extracted with sections (best-effort) ===")
# Print blocks around uses/setup-dotnet and checkout lines
lines=txt.splitlines()
for i,line in enumerate(lines):
if 'actions/setup-dotnet' in line or 'actions/checkout' in line:
start=max(0,i-2); end=min(len(lines), i+20)
print(f"\n--- context around line {i+1} ---")
for j in range(start,end):
print(f"{j+1}: {lines[j]}")
PYRepository: ANcpLua/ANcpLua.OpenTelemetry.SemanticConventions.Analyzers Length of output: 2474 Pin
Proposed fix- - uses: actions/checkout@v4
+ - uses: actions/checkout@<commit-sha>
- - uses: actions/setup-dotnet@v4
+ - uses: actions/setup-dotnet@<commit-sha>🧰 Tools🪛 zizmor (1.25.2)[warning] 31-31: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [error] 31-31: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) [error] 33-33: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) 🤖 Prompt for AI Agents |
||
|
|
||
| - name: Install dotnet-script | ||
| run: dotnet tool install -g dotnet-script | ||
|
Comment on lines
+37
to
+38
Contributor
There was a problem hiding this comment. 🧹 Nitpick | 🔵 Trivial | ⚡ Quick win Pin Installing latest introduces non-reproducible CI behavior. Proposed fix- - name: Install dotnet-script
- run: dotnet tool install -g dotnet-script
+ - name: Install dotnet-script
+ run: dotnet tool install -g dotnet-script --version <pinned-version>🤖 Prompt for AI Agents |
||
|
|
||
| - name: Regenerate the upstream-deprecated extract | ||
| run: | | ||
| export PATH="$PATH:$HOME/.dotnet/tools" | ||
| dotnet-script scripts/regen-supplemental-catalog.csx | ||
|
|
||
| - name: Assert the committed extract is in sync with upstream | ||
| run: | | ||
| if ! git diff --exit-code scripts/.upstream-deprecated-extract.txt; then | ||
| echo "::error::Upstream semantic-conventions @ $(cat scripts/.upstream-semconv-version) added or changed deprecated entries." | ||
| echo "::error::Run 'dotnet-script scripts/regen-supplemental-catalog.csx' locally, review the diff, then update src/.../Imports/Semconv/OpenTelemetryDeprecatedSemconvCatalog.cs and commit both the new extract and the catalog update." | ||
| exit 1 | ||
| fi | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| name: Weaver round-trip | ||
|
|
||
| on: | ||
| push: | ||
| branches: [main] | ||
| paths: | ||
| - 'tests/WeaverRoundTrip/**' | ||
| - 'tests/ANcpLua.OpenTelemetry.SemanticConventions.Analyzers.Tests/WeaverRoundTripTests.cs' | ||
| - 'src/**' | ||
| - '.github/workflows/weaver-roundtrip.yml' | ||
| pull_request: | ||
| paths: | ||
| - 'tests/WeaverRoundTrip/**' | ||
| - 'tests/ANcpLua.OpenTelemetry.SemanticConventions.Analyzers.Tests/WeaverRoundTripTests.cs' | ||
| - 'src/**' | ||
| - '.github/workflows/weaver-roundtrip.yml' | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| weaver-roundtrip: | ||
| runs-on: ubuntu-latest | ||
|
Comment on lines
+3
to
+23
Contributor
There was a problem hiding this comment. 🧹 Nitpick | 🔵 Trivial Add workflow-level concurrency cancellation. This avoids stale duplicate runs on rapid force-push/update sequences and keeps CI signal clean. Suggested patch on:
push:
@@
pull_request:
@@
+concurrency:
+ group: weaver-roundtrip-${{ github.workflow }}-${{ github.ref }}
+ cancel-in-progress: true
+
permissions:
contents: read🧰 Tools🪛 zizmor (1.25.2)[info] 22-22: workflow or action definition without a name (anonymous-definition): this job (anonymous-definition) [warning] 3-16: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting (concurrency-limits) 🤖 Prompt for AI Agents |
||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
Contributor
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
FILE=".github/workflows/weaver-roundtrip.yml"
echo "== File: $FILE =="
nl -ba "$FILE" | sed -n '1,140p'
echo
echo "== Grep for checkout steps =="
rg -n "uses:\s*actions/checkout@" "$FILE" || true
echo
echo "== Grep for persist-credentials =="
rg -n "persist-credentials" "$FILE" || true
echo
echo "== Grep for triggers (pull_request / pull_request_target) =="
rg -n "on:\s*$|pull_request|pull_request_target|workflow_dispatch|schedule" "$FILE" || trueRepository: ANcpLua/ANcpLua.OpenTelemetry.SemanticConventions.Analyzers Length of output: 215 🏁 Script executed: #!/bin/bash
set -euo pipefail
FILE=".github/workflows/weaver-roundtrip.yml"
echo "== File exists? =="
test -f "$FILE" && echo "yes" || (echo "missing: $FILE" && exit 1)
echo
echo "== Showing lines 1-140 (numbered) =="
awk 'NR>=1 && NR<=140 {printf "%5d %s\n", NR, $0}' "$FILE"
echo
echo "== Grep for checkout steps =="
rg -n "uses:\s*actions/checkout@" "$FILE" || true
echo
echo "== Grep for persist-credentials =="
rg -n "persist-credentials" "$FILE" || true
echo
echo "== Grep for PR-related triggers/permissions =="
rg -n "pull_request_target|pull_request\b|permissions:|contents:|id-token:|token:" "$FILE" || trueRepository: ANcpLua/ANcpLua.OpenTelemetry.SemanticConventions.Analyzers Length of output: 3017 Disable checkout credential persistence in This workflow runs repo-controlled scripts on Suggested patch- - uses: actions/checkout@v4
+ - uses: actions/checkout@v4
+ with:
+ persist-credentials: false🧰 Tools🪛 zizmor (1.25.2)[warning] 25-25: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [error] 25-25: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) 🤖 Prompt for AI Agents🧩 Analysis chain🏁 Script executed: #!/bin/bash
# Verify actions are pinned to full commit SHAs (40 hex chars).
rg -nP '^\s*-\s*uses:\s+\S+@([0-9a-f]{40})\s*$' .github/workflows/weaver-roundtrip.yml
rg -nP '^\s*-\s*uses:\s+\S+@v\d+' .github/workflows/weaver-roundtrip.ymlRepository: ANcpLua/ANcpLua.OpenTelemetry.SemanticConventions.Analyzers Length of output: 181 Pin GitHub Actions to immutable commit SHAs (avoid floating
- uses: actions/checkout@v4
- uses: actions/setup-dotnet@v4🧰 Tools🪛 zizmor (1.25.2)[warning] 25-25: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [error] 25-25: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) 🤖 Prompt for AI Agents |
||
|
|
||
| - name: Read pinned Weaver version | ||
| id: pin | ||
| run: echo "version=$(cat tests/WeaverRoundTrip/.weaver-version)" >> "$GITHUB_OUTPUT" | ||
|
|
||
| - name: Install Weaver ${{ steps.pin.outputs.version }} | ||
| run: | | ||
| set -euo pipefail | ||
| v="${{ steps.pin.outputs.version }}" | ||
| url="https://github.com/open-telemetry/weaver/releases/download/v${v}/weaver-x86_64-unknown-linux-gnu.tar.xz" | ||
| mkdir -p "$RUNNER_TEMP/weaver" | ||
| curl -sSLf "$url" -o "$RUNNER_TEMP/weaver.tar.xz" | ||
| tar -xJf "$RUNNER_TEMP/weaver.tar.xz" -C "$RUNNER_TEMP/weaver" --strip-components=1 | ||
| install -m 0755 "$RUNNER_TEMP/weaver/weaver" /usr/local/bin/weaver | ||
|
There was a problem hiding this comment.
The workflow installs the binary directly into Useful? React with 👍 / 👎. |
||
| weaver --version | ||
|
|
||
| - name: Regenerate the round-trip fixture | ||
| run: tests/WeaverRoundTrip/generate.sh | ||
|
|
||
| - name: Assert the committed fixture is in sync with the regeneration | ||
| run: | | ||
| if ! git diff --exit-code tests/WeaverRoundTrip/generated/; then | ||
| echo "::error::Weaver-generated fixture drifted from the checked-in file." | ||
| echo "::error::Run 'tests/WeaverRoundTrip/generate.sh' locally and commit the result." | ||
| exit 1 | ||
| fi | ||
|
|
||
| - uses: actions/setup-dotnet@v4 | ||
| with: | ||
| dotnet-version: '8.0.x' | ||
|
|
||
| - name: Run the round-trip analyzer assertion | ||
| run: | | ||
| dotnet test tests/ANcpLua.OpenTelemetry.SemanticConventions.Analyzers.Tests/ANcpLua.OpenTelemetry.SemanticConventions.Analyzers.Tests.csproj \ | ||
| -c Release \ | ||
| --filter 'FullyQualifiedName~WeaverRoundTrip' | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -10,3 +10,4 @@ obj/ | |
| # Local NuGet cache | ||
| .nuget/ | ||
| packages/ | ||
| .tools/ | ||
File renamed without changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,177 @@ | ||
| # Auto-generated by scripts/regen-supplemental-catalog.csx. | ||
| # Source: github.com/open-telemetry/semantic-conventions @ v1.41.0 (e018fe6f9186). | ||
| # Format: <kind>\t<old>\t<new> | ||
| # kind = attribute | enum-value | ||
| # old = deprecated attribute key, or 'attribute=value' for enum-value entries | ||
| # new = renamed_to target, or '-' when reason != renamed | ||
| # DO NOT EDIT BY HAND. Re-run the script if upstream changes. | ||
| attribute android.state android.app.state | ||
| attribute az.namespace azure.resource_provider.namespace | ||
| attribute az.service_request_id azure.service.request.id | ||
| attribute code.column code.column.number | ||
| attribute code.filepath code.file.path | ||
| attribute code.function - | ||
| attribute code.lineno code.line.number | ||
| attribute code.namespace - | ||
| attribute container.cpu.state cpu.mode | ||
| attribute container.labels container.label | ||
| attribute container.runtime container.runtime.name | ||
| attribute db.cassandra.consistency_level cassandra.consistency.level | ||
| attribute db.cassandra.coordinator.dc cassandra.coordinator.dc | ||
| attribute db.cassandra.coordinator.id cassandra.coordinator.id | ||
| attribute db.cassandra.idempotence cassandra.query.idempotent | ||
| attribute db.cassandra.page_size cassandra.page.size | ||
| attribute db.cassandra.speculative_execution_count cassandra.speculative_execution.count | ||
| attribute db.cassandra.table db.collection.name | ||
| attribute db.client.connections.pool.name db.client.connection.pool.name | ||
| attribute db.client.connections.state db.client.connection.state | ||
| attribute db.connection_string - | ||
| attribute db.cosmosdb.client_id azure.client.id | ||
| attribute db.cosmosdb.connection_mode azure.cosmosdb.connection.mode | ||
| attribute db.cosmosdb.consistency_level azure.cosmosdb.consistency.level | ||
| attribute db.cosmosdb.container db.collection.name | ||
| attribute db.cosmosdb.operation_type - | ||
| attribute db.cosmosdb.regions_contacted azure.cosmosdb.operation.contacted_regions | ||
| attribute db.cosmosdb.request_charge azure.cosmosdb.operation.request_charge | ||
| attribute db.cosmosdb.request_content_length azure.cosmosdb.request.body.size | ||
| attribute db.cosmosdb.status_code - | ||
| attribute db.cosmosdb.sub_status_code azure.cosmosdb.response.sub_status_code | ||
| attribute db.elasticsearch.cluster.name db.namespace | ||
| attribute db.elasticsearch.node.name elasticsearch.node.name | ||
| attribute db.elasticsearch.path_parts db.operation.parameter | ||
| attribute db.instance.id - | ||
| attribute db.jdbc.driver_classname - | ||
| attribute db.mongodb.collection db.collection.name | ||
| attribute db.mssql.instance_name - | ||
| attribute db.name db.namespace | ||
| attribute db.operation db.operation.name | ||
| attribute db.redis.database_index Use `db.namespace` instead. | ||
| attribute db.sql.table - | ||
| attribute db.statement db.query.text | ||
| attribute db.system db.system.name | ||
| attribute db.user - | ||
| attribute deployment.environment deployment.environment.name | ||
| attribute enduser.role - | ||
| attribute enduser.scope - | ||
| attribute error.message - | ||
| attribute event.name - | ||
| attribute exception.escaped - | ||
| attribute feature_flag.evaluation.error.message feature_flag.error.message | ||
| attribute feature_flag.evaluation.reason feature_flag.result.reason | ||
| attribute feature_flag.provider_name feature_flag.provider.name | ||
| attribute feature_flag.variant feature_flag.result.variant | ||
| attribute gen_ai.completion - | ||
| attribute gen_ai.openai.request.response_format gen_ai.output.type | ||
| attribute gen_ai.openai.request.seed gen_ai.request.seed | ||
| attribute gen_ai.openai.request.service_tier openai.request.service_tier | ||
| attribute gen_ai.openai.response.service_tier openai.response.service_tier | ||
| attribute gen_ai.openai.response.system_fingerprint openai.response.system_fingerprint | ||
| attribute gen_ai.prompt - | ||
| attribute gen_ai.system gen_ai.provider.name | ||
| attribute gen_ai.usage.completion_tokens gen_ai.usage.output_tokens | ||
| attribute gen_ai.usage.prompt_tokens gen_ai.usage.input_tokens | ||
| attribute http.client_ip client.address | ||
| attribute http.flavor - | ||
| attribute http.host - | ||
| attribute http.method http.request.method | ||
| attribute http.request_content_length - | ||
| attribute http.request_content_length_uncompressed http.request.body.size | ||
| attribute http.response_content_length - | ||
| attribute http.response_content_length_uncompressed http.response.body.size | ||
| attribute http.scheme url.scheme | ||
| attribute http.server_name server.address | ||
| attribute http.status_code http.response.status_code | ||
| attribute http.target - | ||
| attribute http.url url.full | ||
| attribute http.user_agent user_agent.original | ||
| attribute ios.state ios.app.state | ||
| attribute k8s.pod.labels k8s.pod.label | ||
| attribute linux.memory.slab.state system.memory.linux.slab.state | ||
| attribute message.compressed_size - | ||
| attribute message.id - | ||
| attribute message.type - | ||
| attribute message.uncompressed_size - | ||
| attribute messaging.client_id messaging.client.id | ||
| attribute messaging.destination_publish.anonymous - | ||
| attribute messaging.destination_publish.name - | ||
| attribute messaging.eventhubs.consumer.group messaging.consumer.group.name | ||
| attribute messaging.kafka.consumer.group messaging.consumer.group.name | ||
| attribute messaging.kafka.destination.partition - | ||
| attribute messaging.kafka.message.offset messaging.kafka.offset | ||
| attribute messaging.operation messaging.operation.type | ||
| attribute messaging.rocketmq.client_group - | ||
| attribute messaging.servicebus.destination.subscription_name messaging.destination.subscription.name | ||
| attribute net.host.ip network.local.address | ||
| attribute net.host.name server.address | ||
| attribute net.host.port server.port | ||
| attribute net.peer.ip network.peer.address | ||
| attribute net.peer.name - | ||
| attribute net.peer.port - | ||
| attribute net.protocol.name network.protocol.name | ||
| attribute net.protocol.version network.protocol.version | ||
| attribute net.sock.family - | ||
| attribute net.sock.host.addr network.local.address | ||
| attribute net.sock.host.port network.local.port | ||
| attribute net.sock.peer.addr network.peer.address | ||
| attribute net.sock.peer.name - | ||
| attribute net.sock.peer.port network.peer.port | ||
| attribute net.transport network.transport | ||
| attribute otel.library.name otel.scope.name | ||
| attribute otel.library.version otel.scope.version | ||
| attribute peer.service service.peer.name | ||
| attribute pool.name db.client.connection.pool.name | ||
| attribute process.context_switch_type process.context_switch.type | ||
| attribute process.cpu.state cpu.mode | ||
| attribute process.executable.build_id.profiling process.executable.build_id.htlhash | ||
| attribute process.paging.fault_type system.paging.fault.type | ||
| attribute rpc.connect_rpc.error_code rpc.response.status_code | ||
| attribute rpc.connect_rpc.request.metadata rpc.request.metadata | ||
| attribute rpc.connect_rpc.response.metadata rpc.response.metadata | ||
| attribute rpc.grpc.request.metadata rpc.request.metadata | ||
| attribute rpc.grpc.response.metadata rpc.response.metadata | ||
| attribute rpc.grpc.status_code - | ||
| attribute rpc.jsonrpc.error_code - | ||
| attribute rpc.jsonrpc.error_message - | ||
| attribute rpc.jsonrpc.request_id jsonrpc.request.id | ||
| attribute rpc.jsonrpc.version jsonrpc.protocol.version | ||
| attribute rpc.message.compressed_size - | ||
| attribute rpc.message.id - | ||
| attribute rpc.message.type - | ||
| attribute rpc.message.uncompressed_size - | ||
| attribute rpc.service - | ||
| attribute rpc.system rpc.system.name | ||
| attribute state db.client.connection.state | ||
| attribute system.cpu.logical_number cpu.logical_number | ||
| attribute system.cpu.state cpu.mode | ||
| attribute system.network.state network.connection.state | ||
| attribute system.paging.type system.paging.fault.type | ||
| attribute system.process.status process.state | ||
| attribute system.processes.status process.state | ||
| attribute tls.client.server_name server.address | ||
| attribute vcs.repository.change.id vcs.change.id | ||
| attribute vcs.repository.change.title vcs.change.title | ||
| attribute vcs.repository.ref.name vcs.ref.head.name | ||
| attribute vcs.repository.ref.revision vcs.ref.head.revision | ||
| attribute vcs.repository.ref.type vcs.ref.head.type | ||
| enum-value cloud.platform=azure_aks azure.aks | ||
| enum-value cloud.platform=azure_app_service azure.app_service | ||
| enum-value cloud.platform=azure_container_apps azure.container_apps | ||
| enum-value cloud.platform=azure_container_instances azure.container_instances | ||
| enum-value cloud.platform=azure_functions azure.functions | ||
| enum-value cloud.platform=azure_openshift azure.openshift | ||
| enum-value cloud.platform=azure_vm azure.vm | ||
| enum-value db.system=cache intersystems_cache | ||
| enum-value db.system=cloudscape other_sql | ||
| enum-value db.system=coldfusion - | ||
| enum-value db.system=firstsql other_sql | ||
| enum-value db.system=mssqlcompact other_sql | ||
| enum-value gen_ai.system=az.ai.inference azure.ai.inference | ||
| enum-value gen_ai.system=az.ai.openai azure.ai.openai | ||
| enum-value gen_ai.system=gemini gcp.gemini | ||
| enum-value gen_ai.system=vertex_ai gcp.vertex_ai | ||
| enum-value gen_ai.token.type=output output | ||
| enum-value messaging.operation.type=deliver process | ||
| enum-value messaging.operation.type=publish send | ||
| enum-value os.type=z_os zos | ||
| enum-value system.memory.state=shared - | ||
| enum-value vcs.provider.name=gittea gitea |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| v1.41.0 |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: ANcpLua/ANcpLua.OpenTelemetry.SemanticConventions.Analyzers
Length of output: 375
🏁 Script executed:
Repository: ANcpLua/ANcpLua.OpenTelemetry.SemanticConventions.Analyzers
Length of output: 2318
🌐 Web query:
actions/checkout v4 persist-credentials default value and behavior "persist-credentials" documentation💡 Result:
For actions/checkout v4, the input persist-credentials has no explicit “true/false” value in the README; it is documented as persist-credentials: '' (empty), with the action’s behavior described as “The auth token is persisted in the local git config… Set persist-credentials: false to opt-out.” [1][2] Default value (v4) 1) Documentation shows persist-credentials: '' (blank) in the inputs table for the action. [2][3] 2) The action docs explicitly describe the default behavior as persisting the auth token, and indicate that the way to change it is to set persist-credentials: false. [2] Documented behavior when persist-credentials is enabled (default) - actions/checkout persists the auth token in the local git configuration so that later scripts can run authenticated git commands. [1][2] - The token is removed during post-job cleanup. [1][2] Behavior when persist-credentials: false - Setting persist-credentials: false opts out of persisting credentials. [1][2] Extra nuance (where the credential is stored) - The documentation/README also includes a note that credential persistence behavior has changed over versions: it “now stores credentials in a separate file under $RUNNER_TEMP instead of directly in.git/config” (this affects where the token ends up on disk). [3][4] Example (opt out) uses: actions/checkout@v4 with: persist-credentials: false This prevents the token from being persisted (i.e., removes the “authenticated git commands via stored credentials” behavior), per the documented opt-out. [1][2]
Citations:
Disable checkout credential persistence in PRs (supplemental-catalog-drift).
This workflow runs
scripts/regen-supplemental-catalog.csxonpull_requestevents, butactions/checkout@v4is used withoutpersist-credentials: false. In checkout@v4 the default behavior persists the auth token (local git credential config), increasing exposure if the script uses/reads it.File:
.github/workflows/supplemental-catalog-drift.yml(line 31)Add
with: persist-credentials: falseto theactions/checkout@v4step.🧰 Tools
🪛 zizmor (1.25.2)
[warning] 31-31: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 31-31: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents