[dlabaj]

Summary

Adds the Langfuse generation-export workflow generated by uie-fullsend langfuse setup. These files are generated by the CLI but are never committed or merged automatically, so they need a PR to land on the default branch.

Why this needs to be on main

The workflow is triggered via workflow_dispatch, and GitHub only exposes that trigger for workflows present on the default branch. Until this merges, uie-fullsend langfuse verify fails to dispatch.

Files

• .github/workflows/fullsend-langfuse.yaml — runs on workflow_run completion of the fullsend workflow, plus manual workflow_dispatch for trace verification
• .fullsend/scripts/langfuse-post-run.py — Python standard library only, no third-party dependencies

Security notes

• No credentials are committed. The endpoint and auth header are read at runtime from the existing repo Actions variables and the OTEL_EXPORTER_OTLP_TRACES_HEADERS secret, all of which are already configured.
• The workflow checks out the default branch (ref: github.event.repository.default_branch) with persist-credentials: false, so artifact contents from a triggering run cannot inject code.
• Permissions are scoped to actions: read and contents: read.
• Per the generated script's header, only model/usage and CI metadata are exported; artifacts never supply code, credentials, an endpoint, or prompt/response content.

Verification

After merge, uie-fullsend langfuse verify dispatches the workflow with a unique 32-character trace ID, which should then appear in Langfuse.

🤖 Generated with Claude Code