From 26f05a0e27016c1ecf2afe6ec3442dcd46278c79 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 14 Aug 2026 04:11:06 +0000 Subject: [PATCH] Add debug logging to files with minimal or no existing coverage Adds pkg:filename-namespaced loggers and log.Print/Printf calls at decision points in five files that had zero or minimal debug logging: - pkg/workflow/memory_validation_config.go: legacy field usage, deprecated field rejection, default timeout application - pkg/workflow/enclaves.go: validation entry, network-isolation and bounded-queries rejection paths, built config count - pkg/typeutil/lookup.go: LookupStringPath step failures - pkg/workflow/mcp_renderer_guard.go: guard-policies JSON/TOML render entry - pkg/workflow/dismiss_pull_request_review.go: legacy alias key usage, invalid target rejection, non-map fallback Co-Authored-By: Claude Sonnet 5 --- pkg/typeutil/lookup.go | 7 +++++++ pkg/workflow/dismiss_pull_request_review.go | 3 +++ pkg/workflow/enclaves.go | 8 ++++++++ pkg/workflow/mcp_renderer_guard.go | 2 ++ pkg/workflow/memory_validation_config.go | 8 ++++++++ 5 files changed, 28 insertions(+) diff --git a/pkg/typeutil/lookup.go b/pkg/typeutil/lookup.go index bb32eea2a19..ab1411c0853 100644 --- a/pkg/typeutil/lookup.go +++ b/pkg/typeutil/lookup.go @@ -1,5 +1,9 @@ package typeutil +import "github.com/github/gh-aw/pkg/logger" + +var lookupLog = logger.New("typeutil:lookup") + // ParseBool extracts a boolean value from a map[string]any by key. // Returns false if the map is nil, the key is absent, or the value is not a bool. func ParseBool(m map[string]any, key string) bool { @@ -62,12 +66,14 @@ func LookupStringPath(m map[string]any, path ...string) (string, bool) { for i, key := range path { value, ok := current[key] if !ok { + lookupLog.Printf("Path lookup stopped: key %q missing at step %d/%d", key, i, len(path)) return "", false } if i == len(path)-1 { result, ok := value.(string) if !ok { + lookupLog.Printf("Path lookup failed: final value at key %q is not a string", key) return "", false } return result, true @@ -75,6 +81,7 @@ func LookupStringPath(m map[string]any, path ...string) (string, bool) { next, ok := value.(map[string]any) if !ok { + lookupLog.Printf("Path lookup failed: value at key %q is not a nested map (step %d/%d)", key, i, len(path)) return "", false } current = next diff --git a/pkg/workflow/dismiss_pull_request_review.go b/pkg/workflow/dismiss_pull_request_review.go index 30fb026e397..596c2db76b5 100644 --- a/pkg/workflow/dismiss_pull_request_review.go +++ b/pkg/workflow/dismiss_pull_request_review.go @@ -18,6 +18,7 @@ func (c *Compiler) parseDismissPullRequestReviewConfig(outputMap map[string]any) configData = value } else if value, exists := outputMap["dismiss-review"]; exists { // Backward-compatible alias. + dismissPullRequestReviewLog.Print("Using legacy dismiss-review alias key") configData = value } else { return nil @@ -33,6 +34,7 @@ func (c *Compiler) parseDismissPullRequestReviewConfig(outputMap map[string]any) // Parse target config (target, target-repo, allowed-repos). targetConfig, isInvalid := ParseTargetConfig(configMap) if isInvalid { + dismissPullRequestReviewLog.Print("Rejecting dismiss-pull-request-review: invalid target config") return nil } config.SafeOutputTargetConfig = targetConfig @@ -41,6 +43,7 @@ func (c *Compiler) parseDismissPullRequestReviewConfig(outputMap map[string]any) config.SafeOutputFilterConfig = ParseFilterConfig(configMap) } else { // If configData is nil or not a map, still set the default max. + dismissPullRequestReviewLog.Print("dismiss-pull-request-review config is not a map; applying default max only") config.Max = defaultIntStr(10) } diff --git a/pkg/workflow/enclaves.go b/pkg/workflow/enclaves.go index c96550b9635..d76fe174e9a 100644 --- a/pkg/workflow/enclaves.go +++ b/pkg/workflow/enclaves.go @@ -6,8 +6,12 @@ import ( "fmt" "regexp" "strings" + + "github.com/github/gh-aw/pkg/logger" ) +var enclavesLog = logger.New("workflow:enclaves") + const ( enclaveMCPServerName = "awf-enclave" enclaveMCPUpstreamURL = "http://awf-enclave-mcp:8080/mcp" @@ -112,12 +116,15 @@ func validateEnclavesConfig(workflowData *WorkflowData) error { if !enclavesEnabled(workflowData) { return nil } + enclavesLog.Printf("Validating %d enclave config(s)", len(workflowData.Enclaves)) if !isAWFNetworkIsolationEnabled(workflowData) { + enclavesLog.Print("Rejecting enclaves: AWF network isolation is not enabled") return errors.New("enclaves requires AWF network isolation; set sandbox.agent.sudo: false or use sandbox.agent.runtime: docker-sbx") } if workflowData.ParsedTools != nil && workflowData.ParsedTools.GitHub != nil && workflowData.ParsedTools.GitHub.BoundedQueries != nil { + enclavesLog.Print("Rejecting enclaves: incompatible with tools.github.bounded-queries") return errors.New("enclaves cannot be combined with tools.github.bounded-queries; remove tools.github.bounded-queries to use enclaves. Example:\n\nenclaves:\n - script:\n repos:\n - repo: org/my-repo\n sensitivity: confidential") } seenTypes := make(map[string]struct{}, len(workflowData.Enclaves)) @@ -219,6 +226,7 @@ func buildAWFEnclavesConfig(config EnclavesConfig) []map[string]any { } result = append(result, values) } + enclavesLog.Printf("Built %d AWF enclave config(s) from %d entries", len(result), len(config)) return result } diff --git a/pkg/workflow/mcp_renderer_guard.go b/pkg/workflow/mcp_renderer_guard.go index d61dc6767e0..54ca14c4276 100644 --- a/pkg/workflow/mcp_renderer_guard.go +++ b/pkg/workflow/mcp_renderer_guard.go @@ -59,6 +59,7 @@ func renderGuardPoliciesJSON(yaml *strings.Builder, policies map[string]any, ind if len(policies) == 0 { return } + mcpRendererLog.Printf("Rendering %d guard-policies entries as JSON", len(policies)) // Marshal to JSON with indentation, then re-indent to match the current indent level jsonBytes, err := json.MarshalIndent(policies, indent, " ") @@ -83,6 +84,7 @@ func renderGuardPoliciesToml(yaml *strings.Builder, policies map[string]any, ser if len(policies) == 0 { return } + mcpRendererLog.Printf("Rendering %d guard-policies entries as TOML for server %s", len(policies), serverID) yaml.WriteString(" \n") yaml.WriteString(" [mcp_servers." + serverID + ".\"guard-policies\"]\n") diff --git a/pkg/workflow/memory_validation_config.go b/pkg/workflow/memory_validation_config.go index 141d639240f..75739de8fe6 100644 --- a/pkg/workflow/memory_validation_config.go +++ b/pkg/workflow/memory_validation_config.go @@ -5,8 +5,12 @@ import ( "fmt" "math" "strconv" + + "github.com/github/gh-aw/pkg/logger" ) +var memoryValidationLog = logger.New("workflow:memory_validation_config") + const ( defaultMemoryValidationTimeoutMinutes = 1 maxMemoryValidationTimeoutMinutes = 5 @@ -21,9 +25,11 @@ func parseMemoryValidationConfig(configMap map[string]any, fieldPath string) (*M raw, ok := configMap["validation"] if !ok { if script, ok := configMap["validation-script"].(string); ok { + memoryValidationLog.Printf("Using legacy validation-script field at %s", fieldPath) return normalizeMemoryValidationConfig(&MemoryValidationConfig{Script: script}, fieldPath) } if script, ok := configMap["custom-validation"].(string); ok { + memoryValidationLog.Printf("Using legacy custom-validation field at %s", fieldPath) return normalizeMemoryValidationConfig(&MemoryValidationConfig{Script: script}, fieldPath) } return nil, nil @@ -34,6 +40,7 @@ func parseMemoryValidationConfig(configMap map[string]any, fieldPath string) (*M return normalizeMemoryValidationConfig(&MemoryValidationConfig{Script: value}, fieldPath) case map[string]any: if _, exists := value["timeout"]; exists { + memoryValidationLog.Printf("Rejecting deprecated timeout field at %s", fieldPath) return nil, fmt.Errorf("%s.timeout has been renamed to %s.timeout-minutes. Example:\n%s:\n timeout-minutes: 1", fieldPath, fieldPath, fieldPath) } config := &MemoryValidationConfig{} @@ -96,6 +103,7 @@ func normalizeMemoryValidationConfig(config *MemoryValidationConfig, fieldPath s return nil, fmt.Errorf("%s.script must not be empty. Example:\n%s:\n script: \"throw new Error('invalid state')\"", fieldPath, fieldPath) } if config.TimeoutMinutes == 0 { + memoryValidationLog.Printf("Applying default timeout of %d minute(s) at %s", defaultMemoryValidationTimeoutMinutes, fieldPath) config.TimeoutMinutes = defaultMemoryValidationTimeoutMinutes } return config, nil