Skip to content

fix(audit): decouple error visibility from verbose flag in AuditWorkflowRun #30939

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pelikhan merged 4 commits into from
May 8, 2026
+65 −26
Merged

fix(audit): decouple error visibility from verbose flag in AuditWorkflowRun #30939

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
4b3f971
Initial plan
Copilot May 8, 2026
3897e64
plan: decouple error visibility from verbose flag in AuditWorkflowRun
Copilot May 8, 2026
cade9fa
fix(audit): always log sub-step errors via auditLog, decouple from ve…
Copilot May 8, 2026
366e6f8
Merge remote-tracking branch 'origin/main' into copilot/audit-fix-sil…
Copilot May 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
91 changes: 65 additions & 26 deletions pkg/cli/audit.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -449,38 +449,56 @@ func AuditWorkflowRun(ctx context.Context, runID int64, owner, repo, hostname st

// Fetch detailed job information including durations
jobDetails, err := fetchJobDetails(run.DatabaseID, verbose)
if err != nil && verbose {
fmt.Fprintln(os.Stderr, console.FormatWarningMessage(fmt.Sprintf("Failed to fetch job details: %v", err)))
if err != nil {
auditLog.Printf("fetchJobDetails failed: %v", err)
if verbose {
Comment on lines +452 to +454
fmt.Fprintln(os.Stderr, console.FormatWarningMessage(fmt.Sprintf("Failed to fetch job details: %v", err)))
}
}

// Extract missing tools
missingTools, err := extractMissingToolsFromRun(runOutputDir, run, verbose)
if err != nil && verbose {
fmt.Fprintln(os.Stderr, console.FormatWarningMessage(fmt.Sprintf("Failed to extract missing tools: %v", err)))
if err != nil {
auditLog.Printf("extractMissingToolsFromRun failed: %v", err)
if verbose {
fmt.Fprintln(os.Stderr, console.FormatWarningMessage(fmt.Sprintf("Failed to extract missing tools: %v", err)))
}
}

// Extract missing data
missingData, err := extractMissingDataFromRun(runOutputDir, run, verbose)
if err != nil && verbose {
fmt.Fprintln(os.Stderr, console.FormatWarningMessage(fmt.Sprintf("Failed to extract missing data: %v", err)))
if err != nil {
auditLog.Printf("extractMissingDataFromRun failed: %v", err)
if verbose {
fmt.Fprintln(os.Stderr, console.FormatWarningMessage(fmt.Sprintf("Failed to extract missing data: %v", err)))
}
}

// Extract noops
noops, noopErr := extractNoopsFromRun(runOutputDir, run, verbose)
if noopErr != nil && verbose {
fmt.Fprintln(os.Stderr, console.FormatWarningMessage(fmt.Sprintf("Failed to extract noops: %v", noopErr)))
if noopErr != nil {
auditLog.Printf("extractNoopsFromRun failed: %v", noopErr)
if verbose {
fmt.Fprintln(os.Stderr, console.FormatWarningMessage(fmt.Sprintf("Failed to extract noops: %v", noopErr)))
}
}

// Extract MCP failures
mcpFailures, err := extractMCPFailuresFromRun(runOutputDir, run, verbose)
if err != nil && verbose {
fmt.Fprintln(os.Stderr, console.FormatWarningMessage(fmt.Sprintf("Failed to extract MCP failures: %v", err)))
if err != nil {
auditLog.Printf("extractMCPFailuresFromRun failed: %v", err)
if verbose {
fmt.Fprintln(os.Stderr, console.FormatWarningMessage(fmt.Sprintf("Failed to extract MCP failures: %v", err)))
}
}

// Analyze access logs if available
accessAnalysis, err := analyzeAccessLogs(runOutputDir, verbose)
if err != nil && verbose {
fmt.Fprintln(os.Stderr, console.FormatWarningMessage(fmt.Sprintf("Failed to analyze access logs: %v", err)))
if err != nil {
auditLog.Printf("analyzeAccessLogs failed: %v", err)
if verbose {
fmt.Fprintln(os.Stderr, console.FormatWarningMessage(fmt.Sprintf("Failed to analyze access logs: %v", err)))
}
}

// Analyze firewall/gateway data only when the agent artifact was downloaded.
Expand All @@ -496,8 +514,11 @@ func AuditWorkflowRun(ctx context.Context, runID int64, owner, repo, hostname st
var tokenUsageSummary *TokenUsageSummary
if hasFirewallArtifact {
firewallAnalysis, err = analyzeFirewallLogs(runOutputDir, verbose)
if err != nil && verbose {
fmt.Fprintln(os.Stderr, console.FormatWarningMessage(fmt.Sprintf("Failed to analyze firewall logs: %v", err)))
if err != nil {
auditLog.Printf("analyzeFirewallLogs failed: %v", err)
if verbose {
fmt.Fprintln(os.Stderr, console.FormatWarningMessage(fmt.Sprintf("Failed to analyze firewall logs: %v", err)))
}
}

// Supplement firewall analysis with blocked domains extracted directly from
Expand All @@ -513,39 +534,57 @@ func AuditWorkflowRun(ctx context.Context, runID int64, owner, repo, hostname st

// Analyze firewall policy artifacts if available (policy-manifest.json + audit.jsonl)
policyAnalysis, err = analyzeFirewallPolicy(runOutputDir, verbose)
if err != nil && verbose {
fmt.Fprintln(os.Stderr, console.FormatWarningMessage(fmt.Sprintf("Failed to analyze firewall policy: %v", err)))
if err != nil {
auditLog.Printf("analyzeFirewallPolicy failed: %v", err)
if verbose {
fmt.Fprintln(os.Stderr, console.FormatWarningMessage(fmt.Sprintf("Failed to analyze firewall policy: %v", err)))
}
}

// Extract MCP tool usage data from gateway logs
mcpToolUsage, err = extractMCPToolUsageData(runOutputDir, verbose)
if err != nil && verbose {
fmt.Fprintln(os.Stderr, console.FormatWarningMessage(fmt.Sprintf("Failed to extract MCP tool usage: %v", err)))
if err != nil {
auditLog.Printf("extractMCPToolUsageData failed: %v", err)
if verbose {
fmt.Fprintln(os.Stderr, console.FormatWarningMessage(fmt.Sprintf("Failed to extract MCP tool usage: %v", err)))
}
}

// Analyze token usage from firewall proxy logs
tokenUsageSummary, err = analyzeTokenUsage(runOutputDir, verbose)
if err != nil && verbose {
fmt.Fprintln(os.Stderr, console.FormatWarningMessage(fmt.Sprintf("Failed to analyze token usage: %v", err)))
if err != nil {
auditLog.Printf("analyzeTokenUsage failed: %v", err)
if verbose {
fmt.Fprintln(os.Stderr, console.FormatWarningMessage(fmt.Sprintf("Failed to analyze token usage: %v", err)))
}
}
}

// Analyze redacted domains if available
redactedDomainsAnalysis, err := analyzeRedactedDomains(runOutputDir, verbose)
if err != nil && verbose {
fmt.Fprintln(os.Stderr, console.FormatWarningMessage(fmt.Sprintf("Failed to analyze redacted domains: %v", err)))
if err != nil {
auditLog.Printf("analyzeRedactedDomains failed: %v", err)
if verbose {
fmt.Fprintln(os.Stderr, console.FormatWarningMessage(fmt.Sprintf("Failed to analyze redacted domains: %v", err)))
}
}

// Analyze GitHub API rate limit consumption from github_rate_limits.jsonl
rateLimitUsage, err := analyzeGitHubRateLimits(runOutputDir, verbose)
if err != nil && verbose {
fmt.Fprintln(os.Stderr, console.FormatWarningMessage(fmt.Sprintf("Failed to analyze GitHub rate limit usage: %v", err)))
if err != nil {
auditLog.Printf("analyzeGitHubRateLimits failed: %v", err)
if verbose {
fmt.Fprintln(os.Stderr, console.FormatWarningMessage(fmt.Sprintf("Failed to analyze GitHub rate limit usage: %v", err)))
}
}

// List all artifacts
artifacts, err := listArtifacts(runOutputDir)
if err != nil && verbose {
fmt.Fprintln(os.Stderr, console.FormatWarningMessage(fmt.Sprintf("Failed to list artifacts: %v", err)))
if err != nil {
auditLog.Printf("listArtifacts failed: %v", err)
if verbose {
fmt.Fprintln(os.Stderr, console.FormatWarningMessage(fmt.Sprintf("Failed to list artifacts: %v", err)))
}
}

currentCreatedItems := extractCreatedItemsFromManifest(runOutputDir)
Expand Down