Skip to content

feat(E6): OTel instrumentation - byteport-otel crate, CLI tracing#253

Open
KooshaPari wants to merge 4 commits into
mainfrom
feat/otel-instrumentation
Open

feat(E6): OTel instrumentation - byteport-otel crate, CLI tracing#253
KooshaPari wants to merge 4 commits into
mainfrom
feat/otel-instrumentation

Conversation

@KooshaPari

Copy link
Copy Markdown
Owner

Summary

Add Tier-1 enforcement gate on PR to BytePort, providing automated security scanning, SBOM validation, LICENSE verification, and CHANGELOG update checks.

Context

This implements DAG unit B34 (Tier-1 enforcement on PR) as part of the Phenotype compute/infra epic B — Cross-repo consolidation and L1 grading. Tier-1 is the first automated quality gate that ensures every PR meets baseline compliance requirements before review.

Changes

  • Security Audit: Runs cargo-audit via rustsec/audit-check@v2 on every PR to detect known vulnerabilities in Rust dependencies
  • SBOM Generation & Validation: Generates CycloneDX SBOM via cargo-cyclonedx, validates output is non-empty, and uploads as a build artifact (60-day retention)
  • LICENSE Presence Check: Verifies a LICENSE file exists (LICENSE, LICENSE-MIT, LICENSE.md) and is substantive (>=5 lines)
  • CHANGELOG Update Check: Ensures CHANGELOG.md was modified in the PR with an entry under [Unreleased]

Use Cases

  • PR authors receive immediate CI feedback if their change introduces a known vulnerable dependency
  • SBOM artifact is available for downstream ingestion and supply-chain transparency
  • License compliance is enforced at the gate, preventing missing LICENSE from reaching main
  • Changelog discipline is enforced, making release notes always up to date

Testing

# Push a PR branch and verify checks run:
# 1. Security Audit — passes if no RustSec advisories
# 2. SBOM Check — generates and validates CycloneDX JSON
# 3. License Check — passes if LICENSE file present
# 4. Changelog Check — passes if CHANGELOG.md modified

Links

  • Epic: epic_B — Cross-repo consolidation & L1 grading
  • DAG Unit: B34 — Tier-1 enforcement on PR
  • Area: compute-infra

@KooshaPari KooshaPari added the area:compute-infra Phenotype compute/infra epic label Jun 26, 2026
@gemini-code-assist

Copy link
Copy Markdown

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

@github-actions

Copy link
Copy Markdown

Legacy Tooling Scan Report

Severity Count
Critical 0
High 0
Medium 0
Low 0

No violations detected.

This is a WARN-mode scan. Fix before strict enforcement begins.

@socket-security

socket-security Bot commented Jun 26, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addedcargo/​futures@​0.3.3210010093100100
Addedcargo/​rayon@​1.10.010010093100100
Addedcargo/​tempfile@​3.27.09810093100100

View full report

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d44543cb96

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment on lines +10 to +11
byteport-transport = { path = "../byteport-transport", features = ["otel"] }
byteport-otel = { path = "../byteport-otel" }

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Regenerate Cargo.lock for the OTel dependencies

These new dependencies are not reflected in the committed lockfile: in this commit Cargo.lock still has no byteport-otel, opentelemetry, or tracing-opentelemetry package entries, and the byteport-cli package entry still lists only byteport-transport and clap. Any clean checkout using cargo --locked/CI will fail before compiling because the manifest and lockfile disagree, so the lockfile needs to be regenerated with these dependency edges included.

Useful? React with 👍 / 👎.

}
}

#[cfg_attr(feature = "otel", instrument(skip(self, request), fields(object_key = %request.object_key, content_length = %request.content_length)))]

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Move instrument onto the method

With the new default otel feature enabled, this expands #[instrument(...)] on an impl block rather than on a function/method. tracing::instrument instruments functions, so byteport-transport will fail to compile once the feature is active; put the cfg_attr(..., instrument(...)) on create_upload instead of the trait impl block.

Useful? React with 👍 / 👎.

}

fn main() {
let _otel_guard = byteport_otel::init::init_default();

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Keep telemetry logs off CLI stdout

Because init_default() uses the default config with enable_stdout_log = true and the CLI immediately emits info! events, normal commands now write JSON telemetry to stdout before their actual output. This breaks scriptable commands such as codec encode/decode or upload for callers that capture stdout and expect only the command result; CLI diagnostics should go to stderr or be opt-in.

Useful? React with 👍 / 👎.

@github-actions

Copy link
Copy Markdown

Legacy Tooling Scan Report

Severity Count
Critical 0
High 0
Medium 0
Low 0

No violations detected.

This is a WARN-mode scan. Fix before strict enforcement begins.

@sonarqubecloud

Copy link
Copy Markdown

@KooshaPari

Copy link
Copy Markdown
Owner Author

E6 Review: `feat/otel-instrumentation` — PASS (A+)

@KooshaPari KooshaPari changed the title feat(E9): add OTel metrics for CLI invocation rate/error feat(E6): OTel instrumentation - byteport-otel crate, CLI tracing Jun 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area:compute-infra Phenotype compute/infra epic

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant