Cache lightweight agentic workflow logs

.github/workflows/agentic-logs-cache.yml

@@ -0,0 +1,82 @@
+name: Agentic logs cache
+
+on:
+  schedule:
+    - cron: "0 9 * * *"
+  workflow_dispatch:
+
+permissions:
+  actions: write
+  contents: read
+
+jobs:
+  refresh:
+    runs-on: ubuntu-latest
+    timeout-minutes: 50
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Restore latest logs cache
+        id: restore-cache
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: .github/aw/logs
+          key: agentic-logs
+
+      - name: Build gh-aw
+        run: make build
+
+      - name: Refresh 30 days of logs
+        id: refresh
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          mkdir -p .github/aw/logs
+          ./gh-aw logs \
+            --start-date -30d \
+            --count 100000 \
+            --artifacts activation,usage \
+            --cache-before -30d \
+            --output .github/aw/logs \
+            --json > /tmp/agentic-logs-summary.json
+
+      - name: Delete previous logs cache
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          cache_id=$(gh cache list \
+            --key agentic-logs \
+            --ref "$GITHUB_REF" \
+            --limit 1 \
+            --json id,key \
+            --jq '.[] | select(.key == "agentic-logs") | .id')
+          if [ -n "$cache_id" ]; then
+            gh cache delete "$cache_id"
+          fi
+
+      - name: Save refreshed logs cache
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: .github/aw/logs
+          key: agentic-logs
+
+      - name: Write summary
+        if: always()
+        run: |
+          {
+            echo "### Agentic logs cache"
+            if [ -s /tmp/agentic-logs-summary.json ]; then
+              echo "- Runs cached: $(jq -r '.runs | length' /tmp/agentic-logs-summary.json)"
+              echo "- Artifacts: activation, usage"
+              echo "- Window: 30 days"
+            else
+              echo "- Cache refresh failed before producing a summary."
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/daily-security-observability.md

@@ -68,7 +68,7 @@ steps:
       # --artifacts mcp: only download the MCP gateway log artifact (sufficient for DIFC checking).
       # --timeout 8: cap execution at 8 minutes to prevent runaway downloads.
       gh aw logs --filtered-integrity --start-date -7d --json -c 200 \
-        --artifacts mcp --timeout 8 \
+        --artifacts mcp --timeout 8 --output .github/aw/logs \
         > "$FRESH_LOGS" || true
 
       # Validate JSON output and fall back to an empty dataset on failure
@@ -127,7 +127,7 @@ steps:
       # needed for firewall detection, avoiding large agent artifact downloads.
       # --timeout 8: cap execution at 8 minutes to prevent runaway downloads.
       gh aw logs --firewall --start-date -7d --json -c 100 \
-        --artifacts activation --timeout 8 \
+        --artifacts activation --timeout 8 --output .github/aw/logs \
         > "$FIREWALL_RUNS" || true
 
       # Validate JSON output and fall back to an empty dataset on failure