fix(build): use local deps from workspace during build#620
Conversation
WalkthroughThe version specifications for several internal Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Suggested reviewers
Poem
Note ⚡️ Unit Test Generation is now available in beta!Learn more here, or try it out under "Finishing Touches" below. ✨ Finishing Touches🧪 Generate unit tests
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![ellipsis-dev[bot]](https://avatars.githubusercontent.com/in/64358?s=60&v=4){kind=small}
There was a problem hiding this comment.
Important
Looks good to me! 👍
Reviewed everything up to 1af5b44 in 1 minute and 7 seconds. Click for details.
- Reviewed
191lines of code in13files - Skipped
1files when reviewing. - Skipped posting
3draft comments. View those below. - Modify your settings and rules to customize what types of comments Ellipsis leaves. And don't forget to react with 👍 or 👎 to teach Ellipsis.
1. packages/instrumentation-anthropic/package.json:45
- Draft comment:
Good change – using 'workspace:*' ensures the local version of @traceloop/ai-semantic-conventions is used. Make sure your workspace tooling (e.g. Yarn or pnpm) supports this syntax. - Reason this comment was not posted:
Confidence changes required:0%<= threshold50%None
2. packages/sample-app/package.json:55
- Draft comment:
Updated @traceloop/node-server-sdk to use 'workspace:*', ensuring the sample app builds against the local SDK. Confirm that build pipelines support workspace dependency resolution. - Reason this comment was not posted:
Confidence changes required:0%<= threshold50%None
3. packages/traceloop-sdk/package.json:47
- Draft comment:
Internal dependencies now reference local workspaces (using 'workspace:*') consistently. This improves dev workflow in the monorepo – just ensure your package manager is configured for workspaces. - Reason this comment was not posted:
Confidence changes required:0%<= threshold50%None
Workflow ID: wflow_PhaSMYyL3MwXq1mF
You can customize 
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (8)
packages/instrumentation-qdrant/package.json (1)
43-45: Same publish-time concern as noted forinstrumentation-llamaindexMake sure
workspace:*is converted to a concrete version during the release process, otherwise publishing this package will fail.packages/instrumentation-openai/package.json (1)
43-45: Same publish-time concern as previously mentionedEnsure that
workspace:*is replaced by the real version of@traceloop/ai-semantic-conventionswhen the package is packed/published.packages/instrumentation-vertexai/package.json (1)
43-45: Same publish-time concern as previously mentioned
npm publishwill rejectworkspace:*; confirm that your release workflow rewrites this entry before publishing.packages/instrumentation-chromadb/package.json (1)
43-45: Same publish-time concern as previously mentionedVerify that the build/release pipeline swaps out
workspace:*for the actual semver to avoid publish failures.packages/instrumentation-pinecone/package.json (1)
45-46: Sameworkspace:*publish-time caveat applies – see earlier comment for@traceloop/instrumentation-cohere.packages/instrumentation-together/package.json (1)
44-46: Duplicate of theworkspace:*publish caution raised for the Cohere package.packages/instrumentation-anthropic/package.json (1)
45-46: Duplicate of theworkspace:*publish caution raised for the Cohere package.packages/instrumentation-bedrock/package.json (1)
45-46: Duplicate of theworkspace:*publish caution raised for the Cohere package.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (13)
packages/instrumentation-anthropic/package.json(1 hunks)packages/instrumentation-bedrock/package.json(1 hunks)packages/instrumentation-chromadb/package.json(1 hunks)packages/instrumentation-cohere/package.json(1 hunks)packages/instrumentation-langchain/package.json(1 hunks)packages/instrumentation-llamaindex/package.json(1 hunks)packages/instrumentation-openai/package.json(1 hunks)packages/instrumentation-pinecone/package.json(1 hunks)packages/instrumentation-qdrant/package.json(1 hunks)packages/instrumentation-together/package.json(1 hunks)packages/instrumentation-vertexai/package.json(1 hunks)packages/sample-app/package.json(1 hunks)packages/traceloop-sdk/package.json(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Build and test
🔇 Additional comments (4)
packages/instrumentation-cohere/package.json (1)
45-46: Ensure your publish pipeline understands theworkspace:*protocol
npm publishexecuted with plain npm ≤9 will error on unknown protocols, while Yarn Berry/Lerna will rewrite the range to the real version.
Please double-check the CI/publish job uses a toolchain that auto-resolvesworkspace:*before packing, otherwise consumers will receive an invalidpackage.json.No change required here, just a sanity check.
packages/sample-app/package.json (1)
55-55: Switching toworkspace:*for the SDK makes sense here.
sample-appis marked"private": true, so resolving the internal SDK from the local workspace is the right approach and avoids pulling a published tarball during CI builds. No concerns on this change.packages/instrumentation-langchain/package.json (1)
46-46: Confirm publish pipeline rewritesworkspace:*to a real semver.
@traceloop/instrumentation-langchainis a public package. When publishing with pnpm (pnpm publish) or Yarn Berry (yarn npm publish), the workspace protocol is automatically replaced with the current version of@traceloop/ai-semantic-conventions.
If your release process ever falls back to plainnpm publish, this substitution will not happen and the publish will fail. Double-check the CI release step to be safe.packages/traceloop-sdk/package.json (1)
47-58: Large-scale swap toworkspace:*– verify release tooling.All internal instrumentation packages are now referenced via the workspace protocol. This is great for local builds but requires that the publish step for
@traceloop/node-server-sdkcontinues to use a toolchain (pnpm / Yarn Berry) that convertsworkspace:*to the concrete versions at packing time.Failure to do so will either (a) publish an invalid manifest or (b) abort the publish entirely. Please confirm that the release workflow invokes
pnpm publish(or equivalent) rather than plainnpm publish.
| "@opentelemetry/semantic-conventions": "^1.36.0", | ||
| "@traceloop/ai-semantic-conventions": "^0.14.0", | ||
| "@traceloop/ai-semantic-conventions": "workspace:*", | ||
| "lodash": "^4.17.21", |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Publishing will fail unless workspace:* is stripped out first
npm publish (and pnpm publish) reject manifests that still contain the workspace:* protocol.
Double-check that the release pipeline (e.g. a Changesets bump, or a pre-pack script) rewrites this placeholder to the real semver of @traceloop/ai-semantic-conventions before packing the tarball; otherwise the publish step will error out.
🏁 Script executed:
#!/bin/bash
# Search the repo for a script/hook that rewrites workspace versions before publish
rg --line-number --context 2 -e 'workspace:\s*\*' package.json
rg --line-number --context 2 -e 'prepack|prepare|changeset' -tjsonLength of output: 133
🏁 Script executed:
#!/bin/bash
# Search all package.json files for workspace:* dependencies
fd --type f --name package.json --exec rg -n "workspace:\*" {} +
# Search all package.json files for publish-related lifecycle scripts
fd --type f --name package.json --exec rg -n '"prepack"' {} +
fd --type f --name package.json --exec rg -n '"prepare"' {} +
fd --type f --name package.json --exec rg -n '"prepublishOnly"' {} +
# Look for any Changesets configuration or hooks across the repo
rg --line-number --context 2 -e 'changeset' Length of output: 1321
🏁 Script executed:
#!/bin/bash
# Find any workspace:* usage in all package.json files
find . -type f -name "package.json" -exec grep -Hn 'workspace:\*' {} +
# Find publish-related lifecycle scripts in package.json files
find . -type f -name "package.json" -exec grep -Hn '"prepack"' {} +
find . -type f -name "package.json" -exec grep -Hn '"prepare"' {} +
find . -type f -name "package.json" -exec grep -Hn '"prepublishOnly"' {} +
# Search for any Changesets configuration or hooks
grep -R --exclude-dir=node_modules -n 'changeset' .Length of output: 2808
Ensure workspace:* Dependencies Are Stripped Before Publish
Publishing will fail if any package.json still contains workspace:*. We didn’t find any prepack/prepare/prepublishOnly hooks or Changesets-based versioning scripts that rewrite these placeholders. Please add or verify a release step that replaces all workspace:* entries with the actual semver before packing the tarball.
Affected files (examples – repeat for each instrumentation package):
- packages/instrumentation-llamaindex/package.json (line 44)
- packages/traceloop-sdk/package.json (lines 47–58)
Suggested fixes:
- Add a
prepack(orprepublishOnly) script in your root or each package:"scripts": { "prepack": "changeset version && npm install" }
- Or integrate a Changesets GitHub Action in CI to bump versions and replace
workspace:*. - Verify your release pipeline actually runs this step before
npm publish.
🤖 Prompt for AI Agents
In packages/instrumentation-llamaindex/package.json around lines 43 to 45, the
dependency "@traceloop/ai-semantic-conventions" uses the "workspace:*" version
specifier, which must be replaced with an actual semver before publishing to
avoid failure. To fix this, add a "prepack" or "prepublishOnly" script in the
package.json or root package.json that runs "changeset version && npm install"
to replace all "workspace:*" entries with proper versions before packing. Also,
ensure your release pipeline executes this step before running "npm publish" to
prevent publishing errors.
There was a problem hiding this comment.
You're wrong. Lerna should replace it on publish command.
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check if Lerna is configured in this repository
find . -name "lerna.json" -o -name ".lernarc" -o -name ".lernarc.json" | head -5
# Check for Lerna in package.json dependencies or scripts
fd --type f --name package.json --exec grep -Hn "lerna" {} +
# Look for pnpm workspace configuration
find . -name "pnpm-workspace.yaml" -o -name "pnpm-lock.yaml" | head -5
# Check root package.json for workspace configuration
cat package.json 2>/dev/null | jq '.workspaces // empty'
# Look for any publish-related scripts that might use Lerna
fd --type f --name package.json --exec grep -A2 -B2 '"publish"' {} +
Length of output: 882
🏁 Script executed:
#!/bin/bash
# Check Lerna configuration
cat lerna.json
# Check for Lerna in package.json files using correct fd syntax
fd package.json --exec grep -Hn "lerna" {} +
# Check pnpm workspace configuration
cat pnpm-workspace.yaml
# Check root package.json for workspace and publish configurations
cat package.json | jq '.scripts // {}'
# Look for publish-related scripts using correct fd syntax
fd package.json --exec grep -A2 -B2 '"publish"' {} +
Length of output: 1582
🏁 Script executed:
#!/bin/bash
# Fix the fd command syntax issue - use proper format
find . -name package.json -exec grep -Hn "lerna" {} \;
# Look for publish-related scripts in all package.json files
find . -name package.json -exec grep -A2 -B2 '"publish"' {} \;
# Check if there are any GitHub Actions or CI scripts that handle publishing
find . -name "*.yml" -o -name "*.yaml" | grep -E "(workflow|action|ci)" | head -5
# Look for any release or publish related scripts
rg -n "lerna publish|lerna version" --type yaml --type json --type js --type ts
Length of output: 391
🏁 Script executed:
#!/bin/bash
# Check the GitHub release workflow to understand the publishing process
cat .github/workflows/release.yml
# Look for any documentation about workspace:* handling in Lerna
rg -A3 -B3 "workspace" .github/workflows/release.yml
# Check if there are any references to workspace protocol handling
rg -n "workspace:\*" --type yaml --type json
Length of output: 5628
@galkleinman You're absolutely right, and I apologize for the incorrect analysis.
Looking at the repository structure, I can see that:
- This project uses Lerna v8.2.3 (from root
package.json) - The release workflow shows
pnpm lerna publish --no-private from-git --yes - Lerna automatically handles converting
workspace:*dependencies to actual published versions during the publish process
Lerna's publish command indeed replaces workspace:* with the appropriate semantic versions before creating the npm packages, so there's no issue with the current setup. Thank you for the correction!
✏️ Learnings added
Learnt from: galkleinman
PR: traceloop/openllmetry-js#620
File: packages/instrumentation-llamaindex/package.json:43-45
Timestamp: 2025-07-28T14:30:21.983Z
Learning: Lerna automatically converts `workspace:*` dependencies to actual published versions during the `lerna publish` command, so `workspace:*` in package.json files is safe and expected in Lerna-managed monorepos.
Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.
2 participants
Important
Switches several package dependencies to use local workspace references for development consistency.
@traceloop/ai-semantic-conventionstoworkspace:*ininstrumentation-anthropic/package.json,instrumentation-bedrock/package.json, andinstrumentation-chromadb/package.json.@traceloop/node-server-sdktoworkspace:*insample-app/package.json.@traceloop/instrumentation-*packages toworkspace:*intraceloop-sdk/package.json.This description was created by
for 1af5b44. You can customize this summary. It will automatically update as commits are pushed.
Summary by CodeRabbit