[log] Add debug logging to activation-job compiler split-outs

pkg/workflow/compiler_activation_daily_aic.go

@@ -91,10 +91,12 @@ func (c *Compiler) resolveDailyAICToken(data *WorkflowData) string {
 }
 
 func (c *Compiler) buildActivationDailyAICGuardrailStep(data *WorkflowData) []string {
+	compilerActivationJobLog.Printf("Building daily AIC guardrail step: dedicated_app=%t, cache_enabled=%t", data.MaxDailyAICreditsGitHubApp != nil, data.WorkflowID != "")
 	var steps []string
 	// When a dedicated GitHub App is configured for the daily AIC guardrail, mint
 	// its token first so the subsequent steps can reference it.
 	if data.MaxDailyAICreditsGitHubApp != nil {
+		compilerActivationJobLog.Print("Prepending dedicated daily-AIC app-token mint step")
 		steps = append(steps, c.buildDailyAICAppTokenMintStep(data.MaxDailyAICreditsGitHubApp)...)
 	}
 	// Prepend cache restore step so cached AIC values from prior runs are available
@@ -163,6 +165,7 @@ func buildDailyAICActivationJobEnv(data *WorkflowData) map[string]string {
 	}
 	value := strings.TrimSpace(*data.MaxDailyAICredits)
 	if value == "" {
+		compilerActivationJobLog.Print("Daily AIC guardrail configured but max-daily-ai-credits value is empty; omitting activation job env")
 		return nil
 	}
 	if isExpression(value) {

pkg/workflow/compiler_activation_outputs.go

@@ -43,6 +43,7 @@ func (c *Compiler) addActivationCommandAndLabelOutputs(ctx *activationJobBuildCo
 	}
 
 	if ctx.shouldRemoveLabel {
+		compilerActivationJobLog.Print("Adding remove-trigger-label step for label-command workflow")
 		ctx.steps = append(ctx.steps, "      - name: Remove trigger label\n")
 		ctx.steps = append(ctx.steps, fmt.Sprintf("        id: %s\n", constants.RemoveTriggerLabelStepID))
 		ctx.steps = append(ctx.steps, fmt.Sprintf("        uses: %s\n", getCachedActionPin("actions/github-script", data)))
@@ -61,6 +62,7 @@ func (c *Compiler) addActivationCommandAndLabelOutputs(ctx *activationJobBuildCo
 		ctx.steps = append(ctx.steps, generateGitHubScriptWithRequire("remove_trigger_label.cjs"))
 		ctx.outputs["label_command"] = fmt.Sprintf("${{ steps.%s.outputs.label_name }}", constants.RemoveTriggerLabelStepID)
 	} else if ctx.hasLabelCommand {
+		compilerActivationJobLog.Print("Adding get-trigger-label step for label-command workflow")
 		ctx.steps = append(ctx.steps, "      - name: Get trigger label name\n")
 		ctx.steps = append(ctx.steps, fmt.Sprintf("        id: %s\n", constants.GetTriggerLabelStepID))
 		ctx.steps = append(ctx.steps, fmt.Sprintf("        uses: %s\n", getCachedActionPin("actions/github-script", data)))

pkg/workflow/compiler_activation_permissions.go

@@ -10,8 +10,10 @@ import (
 
 func (c *Compiler) maybeAddActivationAppTokenMintStep(ctx *activationJobBuildContext) {
 	if !activationJobNeedsAppToken(ctx) {
+		compilerActivationJobLog.Print("Skipping activation app-token mint step (no reaction/status-comment/label/access/guardrail trigger requires it)")
 		return
 	}
+	compilerActivationJobLog.Print("Adding activation app-token mint step")
 	appPerms := buildActivationAppTokenPermissions(ctx)
 	ctx.steps = append(ctx.steps, c.buildActivationAppTokenMintStep(ctx.data.ActivationGitHubApp, appPerms)...)
 	ctx.outputs["activation_app_token_minting_failed"] = "${{ steps.activation-app-token.outcome == 'failure' }}"
@@ -126,6 +128,7 @@ func (c *Compiler) buildActivationPermissions(ctx *activationJobBuildContext) (s
 	if err := c.addActivationScriptPermissions(permsMap, ctx); err != nil {
 		return "", err
 	}
+	compilerActivationJobLog.Printf("Computed activation job permissions across %d scope(s)", len(permsMap))
 	return NewPermissionsFromMap(permsMap).RenderToYAML(), nil
 }
 
@@ -232,6 +235,7 @@ func (c *Compiler) addActivationScriptPermissions(permsMap map[PermissionScope]P
 			return err
 		}
 		if len(writeCmds) > 0 {
+			compilerActivationJobLog.Printf("Rejecting activation job: %d write gh command(s) detected in activation step scripts", len(writeCmds))
 			return fmt.Errorf(
 				"activation job uses write gh command(s) [%s]; write operations are not permitted in activation job steps because the activation job runs with read-only permissions. Move write operations to the agent job steps or use safe-outputs. See: https://github.github.com/gh-aw/reference/safe-outputs/",
 				strings.Join(writeCmds, ", "),

pkg/workflow/compiler_yaml_post_agent.go

@@ -119,6 +119,7 @@ func (c *Compiler) collectArtifactPaths(data *WorkflowData, engine CodingAgentEn
 		paths = rewriteTmpGhAwPathsForArcDind(paths)
 	}
 
+	compilerYamlLog.Printf("Collected %d artifact path(s) for unified agent upload", len(paths))
 	return paths
 }
 
@@ -171,6 +172,7 @@ func (c *Compiler) generateSummarySteps(yaml *strings.Builder, data *WorkflowDat
 // post-steps, the unified artifact upload, token invalidation, dev-mode actions restore,
 // and step-order validation.
 func (c *Compiler) generatePostAgentCollectionAndUpload(yaml *strings.Builder, data *WorkflowData, engine CodingAgentEngine, artifactPaths []string, logFileFull string, checkoutMgr *CheckoutManager) error {
+	compilerYamlLog.Print("Generating post-agent collection and upload steps")
 	// Generate engine output cleanup step so workspace files are removed after collection.
 	// The engine-declared output paths are gathered by collectArtifactPaths below.
 	if len(getEngineArtifactPaths(engine)) > 0 {
@@ -243,6 +245,7 @@ func (c *Compiler) generatePostAgentCollectionAndUpload(yaml *strings.Builder, d
 	// Generate single unified artifact upload with all collected paths.
 	// In workflow_call context, apply the per-invocation prefix to avoid name clashes.
 	agentArtifactPrefix := artifactPrefixExprForDownstreamJob(data)
+	compilerYamlLog.Printf("Emitting unified agent artifact upload with %d path(s)", len(artifactPaths))
 	c.generateUnifiedArtifactUpload(yaml, artifactPaths, agentArtifactPrefix)
 
 	// In dev mode the setup action is referenced via a local path (./actions/setup), so its files