[log] Add debug logging to 5 workflow-related files

[github-actions]

Summary

This PR enhances debug logging across 5 critical workflow compilation files to improve troubleshooting and development visibility. All files already had logger declarations, so this change adds meaningful logging calls at key execution points.

Files Enhanced

1. pkg/workflow/safe_outputs_config.go

Added logging for safe-outputs configuration extraction:

• Configuration processing start with key count
• Individual output handler enablement (create-issue, create-pull-request)
• Allowed domains configuration
• Default threat detection application
• Final extraction status

2. pkg/workflow/concurrency_validation.go

Added logging for concurrency group expression validation:

• Brace balance checking progress
• Unclosed brace detection with position details
• Expression count and validation status
• Logical operator deep validation
• Parse failure details

3. pkg/workflow/expression_builder.go

Added logging for GitHub Actions expression tree construction:

• AND condition node creation
• Disjunction term count in reaction conditions
• Safe-output type condition building

4. pkg/workflow/redact_secrets.go

Added logging for secret masking operations:

• Secret reference scanning with YAML size
• Unique secret count discovered
• No-op vs. active redaction step generation
• Secret count in redaction steps

5. pkg/workflow/markdown_security_scanner.go

Added logging for security scanning:

• Frontmatter stripping details (lines removed, bytes scanned)
• Individual security category scan execution (6 categories)
• Unicode abuse detection line count
• Final scan results with issue and category counts
• Added helper function countCategories() for summary logging

Quality Guidelines Followed

✅ No side effects - All log arguments are simple values or pre-computed
✅ Meaningful messages - Each log provides context about what's happening
✅ Proper logger naming - All files already used correct pkg:filename pattern
✅ Efficient logging - Used log.Enabled() check for expensive debug info
✅ No test files - Only modified production code
✅ Build validated - Ran make build successfully

Testing

# Build validation
make build  # ✓ PASSED

# Runtime validation
go run ./cmd/gh-aw compile --help  # ✓ Logger output visible in stderr

Cache Updated

Updated workflow cache to track these 5 newly-enhanced files, bringing total tracked files to 19.

---

🤖 Generated with Claude Code

AI generated by Go Logger Enhancement

• expires on Feb 15, 2026, 7:43 AM UTC

[pelikhan]

@copilot remove the if log.Enabled() . just call the log function

[Copilot]

@pelikhan I've opened a new pull request, #15339, to work on those changes. Once the pull request is ready, I'll request review from you.