Skip to content

Consolidate Daily DIFC Analyzer + Firewall Reporter into unified Daily Security Observability workflow#28831

Merged
pelikhan merged 2 commits intomainfrom
copilot/deep-report-consolidate-daily-observability
Apr 28, 2026
Merged

Consolidate Daily DIFC Analyzer + Firewall Reporter into unified Daily Security Observability workflow#28831
pelikhan merged 2 commits intomainfrom
copilot/deep-report-consolidate-daily-observability

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Apr 28, 2026

Two daily workflows (daily-integrity-analysis, daily-firewall-report) covered the same security observability domain with ~70% behavioral overlap, burning ~2.49M tokens/week unnecessarily.

Changes

  • New: daily-security-observability.md — unified workflow structured as:
    • Phase 1–2: Firewall log collection + analysis (domain blocks, policy rule attribution, trend charts)
    • Phase 3–4: DIFC integrity-filtered event collection + statistical chart generation
    • Phase 5: Single combined GitHub Discussion covering both signals
  • Removed: daily-integrity-analysis.md/lock.yml and daily-firewall-report.md/lock.yml
  • Docs: Updated agent-factory-status.mdx and patterns/daily-ops.md to reference the consolidated workflow

Design notes

  • Based on the DIFC analyzer's prompt structure (more complex of the two)
  • Merged toolsets: agentic-workflows, github (all), bash, edit, mount-as-clis
  • safe-outputs.upload-asset max bumped to 5 (2 firewall charts + 3 DIFC charts)
  • Shared cache path: /tmp/gh-aw/cache-memory/security-observability/
  • Both data-empty early-exit paths preserved independently (either signal can be missing without aborting the other)
  • Timeout raised to 60 min to accommodate the combined workload

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw %H %ct %D (http block)
    • Triggering command: /usr/bin/gh gh repo view --json owner,name --jq .owner.login + "/" + .name ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet name --local $name) { has--show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet api graphql -f .cfg -f owner=github -f ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/orgs/test-owner/actions/secrets
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name k/gh-aw/gh-aw/.github/workflows format:cjs l l (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv --show-toplevel 64/pkg/tool/linu/tmp/go-build2952864170/b112/vet.cfg /usr/bin/git se 2864170/b012/vetrev-parse ache/go/1.25.8/x--show-toplevel git rev-�� --show-toplevel ache/go/1.25.8/x64/pkg/tool/linuremote.origin.url /usr/bin/git se 2864170/b144/vet/opt/hostedtoolcache/node/24.14.1/x64/bin/npm .cfg git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv /tmp/TestHashConsistency_GoAndJavaScript3326672529/001/test-frontmatter-with-arrays.md x_amd64/vet /opt/hostedtoolcache/node/24.14.1/x64/bin/node ithub/workflows (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv 1635-18146/test---workflow show ache/go/1.25.8/x--limit tions-lock.json infocmp gpg.program r: $owner, name:xterm-color ache/go/1.25.8/x64/pkg/tool/linu-goversion -uns�� -unreachable=false /tmp/go-build2952864170/b032/vet-nolocalimports ache/go/1.25.8/x64/pkg/tool/linu-importcfg ormat:pkg-json -git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/go/1.25.8/x64/pkg/tool/linutest@example.com /usr/bin/git se 2864170/b249/vet\n ache/go/1.25.8/x: git rev-�� --show-toplevel ache/go/1.25.8/xconfig /usr/bin/git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git ithub/workflows/git stmain.go /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel s/4/artifacts /usr/bin/infocmp--show-toplevel git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv ignore-path ../../../.prettierignore taviz.md (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv */*.ts' '**/*.jsremote.origin.url core.hooksPath /usr/sbin/git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv */*.ts' '**/*.jsremote.origin.url core.hooksPath tions/setup/node_modules/.bin/no-f (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/go/1.25.8/xconfig /usr/bin/git 2864170/b422/_pkgit -buildtags 2864170/b422=> git rev-�� --show-toplevel /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /usr/bin/git sMw6/OczptQUAQisgit /tmp/go-build295rev-parse trepo.git git (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v9
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv --noprofile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv te '../../../**/*.json' '!../../remote.origin.url (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv ithub/workflows piler_error_formgithub.com/github/gh-aw/cmd/gh-aw yml (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv jbdp/iQdC-QY6gnuLT2Ajjbdp 64/pkg/tool/linux_amd64/vet /usr/bin/infocmp _QdOprojJ (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv HIFr/iLX4908EimRzvG1AHIFr test@example.com /usr/bin/git ithub/workflows --write x_amd64/vet git 2864�� --show-toplevel 2864170/b452/_testmain.go /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/link "prettier" --wrigit erena-mcp-serverrev-parse x_amd64/vet /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/link (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv LOMB/xpa6XnnaqrV1sXfXLOMB 64/pkg/tool/linux_amd64/vet /usr/bin/gh YZCq8JVo5 show 64/pkg/tool/linu--show-toplevel 2864170/b471/importcfg run k/gh-aw/gh-aw/pkg/workflow/features_import_test.go k/gh-aw/gh-aw/pkg/workflow/import_schema_test.go /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet test-logs/run-2 .cfg .cfg /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv */*.ts' '**/*.js-f core.hooksPath ache/uv/0.11.8/x-f (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv -bool -buildtags ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile -errorsas -ifaceassert -nilfunc ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile -ato�� 2864170/b433/_pkg_.a -buildtags 2864170/b433=> -errorsas b/gh-aw/pkg/parsrev-parse -nilfunc infocmp (http block)
  • https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv ithub/workflows/architecture-guardian.md rev-parse /usr/bin/git 2207845089/001' 2207845089/001' cision-gate.lock--show-toplevel git init�� 64/bin/git sh rue,"errors":[],"warnings":[]}] ithub/workflows (http block)
  • https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv (http block)
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv h ../../../.pret.prettierignore (http block)
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq [.object.sha, .object.type] | @tsv h ../../../.prettierignore (http block)
  • https://api.github.com/repos/github/gh-aw
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .default_branch --verify main r: $owner, name: $name) { hasDiscussionsEnabled } } (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git itmaster_branch1git itmaster_branch1rev-parse 64/pkg/tool/linu--show-toplevel /usr/bin/git remo�� -v 64/pkg/tool/linux_amd64/vet /usr/bin/git y_with_explicit_git rev-parse .cfg git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv k/gh-aw/gh-aw/pkg/cli config /usr/bin/git l (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv --show-toplevel l /usr/bin/git ithub/workflows (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-04-21 (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-03-29 (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-01-28 (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name -f 64/pkg/tool/linux_amd64/compile l owner=github DiscussionsEnabl--show-toplevel 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 config 64/pkg/tool/linux_amd64/link l --local ndor/bin/bash 64/pkg/tool/linux_amd64/link -C util.test rev-parse ck get --local ache/go/1.25.8/x--show-toplevel iUEqf5PFeb3NCkL0nF/2rw-RdHCw_apH--jq (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name go-udiff@v0.4.1/export.go 64/pkg/tool/linux_amd64/vet l owner=github -f 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 .cfg 64/pkg/tool/linu-importcfg --get-regexp --global DiscussionsEnabl--show-toplevel 64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name .cfg 64/pkg/tool/linux_amd64/compile o actions/setup-git --global DiscussionsEnabl--show-toplevel 64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 erena-mcp-server:latest 64/pkg/tool/linux_amd64/vet remote.origin.urgit --global git 64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name git 64/pkg/tool/linux_amd64/link on' --ignore-patgit --local ache/go/1.25.8/x--show-toplevel 64/pkg/tool/linux_amd64/link imag�� 845191835 ghcr.io/github/serena-mcp-server:latest ortcfg.link ./../pkg/workflogit /testdeps DiscussionsEnabl--show-toplevel UB4Z85HNraJd7B2VBq/aMwv_nfK75JUCconfig (http block)
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 .cfg .cfg on' --ignore-patgit --local $name) { hasDiscussionsEnabl--show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile api 1635-18146/test-source-field-variant-3617980038/.github/workflows -f ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet -f b/gh-aw/pkg/testrev-parse -f ache/go/1.25.8/x64/pkg/tool/linu-test.v=true (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name .cfg 64/pkg/tool/linu-lang=go1.25 on' --ignore-patgit --local $name) { has--show-toplevel 64/pkg/tool/linu-dwarf=false -C /home/REDACTED/worgo1.25.8 rev-parse ache/go/1.25.8/x-nolocalimports ./../pkg/workflonode --local k/_temp/uv-pytho/home/REDACTED/work/gh-aw/gh-aw/.github/workflows/approach-validator.md ache/go/1.25.8/x/tmp/go-build2952864170/b472/_testmain.go (http block)
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 config .cfg l --local DiscussionsEnabl--git-dir ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile imag�� 1635-18146/test-source-field-variant-3617980038/remote.origin.url ghcr.io/github/serena-mcp-server:latest .cfg get --local r: $owner, name:--show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name config 64/pkg/tool/linux_amd64/compile l --local k/gh-aw/gh-aw/.g--show-toplevel 64/pkg/tool/linux_amd64/compile -C g_.a config .cfg remote.origin.urgit chr/testify/asserev-parse l ache/go/1.25.8/x64/pkg/tool/linu-trimpath (http block)
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 rev-parse .cfg on' --ignore-patgit --local odules/npm/node_--show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile -C 1635-18146/test-source-field-variant-3617980038/.github/workflows show .cfg get --local 86_64/bash ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name om/stretchr/test-c=4 x_amd64/vet on' --ignore-patgit --local ortcfg.link Vgol9MA/jtMHmSR1PwQ4sKWnT8ry -C .test show ortcfg.link ./../pkg/workflogit --local r: $owner, name:--show-toplevel V956ioVewAmv6CbPgJ/VnH09KtbB1Xdi-dwarf=false (http block)
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 l_test.go .cfg remote.origin.urnode --local k/gh-aw/gh-aw/.g/home/REDACTED/work/gh-aw/gh-aw/.github/workflows/agentic-observability-kit.md ache/go/1.25.8/x64/pkg/tool/linu--jq -C 1474369671/custom/workflows show .cfg ./../pkg/workflogit ithub/workflows/init nfig/composer/vendor/bin/git ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path run format:cjs repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 --global ules/.bin/pretti--get-regexp 64/pkg/tool/linu^remote\..*\.gh-resolved$ (http block)
  • https://api.github.com/repos/github/gh-aw/contents/.github/workflows/shared/reporting.md
    • Triggering command: /tmp/go-build2952864170/b404/cli.test /tmp/go-build2952864170/b404/cli.test -test.testlogfile=/tmp/go-build2952864170/b404/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/go/1.25.8/x--json /usr/bin/git /home/REDACTED/worgit show x_amd64/vet git rev-�� --show-toplevel x_amd64/vet /usr/bin/git -unreachable=faldu /tmp/go-build295-k e/git git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv 29/001/test-simple-frontmatter.md 2864170/b085/vet.cfg .cfg ../pkg/workflow/git --local $name) { has--show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv ithub/workflows ../../../**/*.js-test.run=^Test x_amd64/vet --ignore-path ../../../.prettiworkflow ed } } x_amd64/vet api graphql -f x_amd64/vet -f owner=github DiscussionsEnabled } } x_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv --write ../../../**/*.json x_amd64/vet --ignore-path ../../../.pretticonfig DiscussionsEnabl--get-regexp x_amd64/vet -C k/gh-aw/gh-aw/.github/workflows config x_amd64/vet remote.origin.urgit (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv ithub/workflows ../../../**/*.jsgithub.com/github/gh-aw/pkg/parser x_amd64/vet --ignore-path ../../../.pretti-C (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv k/gh-aw/gh-aw/.github/workflows ../../../**/*.json x_amd64/vet l ../../../.pretti-C (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv --write :latest x_amd64/vet --ignore-path ../../../.prettirev-parse (http block)
  • https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv plorer.md 2864170/b055/vet.cfg .cfg ../pkg/workflow/git --local ache/uv/0.11.8/x--get ache/go/1.25.8/xremote.origin.url (http block)
  • https://api.github.com/repos/nonexistent/repo/actions/runs/12345
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion get --local 1/x64/bin/bash ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/owner/repo/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo /snap/bin/sh l (http block)
    • Triggering command: /usr/bin/gh gh workflow list --repo owner/repo --json name,path,state ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet it} --local DiscussionsEnabl--get ache/go/1.25.8/xremote.origin.url (http block)
  • https://api.github.com/repos/test-owner/test-repo/actions/secrets
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name ithub/workflows --silent kflows/ai-moderator.lock.yml (http block)
  • https://api.github.com/repos/test/repo
    • Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch /home/REDACTED/work/gh-aw/gh-aw/.github/workflows config x_amd64/vet remote.origin.urgit --local n-dir/bash x_amd64/vet -C /home/REDACTED/work/gh-aw/gh-aw/.github/workflows config ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet remote.origin.urgh user.email /snap/bin/git ache/go/1.25.8/x4 (http block)

If you need me to access, download, or install something from one of these locations, you can either:

…ly-security-observability

Closes #<issue_number>

- Create daily-security-observability.md combining firewall traffic analysis
  (Phase 1-2) and DIFC integrity-filtered event analysis (Phase 3-4) with a
  single unified discussion output
- Compile daily-security-observability.lock.yml
- Remove daily-integrity-analysis.md and daily-integrity-analysis.lock.yml
- Remove daily-firewall-report.md and daily-firewall-report.lock.yml
- Update docs/agent-factory-status.mdx and patterns/daily-ops.md

Saves ~2.49M tokens/week by eliminating one daily run while producing a more
actionable unified security intelligence report.

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/a607ecfe-384b-442b-94fe-21cd4cdba0ae

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
Copilot AI changed the title [WIP] Consolidate Daily DIFC Analyzer and Firewall Reporter workflows Consolidate Daily DIFC Analyzer + Firewall Reporter into unified Daily Security Observability workflow Apr 28, 2026
Copilot AI requested a review from gh-aw-bot April 28, 2026 01:22
@pelikhan pelikhan marked this pull request as ready for review April 28, 2026 01:24
Copilot AI review requested due to automatic review settings April 28, 2026 01:24
@pelikhan pelikhan merged commit ee14226 into main Apr 28, 2026
19 checks passed
@pelikhan pelikhan deleted the copilot/deep-report-consolidate-daily-observability branch April 28, 2026 01:24
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Consolidates the previously separate daily firewall and DIFC integrity observability workflows into a single “Daily Security Observability” workflow and updates documentation to reference the unified report.

Changes:

  • Adds/updates daily-security-observability workflow + lock file to produce a combined firewall + DIFC discussion (with up to 5 uploaded charts) and longer timeout.
  • Removes the standalone daily-firewall-report workflow + lock file.
  • Updates docs to point to the consolidated workflow.
Show a summary per file
File Description
docs/src/content/docs/patterns/daily-ops.md Updates DailyOps workflow list to reference the unified security observability workflow.
docs/src/content/docs/agent-factory-status.mdx Replaces DIFC and firewall rows with a single “Daily Security Observability Report” entry.
.github/workflows/daily-security-observability.md Defines the consolidated workflow prompt/phases, toolsets, safe-outputs, and reporting template.
.github/workflows/daily-security-observability.lock.yml Compiled workflow reflecting the new workflow name/id, permissions, timeout, and assets limit.
.github/workflows/daily-firewall-report.md Removes the standalone firewall workflow definition.
.github/workflows/daily-firewall-report.lock.yml Removes the standalone firewall compiled workflow.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (7)

.github/workflows/daily-security-observability.lock.yml:460

  • The lock workflow now uploads two artifacts containing the same Python sources/data (python-source-and-data and trending-source-and-data). This duplicates storage and upload time on every run. Consider consolidating to a single artifact (or ensure the two artifacts have distinct content/purpose).
    .github/workflows/daily-security-observability.md:6
  • The schedule comment says "Every day at 10am UTC", but the workflow uses - cron: daily, which resolves to a scattered time (see lock file cron). Either switch to an explicit cron expression for 10:00 UTC or update/remove the comment to avoid misleading maintainers.
    .github/workflows/daily-security-observability.md:83
  • This line states both datasets cover the last 7 days, but the firewall trend chart requirements later call for a 30-day window. Please align the analysis window wording and collection steps (either collect 30 days of firewall runs/data, or change the chart spec to 7 days).

This issue also appears on line 152 of the same file.
.github/workflows/daily-security-observability.md:154

  • The firewall trend chart spec asks for allowed vs blocked requests "over the last 30 days", but Phase 1 only collects firewall-enabled runs from the last 7 days. With the current collection step, the chart can't legitimately represent 30 days. Either expand the firewall run collection to 30 days or update the chart description/window.
    .github/workflows/daily-security-observability.md:434
  • The safe-output tool is named upload_asset, but this section refers to the upload asset tool (with a space). This is likely to cause the agent to call a non-existent tool. Rename references to upload_asset for consistency with the safe-outputs tool name.
    .github/workflows/daily-security-observability.md:455
  • The instructions say to use h3 (###) and lower for all headers, but the provided template introduces ## headers (e.g., firewall/DIFC sections). If downstream reporting linting expects h3+, this will violate the guideline. Please update the template headings to be consistent with the stated requirement.
    .github/workflows/daily-security-observability.md:444
  • Phase 5 instructs creating a discussion unconditionally, but the "Important" section later says to call noop if both datasets are empty. To avoid creating empty discussions, please make the Phase 5 instruction conditional (only create a discussion when at least one dataset has data; otherwise call noop).
  • Files reviewed: 6/6 changed files
  • Comments generated: 0

@github-actions
Copy link
Copy Markdown
Contributor

Hey @Copilot 👋 — great work consolidating the daily-integrity-analysis and daily-firewall-report workflows into a single unified daily-security-observability workflow! The token savings rationale (~2.49M tokens/week eliminated) is well-articulated, and the design notes clearly explain the structural decisions.

One thing to consider before this is reviewed:

  • Add tests — the diff touches the workflow definition files (.md and .lock.yml) but no test files are included. Even a smoke-level test asserting the merged workflow structure parses correctly, or that the expected phases/tool sets are present, would help reviewers gain confidence in the consolidation.

If you'd like to address this automatically, here's a ready-to-use agent prompt:

Add a test for the new unified daily-security-observability workflow in .github/workflows/daily-security-observability.md.
The test should verify:
1. All five phases are present (firewall log collection, firewall analysis, DIFC event collection, DIFC chart generation, combined discussion posting).
2. The merged toolset includes agentic-workflows, github, bash, edit, and mount-as-clis.
3. The safe-outputs upload-asset max is set to 5.
4. Both early-exit paths (missing firewall data and missing DIFC data) are independently preserved.
Place the test in the appropriate test directory following existing test conventions in the repository.

Generated by Contribution Check · ● 1.1M ·

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[deep-report] Consolidate Daily DIFC Analyzer + Daily Firewall Reporter into single Daily Security Observability workflow

4 participants