From 0b73761ef4b816fd406e6b4e7f2fdddff57ef6ac Mon Sep 17 00:00:00 2001 From: nicktrn <55853254+nicktrn@users.noreply.github.com> Date: Wed, 22 Jul 2026 12:47:13 +0100 Subject: [PATCH] feat(supervisor): export workload_token_enforcement_mode gauge Emit a gauge set to 1 for the active WORKLOAD_TOKEN_ENFORCEMENT value (disabled/ log/enforce) so dashboards can show the current mode at a glance. The existing verify/mint counters don't distinguish log from enforce; this closes that gap. --- apps/supervisor/src/workloadToken.ts | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/apps/supervisor/src/workloadToken.ts b/apps/supervisor/src/workloadToken.ts index 914411dd73..d28a615074 100644 --- a/apps/supervisor/src/workloadToken.ts +++ b/apps/supervisor/src/workloadToken.ts @@ -4,7 +4,7 @@ import { type WorkloadDeploymentTokenClaims, type WorkloadDeploymentTokenInput, } from "@trigger.dev/core/v3"; -import { Counter } from "prom-client"; +import { Counter, Gauge } from "prom-client"; import { env } from "./env.js"; import { register } from "./metrics.js"; @@ -37,6 +37,16 @@ const verifyCounter = new Counter({ registers: [register], }); +// Exports the active mode (value 1 for the current WORKLOAD_TOKEN_ENFORCEMENT) so dashboards can show +// disabled/log/enforce at a glance — the counters alone don't distinguish log from enforce. +const enforcementModeGauge = new Gauge({ + name: "workload_token_enforcement_mode", + help: "Active runner-boundary auth mode: value 1 for the label matching WORKLOAD_TOKEN_ENFORCEMENT", + labelNames: ["mode"] as const, + registers: [register], +}); +enforcementModeGauge.set({ mode: env.WORKLOAD_TOKEN_ENFORCEMENT }, 1); + export async function mintDeploymentToken( claims: WorkloadDeploymentTokenInput ): Promise {