[log] Add debug logging to workflow and CLI helper functions

[github-actions]

Adds structured debug log statements to five files that previously lacked logging in key helper and render functions.

Changes

• pkg/cli/audit_report_render.go: Added entry logs to renderFirewallAnalysis, renderRedactedDomainsAnalysis, renderKeyFindings, renderRecommendations, and renderPerformanceMetrics using the shared auditReportLog logger
• pkg/workflow/dispatch_workflow_validation.go: Added entry logs to extractWorkflowDispatchInputs, findWorkflowFile (with result summary), and mdHasWorkflowDispatch
• pkg/workflow/mcp_gateway_config.go: Added logs to buildMCPGatewayConfig (sandbox-disabled path + build path) and isAgentSandboxDisabled (when disabled)
• pkg/workflow/template_injection_validation.go: Added log to detectExpressionContext showing the expression and detected context
• pkg/workflow/expression_safety_validation.go: Added entry log to validateExpressionForDangerousProps showing the expression being checked

Test plan

• make build passes
• go test ./pkg/workflow/... passes (23.6s)
• Verify debug output appears when GH_AW_LOG includes workflow:* patterns

Generated by Go Logger Enhancement · ◷

• expires on Mar 21, 2026, 8:35 PM UTC

---

Note

This was originally intended as a pull request, but PR creation failed. The changes have been pushed to the branch log/add-debug-logging-2026-03-19-fc58fb6203ee37dc.

Original error: Validation Failed: {"resource":"Label","code":"unprocessable","field":"data","message":"Could not resolve to a node with the global id of 'PR_kwDOPc1QR87L9qsl'."}

To create the pull request manually:

gh pr create --title "[log] Add debug logging to workflow and CLI helper functions" --base main --head log/add-debug-logging-2026-03-19-fc58fb6203ee37dc --repo github/gh-aw

Show patch preview (158 of 158 lines)

From ab42adab6247a265a6a0faf6601d97d0c57da4cd Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Thu, 19 Mar 2026 20:34:03 +0000
Subject: [PATCH] Add debug logging to workflow and CLI helper functions

Add structured debug log statements to five files that previously lacked
logging in key helper and render functions:
- pkg/cli/audit_report_render.go: renderFirewallAnalysis, renderRedactedDomainsAnalysis, renderKeyFindings, renderRecommendations, renderPerformanceMetrics
- pkg/workflow/dispatch_workflow_validation.go: extractWorkflowDispatchInputs, findWorkflowFile, mdHasWorkflowDispatch
- pkg/workflow/mcp_gateway_config.go: buildMCPGatewayConfig, isAgentSandboxDisabled
- pkg/workflow/template_injection_validation.go: detectExpressionContext
- pkg/workflow/expression_safety_validation.go: validateExpressionForDangerousProps

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 pkg/cli/audit_report_render.go                | 7 +++++++
 pkg/workflow/dispatch_workflow_validation.go  | 4 ++++
 pkg/workflow/expression_safety_validation.go  | 1 +
 pkg/workflow/mcp_gateway_config.go            | 8 +++++++-
 pkg/workflow/template_injection_validation.go | 1 +
 5 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/pkg/cli/audit_report_render.go b/pkg/cli/audit_report_render.go
index d0cd841..867a1d1 100644
--- a/pkg/cli/audit_report_render.go
+++ b/pkg/cli/audit_report_render.go
@@ -346,6 +346,8 @@ func renderMCPToolUsageTable(mcpData *MCPToolUsageData) {
 
 // renderFirewallAnalysis renders firewall analysis with summary and domain breakdown
 func renderFirewallAnalysis(analysis *FirewallAnalysis) {
+	auditReportLog.Printf("Rendering firewall analysis: total=%d, allowed=%d, blocked=%d, allowed_domains=%d, blocked_domains=%d",
+		analysis.TotalRequests, analysis.AllowedRequests, analysis.BlockedRequests, len(analysis.AllowedDomains), len(analysis.BlockedDomains))
 	// Summary statistics
 	fmt.Fprintf(os
... (truncated)