Add response token count logic to LLM instrumentations

.github/.trivyignore

@@ -1,9 +1,16 @@
+# =============================
+# Accepted Risk Vulnerabilities
+# =============================
+
+# Accepting risk due to Python 3.8 support.
+CVE-2025-50181  # Requires misconfiguration of urllib3, which agent does not do without intervention
+CVE-2025-66418  # Malicious servers could cause high resource consumption
+CVE-2025-66471  # Malicious servers could cause high resource consumption
+CVE-2026-21441  # Improper Handling of Highly Compressed Data (Data Amplification)
+
 # =======================
 # Ignored Vulnerabilities
 # =======================
 
-# Accepting risk due to Python 3.8 support.
-CVE-2025-50181
-
 # Not relevant, only affects Pyodide
 CVE-2025-50182

.github/containers/Dockerfile

@@ -74,18 +74,6 @@ RUN if [ "${TARGETPLATFORM}" = "linux/amd64" ]; then export ARCH="x86_64"; else
     rm -rf /tmp/addlicense && \
     chmod +x /usr/local/bin/addlicense
 
-# Build librdkafka from source
-ARG LIBRDKAFKA_VERSION=2.1.1
-RUN cd /tmp && \
-    wget https://github.com/confluentinc/librdkafka/archive/refs/tags/v${LIBRDKAFKA_VERSION}.zip -O ./librdkafka.zip && \
-    unzip ./librdkafka.zip && \
-    rm ./librdkafka.zip && \
-    cd ./librdkafka-${LIBRDKAFKA_VERSION} && \
-    ./configure && \
-    make all install && \
-    cd /tmp && \
-    rm -rf ./librdkafka-${LIBRDKAFKA_VERSION}
-
 # Setup ODBC config
 RUN if [ "${TARGETPLATFORM}" = "linux/amd64" ]; then export ARCH="x86_64"; else export ARCH="aarch64"; fi && \
     sed -i "s|Driver=psqlodbca.so|Driver=/usr/lib/${ARCH}-linux-gnu/odbc/psqlodbca.so|g" /etc/odbcinst.ini && \
@@ -109,13 +97,11 @@ ENV PATH="${HOME}/.local/bin:${PATH}"
 ENV UV_PYTHON_PREFERENCE="only-managed"
 ENV UV_LINK_MODE="copy"
 
-# Install PyPy versions and rename shims
-RUN uv python install -f pp3.11 pp3.10
-RUN mv "${HOME}/.local/bin/python3.11" "${HOME}/.local/bin/pypy3.11" && \
-    mv "${HOME}/.local/bin/python3.10" "${HOME}/.local/bin/pypy3.10"
-
-# Install CPython versions
-RUN uv python install -f cp3.14 cp3.14t cp3.13 cp3.12 cp3.11 cp3.10 cp3.9 cp3.8
+# Install CPython and PyPy versions
+RUN uv python install -f \
+        cp3.14 cp3.13 cp3.12 cp3.11 cp3.10 cp3.9 cp3.8 \
+        pp3.11 pp3.10 \
+        cp3.14t
 
 # Set default Python version to CPython 3.13
 RUN uv python install -f --default cp3.13
@@ -130,7 +116,7 @@ EOF
 ENV UV_PYTHON_DOWNLOADS=never
 
 # Install tools with uv in isolated environments
-RUN uv tool install tox==4.23.2 --with tox-uv && \
+RUN uv tool install tox --with tox-uv && \
     uv tool install ruff && \
     uv tool install pre-commit --with pre-commit-uv && \
     uv tool install asv --with virtualenv

.github/scripts/install_azure_functions_worker.sh

@@ -34,7 +34,7 @@ ${PIP} install pip-tools build invoke
 
 # Install proto build dependencies
 $( cd ${BUILD_DIR}/workers/ && ${PIPCOMPILE} -o ${BUILD_DIR}/requirements.txt )
-${PIP} install -r ${BUILD_DIR}/requirements.txt
+${PIP} install 'setuptools<82' -r ${BUILD_DIR}/requirements.txt
 
 # Build proto files into pb2 files (invoke handles fixing include paths for the protos)
 cd ${BUILD_DIR}/workers/tests && ${INVOKE} -c test_setup build-protos

.github/workflows/addlicense.yml

@@ -39,7 +39,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # 5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
 
       - name: Fetch git tags
         run: |

.github/workflows/benchmarks.yml

@@ -25,24 +25,51 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  # Benchmarks
+  # ===========================
+  # Aggregate Benchmark Results
+  # ===========================
+  benchmarks:
+    runs-on: ubuntu-24.04
+    if: always() # Always run, even on cancellation or failure
+    needs:
+      - benchmark
+
+    steps:
+      - name: Status
+        run: |
+          if [[ "${{ contains(needs.*.result, 'cancelled') }}" == "true" ]]; then
+            echo "Workflow cancelled."
+            exit 1
+          elif [[ "${{ contains(needs.*.result, 'failure') }}" == "true" ]]; then
+            echo "One or more jobs failed."
+            exit 1
+          else
+            echo "All jobs completed successfully."
+            exit 0
+          fi
+
+  # ==================================
+  # Benchmarks Run Directly On Runners
+  # ==================================
   benchmark:
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     strategy:
+      fail-fast: false
       matrix:
         python: ["3.8", "3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
 
     env:
       ASV_FACTOR: "1.1"
       BASE_SHA: ${{ github.event.pull_request.base.sha }}
+      HEAD_SHA: ${{ github.event.pull_request.head.sha }}
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # 5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # 6.0.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # 6.2.0
         with:
           python-version: "${{ matrix.python }}"
 
@@ -62,9 +89,10 @@ jobs:
 
       - name: Run Benchmark
         run: |
+          echo "Running continuous benchmarking between base commit ${BASE_SHA} and head commit ${HEAD_SHA}"
           asv continuous \
             --show-stderr \
             --split \
             --factor "${ASV_FACTOR}" \
             --python=${{ matrix.python }} \
-            "${BASE_SHA}" "${GITHUB_SHA}"
+            "${BASE_SHA}" "${HEAD_SHA}"

.github/workflows/build-ci-image.yml

@@ -43,14 +43,14 @@ jobs:
     name: Docker Build ${{ matrix.platform }}
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # 5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
         with:
           persist-credentials: false
           fetch-depth: 0
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # 3.11.1
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # 3.12.0
 
       # Lowercase image name and append -ci
       - name: Generate Image Name
@@ -60,7 +60,7 @@ jobs:
 
       - name: Generate Docker Metadata (Tags and Labels)
         id: meta
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # 5.8.0
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # 5.10.0
         with:
           images: ghcr.io/${{ steps.image-name.outputs.IMAGE_NAME }}
           flavor: |
@@ -75,15 +75,15 @@ jobs:
 
       - name: Login to GitHub Container Registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # 3.6.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # 3.7.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and Push Image by Digest
         id: build
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # 6.18.0
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # 6.19.2
         with:
           context: .github/containers
           platforms: ${{ matrix.platform }}
@@ -97,7 +97,7 @@ jobs:
           touch "${{ runner.temp }}/digests/${digest#sha256:}"
 
       - name: Upload Digest
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # 5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # 6.0.0
         with:
           name: digests-${{ matrix.cache_tag }}
           path: ${{ runner.temp }}/digests/*
@@ -114,22 +114,22 @@ jobs:
 
     steps:
       - name: Download Digests
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # 6.0.0
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # 7.0.0
         with:
           path: ${{ runner.temp }}/digests
           pattern: digests-*
           merge-multiple: true
 
       - name: Login to GitHub Container Registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # 3.6.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # 3.7.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # 3.11.1
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # 3.12.0
 
       # Lowercase image name and append -ci
       - name: Generate Image Name
@@ -139,7 +139,7 @@ jobs:
 
       - name: Generate Docker Metadata (Tags and Labels)
         id: meta
-        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # 5.8.0
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # 5.10.0
         with:
           images: ghcr.io/${{ steps.image-name.outputs.IMAGE_NAME }}
           flavor: |

.github/workflows/deploy.yml

@@ -69,14 +69,14 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # 5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
         with:
           persist-credentials: false
           fetch-depth: 0
 
       - name: Setup QEMU
         if: runner.os == 'Linux'
-        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # 3.6.0
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # 3.7.0
         with:
           platforms: arm64
 
@@ -97,7 +97,7 @@ jobs:
           CIBW_TEST_SKIP: "*-win_arm64"
 
       - name: Upload Artifacts
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # 5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # 6.0.0
         with:
           name: ${{ github.job }}-${{ matrix.wheel }}
           path: ./wheelhouse/*.whl
@@ -109,12 +109,12 @@ jobs:
     runs-on: ubuntu-24.04
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # 5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
         with:
           persist-credentials: false
           fetch-depth: 0
 
-      - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # 6.0.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # 6.2.0
         with:
           python-version: "3.13"
 
@@ -134,7 +134,7 @@ jobs:
           openssl md5 -binary "dist/${tarball}" | xxd -p | tr -d '\n' > "dist/${md5_file}"
 
       - name: Upload Artifacts
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # 5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # 6.0.0
         with:
           name: ${{ github.job }}-sdist
           path: |
@@ -166,7 +166,7 @@ jobs:
     environment: ${{ matrix.pypi-instance }}
 
     steps:
-      - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # 6.0.0
+      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # 7.0.0
         with:
           path: ./dist/
           merge-multiple: true
@@ -196,7 +196,7 @@ jobs:
           repository-url: https://test.pypi.org/legacy/
 
       - name: Attest
-        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # 3.0.0
+        uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # 3.2.0
         id: attest
         with:
           subject-path: |

.github/workflows/mega-linter.yml

@@ -45,15 +45,15 @@ jobs:
     steps:
       # Git Checkout
       - name: Checkout Code
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # 5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
         with:
           token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }}
           fetch-depth: 0 # Required for pushing commits to PRs
 
       # MegaLinter
       - name: MegaLinter
         id: ml
-        uses: oxsecurity/megalinter/flavors/python@62c799d895af9bcbca5eacfebca29d527f125a57 # 9.1.0
+        uses: oxsecurity/megalinter/flavors/python@42bb470545e359597e7f12156947c436e4e3fb9a # 9.3.0
         env:
           # All available variables are described in documentation
           # https://megalinter.io/latest/configuration/
@@ -68,7 +68,7 @@ jobs:
       # Upload MegaLinter artifacts
       - name: Archive production artifacts
         if: success() || failure()
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # 5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # 6.0.0
         with:
           name: MegaLinter reports
           include-hidden-files: "true"
@@ -109,7 +109,7 @@ jobs:
         run: sudo chown -Rc $UID .git/
 
       - name: Commit and push applied linter fixes
-        uses: stefanzweifel/git-auto-commit-action@28e16e81777b558cc906c8750092100bbb34c5e3 # 7.0.0
+        uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # 7.1.0
         if: env.APPLY_FIXES_IF_COMMIT == 'true'
         with:
           branch: >-