Enable opentelemetry

[v1v]

Enable opentelemetry if the following two github secrets are available in the repository:

observability:
  otlp:
    endpoint:
      - url: ${{ secrets.GH_AW_OTEL_ENDPOINT }}
        headers:
          Authorization: ${{ secrets.GH_AW_OTEL_AUTHORIZATION }}

Use a shared import.

Official docs:

• https://github.github.com/gh-aw/guides/open-telemetry/

This should be supported in all the GitHub agentic workflows.

[github-actions]

TL;DR: Implement this as an unconditional shared OpenTelemetry fragment, but make the telemetry configuration and secrets optional; the shared change must also add an explicit OTLP network allowlist entry.

Recommendation

Create a shared fragment such as .github/workflows/gh-aw-fragments/otel.md and import it into every hand-authored GitHub agent workflow source. Declare GH_AW_OTEL_ENDPOINT and GH_AW_OTEL_AUTHORIZATION as optional reusable-workflow secrets, map them from caller examples, and use the gh-aw-supported missing-secret behavior so workflows remain valid when telemetry is not configured. Add the collector hostname to the shared network.allowed configuration; do not rely on the compiler to infer it from a secret-backed URL.

Findings

• Static inspection found 57 hand-authored .github/workflows/*.md sources (52 published gh-aw-* workflows plus 5 internal/agent sources), with no OpenTelemetry configuration in those sources. Existing workflows already use shared imports; for example, .github/workflows/gh-aw-pr-review.md:5-18.
• The repository documents fragments as the cross-workflow configuration mechanism in gh-agent-workflows/DEVELOPING.md:36,44-56.
• .github/workflows/gh-aw-estc-pr-buildkite-detective.md:17-51 shows the reusable-workflow secret declaration pattern, while gh-agent-workflows/estc-pr-buildkite-detective/example.yml:19-22 shows explicit caller mapping.
• The secret-backed endpoint cannot provide a hostname for firewall generation, so the collector domain must be explicitly allowlisted in the shared fragment.
• Related PR #1617 is still draft and currently has no changed files, so it does not resolve the issue.

Verification

The local static inventory reported source_workflows=57 and published_workflows=52. A search of workflow sources found no observability, otlp, or GH_AW_OTEL_* configuration. No code or workflow files were modified during triage.

Detailed Action Plan

1. Add the shared OTLP fragment with the requested endpoint and Authorization header expressions, optional/missing-secret handling, and an explicit narrowly scoped collector host or wildcard in network.allowed.
2. Add the fragment import to all applicable .github/workflows/*.md sources; verify the 52 published workflows and audit the 5 internal sources so the all-agentic-workflow requirement is unambiguous.
3. Add the two optional secrets to each affected workflow_call and map them in the corresponding gh-agent-workflows/*/example.yml callers, or use the repository standard for inherited secrets where appropriate.
4. Document the two repository secrets and the collector allowlist requirement in the relevant workflow documentation.
5. Run make compile, inspect compiler output because Makefile:193-205 intentionally ignores the primary compiler command failure, then run make lint (Makefile:228-268). Exercise compilation/runtime configuration with neither secret, only one secret, and both secrets to confirm telemetry is opt-in and partial configuration fails or degrades according to gh-aw semantics rather than silently misconfiguring the workflow.

Related Items

Type	Location	Relevance
Issue	#1616	OpenTelemetry request
PR	#1617	Draft WIP for this issue; no implementation yet
File	.github/workflows/gh-aw-pr-review.md:5-18	Existing shared-import pattern
File	gh-agent-workflows/DEVELOPING.md:36,44-56	Fragment architecture
File	.github/workflows/gh-aw-estc-pr-buildkite-detective.md:17-51	Reusable secret declaration pattern
File	gh-agent-workflows/estc-pr-buildkite-detective/example.yml:19-22	Caller secret mapping pattern
Docs	https://github.github.com/gh-aw/guides/open-telemetry/	Upstream OpenTelemetry configuration reference

---

What is this? | From workflow: Trigger Issue Triage

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.