Fix bedrock guardrail metric crash and strengthen CI secret scanning

.github/workflows/fr-pr.yaml

@@ -18,19 +18,28 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v4
 
-      - name: Fail on hardcoded provider API keys
+      - name: Fail on hardcoded secrets or credentials
         shell: bash
         run: |
           set -euo pipefail
 
-          regex='(sk-(proj-)?[A-Za-z0-9_-]{20,}|sk-or-v1-[A-Za-z0-9]{20,}|sk-ant-[A-Za-z0-9_-]{20,}|gsk_[A-Za-z0-9_-]{20,})'
-
-          if git grep -nI -E "$regex" -- . ':(exclude)*.lock' ':(exclude)*.env.example' ':(exclude)*.env.*.example'; then
-            echo "::error::Potential hardcoded provider key detected. Remove it and use placeholders or GitHub Secrets."
+          # LLM providers: OpenAI, OpenRouter, Anthropic, Groq, Google AI, FortifyRoot
+          # Cloud: AWS access key IDs, GCP service account JSON, GitHub PATs
+          key_patterns='(sk-(proj-)?[A-Za-z0-9_-]{20,}|sk-or-v1-[A-Za-z0-9]{20,}|sk-ant-[A-Za-z0-9_-]{20,}|gsk_[A-Za-z0-9_-]{20,}|AIzaSy[A-Za-z0-9_-]{33}|AKIA[A-Z0-9]{16}|fr_sk_[A-Za-z0-9_-]{30,}|ghp_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{22,})'
+          json_patterns='("type"[[:space:]]*:[[:space:]]*"service_account")'
+          regex="(${key_patterns}|${json_patterns})"
+
+          if git grep -nI -E "$regex" -- . \
+              ':(exclude)*.lock' \
+              ':(exclude)*.env.example' \
+              ':(exclude)*.env.*.example' \
+              ':(exclude).github/workflows/*' \
+              ':(exclude)packages/opentelemetry-instrumentation-anthropic/tests/cassettes/test_bedrock_with_raw_response/*'; then
+            echo "::error::Potential hardcoded secret or credential detected. Remove it and use placeholders or GitHub Secrets."
             exit 1
           fi
 
-          echo "No hardcoded provider key patterns detected."
+          echo "No hardcoded secrets or credentials detected."
 
   fr-tests:
     needs: secret-scan

packages/opentelemetry-instrumentation-bedrock/opentelemetry/instrumentation/bedrock/guardrail.py

@@ -174,7 +174,8 @@ def guardrail_converse(span, response, vendor, model, metric_params):
             for guardrail_info in guardrail_infos:
                 output_filters.append(_handle(Type.OUTPUT, guardrail_info, attrs, metric_params))
     if is_guardrail_activated(response):
-        metric_params.guardrail_activation.add(1, attrs)
+        if metric_params and metric_params.guardrail_activation:
+            metric_params.guardrail_activation.add(1, attrs)
         set_guardrail_attributes(span, input_filters, output_filters)
 
 
@@ -204,7 +205,8 @@ def guardrail_handling(span, response_body, vendor, model, metric_params):
                     output_filters.append(_handle(Type.OUTPUT, guardrail_info, attrs, metric_params))
 
         if is_guardrail_activated(response_body):
-            metric_params.guardrail_activation.add(1, attrs)
+            if metric_params and metric_params.guardrail_activation:
+                metric_params.guardrail_activation.add(1, attrs)
             set_guardrail_attributes(span, input_filters, output_filters)