Function generateFirewallLogParsingStep

pkg/workflow/engine_firewall_support.go:125–166

generateFirewallLogParsingStep creates a GitHub Actions step to parse firewall logs and create step summary.

(workflowName string, workflowData *WorkflowData)

// generateFirewallLogParsingStep creates a GitHub Actions step to parse firewall logs and create step summary.
func generateFirewallLogParsingStep(workflowName string, workflowData *WorkflowData) GitHubActionStep {
	// Firewall logs are at a known location in the sandbox folder structure.
	// On ARC/DinD, /tmp/gh-aw is not daemon-visible so logs land under runner.temp/gh-aw.
	firewallLogsDir := constants.AWFProxyLogsDir
	// For env: blocks, use ${{ runner.temp }} (Actions expression) since shell vars aren't expanded there.
	firewallLogsDirEnv := constants.AWFProxyLogsDir
	if isArcDindTopology(workflowData) {
		firewallLogsDir = "${RUNNER_TEMP}/gh-aw/sandbox/firewall/logs"
		firewallLogsDirEnv = "${{ runner.temp }}/gh-aw/sandbox/firewall/logs"
	}
	firewallDir := path.Dir(firewallLogsDir)

	stepLines := []string{
		"      - name: Print firewall logs",
		"        if: always()",
		"        continue-on-error: true",
		"        env:",
		"          AWF_LOGS_DIR: " + firewallLogsDirEnv,
		"        run: |",
	}

	// When sudo is false (network isolation mode), AWF runs rootless so firewall files
	// are not owned by root — skip the sudo chmod permission-fix step.
	if !isAWFNetworkIsolationEnabled(workflowData) {
		stepLines = append(stepLines,
			"          # Fix permissions on firewall logs/audit dirs so they can be uploaded as artifacts",
			"          # AWF runs with sudo, creating files owned by root",
			fmt.Sprintf("          sudo chmod -R a+rX %s 2>/dev/null || true", firewallDir),
		)
	}

	stepLines = append(stepLines,
		"          # Only run awf logs summary if awf command exists (it may not be installed if workflow failed before install step)",
		"          if command -v awf &> /dev/null; then",
		"            awf logs summary | tee -a \"$GITHUB_STEP_SUMMARY\"",
		"          else",
		"            echo 'AWF binary not installed, skipping firewall log summary'",
		"          fi",
	)

	return GitHubActionStep(stepLines)
}

// defaultGetSquidLogsSteps returns the steps for uploading and parsing Squid logs after
// secret redaction. It is shared across engines (Claude, Codex, Copilot) whose