Add optional native OpenTelemetry export for runner, jobs, and steps

[stefanpenner]

Summary

Opt-in, best-effort native OpenTelemetry export from the runner — no API polling, no new NuGet dependencies (hand-built OTLP/JSON over the runner's proxy-aware HTTP handler). Enabled by setting ACTIONS_RUNNER_OTLP_ENDPOINT. Emits, from the existing job/step lifecycle:

1. Runner info as the OTLP Resource (service.*, host.arch, os.type, github.runner.{name,id,group,ephemeral}).
2. A job span parented to the workflow span.
3. A step span per step parented to the job span, with sub-second timing, action refs, and CI/CD semconv attributes.

Span IDs use a deterministic, name-based contract (run id, run attempt, job/step display names — not the feature-flagged numeric job id) so they merge with a GitHub-API trace reconstruction. Design + usage: docs/adrs/4366-native-otel-export.md. Consumer-side companion: stefanpenner/otel-explorer#54.

Changes

• IOTelTraceExporter : RunnerService (renamed from a static OTelStepTracer), resolved via HostContext.GetService<>() — matches the runner's DI/service convention.

• Lifecycle hooks: JobRunner.RunAsync (resource), ExecutionContext.InitializeJob (job identifiers + flag), ExecutionContext.Complete (job/step spans), JobRunner.CompleteJobAsync (flush).

• Gating: enabled = ACTIONS_RUNNER_OTLP_ENDPOINT set && (Constants.Runner.Features.RunnerOtelExport ?? true) — operator env opt-in + server-side kill switch (defaults on so self-hosted/GHES isn't blocked when the flag isn't provisioned).

• Proxy-aware: export goes through HostContext.CreateHttpClientHandler() (honors runner proxy config).

• Secret masking: every exported string runs through HostContext.SecretMasker.

• Best-effort: failures are logged via Trace and swallowed; never affect the job.

• Env var names are constants in Constants.Variables.Agent:

  Env var	Required	Description
  ACTIONS_RUNNER_OTLP_ENDPOINT	Yes	OTLP/HTTP base URL; traces POSTed to {endpoint}/v1/traces
  ACTIONS_RUNNER_OTLP_HEADERS	No	Comma-separated key=value auth headers
  ACTIONS_RUNNER_OTLP_INSECURE	No	true to skip TLS verification

Deterministic ID contract (mirrored in otel-explorer)

trace = md5("{run_id}-{run_attempt}")
job   = md5("job-{run_id}-{run_attempt}-{job_name}")[:8]              parent -> bigendian(run_id)  (workflow)
step  = md5("step-{run_id}-{run_attempt}-{job_name}-{step_name}")[:8] parent -> job

Test plan

• L0 unit tests for the exporter: golden + cross-language IDs; enable/disable; feature-flag on/off; step semconv + failure status; job span linkage; runner-info resource; secret masking; unreachable endpoint never throws
• Full L0 suite green (961 tests); RunnerWebProxyL0.IsNotUseRawHttpClientHandler satisfied; dotnet format clean; no new dependencies
• End-to-end on a real self-hosted runner: native spans captured and merged with an API-reconstructed trace (server-side queue time + runner-native per-step precision), each span once; --lint reports no semconv issues

Notes

• OTel-only PR; the earlier action-dedup case-sensitivity commits were split to a separate branch (action-dedup-case-fix).

🤖 Generated with Claude Code