Repository navigation
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
alliscode
reviewed
Oct 19, 2026
alliscode
reviewed
Oct 19, 2026
Include filtered job arguments, SQL text, and exception diagnostics, with an operator-controlled identity opt-in. Align exported metadata with bundled instrumentation and isolate public incoming trace context by default. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Document identity opt-in, trusted ingress, outbound exclusions, and the limits of key-based filtering. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Centralize the sensitive-data policy in the exporter while avoiding collection of SQL, job arguments, and exception diagnostics unless operators explicitly opt in. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Add a local Aspire dashboard workflow and show exactly which trace fields change when sensitive diagnostics are enabled. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
🟡 Changes recommended
Unresolved security, operational, and regression-coverage issues need correction before approval.
7 open issues
Review effort: Max
| begin | ||
| uri = URI.parse(endpoint.to_s) | ||
| rescue URI::InvalidURIError | ||
| raise ArgumentError, "OTLP endpoint must be an absolute HTTP(S) URL" |
| config.use "OpenTelemetry::Instrumentation::ActionPack", span_naming: :class | ||
| config.use "OpenTelemetry::Instrumentation::ActiveJob", | ||
| propagation_style: :child, span_naming: :job_class | ||
| config.use "OpenTelemetry::Instrumentation::Net::HTTP", untraced_hosts: |
| next unless span.recording? | ||
|
|
||
| begin | ||
| span.set_attribute("replica.job.arguments", data_filter.job_arguments(job.arguments)) |
| # ORM instrumentation does not cover Hub's direct SQLite calls. | ||
| tracer = OpenTelemetry.tracer_provider.tracer("replica-hub") | ||
| ActiveSupport::Notifications.subscribe("sql.active_record") do |_, started, finished, _, payload| | ||
| next if payload[:name] == "SCHEMA" || payload[:cached] |
Comment on lines
+124
to
+126
| assert spans.any? do |span| | ||
| span_attributes(span)["db.query.text"]&.string_value&.include?("sql-diagnostic-canary") | ||
| end |
| queued = TracingProbeJob.queue_adapter.enqueued_jobs.shift.select { |key, _| key.is_a?(String) } | ||
| serialized = JSON.parse(JSON.generate(queued)) | ||
| begin | ||
| ActiveJob::Base.execute(serialized) |
| | Error status | Exported without a description | Exported without a description | | ||
| | Exception type, message and stack trace | Excluded | Exported | | ||
|
|
||
| The exporter enforces this policy after instrumentation collects spans. Hub also avoids collecting SQL text, job arguments and exception events when the setting is `false`. Changing the environment variable in a running process does not change its policy. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Companies running their own Hub need to connect their application performance monitoring (APM) provider without rebuilding the published container image. A shared OpenTelemetry integration lets operators choose a provider instead of requiring Hub to bundle each vendor's SDK.
Closes #34.
What changes
Hub can export server-side traces through the OpenTelemetry Protocol (OTLP) over HTTP/protobuf. Tracing is off by default. Operators enable it with environment variables and restart every Hub web and job container. Traces cover Rails requests, background jobs, SQLite queries, and outbound Net::HTTP calls.
By default, Hub exports operational metadata without SQL text, job arguments, or exception messages and stack traces.
REPLICA_OTEL_INCLUDE_SENSITIVE_DATA=trueenables those diagnostics together. Credential-keyed job fields remain filtered, SQL bind values remain excluded, and request headers and bodies are never attached.Public requests start fresh traces unless the operator enables
REPLICA_OTEL_TRUST_INCOMING_CONTEXTbehind an ingress that sanitizes trace headers. Hub discards incoming vendor trace state and baggage while preserving its own job trace continuity. Operators can exclude exact outbound hosts from both HTTP tracing and trace-header propagation.Export runs in a bounded background queue. Collector or provider outages can drop traces but do not block successful requests. The deployment guide includes a copy-paste local Aspire dashboard setup and explains endpoint authentication, sampling, certificates, restart behavior, and the data impact of each Replica tracing setting.
Operators can send traces directly to a compatible provider or through a company-managed OpenTelemetry Collector. This first version does not add browser monitoring, metric or log export, an admin configuration page, or vendor-native error reporting. Live Sentry and Datadog ingestion has not been verified.