From ae47c6d2b8302edc2e690c57d62c079ae5743a8f Mon Sep 17 00:00:00 2001
From: grahamc <76716+grahamc@users.noreply.github.com>
Date: Wed, 9 Sep 2026 17:30:18 +0000
Subject: [PATCH] Update `detsys-ts` to `v2.1.3`
 (`99d5b05518240632c090b3c3093be30cac088e8c`)

---
 dist/index.js     | 59 ++++++++++++++++++++++++++++++++++++++++-------
 package-lock.json |  6 ++---
 2 files changed, 54 insertions(+), 11 deletions(-)

diff --git a/dist/index.js b/dist/index.js
index 2fc7966..5994b54 100644
--- a/dist/index.js
+++ b/dist/index.js
@@ -27426,7 +27426,7 @@ var __webpack_unused_export__;
  * SPDX-License-Identifier: Apache-2.0
  */
 __webpack_unused_export__ = ({ value: true });
-__webpack_unused_export__ = __webpack_unused_export__ = __webpack_unused_export__ = __webpack_unused_export__ = __webpack_unused_export__ = __webpack_unused_export__ = __webpack_unused_export__ = __webpack_unused_export__ = __webpack_unused_export__ = __webpack_unused_export__ = exports.J = exports.l = void 0;
+exports.ix = __webpack_unused_export__ = __webpack_unused_export__ = __webpack_unused_export__ = __webpack_unused_export__ = __webpack_unused_export__ = __webpack_unused_export__ = __webpack_unused_export__ = __webpack_unused_export__ = __webpack_unused_export__ = exports.J = exports.l = void 0;
 var BasicTracerProvider_shim_1 = __nccwpck_require__(77254);
 Object.defineProperty(exports, "l", ({ enumerable: true, get: function () { return BasicTracerProvider_shim_1.BasicTracerProvider; } }));
 var BatchSpanProcessor_shim_1 = __nccwpck_require__(98462);
@@ -27442,7 +27442,7 @@ __webpack_unused_export__ = ({ enumerable: true, get: function () { return sdk_t
 __webpack_unused_export__ = ({ enumerable: true, get: function () { return sdk_trace_1.AlwaysOnSampler; } });
 __webpack_unused_export__ = ({ enumerable: true, get: function () { return sdk_trace_1.ParentBasedSampler; } });
 __webpack_unused_export__ = ({ enumerable: true, get: function () { return sdk_trace_1.TraceIdRatioBasedSampler; } });
-__webpack_unused_export__ = ({ enumerable: true, get: function () { return sdk_trace_1.SamplingDecision; } });
+Object.defineProperty(exports, "ix", ({ enumerable: true, get: function () { return sdk_trace_1.SamplingDecision; } }));
 //# sourceMappingURL=index-shim.js.map
 
 /***/ }),
@@ -170154,7 +170154,7 @@ const SCOPE_NAME = "detsys-ts";
 * `$lib_version` that the PostHog instrumentation reported, and which told
 * nobody anything.
 */
-const LIBRARY_VERSION = "2.1.2";
+const LIBRARY_VERSION = "2.1.3";
 /**
 * The OTLP/HTTP collector for all Actions.
 * The exporters add `/v1/traces` and `/v1/logs` to this URL.
@@ -170221,6 +170221,41 @@ const OTLP_EXPORT_VARIABLES = [
 * contextFromTraceparent} correct no matter when they're called.
 */
 const PROPAGATOR = new core_build_src.W3CTraceContextPropagator();
+/** OpenTelemetry's vendor key in `tracestate`. */
+const TRACE_STATE_KEY = "ot";
+const RANDOMNESS_HEX_DIGITS = 14;
+/**
+* The sampling randomness for `source`, as lowercase hexadecimal. Hashed,
+* because a sampler compares this against a threshold and that is only fair
+* if the value is uniformly distributed.
+*/
+function samplingRandomnessOf(source) {
+	return (0,external_node_crypto_.createHash)("sha256").update(source).digest("hex").slice(0, RANDOMNESS_HEX_DIGITS);
+}
+/**
+* Records every span, and gives every trace it starts the same randomness.
+*
+* Each execution phase is a trace of its own, so a sampler keying on trace
+* randomness would keep a job's `main` phase and drop its `post`. One shared
+* value gets one decision for both. This discards nothing itself; the
+* collector decides what to keep.
+*/
+var SharedRandomnessSampler = class {
+	constructor(randomness) {
+		this.traceState = new core_build_src.TraceState().set(TRACE_STATE_KEY, `rv:${randomness}`);
+	}
+	shouldSample(context) {
+		const parent = src.trace.getSpanContext(context);
+		const isRoot = parent === void 0 || !src.isSpanContextValid(parent);
+		return {
+			decision: index_shim/* SamplingDecision */.ix.RECORD_AND_SAMPLED,
+			traceState: isRoot ? this.traceState : parent.traceState
+		};
+	}
+	toString() {
+		return "SharedRandomnessSampler";
+	}
+};
 const SEVERITY = {
 	debug: build_src.SeverityNumber.DEBUG,
 	info: build_src.SeverityNumber.INFO,
@@ -170344,6 +170379,7 @@ var Telemetry = class {
 			})).merge(resources_build_src.detectResources({ detectors: [resources_build_src.envDetector] }));
 			this.tracerProvider = new index_shim/* BasicTracerProvider */.l({
 				resource,
+				...options.samplingRandomnessSource === void 0 ? {} : { sampler: new SharedRandomnessSampler(samplingRandomnessOf(options.samplingRandomnessSource)) },
 				spanProcessors: [new index_shim/* BatchSpanProcessor */.J(new exporter_trace_otlp_http_build_src/* OTLPTraceExporter */.Q())]
 			});
 			this.loggerProvider = new sdk_logs_build_src/* LoggerProvider */.IB({
@@ -170954,6 +170990,8 @@ const ATTR_NIX_STORE_TRUST = "detsys.nix.store_trust";
 const ATTR_NIX_STORE_VERSION = "detsys.nix.store_version";
 const ATTR_NIX_STORE_CHECK_METHOD = "detsys.nix.store_check_method";
 const ATTR_NIX_STORE_CHECK_ERROR = "detsys.nix.store_check_error";
+const ATTR_IDENTITY_STORED = "detsys.identity.stored";
+const ATTR_IDENTITY_STORE_ERROR = "detsys.identity.store_error";
 const ATTR_ATTACHMENT_NAME = "detsys.attachment.name";
 const ATTR_ATTACHMENT_PATH = "detsys.attachment.path";
 const STATE_KEY_EXECUTION_PHASE = "detsys_action_execution_phase";
@@ -171179,11 +171217,15 @@ var DetSysAction = class {
 				});
 				const correlationHashes = JSON.stringify(this.getCorrelationHashes());
 				process.env.DETSYS_CORRELATION = correlationHashes;
-				try {
-					await withSpan("store_identity", async () => {
+				await withSpan("store_identity", async (span) => {
+					try {
 						await writeCorrelationHashes(correlationHashes);
-					});
-				} catch {}
+						span.setAttribute(ATTR_IDENTITY_STORED, true);
+					} catch (e) {
+						span.setAttribute(ATTR_IDENTITY_STORED, false);
+						span.setAttribute(ATTR_IDENTITY_STORE_ERROR, stringifyError$1(e));
+					}
+				});
 				if (!await this.preflightRequireNix()) {
 					this.addEvent(EVENT_PREFLIGHT_REQUIRE_NIX_DENIED);
 					return;
@@ -171233,7 +171275,8 @@ var DetSysAction = class {
 		this.telemetry.start({
 			serviceName: `${this.actionOptions.name}-action`,
 			serviceVersion: dist_text(process.env["GITHUB_ACTION_REF"]),
-			resourceAttributes: await this.telemetryResourceAttributes()
+			resourceAttributes: await this.telemetryResourceAttributes(),
+			samplingRandomnessSource: this.getInvocationId()
 		});
 	}
 	/**
diff --git a/package-lock.json b/package-lock.json
index 567c4d3..c26d370 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -631,9 +631,9 @@
       }
     },
     "node_modules/@determinate-systems/detsys-ts": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/@determinate-systems/detsys-ts/-/detsys-ts-2.1.2.tgz",
-      "integrity": "sha512-4UMrSprlo2I3RYr9eGC+t5fhXkuZ/bl6t1IHfXzJZbO5ew4jRZgpwVmgWQ7Ee0ocA3eNdNERmdvmOq0Hl0FhcA==",
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/@determinate-systems/detsys-ts/-/detsys-ts-2.1.3.tgz",
+      "integrity": "sha512-1uUEqCsZc6L8AUnOG8yFxQTmb2TQjRUqSILgqc0YA+xRs3VC8a0rpC+QCJvYR8ilNmFQ7u7SZgL1/9+N8b2pLA==",
       "license": "MIT",
       "dependencies": {
         "@actions/cache": "^6.0.0",