Add debug logging to under-instrumented threat-detection, frontmatter, and validation paths (#51676)

Author: github-actions[bot]

pkg/workflow/create_entity_helpers.go

@@ -48,6 +48,7 @@ func parseCreateEntityConfig[T any](
 		configData = nil
 	}
 	if preUnmarshal != nil && !preUnmarshal(configData) {
+		debugLog.Printf("preUnmarshal aborted parsing for %s", configKey)
 		return nil
 	}
 
@@ -72,11 +73,13 @@ func parseCreateEntityConfig[T any](
 
 	config := parseConfigScaffold(outputMap, configKey, debugLog, onError)
 	if config == nil {
+		debugLog.Printf("parseConfigScaffold returned nil config for %s", configKey)
 		return nil
 	}
 
 	if postUnmarshal != nil {
 		postUnmarshal(configData, config, expiresDisabled)
+		debugLog.Printf("postUnmarshal applied for %s (expiresDisabled=%t)", configKey, expiresDisabled)
 	}
 
 	return config

pkg/workflow/frontmatter_on_section_cleanup.go

@@ -34,6 +34,7 @@ func (c *Compiler) commentOutProcessedFieldsInOnSection(yamlStr string, frontmat
 	}
 
 	result = dedentTrailingOnCommentBlock(result)
+	frontmatterLog.Printf("Processed 'on' section: %d input lines, %d native label filter section(s)", len(lines), len(nativeLabelFilterSections))
 	return strings.Join(result, "\n")
 }
 
@@ -149,6 +150,7 @@ func (s *onSectionCleanupState) detectEventSection(info onSectionLine) (string,
 }
 
 func (s *onSectionCleanupState) activateEventSection(section string, indent int) {
+	frontmatterLog.Printf("Entering event section %q at indent %d", section, indent)
 	s.resetTopLevelExtensionState()
 	s.inCommentBlock = false
 	s.commentBlockIndent = ""
@@ -668,6 +670,7 @@ func dedentTrailingOnCommentBlock(lines []string) []string {
 		}
 	}
 
+	frontmatterLog.Printf("Dedenting trailing 'on' comment block: lines %d-%d", start, last)
 	for i := start; i <= last; i++ {
 		lines[i] = strings.TrimLeft(lines[i], " \t")
 	}

pkg/workflow/strict_mode_sandbox_validation.go

@@ -53,8 +53,10 @@ func (c *Compiler) validateStrictSandboxCustomization(sandboxConfig *SandboxConf
 				"Remove 'sudo: true' to use the secure default. " +
 				"See: https://github.github.com/gh-aw/reference/sandbox/"
 			if c.strictMode {
+				strictModeValidationLog.Print("Rejecting sandbox.agent.sudo: true in strict mode")
 				return fmt.Errorf("strict mode: %s", sudoTrueMsg)
 			}
+			strictModeValidationLog.Print("Warning about deprecated sandbox.agent.sudo: true in non-strict mode")
 			fmt.Fprintln(os.Stderr, console.FormatWarningMessage(sudoTrueMsg))
 			c.IncrementWarningCount()
 		}
@@ -86,6 +88,7 @@ func (c *Compiler) validateStrictSandboxCustomization(sandboxConfig *SandboxConf
 
 	// Check MCP gateway internal fields
 	if mcp := sandboxConfig.MCP; mcp != nil {
+		strictModeValidationLog.Print("Checking sandbox.mcp internal fields against strict mode restrictions")
 		if mcp.Container != "" {
 			return internalSandboxFieldError("sandbox.mcp.container")
 		}

pkg/workflow/threat_detection_external.go

@@ -132,8 +132,10 @@ func (c *Compiler) buildPullAWFContainersStep(data *WorkflowData) []string {
 
 	images := collectDockerImages(detectionData.Tools, detectionData, c.actionMode)
 	if len(images) == 0 {
+		threatLog.Print("No AWF container images to pre-pull for detection job")
 		return nil
 	}
+	threatLog.Printf("Pre-pulling %d AWF container image(s) for detection job", len(images))
 
 	var b strings.Builder
 	generateDownloadDockerImagesStep(&b, images)
@@ -224,6 +226,7 @@ func (c *Compiler) buildInstallAWFForExternalDetectorStep(data *WorkflowData) []
 		version = firewallConfig.Version
 	}
 
+	threatLog.Printf("Building AWF installation step for external detector (version=%s)", version)
 	step := generateAWFInstallationStep(version, nil)
 	if len(step) == 0 {
 		return nil
@@ -297,6 +300,7 @@ func (c *Compiler) buildExternalDetectorExecutionStep(data *WorkflowData) []stri
 	engineID := c.getExternalThreatDetectionEngineID(data)
 	engine, err := c.getAgenticEngine(engineID)
 	if err != nil {
+		threatLog.Printf("Failed to resolve detection engine %q for external detector execution: %v", engineID, err)
 		return []string{fmt.Sprintf("      # Failed to resolve detection engine %q: %v\n", engineID, err)}
 	}
 

pkg/workflow/threat_detection_inline_engine.go

@@ -17,6 +17,7 @@ func (c *Compiler) buildDetectionEngineExecutionStep(data *WorkflowData) []strin
 	if data.SafeOutputs != nil && data.SafeOutputs.ThreatDetection != nil {
 		if data.SafeOutputs.ThreatDetection.EngineDisabled {
 			// Engine explicitly disabled with engine: false
+			threatLog.Print("Threat detection engine explicitly disabled via engine: false")
 			return []string{
 				"      # AI engine disabled for threat detection (engine: false)\n",
 			}
@@ -49,6 +50,7 @@ func (c *Compiler) buildDetectionEngineExecutionStep(data *WorkflowData) []strin
 	// Get the engine instance
 	engine, err := c.getAgenticEngine(engineSetting)
 	if err != nil {
+		threatLog.Printf("Detection engine %q not found, skipping execution: %v", engineSetting, err)
 		return []string{"      # Engine not found, skipping execution\n"}
 	}
 
@@ -113,6 +115,8 @@ func (c *Compiler) buildDetectionEngineExecutionStep(data *WorkflowData) []strin
 		resolvedDetectionModel = extractPiModelID(resolvedDetectionModel)
 	}
 
+	threatLog.Printf("Resolved inline detection engine %q (original=%q) with model %q", engineSetting, originalEngineID, resolvedDetectionModel)
+
 	// Create minimal WorkflowData for threat detection.
 	// SandboxConfig with AWF enabled ensures the engine runs inside the firewall.
 	// NetworkPermissions.Allowed preserves only literal user-specified domains when Copilot
@@ -154,6 +158,7 @@ func (c *Compiler) buildDetectionEngineExecutionStep(data *WorkflowData) []strin
 	// via BuildStandardNpmEngineInstallSteps) — a duplicate would trip
 	// JobManager.ValidateDuplicateSteps and hard-fail the compile.
 	if engineRequiresNodeHarness(engine) && !installStepsContainNodeSetup(installSteps) {
+		threatLog.Print("Injecting Node.js setup step for detection engine harness")
 		for _, line := range GenerateNodeJsSetupStep() {
 			steps = append(steps, line+"\n")
 		}