Support secret-backed default OTLP endpoints

[Copilot]

Organization-wide OTLP endpoints could only be configured as visible GitHub variables. This adds secret-backed endpoints while preserving existing variable configurations.

• Endpoint resolution

  • Prefer the endpoint secret, then fall back to the variable:

    ${{ secrets.GH_AW_DEFAULT_OTLP_ENDPOINT || vars.GH_AW_DEFAULT_OTLP_ENDPOINT }}

  • Preserve explicit workflow/import OTLP configuration precedence.

• Compiler integration

  • Register the endpoint as a compiler-managed secret for safe-update enforcement.
  • Regenerate affected workflow lock files and secret manifests.

• Documentation

  • Document secret/variable precedence and configuration.
  • Update OTLP diagnostics and specification language.

• Fixes Feature Request: Support GH_AW_DEFAULT_OTLP_ENDPOINT as a Secret #60228

[Copilot]

🟡 Changes recommended

The documentation and runtime recovery guidance advertise an unsupported enterprise secret scope and incorrectly suggest clearing only one fallback endpoint value.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds secret-backed default OTLP endpoints while retaining variable fallback compatibility.

Changes:

• Resolves endpoint secrets before variables and preserves explicit OTLP precedence.
• Registers compiler-managed secrets and updates tests.
• Refreshes documentation, diagnostics, and generated workflows.

File summaries

File	Description
specs/otel-observability-spec.md	Specifies secret-first endpoint resolution.
pkg/workflow/safe_update_enforcement.go	Allows the compiler-managed endpoint secret.
pkg/workflow/safe_update_enforcement_test.go	Tests OTLP secret enforcement.
pkg/workflow/observability_otlp_test.go	Updates fallback assertions.
pkg/workflow/observability_job_summary_test.go	Verifies compiled fallback output.
pkg/workflow/compilerenv/manager.go	Builds the secret-first expression.
pkg/workflow/compilerenv/manager_test.go	Tests expression generation.
pkg/workflow/checkout_runtime_order_test.go	Updates OTLP test documentation.
docs/src/content/docs/reference/open-telemetry.mdx	Documents secret-backed defaults.
docs/src/content/docs/reference/compiler-enterprise-environment-controls.md	Updates endpoint controls and precedence.
docs/adr/56353-always-configure-otlp-from-enterprise-defaults.md	Records the revised decision.
actions/setup/sh/check_otlp_default_credentials.sh	Updates OTLP diagnostics.
.github/workflows/windows.lock.yml	Regenerates OTLP secret configuration.
.github/workflows/squad-plan.lock.yml	Regenerates OTLP secret configuration.
.github/workflows/squad-game-planner.lock.yml	Regenerates OTLP secret configuration.
.github/workflows/smoke-issues.lock.yml	Regenerates OTLP secret configuration.
.github/workflows/smoke-github-claude.lock.yml	Regenerates OTLP secret configuration.
.github/workflows/smoke-copilot-sub-agents.lock.yml	Regenerates OTLP secret configuration.
.github/workflows/smoke-copilot-small.lock.yml	Regenerates OTLP secret configuration.
.github/workflows/smoke-copilot-sdk.lock.yml	Regenerates OTLP secret configuration.
.github/workflows/smoke-copilot-mai.lock.yml	Regenerates OTLP secret configuration.
.github/workflows/smoke-copilot-auto.lock.yml	Regenerates OTLP secret configuration.
.github/workflows/smoke-claude-on-copilot.lock.yml	Regenerates OTLP secret configuration.
.github/workflows/smoke-aider.lock.yml	Regenerates OTLP secret configuration.
.github/workflows/sighthound-security-scan.lock.yml	Regenerates OTLP secret configuration.
.github/workflows/pr-description-caveman.lock.yml	Regenerates OTLP secret configuration.
.github/workflows/feature-grower.lock.yml	Regenerates OTLP secret configuration.
.github/workflows/example-failure-category-filter.lock.yml	Regenerates OTLP secret configuration.
.github/workflows/designer-drift-audit.lock.yml	Regenerates OTLP secret configuration.
.github/workflows/daily-windows-terminal-integration-builder.lock.yml	Regenerates OTLP secret configuration.
.github/workflows/daily-trajectory-grader-implementer.lock.yml	Regenerates OTLP secret configuration.
.github/workflows/daily-team-status.lock.yml	Regenerates OTLP secret configuration.
.github/workflows/daily-squid-image-scan.lock.yml	Regenerates OTLP secret configuration.
.github/workflows/daily-safeoutputs-git-simulator.lock.yml	Regenerates OTLP secret configuration.
.github/workflows/daily-max-ai-credits-test.lock.yml	Regenerates OTLP secret configuration.
.github/workflows/daily-github-docs-seo-optimizer.lock.yml	Regenerates OTLP secret configuration.
.github/workflows/daily-credit-limit-test.lock.yml	Regenerates OTLP secret configuration.
.github/workflows/daily-byok-ollama-test.lock.yml	Regenerates OTLP secret configuration.
.github/workflows/copilot-centralization-optimizer.lock.yml	Regenerates OTLP secret configuration.
.github/workflows/copilot-centralization-drilldown.lock.yml	Regenerates OTLP secret configuration.

Review details

• Files reviewed: 63/63 changed files
• Comments generated: 2
• Review effort level: Balanced

[github-actions]

✅ Ponytail Reviewer completed successfully!

Lean already. Ship.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

Generated by Ponytail Reviewer for #60348

[github-actions]

⚠️ PR Code Quality Reviewer failed during code quality review.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🔎 Code quality review by PR Code Quality Reviewer

[github-actions]

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

[github-actions]

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel skipped because pre-fetch PR data was unavailable: unable to fetch test file diff

🧪 Test quality analysis by Test Quality Sentinel

[github-actions]

⚠️ Security scanning failed for Design Decision Gate 🏗️. Review the logs for details.

No ADR enforcement needed: PR does not have the 'implementation' label and has <=100 new lines of code in business logic directories.

🏗️ ADR gate enforced by Design Decision Gate 🏗️

[github-actions]

Skills-Based Review 🧠

Applied /grill-with-docs and /tdd to the OTLP secret-fallback change. The core compiler logic (BuildDefaultOTLPEndpointExpression, safe-update allowlist entry, lock-file regeneration) is well-targeted and the existing test coverage for the expression itself is solid.

📋 Key Themes & Highlights

Key Themes

• Doc/vocabulary inconsistency: The compiler-enterprise-environment-controls doc still frames GH_AW_DEFAULT_OTLP_ENDPOINT as manageable at "enterprise scope" immediately before instructing readers to gh secret set it — but Actions secrets don't support enterprise scope. This is the same class of issue already flagged by the existing review comments on check_otlp_default_credentials.sh and open-telemetry.mdx; the third doc file has the identical gap.
• Test coverage gap: the new safe_update_enforcement_test.go case only covers both OTLP secrets referenced together — the newly-possible case of the endpoint secret alone (independent of headers) isn't exercised.
• No changeset: this PR changes a documented, compiled runtime expression (OTEL_EXPORTER_OTLP_ENDPOINT) and touches every workflow's lock file, but doesn't appear to include a .changeset/*.md entry per the repo's release process.

Positive Highlights

• ✅ BuildDefaultOTLPEndpointExpression change is minimal and precisely covered by manager_test.go.
• ✅ Registering DefaultOTLPEndpoint in ghAwInternalSecrets correctly prevents safe-update from flagging every recompile.
• ✅ ADR and spec updates keep the precedence rules (secret > variable) consistent across docs, code comments, and the spec's normative language.

Left 2 inline comments on the highest-impact gaps.
@copilot please address the review comments above.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · sonnet50 · 101.1 AIC · ⌖ 15.1 AIC · ⊞ 10.4K
_{Comment /matt to run again}

[github-actions]

[/grill-with-docs] "To mask GH_AW_DEFAULT_OTLP_ENDPOINT, set it with gh secret set instead" implies enterprise-scope secrets are possible, but GitHub Actions secrets only support repository/environment/organization scope — there is no enterprise-level gh secret set. This directly contradicts the line above ("manage these variables in batch at repo, org, or enterprise scope") once the same key is secret-backed.

💡 Suggested fix

Clarify that the secret fallback is only available at repository/org scope, and that gh aw env update --scope ent only ever writes the variable, never the secret. Also state what happens operationally when only one of secret/variable is cleared while the other remains set (since the endpoint precedence would then silently fall through to the leftover value) — this is the same gap flagged in the existing review comment on this file at a nearby line.

@copilot please address this.

[Copilot]

Addressed in a7dfafc: the compiler environment controls docs now separate enterprise-scoped variables from repository/organization-scoped OTLP secrets and document the fallback-clearing behavior.

[github-actions]

[/tdd] The new test case only asserts that both secrets are allowed together; it doesn't cover the asymmetric case where only GH_AW_DEFAULT_OTLP_ENDPOINT is referenced without GH_AW_DEFAULT_OTLP_HEADERS (or vice versa), which is now a realistic runtime state since the endpoint can be secret-backed independently of headers.

💡 Suggested test

{
    name:        "compiler-injected OTLP endpoint secret alone is allowed",
    manifest:    &GHAWManifest{Version: 1, Secrets: []string{}, Actions: []GHAWManifestAction{}},
    secretNames: []string{"GH_AW_DEFAULT_OTLP_ENDPOINT"},
    actionRefs:  []string{},
    wantErr:     false,
},

This would pin down the behavior now that DefaultOTLPEndpoint is independently secret-backed, rather than only exercising the combined case.

@copilot please address this.

[Copilot]

Addressed in a7dfafc: added safe-update tests for endpoint-only, headers-only, and both asymmetric manifest/reference combinations.

[pelikhan]

@copilot run pr-finisher skill

[Copilot]

@copilot run pr-finisher skill

Ran the pr-finisher pass and pushed fixes through a7dfafc. Local validation and final Code Review/CodeQL validation passed; CI is stale after the agent push and needs a maintainer re-trigger before merge.