Retain firewall and MCP observability artifacts

[Copilot]

Recent workflow runs had firewall and MCP runtime topology active, but most did not retain the key post-run evidence: firewall access.log and MCP JSONL telemetry. That made egress auditing and tool-call reconstruction unreliable after the run completed.

• Artifact retention

  • Adds dedicated mcp-logs artifact uploads for MCP gateway telemetry.
  • Adds dedicated firewall-audit-logs artifact uploads for firewall proxy logs, audit logs, AWF reflect data, and AWF config.
  • Keeps the existing unified agent artifact unchanged.

• Generated workflow output

  • Recompiled workflow lock files so generated workflows now upload observability artifacts explicitly:

- name: Upload MCP observability logs
  if: always()
  continue-on-error: true
  uses: actions/upload-artifact@...
  with:
    name: mcp-logs
    path: |
      /tmp/gh-aw/mcp-logs/
    if-no-files-found: ignore

- name: Upload firewall observability logs
  if: always()
  continue-on-error: true
  uses: actions/upload-artifact@...
  with:
    name: firewall-audit-logs
    path: |
      /tmp/gh-aw/sandbox/firewall/logs/
      /tmp/gh-aw/sandbox/firewall/audit/
      /tmp/gh-aw/sandbox/firewall/awf-reflect.json
      /tmp/gh-aw/awf-config.json
    if-no-files-found: ignore

• Regression coverage
  • Adds focused compiler tests for dedicated MCP and firewall observability uploads.
  • Updates wasm golden outputs to reflect the generated artifact steps.

• Fixes [deep-report] Fix firewall/MCP observability artifact retention — 92.9% of sampled runs missing access.log/gateway.jsonl #51111

[github-actions]

Triage Result

Category: bug · Risk: low · Priority: low (score 20/100 — impact 8, urgency 5, quality 7)
Recommended action: defer

Notes: Early-stage WIP (0 diff yet), draft, agent still forming a plan for observability artifact retention fix. CI: copilot check in progress. Revisit once implementation lands.
Batch: wip-early (grouped with other early-WIP copilot PRs).

Generated by 🔧 PR Triage Agent · auto · 31.2 AIC · ⌖ 2.44 AIC · ⊞ 7.9K · ◷

[Copilot]

Pull request overview

Adds dedicated MCP and firewall observability artifacts so post-run telemetry remains independently downloadable.

Changes:

• Generates mcp-logs and conditional firewall-audit-logs uploads.
• Adds constants, compiler tests, and golden coverage.
• Recompiles generated workflow lock files.

Show a summary per file

File	Description
pkg/constants/constants.go	Defines observability artifact names.
pkg/workflow/compiler_yaml_artifacts.go	Generates dedicated artifact uploads.
pkg/workflow/compiler_yaml_post_agent.go	Adds uploads to post-agent processing.
pkg/workflow/compiler_artifacts_test.go	Tests firewall artifact generation.
pkg/workflow/mcp_logs_upload_test.go	Tests MCP artifact generation.
pkg/workflow/testdata/TestWasmGolden_AllEngines/{claude,codex,copilot,gemini,pi}.golden	Updates engine golden outputs.
pkg/workflow/testdata/TestWasmGolden_CompileFixtures/{basic-copilot,playwright-cli-mode,smoke-copilot,with-imports}.golden	Updates fixture golden outputs.
.github/workflows/*.lock.yml	Recompiles generated workflows with dedicated observability uploads.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 290/290 changed files
• Comments generated: 1
• Review effort level: Balanced

[github-actions]

⚠️ Security scanning failed for Test Quality Sentinel. Review the logs for details.

No test files were added or modified in this PR. Test Quality Sentinel skipped.

[github-actions]

⚠️ Security scanning failed for Matt Pocock Skills Reviewer. Review the logs for details.

[github-actions]

⚠️ PR Code Quality Reviewer failed during code quality review.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

[github-actions]

⚠️ Security scanning failed for Design Decision Gate 🏗️. Review the logs for details.

[github-actions]

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 59.4 AIC · ⊞ 5.5K

[github-actions]

Skills-Based Review 🧠

Applied /codebase-design and /tdd — requesting changes on two issues.

📋 Key Themes & Highlights

Issues

• CLI artifact-set mismatch: ArtifactSetMCP and ArtifactSetFirewall in logs_artifact_set.go still map to the agent artifact. The new dedicated mcp-logs and firewall-audit-logs artifacts won't be fetched by gh aw logs --artifacts mcp/firewall.
• Missing negative test: No test verifies that Upload firewall observability logs is absent when the firewall is disabled (no network: block). This is a correctness guard that should accompany the feature.

Positive Highlights

• ✅ Clean extraction of generateObservabilityArtifactUploads and generateDedicatedArtifactUpload — well-factored helpers.
• ✅ continue-on-error: true + if-no-files-found: ignore is the right defensive posture for optional observability logs.
• ✅ ARC/DinD topology awareness for path resolution is consistently handled.
• ✅ Good regression test coverage for the happy path in both compiler_artifacts_test.go and mcp_logs_upload_test.go.
• ✅ Constants MCPLogsArtifactName and FirewallAuditArtifactName centralised in constants.go.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 48.5 AIC · ⊞ 7.1K
_{Comment /matt to run again}

[github-actions]

[/tdd] Missing test for the firewall-disabled case: when no network: block is present, Upload firewall observability logs should NOT appear in the compiled YAML.

Without this, a regression that unconditionally emits the firewall step would go undetected.

💡 Suggested test outline

func TestNoFirewallObservabilityUploadWhenFirewallDisabled(t *testing.T) {
    // compile a workflow with no 'network:' block
    // assert lockYAML does NOT contain 'Upload firewall observability logs'
    // assert lockYAML DOES contain 'Upload MCP observability logs'
}

@copilot please address this.

[github-actions]

Design Decision Gate — ADR Required

This PR makes significant changes to CI/CD observability infrastructure (>100 new lines in tracked directories) but does not have a linked Architecture Decision Record (ADR).

Draft ADR committed: docs/adr/51153-retain-firewall-mcp-observability-artifacts.md — review and complete it before merging.

This PR cannot merge until an ADR is linked in the PR body.

What to do next

1. Review the draft ADR committed to your branch — it was generated from the PR diff
2. Complete the missing sections — add context the AI could not infer, refine the decision rationale, and list real alternatives you considered
3. Commit the finalized ADR to docs/adr/ on your branch
4. Reference the ADR in this PR body by adding a line such as:
   ADR: ADR-51153: Retain Firewall and MCP Observability Artifacts

Once an ADR is linked in the PR body, this gate will re-run and verify the implementation matches the decision.

Michael Nygard ADR Format Reference

An ADR must contain these four sections to be considered complete:

• Context — What is the problem? What forces are at play?
• Decision — What did you decide? Why?
• Alternatives Considered — What else could have been done?
• Consequences — What are the trade-offs (positive and negative)?

All ADRs are stored in docs/adr/ as Markdown files numbered by PR number.

🏗️ ADR gate enforced by Design Decision Gate 🏗️ · sonnet46 · 39.5 AIC · ⊞ 9.6K · ◷
_{Comment /review to run again}