refactor: migrate remaining RunGHWithHost call sites to RunGHContextWithHost

pkg/cli/README.md

@@ -219,7 +219,7 @@ All diagnostic output MUST go to `stderr` using `console` formatting helpers. St
 | `StartDockerImageDownload` | `func(ctx context.Context, image string) (bool, func() error)` | Begins a background image pull; returns false if already pulling. The join function blocks until the goroutine exits and returns any download error. |
 | `CheckAndPrepareDockerImages` | `func(ctx context.Context, opts DockerImagesOptions) error` | Pre-pulls security-scanner Docker images |
 | `UpdateContainerPins` | `func(ctx, workflowDir string, verbose bool) error` | Updates container image SHA pins in workflow files |
-| `CreatePRWithChanges` | `func(branchPrefix, commitMessage, prTitle, prBody string, verbose bool) (string, error)` | Creates a GitHub PR from uncommitted changes |
+| `CreatePRWithChanges` | `func(ctx context.Context, branchPrefix, commitMessage, prTitle, prBody string, verbose bool) (string, error)` | Creates a GitHub PR from uncommitted changes |
 | `AutoMergePullRequestsCreatedAfter` | `func(repoSlug string, createdAfter time.Time, verbose bool) error` | Auto-merges eligible PRs created after a given time |
 | `PreflightCheckForCreatePR` | `func(bool) error` | Validates prerequisites before creating a PR |
 | `DisableAllWorkflowsExcept` | `func(repoSlug string, exceptWorkflows []string, verbose bool) error` | Disables all workflows in a repo except the named ones |

pkg/cli/add_package_manifest.go

@@ -88,15 +88,15 @@ func resolveRepositoryPackage(ctx context.Context, repoSpec *RepoSpec, host stri
 	ref := repositoryPackageEffectiveRef(repoSpec, nil)
 	if ref == "" {
 		if isGhAwRepository(repoSpec.RepoSlug) {
-			if latestRelease, err := getRepositoryPackageLatestRelease(repoSpec.RepoSlug, host); err == nil {
+			if latestRelease, err := getRepositoryPackageLatestRelease(ctx, repoSpec.RepoSlug, host); err == nil {
 				ref = latestRelease
 			} else {
 				addPackageManifestLog.Printf("failed to resolve latest release for %s (host=%q): %v", repoSpec.RepoSlug, host, err)
 			}
 		}
 		if ref == "" {
 			ref = "main"
-			if defaultBranch, err := getRepositoryPackageDefaultBranch(repoSpec.RepoSlug, host); err == nil {
+			if defaultBranch, err := getRepositoryPackageDefaultBranch(ctx, repoSpec.RepoSlug, host); err == nil {
 				ref = defaultBranch
 			} else {
 				addPackageManifestLog.Printf("failed to resolve default branch for %s (host=%q), falling back to %q: %v", repoSpec.RepoSlug, host, ref, err)
@@ -930,12 +930,12 @@ func isRepositoryPackageRemoteNotFound(err error) bool {
 	return strings.Contains(errText, "404") || strings.Contains(errText, "not found")
 }
 
-func resolveRepositoryPackageDefaultBranch(repoSlug, host string) (string, error) {
+func resolveRepositoryPackageDefaultBranch(ctx context.Context, repoSlug, host string) (string, error) {
 	args := []string{"api", "/repos/" + repoSlug, "--jq", ".default_branch"}
 	var output []byte
 	var err error
 	if host != "" {
-		output, err = workflow.RunGHWithHost("Fetching repo info...", host, args...)
+		output, err = workflow.RunGHContextWithHost(ctx, "Fetching repo info...", host, args...)
 		if err != nil {
 			return "", err
 		}
@@ -982,16 +982,16 @@ func isGhAwRepository(repoSlug string) bool {
 // repoSlug must be in "owner/repo" format. host is an optional explicit GitHub
 // hostname (for example "github.com" or a GHES host); when provided, gh API
 // calls are executed against that host.
-func resolveRepositoryPackageLatestRelease(repoSlug, host string) (string, error) {
+func resolveRepositoryPackageLatestRelease(ctx context.Context, repoSlug, host string) (string, error) {
 	deps := workflowUpdateDeps{
-		runReleasesAPI: func(ctx context.Context, repo string) ([]byte, error) {
+		runReleasesAPI: func(innerCtx context.Context, repo string) ([]byte, error) {
 			args := []string{"api", fmt.Sprintf("/repos/%s/releases", repo), "--jq", ".[].tag_name"}
 			if host != "" {
-				return workflow.RunGHWithHost("Fetching releases...", host, args...)
+				return workflow.RunGHContextWithHost(innerCtx, "Fetching releases...", host, args...)
 			}
-			return workflow.RunGHContext(ctx, "Fetching releases...", args...)
+			return workflow.RunGHContext(innerCtx, "Fetching releases...", args...)
 		},
 	}
 
-	return resolveLatestReleaseWithDeps(context.Background(), deps, repoSlug, "", true, false, 0)
+	return resolveLatestReleaseWithDeps(ctx, deps, repoSlug, "", true, false, 0)
 }

pkg/cli/add_package_manifest_test.go

@@ -35,11 +35,11 @@ func TestResolveRepositoryPackage(t *testing.T) {
 		getRepositoryPackageLatestRelease = originalLatestRelease
 	})
 	SetVersionInfo("v1.2.3")
-	getRepositoryPackageDefaultBranch = func(repoSlug, host string) (string, error) {
+	getRepositoryPackageDefaultBranch = func(_ context.Context, repoSlug, host string) (string, error) {
 		return "main", nil
 	}
 
-	getRepositoryPackageLatestRelease = func(repoSlug, host string) (string, error) {
+	getRepositoryPackageLatestRelease = func(_ context.Context, repoSlug, host string) (string, error) {
 		return "", errors.New("no releases found")
 	}
 	listPackageDirFilesForHost = func(_ context.Context, owner, repo, ref, dirPath, host string) ([]string, error) {
@@ -92,12 +92,12 @@ files:
 			getRepositoryPackageDefaultBranch = previousDefaultBranch
 			getRepositoryPackageLatestRelease = previousLatestRelease
 		})
-		getRepositoryPackageLatestRelease = func(repoSlug, host string) (string, error) {
+		getRepositoryPackageLatestRelease = func(_ context.Context, repoSlug, host string) (string, error) {
 			assert.Equal(t, "owner/repo", repoSlug)
 			assert.Equal(t, "github.com", host)
 			return "", errors.New("no releases found")
 		}
-		getRepositoryPackageDefaultBranch = func(repoSlug, host string) (string, error) {
+		getRepositoryPackageDefaultBranch = func(_ context.Context, repoSlug, host string) (string, error) {
 			assert.Equal(t, "owner/repo", repoSlug)
 			assert.Equal(t, "github.com", host)
 			return "master", nil
@@ -137,12 +137,12 @@ files:
 			getRepositoryPackageDefaultBranch = previousDefaultBranch
 			getRepositoryPackageLatestRelease = previousLatestRelease
 		})
-		getRepositoryPackageLatestRelease = func(repoSlug, host string) (string, error) {
+		getRepositoryPackageLatestRelease = func(_ context.Context, repoSlug, host string) (string, error) {
 			assert.Equal(t, "github/gh-aw", repoSlug)
 			assert.Equal(t, "github.com", host)
 			return "v1.2.3", nil
 		}
-		getRepositoryPackageDefaultBranch = func(repoSlug, host string) (string, error) {
+		getRepositoryPackageDefaultBranch = func(_ context.Context, repoSlug, host string) (string, error) {
 			t.Fatalf("default branch lookup should not be called when latest release is available")
 			return "", nil
 		}
@@ -182,12 +182,12 @@ files:
 			getRepositoryPackageDefaultBranch = previousDefaultBranch
 			getRepositoryPackageLatestRelease = previousLatestRelease
 		})
-		getRepositoryPackageLatestRelease = func(repoSlug, host string) (string, error) {
+		getRepositoryPackageLatestRelease = func(_ context.Context, repoSlug, host string) (string, error) {
 			assert.Equal(t, "github/gh-aw", repoSlug)
 			assert.Equal(t, "github.com", host)
 			return "", errors.New("release lookup failed")
 		}
-		getRepositoryPackageDefaultBranch = func(repoSlug, host string) (string, error) {
+		getRepositoryPackageDefaultBranch = func(_ context.Context, repoSlug, host string) (string, error) {
 			assert.Equal(t, "github/gh-aw", repoSlug)
 			assert.Equal(t, "github.com", host)
 			return "main", nil
@@ -226,7 +226,7 @@ files:
 		t.Cleanup(func() {
 			getRepositoryPackageDefaultBranch = previousDefaultBranch
 		})
-		getRepositoryPackageDefaultBranch = func(repoSlug, host string) (string, error) {
+		getRepositoryPackageDefaultBranch = func(_ context.Context, repoSlug, host string) (string, error) {
 			t.Fatalf("default branch lookup should not be called when version is provided")
 			return "", nil
 		}
@@ -751,7 +751,7 @@ func TestResolveWorkflows_RepositoryPackage(t *testing.T) {
 		listPackageDirSubdirsForHost = originalDirSubdirs
 		getRepositoryPackageDefaultBranch = originalDefaultBranch
 	})
-	getRepositoryPackageDefaultBranch = func(repoSlug, host string) (string, error) {
+	getRepositoryPackageDefaultBranch = func(_ context.Context, repoSlug, host string) (string, error) {
 		return "main", nil
 	}
 	listPackageDirFilesForHost = func(_ context.Context, owner, repo, ref, dirPath, host string) ([]string, error) {
@@ -809,7 +809,7 @@ func TestResolveWorkflows_RepositoryPackageRejectsPrivateTrue(t *testing.T) {
 		listPackageDirSubdirsForHost = originalDirSubdirs
 		getRepositoryPackageDefaultBranch = originalDefaultBranch
 	})
-	getRepositoryPackageDefaultBranch = func(repoSlug, host string) (string, error) {
+	getRepositoryPackageDefaultBranch = func(_ context.Context, repoSlug, host string) (string, error) {
 		return "main", nil
 	}
 	listPackageDirFilesForHost = func(_ context.Context, owner, repo, ref, dirPath, host string) ([]string, error) {
@@ -863,7 +863,7 @@ func TestResolveWorkflows_NestedRepositoryPackage(t *testing.T) {
 		listPackageDirSubdirsForHost = originalDirSubdirs
 		getRepositoryPackageDefaultBranch = originalDefaultBranch
 	})
-	getRepositoryPackageDefaultBranch = func(repoSlug, host string) (string, error) {
+	getRepositoryPackageDefaultBranch = func(_ context.Context, repoSlug, host string) (string, error) {
 		return "main", nil
 	}
 	listPackageDirFilesForHost = func(_ context.Context, owner, repo, ref, dirPath, host string) ([]string, error) {
@@ -923,7 +923,7 @@ func TestResolveWorkflows_NestedRepositoryPackage_GithubWorkflowsPathIsRepoRoot(
 		listPackageDirSubdirsForHost = originalDirSubdirs
 		getRepositoryPackageDefaultBranch = originalDefaultBranch
 	})
-	getRepositoryPackageDefaultBranch = func(repoSlug, host string) (string, error) {
+	getRepositoryPackageDefaultBranch = func(_ context.Context, repoSlug, host string) (string, error) {
 		return "main", nil
 	}
 	listPackageDirFilesForHost = func(_ context.Context, owner, repo, ref, dirPath, host string) ([]string, error) {
@@ -982,7 +982,7 @@ func TestResolveWorkflows_NestedRepositoryPackage_AutoScan(t *testing.T) {
 		listPackageDirSubdirsForHost = originalDirSubdirs
 		getRepositoryPackageDefaultBranch = originalDefaultBranch
 	})
-	getRepositoryPackageDefaultBranch = func(repoSlug, host string) (string, error) {
+	getRepositoryPackageDefaultBranch = func(_ context.Context, repoSlug, host string) (string, error) {
 		return "main", nil
 	}
 	listPackageDirFilesForHost = func(_ context.Context, owner, repo, ref, dirPath, host string) ([]string, error) {
@@ -1035,7 +1035,7 @@ func TestResolveWorkflows_FallsBackToWorkflowWhenNestedManifestMissing(t *testin
 		downloadPackageFileFromGitHubForHost = originalDownload
 		getRepositoryPackageDefaultBranch = originalDefaultBranch
 	})
-	getRepositoryPackageDefaultBranch = func(repoSlug, host string) (string, error) {
+	getRepositoryPackageDefaultBranch = func(_ context.Context, repoSlug, host string) (string, error) {
 		return "main", nil
 	}
 
@@ -1246,7 +1246,7 @@ func TestResolveRepositoryPackage_ActionWorkflowYML(t *testing.T) {
 		getRepositoryPackageDefaultBranch = originalDefaultBranch
 	})
 	SetVersionInfo("v1.2.3")
-	getRepositoryPackageDefaultBranch = func(repoSlug, host string) (string, error) {
+	getRepositoryPackageDefaultBranch = func(_ context.Context, repoSlug, host string) (string, error) {
 		return "main", nil
 	}
 	listPackageDirFilesForHost = func(_ context.Context, owner, repo, ref, dirPath, host string) ([]string, error) {
@@ -1351,7 +1351,7 @@ func TestResolveWorkflows_ActionWorkflowYML(t *testing.T) {
 		listPackageDirSubdirsForHost = originalDirSubdirs
 		getRepositoryPackageDefaultBranch = originalDefaultBranch
 	})
-	getRepositoryPackageDefaultBranch = func(repoSlug, host string) (string, error) {
+	getRepositoryPackageDefaultBranch = func(_ context.Context, repoSlug, host string) (string, error) {
 		return "main", nil
 	}
 	listPackageDirFilesForHost = func(_ context.Context, owner, repo, ref, dirPath, host string) ([]string, error) {
@@ -1552,7 +1552,7 @@ func TestResolveRepositoryPackage_SkillsAndAgents(t *testing.T) {
 		getRepositoryPackageDefaultBranch = originalDefaultBranch
 	})
 	SetVersionInfo("v1.2.3")
-	getRepositoryPackageDefaultBranch = func(repoSlug, host string) (string, error) {
+	getRepositoryPackageDefaultBranch = func(_ context.Context, repoSlug, host string) (string, error) {
 		return "main", nil
 	}
 
@@ -1975,7 +1975,7 @@ func TestResolveWorkflows_SkillsAndAgents(t *testing.T) {
 		listPackageDirSubdirsForHost = originalDirSubdirs
 		getRepositoryPackageDefaultBranch = originalDefaultBranch
 	})
-	getRepositoryPackageDefaultBranch = func(repoSlug, host string) (string, error) {
+	getRepositoryPackageDefaultBranch = func(_ context.Context, repoSlug, host string) (string, error) {
 		return "main", nil
 	}
 
@@ -2094,7 +2094,7 @@ func bootstrapTestHelpers(t *testing.T) {
 		getRepositoryPackageDefaultBranch = originalDefaultBranch
 	})
 
-	getRepositoryPackageDefaultBranch = func(repoSlug, host string) (string, error) {
+	getRepositoryPackageDefaultBranch = func(_ context.Context, repoSlug, host string) (string, error) {
 		return "main", nil
 	}
 	listPackageDirFilesForHost = func(_ context.Context, owner, repo, ref, dirPath, host string) ([]string, error) {

pkg/cli/add_workflow_pr.go

@@ -161,7 +161,7 @@ func addWorkflowsWithPR(ctx context.Context, workflows []*ResolvedWorkflow, opts
 
 	// Create PR
 	addWorkflowPRLog.Printf("Creating pull request: %s", prTitle)
-	prNumber, prURL, err := createPR(branchName, prTitle, prBody, opts.Verbose)
+	prNumber, prURL, err := createPR(ctx, branchName, prTitle, prBody, opts.Verbose)
 	if err != nil {
 		addWorkflowPRLog.Printf("Failed to create PR: %v", err)
 		if rollbackErr := tracker.RollbackAllFiles(opts.Verbose); rollbackErr != nil && opts.Verbose {

pkg/cli/audit.go

@@ -952,7 +952,7 @@ func buildRenderedAuditData(ctx context.Context, processedRun ProcessedRun, metr
 	currentCreatedItems := extractCreatedItemsFromManifest(runOutputDir)
 	currentSnapshot := buildAuditComparisonSnapshot(processedRun, currentCreatedItems)
 	comparison := buildAuditComparisonForRun(ctx, processedRun, currentSnapshot, runOutputDir, opts.Owner, opts.Repo, opts.Hostname, opts.Verbose)
-	auditData := buildAuditData(processedRun, metrics, mcpToolUsage)
+	auditData := buildAuditData(ctx, processedRun, metrics, mcpToolUsage)
 	auditData.Comparison = comparison
 	return auditData
 }

pkg/cli/audit_agent_example_test.go

@@ -4,6 +4,7 @@ package cli
 
 import (
 	"bytes"
+	"context"
 	"encoding/json"
 	"io"
 	"os"
@@ -116,7 +117,7 @@ func TestAgentFriendlyOutputExample(t *testing.T) {
 	}
 
 	// Build audit data
-	auditData := buildAuditData(processedRun, metrics, nil)
+	auditData := buildAuditData(context.Background(), processedRun, metrics, nil)
 
 	// Test JSON output
 	t.Run("JSON Output", func(t *testing.T) {
@@ -301,7 +302,7 @@ func TestAgentFriendlyOutputFailureScenario(t *testing.T) {
 	}
 
 	// Build audit data
-	auditData := buildAuditData(processedRun, metrics, nil)
+	auditData := buildAuditData(context.Background(), processedRun, metrics, nil)
 
 	// Test key findings for failure
 	t.Run("Failure Findings", func(t *testing.T) {

pkg/cli/audit_agent_output_test.go

@@ -3,6 +3,7 @@
 package cli
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"strings"
@@ -358,7 +359,7 @@ func TestAuditDataJSONStructure(t *testing.T) {
 	}
 
 	// Build audit data
-	auditData := buildAuditData(processedRun, metrics, nil)
+	auditData := buildAuditData(context.Background(), processedRun, metrics, nil)
 
 	// Marshal to JSON
 	jsonBytes, err := json.MarshalIndent(auditData, "", "  ")

pkg/cli/audit_agentic_analysis_test.go

@@ -3,6 +3,7 @@
 package cli
 
 import (
+	"context"
 	"math"
 	"testing"
 	"time"
@@ -101,7 +102,7 @@ func TestBuildAuditDataIncludesAgenticAnalysis(t *testing.T) {
 	}
 	metrics := LogMetrics{Turns: 3}
 
-	auditData := buildAuditData(processedRun, metrics, nil)
+	auditData := buildAuditData(context.Background(), processedRun, metrics, nil)
 	require.NotNil(t, auditData.TaskDomain, "task domain should be present")
 	require.NotNil(t, auditData.BehaviorFingerprint, "behavioral fingerprint should be present")
 	assert.NotEmpty(t, auditData.AgenticAssessments, "agentic assessments should be present")
@@ -319,7 +320,7 @@ func TestBuildAuditDataToolUsageMatchesBuildToolUsageInfo(t *testing.T) {
 		},
 	}
 
-	auditData := buildAuditData(processedRun, metrics, nil)
+	auditData := buildAuditData(context.Background(), processedRun, metrics, nil)
 	expected := buildToolUsageInfo(metrics)
 
 	require.Equal(t, expected, auditData.ToolUsage, "buildAuditData tool usage should match buildToolUsageInfo output")

pkg/cli/audit_ambient_context_test.go

@@ -3,6 +3,7 @@
 package cli
 
 import (
+	"context"
 	"testing"
 	"time"
 
@@ -29,7 +30,7 @@ func TestBuildAuditDataIncludesAmbientContext(t *testing.T) {
 		},
 	}
 
-	auditData := buildAuditData(processedRun, workflow.LogMetrics{}, nil)
+	auditData := buildAuditData(context.Background(), processedRun, workflow.LogMetrics{}, nil)
 	require.NotNil(t, auditData.Metrics.AmbientContext, "ambient context should be populated")
 	assert.Equal(t, 1200, auditData.Metrics.AmbientContext.InputTokens, "input tokens should match")
 	assert.Equal(t, 300, auditData.Metrics.AmbientContext.CachedTokens, "cached tokens should match")

pkg/cli/audit_expanded_test.go

@@ -3,6 +3,7 @@
 package cli
 
 import (
+	"context"
 	"os"
 	"path/filepath"
 	"testing"
@@ -601,7 +602,7 @@ func TestBuildAuditDataWithExpandedSections(t *testing.T) {
 		},
 	}
 
-	auditData := buildAuditData(processedRun, metrics, mcpToolUsage)
+	auditData := buildAuditData(context.Background(), processedRun, metrics, mcpToolUsage)
 
 	// Verify new expanded sections are populated
 	t.Run("AuditEngineConfig", func(t *testing.T) {
@@ -661,7 +662,7 @@ func TestBuildAuditDataExpandedWithNoData(t *testing.T) {
 	}
 	metrics := LogMetrics{}
 
-	auditData := buildAuditData(processedRun, metrics, nil)
+	auditData := buildAuditData(context.Background(), processedRun, metrics, nil)
 
 	assert.Nil(t, auditData.EngineConfig, "Engine config should be nil without aw_info.json")
 	assert.Nil(t, auditData.PromptAnalysis, "Prompt analysis should be nil without prompt.txt")

pkg/cli/audit_input_size_test.go

@@ -3,6 +3,7 @@
 package cli
 
 import (
+	"context"
 	"encoding/json"
 	"strings"
 	"testing"
@@ -43,7 +44,7 @@ func TestAuditDataJSONIncludesInputSizes(t *testing.T) {
 	}
 
 	// Build audit data
-	auditData := buildAuditData(processedRun, metrics, nil)
+	auditData := buildAuditData(context.Background(), processedRun, metrics, nil)
 
 	// Verify tool usage data includes input sizes
 	if len(auditData.ToolUsage) == 0 {