From b9476fff00b529178a7b99b1c9e81ab4d62a600c Mon Sep 17 00:00:00 2001 From: Manasjyoti Sharma Date: Fri, 3 Apr 2026 10:14:17 +0530 Subject: [PATCH] Fix bedrock guardrail metric None-guard and strengthen CI secret scanning Add None-guard around guardrail_activation metric in bedrock guardrail handling to prevent AttributeError when metrics are disabled. Expand CI secret scanning to detect Google AI, AWS, GCP, and GitHub credential patterns. --- .github/workflows/fr-pr.yaml | 21 +++++++++++++------ .../instrumentation/bedrock/guardrail.py | 6 ++++-- 2 files changed, 19 insertions(+), 8 deletions(-) diff --git a/.github/workflows/fr-pr.yaml b/.github/workflows/fr-pr.yaml index d92e1eea55..9d1dbe7369 100644 --- a/.github/workflows/fr-pr.yaml +++ b/.github/workflows/fr-pr.yaml @@ -18,19 +18,28 @@ jobs: - name: Check out code uses: actions/checkout@v4 - - name: Fail on hardcoded provider API keys + - name: Fail on hardcoded secrets or credentials shell: bash run: | set -euo pipefail - regex='(sk-(proj-)?[A-Za-z0-9_-]{20,}|sk-or-v1-[A-Za-z0-9]{20,}|sk-ant-[A-Za-z0-9_-]{20,}|gsk_[A-Za-z0-9_-]{20,})' - - if git grep -nI -E "$regex" -- . ':(exclude)*.lock' ':(exclude)*.env.example' ':(exclude)*.env.*.example'; then - echo "::error::Potential hardcoded provider key detected. Remove it and use placeholders or GitHub Secrets." + # LLM providers: OpenAI, OpenRouter, Anthropic, Groq, Google AI, FortifyRoot + # Cloud: AWS access key IDs, GCP service account JSON, GitHub PATs + key_patterns='(sk-(proj-)?[A-Za-z0-9_-]{20,}|sk-or-v1-[A-Za-z0-9]{20,}|sk-ant-[A-Za-z0-9_-]{20,}|gsk_[A-Za-z0-9_-]{20,}|AIzaSy[A-Za-z0-9_-]{33}|AKIA[A-Z0-9]{16}|fr_sk_[A-Za-z0-9_-]{30,}|ghp_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{22,})' + json_patterns='("type"[[:space:]]*:[[:space:]]*"service_account")' + regex="(${key_patterns}|${json_patterns})" + + if git grep -nI -E "$regex" -- . \ + ':(exclude)*.lock' \ + ':(exclude)*.env.example' \ + ':(exclude)*.env.*.example' \ + ':(exclude).github/workflows/*' \ + ':(exclude)packages/opentelemetry-instrumentation-anthropic/tests/cassettes/test_bedrock_with_raw_response/*'; then + echo "::error::Potential hardcoded secret or credential detected. Remove it and use placeholders or GitHub Secrets." exit 1 fi - echo "No hardcoded provider key patterns detected." + echo "No hardcoded secrets or credentials detected." fr-tests: needs: secret-scan diff --git a/packages/opentelemetry-instrumentation-bedrock/opentelemetry/instrumentation/bedrock/guardrail.py b/packages/opentelemetry-instrumentation-bedrock/opentelemetry/instrumentation/bedrock/guardrail.py index 565039f6d5..1f566561b1 100644 --- a/packages/opentelemetry-instrumentation-bedrock/opentelemetry/instrumentation/bedrock/guardrail.py +++ b/packages/opentelemetry-instrumentation-bedrock/opentelemetry/instrumentation/bedrock/guardrail.py @@ -174,7 +174,8 @@ def guardrail_converse(span, response, vendor, model, metric_params): for guardrail_info in guardrail_infos: output_filters.append(_handle(Type.OUTPUT, guardrail_info, attrs, metric_params)) if is_guardrail_activated(response): - metric_params.guardrail_activation.add(1, attrs) + if metric_params and metric_params.guardrail_activation: + metric_params.guardrail_activation.add(1, attrs) set_guardrail_attributes(span, input_filters, output_filters) @@ -204,7 +205,8 @@ def guardrail_handling(span, response_body, vendor, model, metric_params): output_filters.append(_handle(Type.OUTPUT, guardrail_info, attrs, metric_params)) if is_guardrail_activated(response_body): - metric_params.guardrail_activation.add(1, attrs) + if metric_params and metric_params.guardrail_activation: + metric_params.guardrail_activation.add(1, attrs) set_guardrail_attributes(span, input_filters, output_filters)