From 09deb18f244e25470a89e96183474532642ebfc8 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 13 Jul 2026 04:35:00 +0000 Subject: [PATCH] add debug logging to activation-job compiler split-outs Adds namespaced debug logging at key decision points in four compiler files that were newly split out from the (now deleted) compiler_activation_job_builder.go and compiler_yaml_main_job.go. - compiler_activation_permissions.go: app-token gate (add/skip), computed permission-scope count, write-command rejection. - compiler_activation_daily_aic.go: guardrail step build flags, dedicated app-token prepend, empty max-daily-ai-credits env skip. - compiler_yaml_post_agent.go: artifact-path collection count, post-agent phase entry, unified upload path count. - compiler_activation_outputs.go: remove-label vs get-label branch. All reuse the existing package-level compilerActivationJobLog / compilerYamlLog loggers (no new imports or vars). Log arguments are side-effect-free (field reads, len(), pointer nil checks). Co-Authored-By: Claude Opus 4.8 (1M context) --- pkg/workflow/compiler_activation_daily_aic.go | 3 +++ pkg/workflow/compiler_activation_outputs.go | 2 ++ pkg/workflow/compiler_activation_permissions.go | 4 ++++ pkg/workflow/compiler_yaml_post_agent.go | 3 +++ 4 files changed, 12 insertions(+) diff --git a/pkg/workflow/compiler_activation_daily_aic.go b/pkg/workflow/compiler_activation_daily_aic.go index c3f7d113ee1..c9315b6c633 100644 --- a/pkg/workflow/compiler_activation_daily_aic.go +++ b/pkg/workflow/compiler_activation_daily_aic.go @@ -91,10 +91,12 @@ func (c *Compiler) resolveDailyAICToken(data *WorkflowData) string { } func (c *Compiler) buildActivationDailyAICGuardrailStep(data *WorkflowData) []string { + compilerActivationJobLog.Printf("Building daily AIC guardrail step: dedicated_app=%t, cache_enabled=%t", data.MaxDailyAICreditsGitHubApp != nil, data.WorkflowID != "") var steps []string // When a dedicated GitHub App is configured for the daily AIC guardrail, mint // its token first so the subsequent steps can reference it. if data.MaxDailyAICreditsGitHubApp != nil { + compilerActivationJobLog.Print("Prepending dedicated daily-AIC app-token mint step") steps = append(steps, c.buildDailyAICAppTokenMintStep(data.MaxDailyAICreditsGitHubApp)...) } // Prepend cache restore step so cached AIC values from prior runs are available @@ -163,6 +165,7 @@ func buildDailyAICActivationJobEnv(data *WorkflowData) map[string]string { } value := strings.TrimSpace(*data.MaxDailyAICredits) if value == "" { + compilerActivationJobLog.Print("Daily AIC guardrail configured but max-daily-ai-credits value is empty; omitting activation job env") return nil } if isExpression(value) { diff --git a/pkg/workflow/compiler_activation_outputs.go b/pkg/workflow/compiler_activation_outputs.go index e137fa434ed..be1c294ea19 100644 --- a/pkg/workflow/compiler_activation_outputs.go +++ b/pkg/workflow/compiler_activation_outputs.go @@ -43,6 +43,7 @@ func (c *Compiler) addActivationCommandAndLabelOutputs(ctx *activationJobBuildCo } if ctx.shouldRemoveLabel { + compilerActivationJobLog.Print("Adding remove-trigger-label step for label-command workflow") ctx.steps = append(ctx.steps, " - name: Remove trigger label\n") ctx.steps = append(ctx.steps, fmt.Sprintf(" id: %s\n", constants.RemoveTriggerLabelStepID)) ctx.steps = append(ctx.steps, fmt.Sprintf(" uses: %s\n", getCachedActionPin("actions/github-script", data))) @@ -61,6 +62,7 @@ func (c *Compiler) addActivationCommandAndLabelOutputs(ctx *activationJobBuildCo ctx.steps = append(ctx.steps, generateGitHubScriptWithRequire("remove_trigger_label.cjs")) ctx.outputs["label_command"] = fmt.Sprintf("${{ steps.%s.outputs.label_name }}", constants.RemoveTriggerLabelStepID) } else if ctx.hasLabelCommand { + compilerActivationJobLog.Print("Adding get-trigger-label step for label-command workflow") ctx.steps = append(ctx.steps, " - name: Get trigger label name\n") ctx.steps = append(ctx.steps, fmt.Sprintf(" id: %s\n", constants.GetTriggerLabelStepID)) ctx.steps = append(ctx.steps, fmt.Sprintf(" uses: %s\n", getCachedActionPin("actions/github-script", data))) diff --git a/pkg/workflow/compiler_activation_permissions.go b/pkg/workflow/compiler_activation_permissions.go index 7ebeb1f458f..7a2ac698421 100644 --- a/pkg/workflow/compiler_activation_permissions.go +++ b/pkg/workflow/compiler_activation_permissions.go @@ -10,8 +10,10 @@ import ( func (c *Compiler) maybeAddActivationAppTokenMintStep(ctx *activationJobBuildContext) { if !activationJobNeedsAppToken(ctx) { + compilerActivationJobLog.Print("Skipping activation app-token mint step (no reaction/status-comment/label/access/guardrail trigger requires it)") return } + compilerActivationJobLog.Print("Adding activation app-token mint step") appPerms := buildActivationAppTokenPermissions(ctx) ctx.steps = append(ctx.steps, c.buildActivationAppTokenMintStep(ctx.data.ActivationGitHubApp, appPerms)...) ctx.outputs["activation_app_token_minting_failed"] = "${{ steps.activation-app-token.outcome == 'failure' }}" @@ -126,6 +128,7 @@ func (c *Compiler) buildActivationPermissions(ctx *activationJobBuildContext) (s if err := c.addActivationScriptPermissions(permsMap, ctx); err != nil { return "", err } + compilerActivationJobLog.Printf("Computed activation job permissions across %d scope(s)", len(permsMap)) return NewPermissionsFromMap(permsMap).RenderToYAML(), nil } @@ -232,6 +235,7 @@ func (c *Compiler) addActivationScriptPermissions(permsMap map[PermissionScope]P return err } if len(writeCmds) > 0 { + compilerActivationJobLog.Printf("Rejecting activation job: %d write gh command(s) detected in activation step scripts", len(writeCmds)) return fmt.Errorf( "activation job uses write gh command(s) [%s]; write operations are not permitted in activation job steps because the activation job runs with read-only permissions. Move write operations to the agent job steps or use safe-outputs. See: https://github.github.com/gh-aw/reference/safe-outputs/", strings.Join(writeCmds, ", "), diff --git a/pkg/workflow/compiler_yaml_post_agent.go b/pkg/workflow/compiler_yaml_post_agent.go index 03c03208d63..f16eaf73865 100644 --- a/pkg/workflow/compiler_yaml_post_agent.go +++ b/pkg/workflow/compiler_yaml_post_agent.go @@ -119,6 +119,7 @@ func (c *Compiler) collectArtifactPaths(data *WorkflowData, engine CodingAgentEn paths = rewriteTmpGhAwPathsForArcDind(paths) } + compilerYamlLog.Printf("Collected %d artifact path(s) for unified agent upload", len(paths)) return paths } @@ -171,6 +172,7 @@ func (c *Compiler) generateSummarySteps(yaml *strings.Builder, data *WorkflowDat // post-steps, the unified artifact upload, token invalidation, dev-mode actions restore, // and step-order validation. func (c *Compiler) generatePostAgentCollectionAndUpload(yaml *strings.Builder, data *WorkflowData, engine CodingAgentEngine, artifactPaths []string, logFileFull string, checkoutMgr *CheckoutManager) error { + compilerYamlLog.Print("Generating post-agent collection and upload steps") // Generate engine output cleanup step so workspace files are removed after collection. // The engine-declared output paths are gathered by collectArtifactPaths below. if len(getEngineArtifactPaths(engine)) > 0 { @@ -243,6 +245,7 @@ func (c *Compiler) generatePostAgentCollectionAndUpload(yaml *strings.Builder, d // Generate single unified artifact upload with all collected paths. // In workflow_call context, apply the per-invocation prefix to avoid name clashes. agentArtifactPrefix := artifactPrefixExprForDownstreamJob(data) + compilerYamlLog.Printf("Emitting unified agent artifact upload with %d path(s)", len(artifactPaths)) c.generateUnifiedArtifactUpload(yaml, artifactPaths, agentArtifactPrefix) // In dev mode the setup action is referenced via a local path (./actions/setup), so its files