Manage CI/CD Observability as Code

This GitHub Action automatically instruments your CI/CD pipelines with OpenTelemetry, sending traces and metrics to Dash0.

For other "as code" approaches, see the Manage as Code overview.

This action exports Github CI/CD workflows to any endpoint compatible with OpenTelemetry.

This is a fork of otel-export-trace-action with more features and better support. Originally created and maintained by Corentin Musard, now maintained by Dash0.

Compliant with OpenTelemetry CICD semconv. Look at Sample OpenTelemetry Output for the list of attributes and their values.

Usage

We provide sample code for popular platforms. If you feel one is missing, please open an issue.

On workflow_run event

workflow_run github documentation

1234567891011121314151617
on:
  workflow_run:
    workflows:
      # The name of the workflow(s) that triggers the export
      - "Build"
    types: [completed]

jobs:
  otel-cicd-actions:
    runs-on: ubuntu-latest
    steps:
      - uses: dash0hq/otel-cicd-action@v4
        with:
          otlpEndpoint: grpc://ingress.eu-west-1.aws.dash0.com:4317
          otlpHeaders: ${{ secrets.OTLP_HEADERS }}
          githubToken: ${{ secrets.GITHUB_TOKEN }}
          runId: ${{ github.event.workflow_run.id }}

Inside an existing workflow

123456789101112131415
jobs:
  build:
    # ... existing code
  otel-cicd-action:
    if: always()
    name: OpenTelemetry Export Trace
    runs-on: ubuntu-latest
    needs: [build] # must run when all jobs are completed
    steps:
      - name: Export workflow
        uses: dash0hq/otel-cicd-action@v4
        with:
          otlpEndpoint: grpc://ingress.eu-west-1.aws.dash0.com:4317
          otlpHeaders: ${{ secrets.OTLP_HEADERS }}
          githubToken: ${{ secrets.GITHUB_TOKEN }}

On workflow_run eventCopy vs Inside an existing workflowCopy

Both methods must be run when the workflow is completed, otherwise, the trace will be incomplete.

Private Repository

If you are using a private repository, you need to set the following permissions in your workflow file. It can be done at the global level or at the job level.

12345
permissions:
  contents: read # Required. To access the private repository
  actions: read # Required. To read workflow runs
  pull-requests: read # Optional. To read PR labels
  checks: read # Optional. To read run annotations

Adding arbitrary resource attributes

You can use extraAttributesCopy to set any additional string resource attributes. Attributes are splitted on ,Copy and then each key/value are splitted on the first =Copy.

1234567
- name: Export workflow
  uses: dash0hq/otel-cicd-action@v4
  with:
    otlpEndpoint: "CHANGE ME"
    otlpHeaders: "CHANGE ME"
    githubToken: ${{ secrets.GITHUB_TOKEN }}
    extraAttributes: "extra.attribute=1,key2=value2"

Using a self-signed certificate

When an internal OTLP endpoint uses a self-signed certificate and its certificate authority cannot be added to the runner's trust store, set otlpInsecureSkipVerifyCopy to trueCopy:

1234567
- name: Export workflow
  uses: dash0hq/otel-cicd-action@v4
  with:
    otlpEndpoint: grpc://otlp.example.com:4317
    otlpHeaders: "CHANGE ME"
    githubToken: ${{ secrets.GITHUB_TOKEN }}
    otlpInsecureSkipVerify: true

This disables certificate verification for the OTLP exporter connection and makes it vulnerable to man-in-the-middle attacks. Only use it with a trusted internal endpoint.

Action Inputs

Action Outputs

What data is exported

The action exports the workflow run metadata returned by the GitHub API as span attributes, without redaction. There is currently no way to opt out of individual attributes, so make sure your telemetry backend is an acceptable place for this data. In particular, be aware that:

• Commit metadata is included: the full commit message, plus author and committer names and email addresses (github.head_commit.*Copy).
• Job annotations and PR metadata are included when the token has the optional checks: readCopy and pull-requests: readCopy permissions: annotation messages, PR numbers, branch names, and labels.
• service.instance.idCopy is unique per run attempt (<repo>/<workflow id>/<run id>/<attempt>Copy), so each workflow run appears as its own service instance. Backends that bill or aggregate by service instance will see one instance per run.

See the Sample OpenTelemetry Output for the full list of exported attributes and example values.