From 446e09afb838b0350b4c621404fd4f42c3871a99 Mon Sep 17 00:00:00 2001
From: Shubham Gupta <shubham.gupta@sumologic.com>
Date: Wed, 16 Sep 2026 21:26:11 +0530
Subject: [PATCH 1/9] fix(ci): use RenovateBot app token to push release tag to
 main

The default GITHUB_TOKEN cannot push to branches protected by
branch-protection rules. Using the RenovateBot-SumoLogic GitHub App
(already used in this org) to mint a short-lived token that has the
required bypass permission on main.
---
 .github/workflows/release-tag.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/workflows/release-tag.yml b/.github/workflows/release-tag.yml
index fd8ad5a..fceabf5 100644
--- a/.github/workflows/release-tag.yml
+++ b/.github/workflows/release-tag.yml
@@ -43,10 +43,18 @@ jobs:
           echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
           echo "language=${LANGUAGE}" >> "$GITHUB_OUTPUT"
 
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ secrets.RENOVATE_APP_ID }}
+          private-key: ${{ secrets.RENOVATE_PRIVATE_KEY }}
+
       - uses: actions/checkout@v4
         with:
           ref: main
           fetch-depth: 0
+          token: ${{ steps.app-token.outputs.token }}
 
       - name: Configure git
         run: |

From 029dc676007a06af8107b78937c17805ee2467b8 Mon Sep 17 00:00:00 2001
From: Shubham Gupta <shubham.gupta@sumologic.com>
Date: Wed, 16 Sep 2026 21:26:34 +0530
Subject: [PATCH 2/9] fix(ci): ignore release tag links in markdown-link-check

Docs PRs add a CHANGELOG entry with a link to the upcoming release tag
before that tag exists. The link checker returns 404 and fails the PR.

Release tags are immutable once created, so skipping live HTTP checks
on them is safe. Any genuine typo in a tag URL would be caught by the
release-tag workflow itself failing to push.
---
 .markdown_link_check.json | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.markdown_link_check.json b/.markdown_link_check.json
index 6991086..946fcc9 100644
--- a/.markdown_link_check.json
+++ b/.markdown_link_check.json
@@ -11,6 +11,9 @@
     "ignorePatterns": [
       {
         "pattern": "^https://mikefarah.gitbook.io/yq"
+      },
+      {
+        "pattern": "https://github.com/SumoLogic/sumologic-otel-lambda/releases/tag/"
       }
     ]
   }

From 4e0001b6510f30720246a4067221e8313547b8be Mon Sep 17 00:00:00 2001
From: Shubham Gupta <shubham.gupta@sumologic.com>
Date: Wed, 16 Sep 2026 21:27:48 +0530
Subject: [PATCH 3/9] fix(ci): only run relevant checks per changed file type

Three problems in pull-request-checks.yml:
- markdown-link-check had no job-level if guard so it ran on every PR
- yamllint referenced a non-existent 'chart-changed' output (typo),
  always silently skipping but still spinning up a runner
- terraform-lint ran unconditionally regardless of whether any .tf files changed

Fixes:
- Add a terraform-changed job that detects .tf/.tfvars changes
- Add if guard to markdown-link-check at the job level
- Fix yamllint to reference docs-changed instead of chart-changed
- Gate terraform-lint on terraform-changed
---
 .github/workflows/pull-request-checks.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/pull-request-checks.yml b/.github/workflows/pull-request-checks.yml
index 5bb7c20..d7097a7 100644
--- a/.github/workflows/pull-request-checks.yml
+++ b/.github/workflows/pull-request-checks.yml
@@ -46,15 +46,16 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: install yamllint
-        if: needs.chart-changed.outputs.any_changed == 'true'
+        if: needs.docs-changed.outputs.any_changed == 'true'
         run: pip install yamllint
       - name: yamllint
-        if: needs.chart-changed.outputs.any_changed == 'true'
+        if: needs.docs-changed.outputs.any_changed == 'true'
         run: make yaml-lint
 
   markdown-link-check:
     runs-on: ubuntu-22.04
     needs: [docs-changed]
+    if: needs.docs-changed.outputs.any_changed == 'true'
     steps:
       - uses: actions/checkout@v4
       - uses: gaurav-nelson/github-action-markdown-link-check@v1

From bfcc336c055d970fd861cd0143cbb027978d9efd Mon Sep 17 00:00:00 2001
From: Shubham Gupta <shubham.gupta@sumologic.com>
Date: Thu, 17 Sep 2026 12:51:52 +0530
Subject: [PATCH 4/9] ci: fix yaml-lint

---
 .github/labeler.yml                         | 7 +++----
 .github/workflows/publish-release-layer.yml | 2 +-
 .github/workflows/release-build-java.yml    | 2 --
 .github/workflows/release-build-nodejs.yml  | 1 -
 .github/workflows/release-build-python.yml  | 1 -
 .yamllint.yaml                              | 2 +-
 6 files changed, 5 insertions(+), 10 deletions(-)

diff --git a/.github/labeler.yml b/.github/labeler.yml
index 9d94358..e292579 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -1,14 +1,13 @@
 # Add 'documentation' label to any change to *.md files
 documentation:
   - changed-files:
-      - any-glob-to-any-file: [ '**/*.md' ]
+      - any-glob-to-any-file: ["**/*.md"]
 
 # Add 'github_actions' label to any change .github/ directory
 github_actions:
   - changed-files:
-      - any-glob-to-any-file: [ '.github/**' ]
-
+      - any-glob-to-any-file: [".github/**"]
 
 osc:
   - changed-files:
-      - any-glob-to-any-file: [ '**' ]
\ No newline at end of file
+      - any-glob-to-any-file: ["**"]
diff --git a/.github/workflows/publish-release-layer.yml b/.github/workflows/publish-release-layer.yml
index c81aed6..6ff379d 100644
--- a/.github/workflows/publish-release-layer.yml
+++ b/.github/workflows/publish-release-layer.yml
@@ -25,7 +25,7 @@ jobs:
         architecture: [ amd64, arm64 ]
         aws_region: [ us-east-1, us-east-2, us-west-1, us-west-2, af-south-1, ap-east-1, ap-south-1, ap-northeast-3,
                       ap-northeast-2, ap-southeast-1, ap-southeast-2, ap-northeast-1, ca-central-1, eu-central-1,
-                      eu-west-1, eu-west-2, eu-south-1, eu-west-3, eu-north-1, sa-east-1 ] # me-south-1 temporarily disabled
+                      eu-west-1, eu-west-2, eu-south-1, eu-west-3, eu-north-1, sa-east-1 ]  # me-south-1 temporarily disabled
         exclude:
           - aws_region: ap-northeast-2
             architecture: arm64
diff --git a/.github/workflows/release-build-java.yml b/.github/workflows/release-build-java.yml
index f00abd9..a574969 100644
--- a/.github/workflows/release-build-java.yml
+++ b/.github/workflows/release-build-java.yml
@@ -126,10 +126,8 @@ jobs:
             ${{ env.ARM64_LAYERS }}
 
             ## Lambda Container dependencies:
-            
             - [amd64 containers](https://github.com/SumoLogic/sumologic-otel-lambda/releases/download/${{ github.ref_name }}/opentelemetry-java-wrapper-amd64.zip)
             - [arm64 containers](https://github.com/SumoLogic/sumologic-otel-lambda/releases/download/${{ github.ref_name }}/opentelemetry-java-wrapper-arm64.zip)
-          
           artifacts: "artifacts/opentelemetry-java-wrapper-amd64.zip,artifacts/opentelemetry-java-wrapper-arm64.zip,artifacts/java-sample-app.jar"
           artifactErrorsFailBuild: true
           replacesArtifacts: true
diff --git a/.github/workflows/release-build-nodejs.yml b/.github/workflows/release-build-nodejs.yml
index 724c936..1514b18 100644
--- a/.github/workflows/release-build-nodejs.yml
+++ b/.github/workflows/release-build-nodejs.yml
@@ -126,7 +126,6 @@ jobs:
             ${{ env.ARM64_LAYERS }}
 
             ## Lambda Container dependencies:
-            
             - [amd64 containers](https://github.com/SumoLogic/sumologic-otel-lambda/releases/download/${{ github.ref_name }}/opentelemetry-nodejs-amd64.zip)
             - [arm64 containers](https://github.com/SumoLogic/sumologic-otel-lambda/releases/download/${{ github.ref_name }}/opentelemetry-nodejs-arm64.zip)
 
diff --git a/.github/workflows/release-build-python.yml b/.github/workflows/release-build-python.yml
index bcda08d..dbb8798 100644
--- a/.github/workflows/release-build-python.yml
+++ b/.github/workflows/release-build-python.yml
@@ -126,7 +126,6 @@ jobs:
             ${{ env.ARM64_LAYERS }}
 
             ## Lambda Container dependencies:
-            
             - [amd64 containers](https://github.com/SumoLogic/sumologic-otel-lambda/releases/download/${{ github.ref_name }}/opentelemetry-python-amd64.zip)
             - [arm64 containers](https://github.com/SumoLogic/sumologic-otel-lambda/releases/download/${{ github.ref_name }}/opentelemetry-python-arm64.zip)
 
diff --git a/.yamllint.yaml b/.yamllint.yaml
index 2d5607a..52b14ec 100644
--- a/.yamllint.yaml
+++ b/.yamllint.yaml
@@ -5,7 +5,7 @@ rules:
     comments-indentation: disable
 
     line-length:
-        max: 140
+        max: 170
         level: error
 
     indentation:

From 637a5182ff5c6ba1f63139882f4824a18d2175a0 Mon Sep 17 00:00:00 2001
From: Shubham Gupta <shubham.gupta@sumologic.com>
Date: Thu, 17 Sep 2026 13:16:45 +0530
Subject: [PATCH 5/9] ci: make required status checks report on every PR

Branch protection matches checks by name. Two gating styles gave
different results:

- A job that an `if` condition skips reports a `skipped` conclusion.
  Branch protection accepts this.
- A workflow that `on.pull_request.paths` skips reports no check run at
  all. Branch protection waits for it forever.

The three `pr-build-*` workflows used path filters, so a docs-only PR
left six required contexts pending and blocked the merge. A job-level
`if` cannot replace the path filter directly, because those jobs call
reusable workflows and the nested check names do not exist when the
call is skipped.

Each `pr-build-*` workflow now runs on every PR, moves the file test
into a `changes` job, and ends with a plain aggregator job that always
reports. `pull-request-checks.yml` gets the same aggregator.

Also move the four lint guards in `pull-request-checks.yml` from step
level to job level, so those jobs no longer start a runner to do
nothing.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 .github/workflows/pr-build-java.yml       | 51 +++++++++++++++++++----
 .github/workflows/pr-build-nodejs.yml     | 51 +++++++++++++++++++----
 .github/workflows/pr-build-python.yml     | 51 +++++++++++++++++++----
 .github/workflows/pull-request-checks.yml | 34 +++++++++++----
 4 files changed, 152 insertions(+), 35 deletions(-)

diff --git a/.github/workflows/pr-build-java.yml b/.github/workflows/pr-build-java.yml
index 5e16396..eac1df8 100644
--- a/.github/workflows/pr-build-java.yml
+++ b/.github/workflows/pr-build-java.yml
@@ -1,17 +1,37 @@
 name: Pull Request Build - Java
 
+# This workflow has no `on.pull_request.paths` filter on purpose. A workflow
+# skipped by path filtering reports no check run at all, which leaves a required
+# status check pending forever. Gating happens in the `changes` job instead, and
+# `pr-build-java-complete` always reports.
 on:
   pull_request:
-    paths:
-      - 'java/**'
-      - 'opentelemetry-lambda/**'
-      - '.github/workflows/*-java.yml'
-      - '.github/workflows/tests.yml'
-      - '!java/sample-apps/template.yaml'
-      - '!**/*.md'
 
 jobs:
+  changes:
+    runs-on: ubuntu-22.04
+    outputs:
+      any_changed: ${{ steps.changed-files.outputs.any_changed }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Check if Java related files changed
+        id: changed-files
+        uses: tj-actions/changed-files@v44
+        with:
+          files: |
+            java/**
+            opentelemetry-lambda/**
+            .github/workflows/*-java.yml
+            .github/workflows/tests.yml
+          files_ignore: |
+            java/sample-apps/template.yaml
+            **/*.md
+
   build-artifacts:
+    needs: changes
+    if: needs.changes.outputs.any_changed == 'true'
     uses: ./.github/workflows/build-artifacts.yml
     with:
       BUILD_COMMAND: make build-java
@@ -20,7 +40,8 @@ jobs:
       ARTIFACT_NAME: ${{ github.head_ref }}
 
   create-dev-lambda-layer:
-    needs: build-artifacts
+    needs: [changes, build-artifacts]
+    if: needs.changes.outputs.any_changed == 'true'
     uses: ./.github/workflows/publish-dev-layer.yml
     with:
       ARTIFACT_ARCHIVE_BASE_NAME: opentelemetry-java-wrapper
@@ -28,9 +49,21 @@ jobs:
       LANGUAGE: java
 
   run-tests:
-    needs: create-dev-lambda-layer
+    needs: [changes, create-dev-lambda-layer]
+    if: needs.changes.outputs.any_changed == 'true'
     uses: ./.github/workflows/tests.yml
     with:
       LANGUAGE: java
       LAYER_ARN_AMD64: ${{ needs.create-dev-lambda-layer.outputs.lambdalayeramd64 }}
       LAYER_ARN_ARM64: ${{ needs.create-dev-lambda-layer.outputs.lambdalayerarm64 }}
+
+  pr-build-java-complete:
+    runs-on: ubuntu-22.04
+    needs: [changes, build-artifacts, create-dev-lambda-layer, run-tests]
+    if: always()
+    steps:
+      - name: Fail if any job did not pass
+        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+        run: |
+          echo "At least one Java build job failed or was cancelled."
+          exit 1
diff --git a/.github/workflows/pr-build-nodejs.yml b/.github/workflows/pr-build-nodejs.yml
index 5d39a4d..46af017 100644
--- a/.github/workflows/pr-build-nodejs.yml
+++ b/.github/workflows/pr-build-nodejs.yml
@@ -1,17 +1,37 @@
 name: Pull Request Build - NodeJS
 
+# This workflow has no `on.pull_request.paths` filter on purpose. A workflow
+# skipped by path filtering reports no check run at all, which leaves a required
+# status check pending forever. Gating happens in the `changes` job instead, and
+# `pr-build-nodejs-complete` always reports.
 on:
   pull_request:
-    paths:
-      - 'nodejs/**'
-      - 'opentelemetry-lambda/**'
-      - '.github/workflows/*-nodejs.yml'
-      - '.github/workflows/tests.yml'
-      - '!nodejs/sample-apps/template.yaml'
-      - '!**/*.md'
 
 jobs:
+  changes:
+    runs-on: ubuntu-22.04
+    outputs:
+      any_changed: ${{ steps.changed-files.outputs.any_changed }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Check if NodeJS related files changed
+        id: changed-files
+        uses: tj-actions/changed-files@v44
+        with:
+          files: |
+            nodejs/**
+            opentelemetry-lambda/**
+            .github/workflows/*-nodejs.yml
+            .github/workflows/tests.yml
+          files_ignore: |
+            nodejs/sample-apps/template.yaml
+            **/*.md
+
   build-artifacts:
+    needs: changes
+    if: needs.changes.outputs.any_changed == 'true'
     uses: ./.github/workflows/build-artifacts.yml
     with:
       BUILD_COMMAND: make build-nodejs
@@ -20,7 +40,8 @@ jobs:
       ARTIFACT_NAME: ${{ github.head_ref }}
 
   create-dev-lambda-layer:
-    needs: build-artifacts
+    needs: [changes, build-artifacts]
+    if: needs.changes.outputs.any_changed == 'true'
     uses: ./.github/workflows/publish-dev-layer.yml
     with:
       ARTIFACT_ARCHIVE_BASE_NAME: opentelemetry-nodejs
@@ -28,9 +49,21 @@ jobs:
       LANGUAGE: nodejs
 
   run-tests:
-    needs: create-dev-lambda-layer
+    needs: [changes, create-dev-lambda-layer]
+    if: needs.changes.outputs.any_changed == 'true'
     uses: ./.github/workflows/tests.yml
     with:
       LANGUAGE: nodejs
       LAYER_ARN_AMD64: ${{ needs.create-dev-lambda-layer.outputs.lambdalayeramd64 }}
       LAYER_ARN_ARM64: ${{ needs.create-dev-lambda-layer.outputs.lambdalayerarm64 }}
+
+  pr-build-nodejs-complete:
+    runs-on: ubuntu-22.04
+    needs: [changes, build-artifacts, create-dev-lambda-layer, run-tests]
+    if: always()
+    steps:
+      - name: Fail if any job did not pass
+        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+        run: |
+          echo "At least one NodeJS build job failed or was cancelled."
+          exit 1
diff --git a/.github/workflows/pr-build-python.yml b/.github/workflows/pr-build-python.yml
index cc939e3..362d51d 100644
--- a/.github/workflows/pr-build-python.yml
+++ b/.github/workflows/pr-build-python.yml
@@ -1,17 +1,37 @@
 name: Pull Request Build - Python
 
+# This workflow has no `on.pull_request.paths` filter on purpose. A workflow
+# skipped by path filtering reports no check run at all, which leaves a required
+# status check pending forever. Gating happens in the `changes` job instead, and
+# `pr-build-python-complete` always reports.
 on:
   pull_request:
-    paths:
-      - 'python/**'
-      - 'opentelemetry-lambda/**'
-      - '.github/workflows/*-python.yml'
-      - '.github/workflows/tests.yml'
-      - '!python/sample-apps/template.yaml'
-      - '!**/*.md'
 
 jobs:
+  changes:
+    runs-on: ubuntu-22.04
+    outputs:
+      any_changed: ${{ steps.changed-files.outputs.any_changed }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Check if Python related files changed
+        id: changed-files
+        uses: tj-actions/changed-files@v44
+        with:
+          files: |
+            python/**
+            opentelemetry-lambda/**
+            .github/workflows/*-python.yml
+            .github/workflows/tests.yml
+          files_ignore: |
+            python/sample-apps/template.yaml
+            **/*.md
+
   build-artifacts:
+    needs: changes
+    if: needs.changes.outputs.any_changed == 'true'
     uses: ./.github/workflows/build-artifacts.yml
     with:
       BUILD_COMMAND: make build-python
@@ -20,7 +40,8 @@ jobs:
       ARTIFACT_NAME: ${{ github.head_ref }}
 
   create-dev-lambda-layer:
-    needs: build-artifacts
+    needs: [changes, build-artifacts]
+    if: needs.changes.outputs.any_changed == 'true'
     uses: ./.github/workflows/publish-dev-layer.yml
     with:
       ARTIFACT_ARCHIVE_BASE_NAME: opentelemetry-python
@@ -28,9 +49,21 @@ jobs:
       LANGUAGE: python
 
   run-tests:
-    needs: create-dev-lambda-layer
+    needs: [changes, create-dev-lambda-layer]
+    if: needs.changes.outputs.any_changed == 'true'
     uses: ./.github/workflows/tests.yml
     with:
       LANGUAGE: python
       LAYER_ARN_AMD64: ${{ needs.create-dev-lambda-layer.outputs.lambdalayeramd64 }}
       LAYER_ARN_ARM64: ${{ needs.create-dev-lambda-layer.outputs.lambdalayerarm64 }}
+
+  pr-build-python-complete:
+    runs-on: ubuntu-22.04
+    needs: [changes, build-artifacts, create-dev-lambda-layer, run-tests]
+    if: always()
+    steps:
+      - name: Fail if any job did not pass
+        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+        run: |
+          echo "At least one Python build job failed or was cancelled."
+          exit 1
diff --git a/.github/workflows/pull-request-checks.yml b/.github/workflows/pull-request-checks.yml
index d7097a7..06c7a8d 100644
--- a/.github/workflows/pull-request-checks.yml
+++ b/.github/workflows/pull-request-checks.yml
@@ -31,25 +31,23 @@ jobs:
   markdownlint:
     runs-on: ubuntu-22.04
     needs: [docs-changed]
+    if: needs.docs-changed.outputs.any_changed == 'true'
     steps:
       - uses: actions/checkout@v4
       - name: install markdownlint
-        if: needs.docs-changed.outputs.any_changed == 'true'
         run: npm install -g markdownlint-cli
       - name: markdownlint check
-        if: needs.docs-changed.outputs.any_changed == 'true'
         run: make markdown-lint
 
   yamllint:
     runs-on: ubuntu-22.04
     needs: [docs-changed]
+    if: needs.docs-changed.outputs.any_changed == 'true'
     steps:
       - uses: actions/checkout@v4
       - name: install yamllint
-        if: needs.docs-changed.outputs.any_changed == 'true'
         run: pip install yamllint
       - name: yamllint
-        if: needs.docs-changed.outputs.any_changed == 'true'
         run: make yaml-lint
 
   markdown-link-check:
@@ -68,24 +66,23 @@ jobs:
   md-links-lint:
     runs-on: ubuntu-22.04
     needs: [docs-changed]
+    if: needs.docs-changed.outputs.any_changed == 'true'
     steps:
       - uses: actions/checkout@v4
       - name: Lint markdown links
-        if: needs.docs-changed.outputs.any_changed == 'true'
         run: |
           make markdown-links-lint
+
   markdown-table-formatter-check:
     runs-on: ubuntu-22.04
     needs: [docs-changed]
+    if: needs.docs-changed.outputs.any_changed == 'true'
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
-        if: needs.docs-changed.outputs.any_changed == 'true'
       - name: Install markdown-table-formatter
-        if: needs.docs-changed.outputs.any_changed == 'true'
         run: npm install markdown-table-formatter --save
       - name: Run markdown-table-formatter
-        if: needs.docs-changed.outputs.any_changed == 'true'
         run: CMD=./node_modules/.bin/markdown-table-formatter make markdown-table-formatter-check
 
   terraform-lint:
@@ -114,3 +111,24 @@ jobs:
         uses: dflook/terraform-fmt@v1
         with:
           path: utils/receiver-mock/deploy
+
+  # Single required status check for this workflow. A job skipped by a job-level
+  # `if` reports a `skipped` conclusion that branch protection accepts, so this
+  # stays green when no relevant files changed but fails if any check failed.
+  pr-checks-complete:
+    runs-on: ubuntu-22.04
+    needs:
+      - docs-changed
+      - markdownlint
+      - yamllint
+      - markdown-link-check
+      - md-links-lint
+      - markdown-table-formatter-check
+      - terraform-lint
+    if: always()
+    steps:
+      - name: Fail if any check did not pass
+        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+        run: |
+          echo "At least one PR check failed or was cancelled."
+          exit 1

From a1bcf7e47f0fd7a1960a597e60a36e381c581f68 Mon Sep 17 00:00:00 2001
From: Shubham Gupta <shubham.gupta@sumologic.com>
Date: Thu, 17 Sep 2026 14:33:05 +0530
Subject: [PATCH 6/9] fix(ci): give artifacts a name that has no slash

`actions/upload-artifact@v4` rejects a name that contains a forward
slash. The PR build workflows built the artifact name from
`github.head_ref`, so every branch with a slash in its name, for example
`fix/ci-optimizations`, failed the build before it compiled any code.

Use `github.run_id`-`github.run_attempt`, which is always plain digits.
The attempt number gives each re-run a new namespace, because an
artifact name cannot be reused.

`ARTIFACT_NAME` only names and finds artifacts. Layer names and bucket
names come from `github.run_id`, so they do not change. The release
workflows keep `github.ref_name`, because a tag name has no slash.

This matches the same fix in PR #72, so the two branches do not
disagree.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 .github/workflows/pr-build-java.yml   | 4 ++--
 .github/workflows/pr-build-nodejs.yml | 4 ++--
 .github/workflows/pr-build-python.yml | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/pr-build-java.yml b/.github/workflows/pr-build-java.yml
index eac1df8..bd3e72c 100644
--- a/.github/workflows/pr-build-java.yml
+++ b/.github/workflows/pr-build-java.yml
@@ -37,7 +37,7 @@ jobs:
       BUILD_COMMAND: make build-java
       LANGUAGE: java
       ARTIFACT_ARCHIVE_BASE_NAME: opentelemetry-java-wrapper
-      ARTIFACT_NAME: ${{ github.head_ref }}
+      ARTIFACT_NAME: ${{ github.run_id }}-${{ github.run_attempt }}
 
   create-dev-lambda-layer:
     needs: [changes, build-artifacts]
@@ -45,7 +45,7 @@ jobs:
     uses: ./.github/workflows/publish-dev-layer.yml
     with:
       ARTIFACT_ARCHIVE_BASE_NAME: opentelemetry-java-wrapper
-      ARTIFACT_NAME: ${{ github.head_ref }}
+      ARTIFACT_NAME: ${{ github.run_id }}-${{ github.run_attempt }}
       LANGUAGE: java
 
   run-tests:
diff --git a/.github/workflows/pr-build-nodejs.yml b/.github/workflows/pr-build-nodejs.yml
index 46af017..8bb955a 100644
--- a/.github/workflows/pr-build-nodejs.yml
+++ b/.github/workflows/pr-build-nodejs.yml
@@ -37,7 +37,7 @@ jobs:
       BUILD_COMMAND: make build-nodejs
       LANGUAGE: nodejs
       ARTIFACT_ARCHIVE_BASE_NAME: opentelemetry-nodejs
-      ARTIFACT_NAME: ${{ github.head_ref }}
+      ARTIFACT_NAME: ${{ github.run_id }}-${{ github.run_attempt }}
 
   create-dev-lambda-layer:
     needs: [changes, build-artifacts]
@@ -45,7 +45,7 @@ jobs:
     uses: ./.github/workflows/publish-dev-layer.yml
     with:
       ARTIFACT_ARCHIVE_BASE_NAME: opentelemetry-nodejs
-      ARTIFACT_NAME: ${{ github.head_ref }}
+      ARTIFACT_NAME: ${{ github.run_id }}-${{ github.run_attempt }}
       LANGUAGE: nodejs
 
   run-tests:
diff --git a/.github/workflows/pr-build-python.yml b/.github/workflows/pr-build-python.yml
index 362d51d..c735aad 100644
--- a/.github/workflows/pr-build-python.yml
+++ b/.github/workflows/pr-build-python.yml
@@ -37,7 +37,7 @@ jobs:
       BUILD_COMMAND: make build-python
       LANGUAGE: python
       ARTIFACT_ARCHIVE_BASE_NAME: opentelemetry-python
-      ARTIFACT_NAME: ${{ github.head_ref }}
+      ARTIFACT_NAME: ${{ github.run_id }}-${{ github.run_attempt }}
 
   create-dev-lambda-layer:
     needs: [changes, build-artifacts]
@@ -45,7 +45,7 @@ jobs:
     uses: ./.github/workflows/publish-dev-layer.yml
     with:
       ARTIFACT_ARCHIVE_BASE_NAME: opentelemetry-python
-      ARTIFACT_NAME: ${{ github.head_ref }}
+      ARTIFACT_NAME: ${{ github.run_id }}-${{ github.run_attempt }}
       LANGUAGE: python
 
   run-tests:

From fa68781abab03a3928c98b1d44270ff631126da0 Mon Sep 17 00:00:00 2001
From: Shubham Gupta <shubham.gupta@sumologic.com>
Date: Thu, 17 Sep 2026 18:14:15 +0530
Subject: [PATCH 7/9] fix(ci): pin tj-actions/changed-files to v47.0.6 SHA

Mutable tags can be retargeted silently. tj-actions/changed-files had
a supply-chain incident in 2025 where a tag was hijacked to exfiltrate
secrets. Pinning to an immutable commit SHA prevents a future tag
retarget from changing CI behaviour.

Also upgrades from v44 to v47.0.6. No breaking changes to the inputs
or outputs used (files, files_ignore, any_changed).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/pr-build-java.yml       | 2 +-
 .github/workflows/pr-build-nodejs.yml     | 2 +-
 .github/workflows/pr-build-python.yml     | 2 +-
 .github/workflows/pull-request-checks.yml | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/pr-build-java.yml b/.github/workflows/pr-build-java.yml
index 603f592..6a8b344 100644
--- a/.github/workflows/pr-build-java.yml
+++ b/.github/workflows/pr-build-java.yml
@@ -18,7 +18,7 @@ jobs:
           fetch-depth: 0
       - name: Check if Java related files changed
         id: changed-files
-        uses: tj-actions/changed-files@v44
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96  # v47.0.6
         with:
           files: |
             java/**
diff --git a/.github/workflows/pr-build-nodejs.yml b/.github/workflows/pr-build-nodejs.yml
index a870204..35cc80e 100644
--- a/.github/workflows/pr-build-nodejs.yml
+++ b/.github/workflows/pr-build-nodejs.yml
@@ -18,7 +18,7 @@ jobs:
           fetch-depth: 0
       - name: Check if NodeJS related files changed
         id: changed-files
-        uses: tj-actions/changed-files@v44
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96  # v47.0.6
         with:
           files: |
             nodejs/**
diff --git a/.github/workflows/pr-build-python.yml b/.github/workflows/pr-build-python.yml
index 59e1742..c962e9f 100644
--- a/.github/workflows/pr-build-python.yml
+++ b/.github/workflows/pr-build-python.yml
@@ -18,7 +18,7 @@ jobs:
           fetch-depth: 0
       - name: Check if Python related files changed
         id: changed-files
-        uses: tj-actions/changed-files@v44
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96  # v47.0.6
         with:
           files: |
             python/**
diff --git a/.github/workflows/pull-request-checks.yml b/.github/workflows/pull-request-checks.yml
index 06c7a8d..39150e3 100644
--- a/.github/workflows/pull-request-checks.yml
+++ b/.github/workflows/pull-request-checks.yml
@@ -19,7 +19,7 @@ jobs:
           fetch-depth: 0
       - name: Check if documentation related files changed
         id: changed-files
-        uses: tj-actions/changed-files@v44
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96  # v47.0.6
         with:
           files: |
             **/*.md

From 86f6000293692090b6a59c4734f4667222a21102 Mon Sep 17 00:00:00 2001
From: Shubham Gupta <shubham.gupta@sumologic.com>
Date: Fri, 18 Sep 2026 09:42:19 +0530
Subject: [PATCH 8/9] ci: comment workflow trigger from gh token, now its
 automatic based on branch name

---
 .github/workflows/release-tag.yml | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/release-tag.yml b/.github/workflows/release-tag.yml
index fceabf5..ffbe968 100644
--- a/.github/workflows/release-tag.yml
+++ b/.github/workflows/release-tag.yml
@@ -102,10 +102,10 @@ jobs:
           git tag -m "${TAG}" "${TAG}"
           git push --atomic origin main "${TAG}"
 
-      - name: Dispatch release build
-        if: steps.state.outputs.tag_exists != 'true'
-        env:
-          GH_TOKEN: ${{ github.token }}
-          LANGUAGE: ${{ steps.parse.outputs.language }}
-          TAG: ${{ steps.parse.outputs.tag }}
-        run: gh workflow run "release-build-${LANGUAGE}.yml" --ref "${TAG}"
+#      - name: Dispatch release build
+#        if: steps.state.outputs.tag_exists != 'true'
+#        env:
+#          GH_TOKEN: ${{ github.token }}
+#          LANGUAGE: ${{ steps.parse.outputs.language }}
+#          TAG: ${{ steps.parse.outputs.tag }}
+#        run: gh workflow run "release-build-${LANGUAGE}.yml" --ref "${TAG}"

From edbd791dc657adea7cc12ec80b5471849ecc9a43 Mon Sep 17 00:00:00 2001
From: Shubham Gupta <shubham.gupta@sumologic.com>
Date: Fri, 18 Sep 2026 15:40:39 +0530
Subject: [PATCH 9/9] ci: fix link

---
 .markdown_link_check.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.markdown_link_check.json b/.markdown_link_check.json
index 946fcc9..8c69d5d 100644
--- a/.markdown_link_check.json
+++ b/.markdown_link_check.json
@@ -13,7 +13,7 @@
         "pattern": "^https://mikefarah.gitbook.io/yq"
       },
       {
-        "pattern": "https://github.com/SumoLogic/sumologic-otel-lambda/releases/tag/"
+        "pattern": "^https://github\\.com/SumoLogic/sumologic-otel-lambda/releases/tag/"
       }
     ]
   }