From bed98d8dce38cd4feb3fcc4dc5107b6e761b5ee1 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 15 Jul 2026 11:15:57 +0000
Subject: [PATCH 1/4] Initial plan


From 6fcb42b2c951335d289a0ad92801cb85112a4867 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 15 Jul 2026 11:32:31 +0000
Subject: [PATCH 2/4] chore: make inline/dynamic logger.New calls greppable in
 workflow package

- Lift 3 inline logger.New calls in closeEntityRegistry to package-level
  vars (logCloseIssue, logClosePullRequest, logCloseDiscussion)
- Inline all newValidationLogger(domain) call sites (~48 files) with direct
  logger.New("workflow:domain_validation") string literals
- Fix doubled _validation suffix bug in push_to_pull_request_branch_validation.go
- Remove newValidationLogger helper function (no remaining callers)

Fixes #45509

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 pkg/workflow/agent_validation.go                    |  3 ++-
 pkg/workflow/call_workflow_validation.go            |  3 ++-
 pkg/workflow/checkout_path_validation.go            |  4 +++-
 pkg/workflow/close_entity_helpers.go                | 10 +++++++---
 pkg/workflow/compiler_filters_validation.go         |  4 +++-
 pkg/workflow/concurrency_validation.go              |  4 +++-
 pkg/workflow/dangerous_permissions_validation.go    |  4 +++-
 pkg/workflow/dispatch_repository_validation.go      |  4 +++-
 pkg/workflow/dispatch_workflow_validation.go        |  3 ++-
 pkg/workflow/docker_validation.go                   |  3 ++-
 pkg/workflow/engine_validation.go                   |  3 ++-
 pkg/workflow/event_validation.go                    |  3 ++-
 pkg/workflow/expression_safety_validation.go        |  3 ++-
 .../expression_secrets_serialization_validation.go  |  3 ++-
 pkg/workflow/features_validation.go                 |  3 ++-
 pkg/workflow/firewall_validation.go                 |  4 +++-
 pkg/workflow/github_app_permissions_validation.go   |  3 ++-
 pkg/workflow/imported_steps_validation.go           |  3 ++-
 pkg/workflow/labels_validation.go                   |  4 +++-
 pkg/workflow/mcp_config_validation.go               |  3 ++-
 pkg/workflow/mcp_mount_validation.go                |  3 ++-
 pkg/workflow/mcp_scripts_dependencies_validation.go |  3 ++-
 pkg/workflow/model_alias_validation.go              |  3 ++-
 pkg/workflow/network_firewall_validation.go         |  3 ++-
 pkg/workflow/npm_validation.go                      |  3 ++-
 pkg/workflow/permissions_toolset_data.go            |  4 +++-
 pkg/workflow/pip_validation.go                      |  3 ++-
 pkg/workflow/pull_request_target_validation.go      |  4 +++-
 .../push_to_pull_request_branch_validation.go       |  3 ++-
 pkg/workflow/repo_memory_validation.go              |  4 +++-
 pkg/workflow/repository_features_validation.go      |  3 ++-
 pkg/workflow/run_install_scripts_validation.go      |  3 ++-
 pkg/workflow/runs_on_validation.go                  |  4 +++-
 pkg/workflow/runtime_validation.go                  |  3 ++-
 .../safe_outputs_allowed_labels_validation.go       |  4 +++-
 pkg/workflow/safe_outputs_max_validation.go         |  3 ++-
 ...safe_outputs_steps_shell_expansion_validation.go |  3 ++-
 pkg/workflow/safe_outputs_validation.go             |  9 +++++----
 pkg/workflow/samples_validation.go                  |  3 ++-
 pkg/workflow/sandbox_validation.go                  |  3 ++-
 pkg/workflow/schema_validation.go                   |  4 +++-
 pkg/workflow/secrets_validation.go                  |  4 +++-
 pkg/workflow/step_order_validation.go               |  3 ++-
 pkg/workflow/step_shell_validator.go                |  3 ++-
 pkg/workflow/strict_mode_update_check_validation.go |  3 ++-
 pkg/workflow/strict_mode_validation.go              |  4 +++-
 pkg/workflow/template_injection_validation.go       |  4 +++-
 pkg/workflow/template_validation.go                 |  3 ++-
 pkg/workflow/tools_validation.go                    |  4 +++-
 pkg/workflow/validation_helpers.go                  | 13 -------------
 50 files changed, 123 insertions(+), 67 deletions(-)

diff --git a/pkg/workflow/agent_validation.go b/pkg/workflow/agent_validation.go
index fce63bbc64f..d46086bdcfa 100644
--- a/pkg/workflow/agent_validation.go
+++ b/pkg/workflow/agent_validation.go
@@ -54,10 +54,11 @@ import (
 
 	"github.com/github/gh-aw/pkg/console"
 	"github.com/github/gh-aw/pkg/constants"
+	"github.com/github/gh-aw/pkg/logger"
 	"github.com/goccy/go-yaml"
 )
 
-var agentValidationLog = newValidationLogger("agent")
+var agentValidationLog = logger.New("workflow:agent_validation")
 
 // validateAgentFile validates that the custom agent file specified in imports exists
 func (c *Compiler) validateAgentFile(workflowData *WorkflowData, markdownPath string) error {
diff --git a/pkg/workflow/call_workflow_validation.go b/pkg/workflow/call_workflow_validation.go
index 3b4b03c09bc..fe1403eb4de 100644
--- a/pkg/workflow/call_workflow_validation.go
+++ b/pkg/workflow/call_workflow_validation.go
@@ -7,11 +7,12 @@ import (
 	"path/filepath"
 
 	"github.com/github/gh-aw/pkg/constants"
+	"github.com/github/gh-aw/pkg/logger"
 	"github.com/github/gh-aw/pkg/parser"
 	"github.com/goccy/go-yaml"
 )
 
-var callWorkflowValidationLog = newValidationLogger("call_workflow")
+var callWorkflowValidationLog = logger.New("workflow:call_workflow_validation")
 
 // validateCallWorkflow validates that the call-workflow configuration is correct.
 // It checks that each workflow exists, declares a workflow_call trigger, and is not
diff --git a/pkg/workflow/checkout_path_validation.go b/pkg/workflow/checkout_path_validation.go
index 23e7b66d0c4..f0bea5b498a 100644
--- a/pkg/workflow/checkout_path_validation.go
+++ b/pkg/workflow/checkout_path_validation.go
@@ -4,9 +4,11 @@ import (
 	"fmt"
 	"os"
 	"strings"
+
+	"github.com/github/gh-aw/pkg/logger"
 )
 
-var checkoutPathValidationLog = newValidationLogger("checkout_path")
+var checkoutPathValidationLog = logger.New("workflow:checkout_path_validation")
 
 // deriveAndWarnCrossRepoCheckoutPaths emits warnings for cross-repository
 // checkout entries that have no explicit path: field, and auto-derives a path from
diff --git a/pkg/workflow/close_entity_helpers.go b/pkg/workflow/close_entity_helpers.go
index c9a61cab46f..99daa1744ed 100644
--- a/pkg/workflow/close_entity_helpers.go
+++ b/pkg/workflow/close_entity_helpers.go
@@ -156,6 +156,10 @@ type closeEntityDefinition struct {
 	Logger           *logger.Logger
 }
 
+var logCloseIssue = logger.New("workflow:close_issue")
+var logClosePullRequest = logger.New("workflow:close_pull_request")
+var logCloseDiscussion = logger.New("workflow:close_discussion")
+
 // closeEntityRegistry holds all close entity definitions
 var closeEntityRegistry = []closeEntityDefinition{
 	{
@@ -169,7 +173,7 @@ var closeEntityRegistry = []closeEntityDefinition{
 		EventNumberPath1: "github.event.issue.number",
 		EventNumberPath2: "github.event.comment.issue.number",
 		PermissionsFunc:  NewPermissionsContentsReadIssuesWrite,
-		Logger:           logger.New("workflow:close_issue"),
+		Logger:           logCloseIssue,
 	},
 	{
 		EntityType:       CloseEntityPullRequest,
@@ -182,7 +186,7 @@ var closeEntityRegistry = []closeEntityDefinition{
 		EventNumberPath1: "github.event.pull_request.number",
 		EventNumberPath2: "github.event.comment.pull_request.number",
 		PermissionsFunc:  NewPermissionsContentsReadPRWrite,
-		Logger:           logger.New("workflow:close_pull_request"),
+		Logger:           logClosePullRequest,
 	},
 	{
 		EntityType:       CloseEntityDiscussion,
@@ -195,7 +199,7 @@ var closeEntityRegistry = []closeEntityDefinition{
 		EventNumberPath1: "github.event.discussion.number",
 		EventNumberPath2: "github.event.comment.discussion.number",
 		PermissionsFunc:  NewPermissionsContentsReadDiscussionsWrite,
-		Logger:           logger.New("workflow:close_discussion"),
+		Logger:           logCloseDiscussion,
 	},
 }
 
diff --git a/pkg/workflow/compiler_filters_validation.go b/pkg/workflow/compiler_filters_validation.go
index 99072da193a..c68980a0d6e 100644
--- a/pkg/workflow/compiler_filters_validation.go
+++ b/pkg/workflow/compiler_filters_validation.go
@@ -48,9 +48,11 @@ package workflow
 import (
 	"fmt"
 	"strings"
+
+	"github.com/github/gh-aw/pkg/logger"
 )
 
-var filterValidationLog = newValidationLogger("filter")
+var filterValidationLog = logger.New("workflow:filter_validation")
 
 // ValidateEventFilters checks for GitHub Actions filter mutual exclusivity rules
 func ValidateEventFilters(frontmatter map[string]any) error {
diff --git a/pkg/workflow/concurrency_validation.go b/pkg/workflow/concurrency_validation.go
index 0b6664a9ea5..8532a4edab1 100644
--- a/pkg/workflow/concurrency_validation.go
+++ b/pkg/workflow/concurrency_validation.go
@@ -30,9 +30,11 @@ package workflow
 import (
 	"regexp"
 	"strings"
+
+	"github.com/github/gh-aw/pkg/logger"
 )
 
-var concurrencyValidationLog = newValidationLogger("concurrency")
+var concurrencyValidationLog = logger.New("workflow:concurrency_validation")
 
 var (
 	concurrencyGroupPattern                = regexp.MustCompile(`(?m)^\s*group:\s*["']?([^"'\n]+?)["']?\s*$`)
diff --git a/pkg/workflow/dangerous_permissions_validation.go b/pkg/workflow/dangerous_permissions_validation.go
index 5f85387e1b9..af63243c388 100644
--- a/pkg/workflow/dangerous_permissions_validation.go
+++ b/pkg/workflow/dangerous_permissions_validation.go
@@ -4,9 +4,11 @@ import (
 	"errors"
 	"fmt"
 	"strings"
+
+	"github.com/github/gh-aw/pkg/logger"
 )
 
-var dangerousPermissionsLog = newValidationLogger("dangerous_permissions")
+var dangerousPermissionsLog = logger.New("workflow:dangerous_permissions_validation")
 
 // validateDangerousPermissions validates that write permissions are not used.
 //
diff --git a/pkg/workflow/dispatch_repository_validation.go b/pkg/workflow/dispatch_repository_validation.go
index 2530c6db9e1..63b9d9ff9d1 100644
--- a/pkg/workflow/dispatch_repository_validation.go
+++ b/pkg/workflow/dispatch_repository_validation.go
@@ -5,9 +5,11 @@ import (
 	"fmt"
 	"regexp"
 	"strings"
+
+	"github.com/github/gh-aw/pkg/logger"
 )
 
-var dispatchRepositoryValidationLog = newValidationLogger("dispatch_repository")
+var dispatchRepositoryValidationLog = logger.New("workflow:dispatch_repository_validation")
 
 // repoSlugPattern matches a valid owner/repo GitHub repository slug.
 // Owner names: alphanumerics and hyphens (no dots - GitHub usernames/org names cannot have dots).
diff --git a/pkg/workflow/dispatch_workflow_validation.go b/pkg/workflow/dispatch_workflow_validation.go
index 72e9ba839ac..b8a641cb138 100644
--- a/pkg/workflow/dispatch_workflow_validation.go
+++ b/pkg/workflow/dispatch_workflow_validation.go
@@ -8,11 +8,12 @@ import (
 	"strings"
 
 	"github.com/github/gh-aw/pkg/constants"
+	"github.com/github/gh-aw/pkg/logger"
 	"github.com/github/gh-aw/pkg/repoutil"
 	"github.com/goccy/go-yaml"
 )
 
-var dispatchWorkflowValidationLog = newValidationLogger("dispatch_workflow")
+var dispatchWorkflowValidationLog = logger.New("workflow:dispatch_workflow_validation")
 
 // validateDispatchWorkflow validates that the dispatch-workflow configuration is correct
 func (c *Compiler) validateDispatchWorkflow(data *WorkflowData, workflowPath string) error {
diff --git a/pkg/workflow/docker_validation.go b/pkg/workflow/docker_validation.go
index 808e9f9c507..c3009eb2d10 100644
--- a/pkg/workflow/docker_validation.go
+++ b/pkg/workflow/docker_validation.go
@@ -49,10 +49,11 @@ import (
 	"time"
 
 	"github.com/github/gh-aw/pkg/constants"
+	"github.com/github/gh-aw/pkg/logger"
 	"github.com/github/gh-aw/pkg/syncutil"
 )
 
-var dockerValidationLog = newValidationLogger("docker")
+var dockerValidationLog = logger.New("workflow:docker_validation")
 
 // dockerDaemonCheckTimeout is how long to wait for `docker info` to respond.
 // If the daemon isn't running, this prevents long hangs on every docker command.
diff --git a/pkg/workflow/engine_validation.go b/pkg/workflow/engine_validation.go
index 9f3c273d743..fccfddb71af 100644
--- a/pkg/workflow/engine_validation.go
+++ b/pkg/workflow/engine_validation.go
@@ -45,10 +45,11 @@ import (
 
 	"github.com/github/gh-aw/pkg/console"
 	"github.com/github/gh-aw/pkg/constants"
+	"github.com/github/gh-aw/pkg/logger"
 	"github.com/github/gh-aw/pkg/parser"
 )
 
-var engineValidationLog = newValidationLogger("engine")
+var engineValidationLog = logger.New("workflow:engine_validation")
 var safeHarnessScriptPattern = regexp.MustCompile(`^[A-Za-z0-9_][A-Za-z0-9._-]*$`)
 
 // safeSDKDriverSegmentPattern allows path segments that may start with a dot followed by an
diff --git a/pkg/workflow/event_validation.go b/pkg/workflow/event_validation.go
index bd769c3e429..7480e2c26d8 100644
--- a/pkg/workflow/event_validation.go
+++ b/pkg/workflow/event_validation.go
@@ -31,10 +31,11 @@ import (
 	"slices"
 	"strings"
 
+	"github.com/github/gh-aw/pkg/logger"
 	"github.com/github/gh-aw/pkg/stringutil"
 )
 
-var eventValidationLog = newValidationLogger("event")
+var eventValidationLog = logger.New("workflow:event_validation")
 
 // validGitHubEventTypes is the list of all supported GitHub Actions event types.
 // Source: https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows
diff --git a/pkg/workflow/expression_safety_validation.go b/pkg/workflow/expression_safety_validation.go
index 62594050f2e..8579d57538a 100644
--- a/pkg/workflow/expression_safety_validation.go
+++ b/pkg/workflow/expression_safety_validation.go
@@ -12,10 +12,11 @@ import (
 	"strings"
 
 	"github.com/github/gh-aw/pkg/constants"
+	"github.com/github/gh-aw/pkg/logger"
 	"github.com/github/gh-aw/pkg/parser"
 )
 
-var expressionValidationLog = newValidationLogger("expression")
+var expressionValidationLog = logger.New("workflow:expression_validation")
 
 // maxFuzzyMatchSuggestions is the maximum number of similar expressions to suggest
 // when an unauthorized expression is found
diff --git a/pkg/workflow/expression_secrets_serialization_validation.go b/pkg/workflow/expression_secrets_serialization_validation.go
index 4fc0e774250..0670a2ea9ad 100644
--- a/pkg/workflow/expression_secrets_serialization_validation.go
+++ b/pkg/workflow/expression_secrets_serialization_validation.go
@@ -25,10 +25,11 @@ import (
 	"strings"
 
 	"github.com/github/gh-aw/pkg/console"
+	"github.com/github/gh-aw/pkg/logger"
 	"github.com/github/gh-aw/pkg/sliceutil"
 )
 
-var expressionSecretsSerializationLog = newValidationLogger("expression_secrets_serialization")
+var expressionSecretsSerializationLog = logger.New("workflow:expression_secrets_serialization_validation")
 
 // secretsSerializationPattern matches function calls that pass the entire secrets
 // context as an argument, e.g. toJSON(secrets).
diff --git a/pkg/workflow/features_validation.go b/pkg/workflow/features_validation.go
index a4a19599253..fc77ec66f66 100644
--- a/pkg/workflow/features_validation.go
+++ b/pkg/workflow/features_validation.go
@@ -26,10 +26,11 @@ import (
 	"fmt"
 
 	"github.com/github/gh-aw/pkg/gitutil"
+	"github.com/github/gh-aw/pkg/logger"
 	"github.com/github/gh-aw/pkg/semverutil"
 )
 
-var featuresValidationLog = newValidationLogger("features")
+var featuresValidationLog = logger.New("workflow:features_validation")
 
 // validateFeatures validates all feature flags in the workflow data
 func validateFeatures(data *WorkflowData) error {
diff --git a/pkg/workflow/firewall_validation.go b/pkg/workflow/firewall_validation.go
index 333146a9055..d41e78c8416 100644
--- a/pkg/workflow/firewall_validation.go
+++ b/pkg/workflow/firewall_validation.go
@@ -13,9 +13,11 @@ package workflow
 import (
 	"fmt"
 	"slices"
+
+	"github.com/github/gh-aw/pkg/logger"
 )
 
-var firewallValidationLog = newValidationLogger("firewall")
+var firewallValidationLog = logger.New("workflow:firewall_validation")
 
 // validateFirewallConfig validates firewall configuration including log-level
 func (c *Compiler) validateFirewallConfig(workflowData *WorkflowData) error {
diff --git a/pkg/workflow/github_app_permissions_validation.go b/pkg/workflow/github_app_permissions_validation.go
index 0d609048118..a288f3e3e59 100644
--- a/pkg/workflow/github_app_permissions_validation.go
+++ b/pkg/workflow/github_app_permissions_validation.go
@@ -8,9 +8,10 @@ import (
 	"strings"
 
 	"github.com/github/gh-aw/pkg/console"
+	"github.com/github/gh-aw/pkg/logger"
 )
 
-var githubAppPermissionsLog = newValidationLogger("github_app_permissions")
+var githubAppPermissionsLog = logger.New("workflow:github_app_permissions_validation")
 
 // validateGitHubAppOnlyPermissions validates that when GitHub App-only permissions
 // are specified in the workflow, a GitHub App is configured somewhere in the workflow,
diff --git a/pkg/workflow/imported_steps_validation.go b/pkg/workflow/imported_steps_validation.go
index dc1acd73992..1677a94c46d 100644
--- a/pkg/workflow/imported_steps_validation.go
+++ b/pkg/workflow/imported_steps_validation.go
@@ -31,9 +31,10 @@ import (
 	"github.com/goccy/go-yaml"
 
 	"github.com/github/gh-aw/pkg/console"
+	"github.com/github/gh-aw/pkg/logger"
 )
 
-var importedStepsValidationLog = newValidationLogger("imported_steps")
+var importedStepsValidationLog = logger.New("workflow:imported_steps_validation")
 
 // validateImportedStepsNoAgenticSecrets validates that engine steps don't use agentic engine secrets
 // This validation is now a no-op since custom engine support has been removed.
diff --git a/pkg/workflow/labels_validation.go b/pkg/workflow/labels_validation.go
index 682dc94eae3..9331d73087e 100644
--- a/pkg/workflow/labels_validation.go
+++ b/pkg/workflow/labels_validation.go
@@ -3,9 +3,11 @@ package workflow
 import (
 	"fmt"
 	"strings"
+
+	"github.com/github/gh-aw/pkg/logger"
 )
 
-var labelsValidationLog = newValidationLogger("labels")
+var labelsValidationLog = logger.New("workflow:labels_validation")
 
 // validateLabels validates the labels field in the workflow frontmatter.
 // It checks that:
diff --git a/pkg/workflow/mcp_config_validation.go b/pkg/workflow/mcp_config_validation.go
index 5406fa02154..c9737890b1d 100644
--- a/pkg/workflow/mcp_config_validation.go
+++ b/pkg/workflow/mcp_config_validation.go
@@ -18,12 +18,13 @@ import (
 	"strings"
 
 	"github.com/github/gh-aw/pkg/constants"
+	"github.com/github/gh-aw/pkg/logger"
 	"github.com/github/gh-aw/pkg/parser"
 	"github.com/github/gh-aw/pkg/setutil"
 	"github.com/github/gh-aw/pkg/sliceutil"
 )
 
-var mcpValidationLog = newValidationLogger("mcp_config")
+var mcpValidationLog = logger.New("workflow:mcp_config_validation")
 
 // builtInToolNames is the canonical set of recognized built-in tool names for the tools: section.
 // Any key in tools: that is not in this set is a compile error.
diff --git a/pkg/workflow/mcp_mount_validation.go b/pkg/workflow/mcp_mount_validation.go
index 6d873b1534a..d1dfed55760 100644
--- a/pkg/workflow/mcp_mount_validation.go
+++ b/pkg/workflow/mcp_mount_validation.go
@@ -15,9 +15,10 @@ import (
 	"fmt"
 
 	"github.com/github/gh-aw/pkg/constants"
+	"github.com/github/gh-aw/pkg/logger"
 )
 
-var mcpMountValidationLog = newValidationLogger("mcp_mount")
+var mcpMountValidationLog = logger.New("workflow:mcp_mount_validation")
 
 // validateMCPMountsSyntax validates that mount strings in a custom MCP server config
 // follow the correct syntax required by MCP Gateway v0.1.5+.
diff --git a/pkg/workflow/mcp_scripts_dependencies_validation.go b/pkg/workflow/mcp_scripts_dependencies_validation.go
index 1d820e35586..4cccba0fe5e 100644
--- a/pkg/workflow/mcp_scripts_dependencies_validation.go
+++ b/pkg/workflow/mcp_scripts_dependencies_validation.go
@@ -8,6 +8,7 @@ import (
 	"regexp"
 	"strings"
 
+	"github.com/github/gh-aw/pkg/logger"
 	"github.com/github/gh-aw/pkg/semverutil"
 )
 
@@ -16,7 +17,7 @@ var (
 	shellPackageDependencyNameRE = regexp.MustCompile(`^[a-z0-9][a-z0-9+.-]*([:=][A-Za-z0-9.+~:-]+)?$`)
 )
 
-var mcpScriptDepsValidationLog = newValidationLogger("mcp_script_dependencies")
+var mcpScriptDepsValidationLog = logger.New("workflow:mcp_script_dependencies_validation")
 
 func (c *Compiler) validateMCPScriptDependencies(workflowData *WorkflowData) error {
 	if workflowData == nil || workflowData.MCPScripts == nil {
diff --git a/pkg/workflow/model_alias_validation.go b/pkg/workflow/model_alias_validation.go
index 886ffd416ce..41bbaf82148 100644
--- a/pkg/workflow/model_alias_validation.go
+++ b/pkg/workflow/model_alias_validation.go
@@ -29,11 +29,12 @@ import (
 	"sync"
 
 	"github.com/github/gh-aw/pkg/console"
+	"github.com/github/gh-aw/pkg/logger"
 	"github.com/github/gh-aw/pkg/setutil"
 	"github.com/github/gh-aw/pkg/sliceutil"
 )
 
-var modelAliasValidationLog = newValidationLogger("model_alias")
+var modelAliasValidationLog = logger.New("workflow:model_alias_validation")
 
 // builtinCycleCheckOnce caches the result of the first cycle-detection DFS over
 // the pure builtin alias map.  The builtins are a compile-time constant so cycles
diff --git a/pkg/workflow/network_firewall_validation.go b/pkg/workflow/network_firewall_validation.go
index 50ef6fb03e6..ced6c14c8b4 100644
--- a/pkg/workflow/network_firewall_validation.go
+++ b/pkg/workflow/network_firewall_validation.go
@@ -19,9 +19,10 @@ import (
 	"strings"
 
 	"github.com/github/gh-aw/pkg/constants"
+	"github.com/github/gh-aw/pkg/logger"
 )
 
-var networkFirewallValidationLog = newValidationLogger("network_firewall")
+var networkFirewallValidationLog = logger.New("workflow:network_firewall_validation")
 
 // validateNetworkFirewallConfig validates network firewall configuration dependencies
 // Returns an error if the configuration is invalid
diff --git a/pkg/workflow/npm_validation.go b/pkg/workflow/npm_validation.go
index fbb4b62fe46..32b16349054 100644
--- a/pkg/workflow/npm_validation.go
+++ b/pkg/workflow/npm_validation.go
@@ -40,9 +40,10 @@ import (
 	"strings"
 
 	"github.com/github/gh-aw/pkg/console"
+	"github.com/github/gh-aw/pkg/logger"
 )
 
-var npmValidationLog = newValidationLogger("npm")
+var npmValidationLog = logger.New("workflow:npm_validation")
 
 // validateNpxPackages validates that npx packages are available on npm registry
 func (c *Compiler) validateNpxPackages(workflowData *WorkflowData) error {
diff --git a/pkg/workflow/permissions_toolset_data.go b/pkg/workflow/permissions_toolset_data.go
index 73ea242b049..d99eb78560d 100644
--- a/pkg/workflow/permissions_toolset_data.go
+++ b/pkg/workflow/permissions_toolset_data.go
@@ -6,9 +6,11 @@ import (
 	"fmt"
 	"strings"
 	"sync"
+
+	"github.com/github/gh-aw/pkg/logger"
 )
 
-var permissionsValidationLog = newValidationLogger("permissions")
+var permissionsValidationLog = logger.New("workflow:permissions_validation")
 
 //go:embed data/github_toolsets_permissions.json
 var githubToolsetsPermissionsJSON []byte
diff --git a/pkg/workflow/pip_validation.go b/pkg/workflow/pip_validation.go
index 9b5ff40d953..a5ff24842fb 100644
--- a/pkg/workflow/pip_validation.go
+++ b/pkg/workflow/pip_validation.go
@@ -43,9 +43,10 @@ import (
 	"strings"
 
 	"github.com/github/gh-aw/pkg/console"
+	"github.com/github/gh-aw/pkg/logger"
 )
 
-var pipValidationLog = newValidationLogger("pip")
+var pipValidationLog = logger.New("workflow:pip_validation")
 
 // validatePythonPackagesWithPip is a generic helper that validates Python packages using pip index.
 // It accepts a package list, package type name for error messaging, and pip command to use.
diff --git a/pkg/workflow/pull_request_target_validation.go b/pkg/workflow/pull_request_target_validation.go
index e87db194679..b087c96ed96 100644
--- a/pkg/workflow/pull_request_target_validation.go
+++ b/pkg/workflow/pull_request_target_validation.go
@@ -40,9 +40,11 @@ import (
 	"strings"
 
 	"github.com/goccy/go-yaml"
+
+	"github.com/github/gh-aw/pkg/logger"
 )
 
-var pullRequestTargetLog = newValidationLogger("pull_request_target")
+var pullRequestTargetLog = logger.New("workflow:pull_request_target_validation")
 
 // [^{}]+? deliberately excludes brace characters so nested expression constructs
 // are never treated as a trusted literal allowlist match.
diff --git a/pkg/workflow/push_to_pull_request_branch_validation.go b/pkg/workflow/push_to_pull_request_branch_validation.go
index 5bed73e8b2e..b09434faee9 100644
--- a/pkg/workflow/push_to_pull_request_branch_validation.go
+++ b/pkg/workflow/push_to_pull_request_branch_validation.go
@@ -7,9 +7,10 @@ import (
 	"strings"
 
 	"github.com/github/gh-aw/pkg/console"
+	"github.com/github/gh-aw/pkg/logger"
 )
 
-var pushToPullRequestBranchValidationLog = newValidationLogger("push_to_pull_request_branch_validation")
+var pushToPullRequestBranchValidationLog = logger.New("workflow:push_to_pull_request_branch_validation")
 
 var fetchRepositoryVisibility = getRepositoryVisibilityForSlug
 
diff --git a/pkg/workflow/repo_memory_validation.go b/pkg/workflow/repo_memory_validation.go
index 282b09c7bae..47cea565f63 100644
--- a/pkg/workflow/repo_memory_validation.go
+++ b/pkg/workflow/repo_memory_validation.go
@@ -23,9 +23,11 @@ import (
 	"errors"
 	"fmt"
 	"strings"
+
+	"github.com/github/gh-aw/pkg/logger"
 )
 
-var repoMemValidationLog = newValidationLogger("repo_memory")
+var repoMemValidationLog = logger.New("workflow:repo_memory_validation")
 
 // validateBranchPrefix validates that the branch prefix meets requirements
 func validateBranchPrefix(prefix string) error {
diff --git a/pkg/workflow/repository_features_validation.go b/pkg/workflow/repository_features_validation.go
index 3f9d9a16071..81ad0923050 100644
--- a/pkg/workflow/repository_features_validation.go
+++ b/pkg/workflow/repository_features_validation.go
@@ -49,6 +49,7 @@ import (
 	"github.com/cli/go-gh/v2/pkg/api"
 	"github.com/cli/go-gh/v2/pkg/repository"
 	"github.com/github/gh-aw/pkg/console"
+	"github.com/github/gh-aw/pkg/logger"
 	"github.com/github/gh-aw/pkg/syncutil"
 )
 
@@ -56,7 +57,7 @@ import (
 // (mirrors the copilot-billing probe timeout).
 const repositoryFeaturesTimeout = 3 * time.Second
 
-var repositoryFeaturesLog = newValidationLogger("repository_features")
+var repositoryFeaturesLog = logger.New("workflow:repository_features_validation")
 
 // checkRepositoryHasDiscussionsQuery is a hardcoded static GraphQL query template used to check
 // if discussions are enabled for a repository. Declared as a named constant to make clear
diff --git a/pkg/workflow/run_install_scripts_validation.go b/pkg/workflow/run_install_scripts_validation.go
index 9eb1ebe73cb..f16e4028ebd 100644
--- a/pkg/workflow/run_install_scripts_validation.go
+++ b/pkg/workflow/run_install_scripts_validation.go
@@ -32,9 +32,10 @@ import (
 	"os"
 
 	"github.com/github/gh-aw/pkg/console"
+	"github.com/github/gh-aw/pkg/logger"
 )
 
-var runInstallScriptsLog = newValidationLogger("run_install_scripts")
+var runInstallScriptsLog = logger.New("workflow:run_install_scripts_validation")
 
 // resolveRunInstallScripts determines whether install scripts should be allowed based on
 // the workflow frontmatter and any merged settings from imported shared workflows.
diff --git a/pkg/workflow/runs_on_validation.go b/pkg/workflow/runs_on_validation.go
index ac94445f7e4..31fad63bf8c 100644
--- a/pkg/workflow/runs_on_validation.go
+++ b/pkg/workflow/runs_on_validation.go
@@ -26,9 +26,11 @@ package workflow
 import (
 	"fmt"
 	"strings"
+
+	"github.com/github/gh-aw/pkg/logger"
 )
 
-var runsOnValidationLog = newValidationLogger("runs_on")
+var runsOnValidationLog = logger.New("workflow:runs_on_validation")
 
 // macOSRunnerFAQURL is the URL to the FAQ entry explaining why macOS runners are not supported.
 const macOSRunnerFAQURL = "https://github.github.com/gh-aw/reference/faq/#why-are-macos-runners-not-supported"
diff --git a/pkg/workflow/runtime_validation.go b/pkg/workflow/runtime_validation.go
index ef01b4251ef..d41471198d8 100644
--- a/pkg/workflow/runtime_validation.go
+++ b/pkg/workflow/runtime_validation.go
@@ -46,9 +46,10 @@ import (
 	"strings"
 
 	"github.com/github/gh-aw/pkg/console"
+	"github.com/github/gh-aw/pkg/logger"
 )
 
-var runtimeValidationLog = newValidationLogger("runtime")
+var runtimeValidationLog = logger.New("workflow:runtime_validation")
 
 // validateExpressionSizes validates that no expression values in the generated YAML exceed GitHub Actions limits.
 //
diff --git a/pkg/workflow/safe_outputs_allowed_labels_validation.go b/pkg/workflow/safe_outputs_allowed_labels_validation.go
index a109944d8b2..bb66b303c5d 100644
--- a/pkg/workflow/safe_outputs_allowed_labels_validation.go
+++ b/pkg/workflow/safe_outputs_allowed_labels_validation.go
@@ -3,9 +3,11 @@ package workflow
 import (
 	"fmt"
 	"strings"
+
+	"github.com/github/gh-aw/pkg/logger"
 )
 
-var safeOutputsAllowedLabelsValidationLog = newValidationLogger("safe_outputs_allowed_labels")
+var safeOutputsAllowedLabelsValidationLog = logger.New("workflow:safe_outputs_allowed_labels_validation")
 
 // validateSafeOutputsAllowedLabelsGlobScope returns an error when any safe-outputs
 // allowed-labels field contains a bare "*" glob pattern (CTR-015).
diff --git a/pkg/workflow/safe_outputs_max_validation.go b/pkg/workflow/safe_outputs_max_validation.go
index cb3db60d7ea..1b2301ebc21 100644
--- a/pkg/workflow/safe_outputs_max_validation.go
+++ b/pkg/workflow/safe_outputs_max_validation.go
@@ -5,10 +5,11 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/github/gh-aw/pkg/logger"
 	"github.com/github/gh-aw/pkg/sliceutil"
 )
 
-var safeOutputsMaxValidationLog = newValidationLogger("safe_outputs_max")
+var safeOutputsMaxValidationLog = logger.New("workflow:safe_outputs_max_validation")
 
 // isInvalidMaxValue returns true if n is not a valid max field value.
 // Valid values are positive integers (n > 0) or -1 (unlimited).
diff --git a/pkg/workflow/safe_outputs_steps_shell_expansion_validation.go b/pkg/workflow/safe_outputs_steps_shell_expansion_validation.go
index 978264a843d..8d55385b41c 100644
--- a/pkg/workflow/safe_outputs_steps_shell_expansion_validation.go
+++ b/pkg/workflow/safe_outputs_steps_shell_expansion_validation.go
@@ -34,10 +34,11 @@ import (
 	"regexp"
 	"strings"
 
+	"github.com/github/gh-aw/pkg/logger"
 	"github.com/github/gh-aw/pkg/stringutil"
 )
 
-var safeOutputsStepsShellExpansionLog = newValidationLogger("safe_outputs_steps_shell_expansion")
+var safeOutputsStepsShellExpansionLog = logger.New("workflow:safe_outputs_steps_shell_expansion_validation")
 
 // shellExpansionPattern matches dangerous bash expansion constructs inside a run: script.
 //
diff --git a/pkg/workflow/safe_outputs_validation.go b/pkg/workflow/safe_outputs_validation.go
index f429ce0b504..44cad1349e6 100644
--- a/pkg/workflow/safe_outputs_validation.go
+++ b/pkg/workflow/safe_outputs_validation.go
@@ -4,10 +4,11 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/github/gh-aw/pkg/logger"
 	"github.com/github/gh-aw/pkg/stringutil"
 )
 
-var safeOutputsDomainsValidationLog = newValidationLogger("safe_outputs_domains")
+var safeOutputsDomainsValidationLog = logger.New("workflow:safe_outputs_domains_validation")
 
 const (
 	SafeOutputsURLsPolicyAllowedOnly         = "allowed-only"
@@ -68,7 +69,7 @@ func (c *Compiler) validateSafeOutputsAllowedDomains(config *SafeOutputsConfig)
 	return nil
 }
 
-var safeOutputsTargetValidationLog = newValidationLogger("safe_outputs_target")
+var safeOutputsTargetValidationLog = logger.New("workflow:safe_outputs_target_validation")
 
 // validateSafeOutputsTarget validates target fields in all safe-outputs configurations
 // Valid target values:
@@ -212,9 +213,9 @@ func validateTargetValue(configName, target string) error {
 	)
 }
 
-var safeOutputsAllowWorkflowsValidationLog = newValidationLogger("safe_outputs_allow_workflows")
+var safeOutputsAllowWorkflowsValidationLog = logger.New("workflow:safe_outputs_allow_workflows_validation")
 
-var safeOutputsMergePullRequestValidationLog = newValidationLogger("safe_outputs_merge_pull_request")
+var safeOutputsMergePullRequestValidationLog = logger.New("workflow:safe_outputs_merge_pull_request_validation")
 
 // validateSafeOutputsMergePullRequest validates merge-pull-request policy configuration.
 func validateSafeOutputsMergePullRequest(config *SafeOutputsConfig) error {
diff --git a/pkg/workflow/samples_validation.go b/pkg/workflow/samples_validation.go
index 9462b6c4a1d..5313262da51 100644
--- a/pkg/workflow/samples_validation.go
+++ b/pkg/workflow/samples_validation.go
@@ -8,11 +8,12 @@ import (
 	"strings"
 	"sync"
 
+	"github.com/github/gh-aw/pkg/logger"
 	"github.com/github/gh-aw/pkg/sliceutil"
 	"github.com/santhosh-tekuri/jsonschema/v6"
 )
 
-var samplesValidationLog = newValidationLogger("samples")
+var samplesValidationLog = logger.New("workflow:samples_validation")
 
 var sampleRuntimeExpressionPattern = regexp.MustCompile(`(?s)\$\{\{.*?\}\}`)
 
diff --git a/pkg/workflow/sandbox_validation.go b/pkg/workflow/sandbox_validation.go
index a45d57cc970..804590a2fa5 100644
--- a/pkg/workflow/sandbox_validation.go
+++ b/pkg/workflow/sandbox_validation.go
@@ -17,9 +17,10 @@ import (
 	"strings"
 
 	"github.com/github/gh-aw/pkg/constants"
+	"github.com/github/gh-aw/pkg/logger"
 )
 
-var sandboxValidationLog = newValidationLogger("sandbox")
+var sandboxValidationLog = logger.New("workflow:sandbox_validation")
 
 const minSandboxDisableJustificationLength = 20
 
diff --git a/pkg/workflow/schema_validation.go b/pkg/workflow/schema_validation.go
index 335e60d7a84..ecabee40e5a 100644
--- a/pkg/workflow/schema_validation.go
+++ b/pkg/workflow/schema_validation.go
@@ -46,9 +46,11 @@ import (
 
 	"github.com/goccy/go-yaml"
 	"github.com/santhosh-tekuri/jsonschema/v6"
+
+	"github.com/github/gh-aw/pkg/logger"
 )
 
-var schemaValidationLog = newValidationLogger("schema")
+var schemaValidationLog = logger.New("workflow:schema_validation")
 
 // Cached compiled schema to avoid recompiling on every validation
 var (
diff --git a/pkg/workflow/secrets_validation.go b/pkg/workflow/secrets_validation.go
index 50aee2ad6ba..75ae41b74e6 100644
--- a/pkg/workflow/secrets_validation.go
+++ b/pkg/workflow/secrets_validation.go
@@ -3,9 +3,11 @@ package workflow
 import (
 	"errors"
 	"regexp"
+
+	"github.com/github/gh-aw/pkg/logger"
 )
 
-var secretsValidationLog = newValidationLogger("secrets")
+var secretsValidationLog = logger.New("workflow:secrets_validation")
 
 // secretsExpressionPattern matches GitHub Actions secrets expressions for jobs.secrets validation.
 // Pattern matches: ${{ secrets.NAME }} or ${{ secrets.NAME1 || secrets.NAME2 }}
diff --git a/pkg/workflow/step_order_validation.go b/pkg/workflow/step_order_validation.go
index 9c3069194b6..b5b1b5dcefd 100644
--- a/pkg/workflow/step_order_validation.go
+++ b/pkg/workflow/step_order_validation.go
@@ -8,9 +8,10 @@ import (
 	"strings"
 
 	"github.com/github/gh-aw/pkg/constants"
+	"github.com/github/gh-aw/pkg/logger"
 )
 
-var stepOrderLog = newValidationLogger("step_order")
+var stepOrderLog = logger.New("workflow:step_order_validation")
 
 // StepType represents the type of step being generated
 type StepType int
diff --git a/pkg/workflow/step_shell_validator.go b/pkg/workflow/step_shell_validator.go
index 64075576927..b56d998aa85 100644
--- a/pkg/workflow/step_shell_validator.go
+++ b/pkg/workflow/step_shell_validator.go
@@ -17,9 +17,10 @@ import (
 	"strings"
 
 	"github.com/github/gh-aw/pkg/console"
+	"github.com/github/gh-aw/pkg/logger"
 )
 
-var stepShellValidatorLog = newValidationLogger("step_shell_validator")
+var stepShellValidatorLog = logger.New("workflow:step_shell_validator_validation")
 
 // ghCLIPattern detects invocations of the gh CLI in shell run scripts.
 // It matches "gh" as a command token at the start of a line (optionally
diff --git a/pkg/workflow/strict_mode_update_check_validation.go b/pkg/workflow/strict_mode_update_check_validation.go
index b6f47b289c0..965ca96bdc0 100644
--- a/pkg/workflow/strict_mode_update_check_validation.go
+++ b/pkg/workflow/strict_mode_update_check_validation.go
@@ -17,9 +17,10 @@ import (
 	"os"
 
 	"github.com/github/gh-aw/pkg/console"
+	"github.com/github/gh-aw/pkg/logger"
 )
 
-var updateCheckValidationLog = newValidationLogger("update_check")
+var updateCheckValidationLog = logger.New("workflow:update_check_validation")
 
 // validateUpdateCheck enforces the policy for the check-for-updates: false flag.
 // In strict mode it returns an error; in non-strict mode it emits a warning.
diff --git a/pkg/workflow/strict_mode_validation.go b/pkg/workflow/strict_mode_validation.go
index 12ad5f04cc5..acd55b13540 100644
--- a/pkg/workflow/strict_mode_validation.go
+++ b/pkg/workflow/strict_mode_validation.go
@@ -22,7 +22,9 @@
 
 package workflow
 
-var strictModeValidationLog = newValidationLogger("strict_mode")
+import "github.com/github/gh-aw/pkg/logger"
+
+var strictModeValidationLog = logger.New("workflow:strict_mode_validation")
 
 // validateStrictMode performs strict mode validations on the workflow
 //
diff --git a/pkg/workflow/template_injection_validation.go b/pkg/workflow/template_injection_validation.go
index bb858d8741f..d38578ab261 100644
--- a/pkg/workflow/template_injection_validation.go
+++ b/pkg/workflow/template_injection_validation.go
@@ -50,9 +50,11 @@ package workflow
 import (
 	"regexp"
 	"strings"
+
+	"github.com/github/gh-aw/pkg/logger"
 )
 
-var templateInjectionValidationLog = newValidationLogger("template_injection")
+var templateInjectionValidationLog = logger.New("workflow:template_injection_validation")
 
 // Pre-compiled regex patterns for template injection detection
 var (
diff --git a/pkg/workflow/template_validation.go b/pkg/workflow/template_validation.go
index c8e7b63fbc5..74c0d01a092 100644
--- a/pkg/workflow/template_validation.go
+++ b/pkg/workflow/template_validation.go
@@ -36,10 +36,11 @@ import (
 	"regexp"
 	"strings"
 
+	"github.com/github/gh-aw/pkg/logger"
 	"github.com/github/gh-aw/pkg/parser"
 )
 
-var templateValidationLog = newValidationLogger("template")
+var templateValidationLog = logger.New("workflow:template_validation")
 
 // Pre-compiled regexes for performance (avoid recompilation in hot paths)
 var (
diff --git a/pkg/workflow/tools_validation.go b/pkg/workflow/tools_validation.go
index ab249e1609c..e62fe456885 100644
--- a/pkg/workflow/tools_validation.go
+++ b/pkg/workflow/tools_validation.go
@@ -2,9 +2,11 @@ package workflow
 
 import (
 	"errors"
+
+	"github.com/github/gh-aw/pkg/logger"
 )
 
-var toolsValidationLog = newValidationLogger("tools")
+var toolsValidationLog = logger.New("workflow:tools_validation")
 
 // validateBashToolConfig validates that bash tool configuration is explicit (not nil/anonymous)
 func validateBashToolConfig(tools *Tools, workflowName string) error {
diff --git a/pkg/workflow/validation_helpers.go b/pkg/workflow/validation_helpers.go
index 82456553c66..e463bc89dc4 100644
--- a/pkg/workflow/validation_helpers.go
+++ b/pkg/workflow/validation_helpers.go
@@ -6,7 +6,6 @@
 //
 // # Available Helper Functions
 //
-//   - newValidationLogger() - Creates a standardized logger for a validation domain
 //   - validateIntRange() - Validates that an integer value is within a specified range
 //   - validateMountStringFormat() - Parses and validates a "source:dest:mode" mount string
 //   - containsTrigger() - Reports whether an 'on:' section includes a named trigger
@@ -36,18 +35,6 @@ import (
 
 var validationHelpersLog = logger.New("workflow:validation_helpers")
 
-// newValidationLogger creates a standardized logger for a validation domain.
-// It follows the naming convention "workflow:<domain>_validation" used across
-// all *_validation.go files.
-//
-// Example:
-//
-//	var engineValidationLog = newValidationLogger("engine")
-//	// produces logger named "workflow:engine_validation"
-func newValidationLogger(domain string) *logger.Logger {
-	return logger.New("workflow:" + domain + "_validation")
-}
-
 // validateIntRange validates that a value is within the specified inclusive range [min, max].
 // It returns an error if the value is outside the range, with a descriptive message
 // including the field name and the actual value.

From bd8faaebdab97b5cfe81ebad957ffb66c7d2eebf Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Wed, 15 Jul 2026 12:38:37 +0000
Subject: [PATCH 3/4] docs(adr): draft ADR-45721 for static logger namespace
 refactor

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 ...-logger-namespaces-statically-greppable.md | 48 +++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 docs/adr/45721-make-logger-namespaces-statically-greppable.md

diff --git a/docs/adr/45721-make-logger-namespaces-statically-greppable.md b/docs/adr/45721-make-logger-namespaces-statically-greppable.md
new file mode 100644
index 00000000000..be2479ad88e
--- /dev/null
+++ b/docs/adr/45721-make-logger-namespaces-statically-greppable.md
@@ -0,0 +1,48 @@
+# ADR-45721: Make Workflow Logger Namespaces Statically Greppable
+
+**Date**: 2026-07-15
+**Status**: Draft
+**Deciders**: pelikhan, copilot-swe-agent
+
+---
+
+### Context
+
+The `pkg/workflow` package contains ~48 validation files, each declaring a package-level logger variable. These loggers were created via a shared helper `newValidationLogger(domain string)` in `validation_helpers.go`, which constructed the namespace string at runtime via concatenation: `"workflow:" + domain + "_validation"`. This made it impossible to statically discover the complete set of logger namespaces using grep (e.g., `grep -rn 'logger.New'`) because the actual string values only existed at runtime. Additionally, `close_entity_helpers.go` embedded three `logger.New(...)` calls directly inside a composite slice literal, which also evaded static grep discovery. One call in `push_to_pull_request_branch_validation.go` carried a latent bug where `newValidationLogger("push_to_pull_request_branch_validation")` silently produced the doubly-suffixed namespace `"workflow:push_to_pull_request_branch_validation_validation"`.
+
+### Decision
+
+We will remove the `newValidationLogger()` helper and replace every call site with a direct `logger.New("workflow:<domain>_validation")` string literal. In `close_entity_helpers.go`, the three inline `logger.New(...)` calls inside the registry slice literal will be extracted into named package-level vars. The doubled-suffix bug will be corrected to `"workflow:push_to_pull_request_branch_validation"` as part of the same pass. No behaviour changes beyond that one bug fix are introduced.
+
+### Alternatives Considered
+
+#### Alternative 1: Keep `newValidationLogger()` and add a static analysis lint rule
+
+The helper is retained but a custom lint rule (or `go generate` pass) enumerates its call sites and records the resolved namespace strings in a generated file. This preserves the DRY convention enforced by the helper while still enabling static discovery.
+
+Rejected because it adds tooling complexity (a custom linter or generator that must be maintained and run in CI) without eliminating the runtime indirection. The direct string literal approach is simpler and equally correct, and Go's import cycle prevents the namespace string from drifting silently.
+
+#### Alternative 2: Use a code generator to produce a central namespace registry
+
+A generator scans all `*_validation.go` files, extracts the domain names, and emits a single `logger_namespaces_gen.go` file listing all `logger.New(...)` calls. Callers import the generated constants.
+
+Rejected as over-engineering. The benefit (one authoritative file) does not outweigh the cost (a generator to maintain, a generated file to keep in sync, and a new build step). Direct `logger.New()` literals with a well-known naming convention are greppable and self-documenting without any tooling.
+
+### Consequences
+
+#### Positive
+- All logger namespace strings are now fully static: `grep -rn 'logger.New'` in `pkg/workflow` yields the complete, authoritative list.
+- The latent doubled-suffix bug (`push_to_pull_request_branch_validation_validation`) is fixed.
+- The `newValidationLogger` helper is removed, shrinking the public API surface of `validation_helpers.go`.
+
+#### Negative
+- Each of the ~48 `*_validation.go` files now carries a direct `import "github.com/github/gh-aw/pkg/logger"`, increasing per-file coupling to the logger package (previously mediated by the shared helper in one file).
+- Future validation files must manually follow the `"workflow:<domain>_validation"` naming convention; the helper previously enforced this implicitly. A new file author could deviate without a compile error.
+
+#### Neutral
+- The change is a mechanical find-and-replace across 50 files; the diff is large by line count but trivially reviewable because every hunk is structurally identical.
+- `close_entity_helpers.go` acquires three extra package-level var declarations moved out of the slice literal initialiser.
+
+---
+
+*ADR created by [adr-writer agent]. Review and finalize before changing status from Draft to Accepted.*

From 4ec772f56dad0b33d5b0b67c2e5e81370b99323b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 15 Jul 2026 14:05:04 +0000
Subject: [PATCH 4/4] fix(workflow): correct 5 namespace mismatches flagged in
 PR review
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- step_shell_validator.go: remove spurious _validation suffix
  (step_shell_validator_validation → step_shell_validator)
- expression_safety_validation.go: restore dropped _safety component
  (expression_validation → expression_safety_validation)
- compiler_filters_validation.go: restore compiler_ prefix and plural
  (filter_validation → compiler_filters_validation), rename var
- strict_mode_update_check_validation.go: restore strict_mode_ prefix
  (update_check_validation → strict_mode_update_check_validation)
- mcp_scripts_dependencies_validation.go: fix singular/plural mismatch
  (mcp_script_dependencies_validation → mcp_scripts_dependencies_validation),
  rename var

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
---
 pkg/workflow/compiler_filters_validation.go   | 36 +++++++++----------
 pkg/workflow/expression_safety_validation.go  |  2 +-
 .../mcp_scripts_dependencies_validation.go    |  8 ++---
 pkg/workflow/step_shell_validator.go          |  2 +-
 .../strict_mode_update_check_validation.go    |  2 +-
 5 files changed, 25 insertions(+), 25 deletions(-)

diff --git a/pkg/workflow/compiler_filters_validation.go b/pkg/workflow/compiler_filters_validation.go
index c68980a0d6e..0b2950ce59c 100644
--- a/pkg/workflow/compiler_filters_validation.go
+++ b/pkg/workflow/compiler_filters_validation.go
@@ -52,27 +52,27 @@ import (
 	"github.com/github/gh-aw/pkg/logger"
 )
 
-var filterValidationLog = logger.New("workflow:filter_validation")
+var compilerFiltersValidationLog = logger.New("workflow:compiler_filters_validation")
 
 // ValidateEventFilters checks for GitHub Actions filter mutual exclusivity rules
 func ValidateEventFilters(frontmatter map[string]any) error {
-	filterValidationLog.Print("Validating event filter mutual exclusivity")
+	compilerFiltersValidationLog.Print("Validating event filter mutual exclusivity")
 
 	on, exists := frontmatter["on"]
 	if !exists {
-		filterValidationLog.Print("No 'on' section found, skipping filter validation")
+		compilerFiltersValidationLog.Print("No 'on' section found, skipping filter validation")
 		return nil
 	}
 
 	onMap, ok := on.(map[string]any)
 	if !ok {
-		filterValidationLog.Print("'on' section is not a map, skipping filter validation")
+		compilerFiltersValidationLog.Print("'on' section is not a map, skipping filter validation")
 		return nil
 	}
 
 	// Check push event
 	if pushVal, exists := onMap["push"]; exists {
-		filterValidationLog.Print("Validating push event filters")
+		compilerFiltersValidationLog.Print("Validating push event filters")
 		if err := validateFilterExclusivity(pushVal, "push"); err != nil {
 			return err
 		}
@@ -80,13 +80,13 @@ func ValidateEventFilters(frontmatter map[string]any) error {
 
 	// Check pull_request event
 	if prVal, exists := onMap["pull_request"]; exists {
-		filterValidationLog.Print("Validating pull_request event filters")
+		compilerFiltersValidationLog.Print("Validating pull_request event filters")
 		if err := validateFilterExclusivity(prVal, "pull_request"); err != nil {
 			return err
 		}
 	}
 
-	filterValidationLog.Print("Event filter validation completed successfully")
+	compilerFiltersValidationLog.Print("Event filter validation completed successfully")
 	return nil
 }
 
@@ -96,7 +96,7 @@ func ValidateEventFilters(frontmatter map[string]any) error {
 // activate immediately after new lock files are first pushed to the branch, producing
 // zero-turn failures for every agentic workflow in the repository).
 func ValidatePushBranchScope(frontmatter map[string]any) error {
-	filterValidationLog.Print("Validating push event branch/tag scope")
+	compilerFiltersValidationLog.Print("Validating push event branch/tag scope")
 
 	on, exists := frontmatter["on"]
 	if !exists {
@@ -115,7 +115,7 @@ func ValidatePushBranchScope(frontmatter map[string]any) error {
 
 	// A nil push value (bare `push:` key with no sub-keys) is unscoped.
 	if pushVal == nil {
-		filterValidationLog.Print("ERROR: push event has no branch/tag scope (nil push value)")
+		compilerFiltersValidationLog.Print("ERROR: push event has no branch/tag scope (nil push value)")
 		return newUnScopedPushError()
 	}
 
@@ -131,11 +131,11 @@ func ValidatePushBranchScope(frontmatter map[string]any) error {
 	_, hasTagsIgnore := pushMap["tags-ignore"]
 
 	if !hasBranches && !hasBranchesIgnore && !hasTags && !hasTagsIgnore {
-		filterValidationLog.Print("ERROR: push event has no branches or tags scope")
+		compilerFiltersValidationLog.Print("ERROR: push event has no branches or tags scope")
 		return newUnScopedPushError()
 	}
 
-	filterValidationLog.Print("Push event branches or tags scope is valid")
+	compilerFiltersValidationLog.Print("Push event branches or tags scope is valid")
 	return nil
 }
 
@@ -152,7 +152,7 @@ func newUnScopedPushError() *WorkflowValidationError {
 func validateFilterExclusivity(eventVal any, eventName string) error {
 	eventMap, ok := eventVal.(map[string]any)
 	if !ok {
-		filterValidationLog.Printf("Event '%s' is not a map, skipping filter validation", eventName)
+		compilerFiltersValidationLog.Printf("Event '%s' is not a map, skipping filter validation", eventName)
 		return nil
 	}
 
@@ -161,7 +161,7 @@ func validateFilterExclusivity(eventVal any, eventName string) error {
 	_, hasBranchesIgnore := eventMap["branches-ignore"]
 
 	if hasBranches && hasBranchesIgnore {
-		filterValidationLog.Printf("ERROR: Event '%s' has both 'branches' and 'branches-ignore' filters", eventName)
+		compilerFiltersValidationLog.Printf("ERROR: Event '%s' has both 'branches' and 'branches-ignore' filters", eventName)
 		return NewValidationError(
 			"on."+eventName,
 			"branches + branches-ignore",
@@ -175,7 +175,7 @@ func validateFilterExclusivity(eventVal any, eventName string) error {
 	_, hasPathsIgnore := eventMap["paths-ignore"]
 
 	if hasPaths && hasPathsIgnore {
-		filterValidationLog.Printf("ERROR: Event '%s' has both 'paths' and 'paths-ignore' filters", eventName)
+		compilerFiltersValidationLog.Printf("ERROR: Event '%s' has both 'paths' and 'paths-ignore' filters", eventName)
 		return NewValidationError(
 			"on."+eventName,
 			"paths + paths-ignore",
@@ -184,7 +184,7 @@ func validateFilterExclusivity(eventVal any, eventName string) error {
 		)
 	}
 
-	filterValidationLog.Printf("Event '%s' filters are valid", eventName)
+	compilerFiltersValidationLog.Printf("Event '%s' filters are valid", eventName)
 	return nil
 }
 
@@ -200,7 +200,7 @@ var globValidationEvents = []string{"push", "pull_request", "pull_request_target
 // ValidateGlobPatterns validates branch, tag, and path glob patterns in the 'on' section
 // of a workflow's frontmatter. It returns the first validation error encountered, if any.
 func ValidateGlobPatterns(frontmatter map[string]any) error {
-	filterValidationLog.Print("Validating glob patterns in event filters")
+	compilerFiltersValidationLog.Print("Validating glob patterns in event filters")
 
 	on, exists := frontmatter["on"]
 	if !exists {
@@ -237,7 +237,7 @@ func ValidateGlobPatterns(frontmatter map[string]any) error {
 		}
 	}
 
-	filterValidationLog.Print("Glob pattern validation completed successfully")
+	compilerFiltersValidationLog.Print("Glob pattern validation completed successfully")
 	return nil
 }
 
@@ -263,7 +263,7 @@ func validateGlobList(eventMap map[string]any, eventName, filterKey string, isPa
 	}
 
 	return validateGlobPatternList(patterns, validate, func(_ int, pat string, msgs []string) error {
-		filterValidationLog.Printf("ERROR: invalid glob pattern %q in %s.%s: %s", pat, eventName, filterKey, strings.Join(msgs, "; "))
+		compilerFiltersValidationLog.Printf("ERROR: invalid glob pattern %q in %s.%s: %s", pat, eventName, filterKey, strings.Join(msgs, "; "))
 		return NewValidationError(
 			fmt.Sprintf("on.%s.%s", eventName, filterKey),
 			pat,
diff --git a/pkg/workflow/expression_safety_validation.go b/pkg/workflow/expression_safety_validation.go
index 8579d57538a..674b29d5851 100644
--- a/pkg/workflow/expression_safety_validation.go
+++ b/pkg/workflow/expression_safety_validation.go
@@ -16,7 +16,7 @@ import (
 	"github.com/github/gh-aw/pkg/parser"
 )
 
-var expressionValidationLog = logger.New("workflow:expression_validation")
+var expressionValidationLog = logger.New("workflow:expression_safety_validation")
 
 // maxFuzzyMatchSuggestions is the maximum number of similar expressions to suggest
 // when an unauthorized expression is found
diff --git a/pkg/workflow/mcp_scripts_dependencies_validation.go b/pkg/workflow/mcp_scripts_dependencies_validation.go
index 4cccba0fe5e..f19e0db6bbb 100644
--- a/pkg/workflow/mcp_scripts_dependencies_validation.go
+++ b/pkg/workflow/mcp_scripts_dependencies_validation.go
@@ -17,14 +17,14 @@ var (
 	shellPackageDependencyNameRE = regexp.MustCompile(`^[a-z0-9][a-z0-9+.-]*([:=][A-Za-z0-9.+~:-]+)?$`)
 )
 
-var mcpScriptDepsValidationLog = logger.New("workflow:mcp_script_dependencies_validation")
+var mcpScriptsDepsValidationLog = logger.New("workflow:mcp_scripts_dependencies_validation")
 
 func (c *Compiler) validateMCPScriptDependencies(workflowData *WorkflowData) error {
 	if workflowData == nil || workflowData.MCPScripts == nil {
 		return nil
 	}
 
-	mcpScriptDepsValidationLog.Printf("Validating MCP script dependencies for %d tool(s)", len(workflowData.MCPScripts.Tools))
+	mcpScriptsDepsValidationLog.Printf("Validating MCP script dependencies for %d tool(s)", len(workflowData.MCPScripts.Tools))
 
 	for toolName, tool := range workflowData.MCPScripts.Tools {
 		if len(tool.Dependencies) == 0 {
@@ -33,11 +33,11 @@ func (c *Compiler) validateMCPScriptDependencies(workflowData *WorkflowData) err
 
 		manager := inferMCPScriptDependencyManager(tool)
 		if manager == "" {
-			mcpScriptDepsValidationLog.Printf("Tool %q: no dependency manager inferred, skipping %d dependencies", toolName, len(tool.Dependencies))
+			mcpScriptsDepsValidationLog.Printf("Tool %q: no dependency manager inferred, skipping %d dependencies", toolName, len(tool.Dependencies))
 			continue
 		}
 
-		mcpScriptDepsValidationLog.Printf("Tool %q: validating %d %q dependencies", toolName, len(tool.Dependencies), manager)
+		mcpScriptsDepsValidationLog.Printf("Tool %q: validating %d %q dependencies", toolName, len(tool.Dependencies), manager)
 
 		for _, dependency := range tool.Dependencies {
 			dependency = strings.TrimSpace(dependency)
diff --git a/pkg/workflow/step_shell_validator.go b/pkg/workflow/step_shell_validator.go
index b56d998aa85..ebb91c6f39e 100644
--- a/pkg/workflow/step_shell_validator.go
+++ b/pkg/workflow/step_shell_validator.go
@@ -20,7 +20,7 @@ import (
 	"github.com/github/gh-aw/pkg/logger"
 )
 
-var stepShellValidatorLog = logger.New("workflow:step_shell_validator_validation")
+var stepShellValidatorLog = logger.New("workflow:step_shell_validator")
 
 // ghCLIPattern detects invocations of the gh CLI in shell run scripts.
 // It matches "gh" as a command token at the start of a line (optionally
diff --git a/pkg/workflow/strict_mode_update_check_validation.go b/pkg/workflow/strict_mode_update_check_validation.go
index 965ca96bdc0..e99d3d9ceef 100644
--- a/pkg/workflow/strict_mode_update_check_validation.go
+++ b/pkg/workflow/strict_mode_update_check_validation.go
@@ -20,7 +20,7 @@ import (
 	"github.com/github/gh-aw/pkg/logger"
 )
 
-var updateCheckValidationLog = logger.New("workflow:update_check_validation")
+var updateCheckValidationLog = logger.New("workflow:strict_mode_update_check_validation")
 
 // validateUpdateCheck enforces the policy for the check-for-updates: false flag.
 // In strict mode it returns an error; in non-strict mode it emits a warning.