feat: [DEVOPS-2394] auto-clone cx-contrib fork + pin SHA

- publish-sandbox.sh: auto-clone coralogix/opentelemetry-js-contrib to
  .build-cache/ on first run; checkout pinned SHA. Removes the manual
  sibling-clone setup step. OPENTELEMETRY_JS_CONTRIB_PATH override still
  honored for local dev against a different checkout.
- Pin cx-contrib in the publish workflow to the same SHA for reproducibility.
- .gitignore: .build-cache/, build-sandbox/

Verified: fresh clone + unset OPENTELEMETRY_JS_CONTRIB_PATH → script clones,
builds, publishes sandbox-arm64 v2 successfully.

Author: jmsundar

.github/workflows/publish-extend-otel-layer.yml

@@ -45,8 +45,10 @@ jobs:
       OPENTELEMETRY_JS_CONTRIB_PATH: ${{ github.workspace }}/opentelemetry-js-contrib
     steps:
       - uses: actions/checkout@v4
+      # Pinned SHA — bump when upstream cx-contrib lands a fix/feature we want.
+      # Keep in sync with CX_CONTRIB_SHA in ci-scripts/publish-sandbox.sh.
       - uses: actions/checkout@v4
-        with: { repository: coralogix/opentelemetry-js-contrib, ref: coralogix-autoinstrumentation, path: opentelemetry-js-contrib }
+        with: { repository: coralogix/opentelemetry-js-contrib, ref: 3a9691a699ddd06c3644eec70bf4b50cc4217ba3, path: opentelemetry-js-contrib }
       - uses: actions/setup-node@v4
         with:
           node-version: 22

.gitignore

@@ -26,6 +26,8 @@ collector/VERSION
 opentelemetry-js/
 opentelemetry-js-contrib-cx/
 import-in-the-middle/
+.build-cache/
+build-sandbox/
 
 .envrc
 mise.toml

ci-scripts/publish-sandbox.sh

@@ -2,21 +2,40 @@
 # Publishes extend-nodejs-wrapper-and-exporter-{arch} to engservicessandbox us-east-1 as a PRIVATE layer.
 # Prereqs:
 #   - AWS_PROFILE set to engservicessandbox (or SSO-logged-in) w/ lambda:PublishLayerVersion
-#   - coralogix/opentelemetry-js-contrib cloned as sibling at ../opentelemetry-js-contrib (coralogix-autoinstrumentation branch)
 #   - Run from repo root
+#
+# The coralogix/opentelemetry-js-contrib fork is auto-cloned to .build-cache/ on first run.
+# To override the clone path (e.g. for local dev against a different checkout), set
+# OPENTELEMETRY_JS_CONTRIB_PATH before invoking this script.
 
 set -euo pipefail
 
 ARCH="${1:-arm64}"
 REGION="us-east-1"
 LAYER_NAME="extend-nodejs-wrapper-and-exporter-sandbox-${ARCH}"
 
+# Pinned to a specific commit on coralogix-autoinstrumentation for reproducible builds.
+# Bump when upstream cx-contrib lands a fix/feature we want.
+CX_CONTRIB_REPO="https://github.com/coralogix/opentelemetry-js-contrib.git"
+CX_CONTRIB_SHA="3a9691a699ddd06c3644eec70bf4b50cc4217ba3"
+CX_CONTRIB_CACHE="${OPENTELEMETRY_JS_CONTRIB_PATH:-.build-cache/opentelemetry-js-contrib}"
+
 case "$ARCH" in
   amd64) AWS_ARCH="x86_64" ;;
   arm64) AWS_ARCH="arm64" ;;
   *) echo "unsupported arch: $ARCH"; exit 1 ;;
 esac
 
+echo "==> resolving cx-contrib fork at $CX_CONTRIB_SHA"
+if [ ! -d "$CX_CONTRIB_CACHE/.git" ]; then
+  mkdir -p "$(dirname "$CX_CONTRIB_CACHE")"
+  git clone --filter=blob:none "$CX_CONTRIB_REPO" "$CX_CONTRIB_CACHE"
+fi
+git -C "$CX_CONTRIB_CACHE" fetch --quiet origin "$CX_CONTRIB_SHA" 2>/dev/null || git -C "$CX_CONTRIB_CACHE" fetch --quiet origin
+git -C "$CX_CONTRIB_CACHE" checkout --quiet "$CX_CONTRIB_SHA"
+export OPENTELEMETRY_JS_CONTRIB_PATH
+OPENTELEMETRY_JS_CONTRIB_PATH="$(cd "$CX_CONTRIB_CACHE" && pwd)"
+
 echo "==> building collector ($ARCH)"
 make -C collector package-extend GOARCH="$ARCH"