[file-diet] Refactor: pkg/workflow/awf_helpers.go exceeds 800 lines (1131 LOC)

[github-actions]

Overview

The file pkg/workflow/awf_helpers.go has grown to 1131 lines, making it difficult to maintain and test. This task involves refactoring it into smaller, focused files with improved test coverage.

Current State

• File: pkg/workflow/awf_helpers.go
• Size: 1131 lines
• Test Coverage: awf_helpers_test.go is 2480 lines (~2.2x ratio) — good overall coverage, but concentrated in one large test file that should split alongside the source
• Complexity: Mixes several distinct concerns — AWF command/argument construction, firewall version-capability gating, container digest resolution, ARC/DinD chroot rewriting, and env-var exclusion logic — in a single 26-function file

Full File Analysis

Function Inventory (26 top-level functions)

• shouldUseWorkflowCallNetworkAllowedInput (L123)
• buildModelsJSONPathExportScript (L130)
• rewriteArcDindPath (L138), rewriteArcDindEngineCommand (L142)
• applyDefaultMaxAICreditsEnvToMap (L153), injectMaxAICreditsExpression (L182)
• buildWorkflowCallNetworkAllowedUpdateScript (L197)
• BuildAWFCommand (L229–630) — ~400 lines, the single largest function, builds the full awf CLI invocation
• BuildAWFArgs (L630–809) — ~180 lines, builds argument list variant
• GetAWFCommandPrefix (L809)
• buildAWFImageTagWithDigests (L838), lookupContainerDigest (L875)
• WrapCommandInShell (L898)
• ComputeAWFExcludeEnvVarNames (L930–1023) — ~90 lines
• addCliProxyGHTokenToEnv (L1023)
• awfSupportsExcludeEnv, awfVersionAtLeast, awfSupportsCliProxy, awfSupportsAllowHostPorts, awfSupportsDockerHostPathPrefix, awfSupportsTokenSteering, awfSupportsChrootConfig, awfSupportsContainerRuntime, awfSupportsLegacySecurity, awfSupportsAPIProxyProviders (L1036–1108) — 9 near-identical version-gate predicates, strong candidate for a small table-driven helper or shared pattern
• buildArcDindChrootConfigPatchBody (L1109), buildArcDindChrootConfigPatchBodyBash (L1122)

Complexity hotspots

• BuildAWFCommand (L229–630) and BuildAWFArgs (L630–809) together account for over half the file and mix argument assembly, feature-flag branching, and string formatting.
• The 9 awfSupports* predicates (L1036–1108) are structurally duplicate — each just calls awfVersionAtLeast with a different constant — and could be collapsed into a single map-driven capability lookup, reducing both line count and future duplication risk.

Refactoring Strategy

Proposed File Splits

1. awf_command_builder.go

   • Functions: BuildAWFCommand, BuildAWFArgs, GetAWFCommandPrefix, WrapCommandInShell
   • Responsibility: Constructing the awf command line and argument list used to wrap agentic engine execution
   • Estimated LOC: ~550

2. awf_capabilities.go

   • Functions: awfVersionAtLeast, awfSupportsExcludeEnv, awfSupportsCliProxy, awfSupportsAllowHostPorts, awfSupportsDockerHostPathPrefix, awfSupportsTokenSteering, awfSupportsChrootConfig, awfSupportsContainerRuntime, awfSupportsLegacySecurity, awfSupportsAPIProxyProviders
   • Responsibility: Firewall version-gated feature capability checks (consider collapsing into a single table-driven lookup during the split)
   • Estimated LOC: ~90

3. awf_env.go

   • Functions: ComputeAWFExcludeEnvVarNames, addCliProxyGHTokenToEnv, applyDefaultMaxAICreditsEnvToMap, injectMaxAICreditsExpression
   • Responsibility: Environment variable computation/injection for the AWF sandbox (exclusions, GH token, max-AI-credits expression)
   • Estimated LOC: ~150

4. awf_digest.go

   • Functions: buildAWFImageTagWithDigests, lookupContainerDigest
   • Responsibility: Resolving and pinning container image digests for AWF images
   • Estimated LOC: ~60

5. awf_arc_dind.go

   • Functions: rewriteArcDindPath, rewriteArcDindEngineCommand, buildModelsJSONPathExportScript, buildArcDindChrootConfigPatchBody, buildArcDindChrootConfigPatchBodyBash
   • Responsibility: ARC/DinD-specific path rewriting and chroot config patching
   • Estimated LOC: ~80

6. awf_helpers.go (remaining)

   • Functions: shouldUseWorkflowCallNetworkAllowedInput, buildWorkflowCallNetworkAllowedUpdateScript
   • Responsibility: Workflow-call network-allowed input handling
   • Estimated LOC: ~100

Shared Utilities

No new shared utility file needed; keep helpers colocated with their consuming domain per above split.

Interface Abstractions

• Consider a firewallCapability table (map[string]constants.Version]) consumed by a single awfSupports(firewallConfig *FirewallConfig, name string) bool to eliminate the 9 near-duplicate predicate functions, exposing typed wrapper constants for call-site clarity if needed.

Test Coverage Plan

Split awf_helpers_test.go (2480 lines) to mirror the new source files:

1. awf_command_builder_test.go

   • Test cases: BuildAWFCommand/BuildAWFArgs across engine types, network modes, proxy configs, ARC/DinD variants
   • Target coverage: >80%

2. awf_capabilities_test.go

   • Test cases: each awfSupports* predicate at boundary versions (below/at/above min version), nil FirewallConfig handling
   • Target coverage: >80%

3. awf_env_test.go

   • Test cases: exclude-env-var computation with/without secrets, CLI proxy token injection, max-AI-credits default/override/expression injection
   • Target coverage: >80%

4. awf_digest_test.go

   • Test cases: digest lookup success/failure, image tag rewriting with/without digest
   • Target coverage: >80%

5. awf_arc_dind_test.go

   • Test cases: ARC/DinD path and command rewriting, chroot config patch body (JSON and bash variants)
   • Target coverage: >80%

Implementation Guidelines

1. Preserve Behavior: Ensure all existing functionality works identically
2. Maintain Exports: Keep public API unchanged (exported functions/types)
3. Add Tests First: Write tests for each new file before refactoring
4. Incremental Changes: Split one module at a time
5. Run Tests Frequently: Verify make test-unit passes after each split
6. Update Imports: Ensure all import paths are correct
7. Document Changes: Add comments explaining module boundaries

Acceptance Criteria

• Original file is split into 6 focused files
• Each new file is under 500 lines (except command builder, which may need a further internal split of BuildAWFCommand/BuildAWFArgs if it exceeds 500 lines)
• All tests pass (make test-unit)
• Test coverage is ≥80% for new files
• No breaking changes to public API
• Code passes linting (make lint)
• Build succeeds (make build)

Additional Context

• Repository Guidelines: Follow patterns in .github/agents/developer.instructions.agent.md
• Code Organization: Prefer many small files grouped by functionality
• Testing: Match existing test patterns in pkg/workflow/*_test.go

---

Priority: Medium
Effort: Medium — 26 functions across 6 well-separated domains, existing tests provide a strong safety net
Expected Impact: Improved maintainability, easier testing, reduced complexity

Generated by 🧹 Daily File Diet · sonnet50 · 54.2 AIC · ⌖ 9.04 AIC · ⊞ 9.5K · ◷

• expires on Jul 30, 2026, 5:16 AM UTC-08:00

[github-actions]

🍪 Issue Monster selected this for Copilot

I have identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 2.44 AIC · ⌖ 4.33 AIC · ⊞ 6.8K · ◷

[github-actions]

This issue was automatically closed because it expired on 2026-07-30T13:16:42.569Z.

Closed by Workflow