Method buildDetectionJobSteps

pkg/workflow/threat_detection_steps.go:16–116

buildDetectionJobSteps builds the threat detection steps to be run in the separate detection job. These steps run after the agent job completes and analyze agent output for threats using the same agentic engine with sandbox.agent and fully blocked network. The detection job downloads the agent artif

(data *WorkflowData)

// same agentic engine with sandbox.agent and fully blocked network.
// The detection job downloads the agent artifact to access the output files.
func (c *Compiler) buildDetectionJobSteps(data *WorkflowData) []string {
	threatLog.Print("Building threat detection steps for detection job")
	if data.SafeOutputs == nil || data.SafeOutputs.ThreatDetection == nil {
		return nil
	}

	var steps []string

	// Comment separator
	steps = append(steps, "      # --- Threat Detection ---\n")

	// Step 0: Clean stale firewall files left by the agent artifact download.
	// The agent artifact populates sandbox/firewall/logs and sandbox/firewall/audit
	// with files that cause the squid container to crash on start-up.
	steps = append(steps, c.buildCleanFirewallDirsStep()...)

	// Step 1: Pull AWF container images - the detection engine runs inside AWF (firewall),
	// so pre-pulling the containers speeds up execution and avoids on-demand pulls.
	//
	// For the inline Codex detection path (gh-aw-detection feature disabled), MCP setup
	// generation already emits this step via generateDownloadDockerImagesStep, so skip here
	// to avoid duplicate step names in the detection job.
	// For the external detector path (gh-aw-detection: true), MCP setup is not called for
	// the detection job, so the download step must be emitted here unconditionally.
	usingExternalDetector := isFeatureEnabled(constants.GHAWDetectionFeatureFlag, data)
	if c.getThreatDetectionEngineID(data) != "codex" || usingExternalDetector {
		steps = append(steps, c.buildPullAWFContainersStep(data)...)
	}

	// Step 2: Detection guard - determines whether detection should run
	steps = append(steps, c.buildDetectionGuardStep()...)

	// Step 3: Clear MCP configuration files so the detection engine runs without MCP servers
	steps = append(steps, c.buildClearMCPConfigStep()...)

	// Step 4: Prepare files - copies agent output files to expected paths
	steps = append(steps, c.buildPrepareDetectionFilesStep()...)

	// Step 5: Custom pre-steps if configured (run before engine execution)
	if len(data.SafeOutputs.ThreatDetection.Steps) > 0 {
		steps = append(steps, c.buildCustomThreatDetectionSteps(data.SafeOutputs.ThreatDetection.Steps)...)
	}

	// Step 6: Setup threat detection (github-script)
	steps = append(steps, c.buildThreatDetectionAnalysisStep(data)...)

	if isFeatureEnabled(constants.GHAWDetectionFeatureFlag, data) {
		// External detector path (features: gh-aw-detection: true)

		// Step 7: Install AWF binary (required for the detection AWF invocation)
		steps = append(steps, c.buildInstallAWFForExternalDetectorStep(data)...)

		// Step 8: Install the selected agentic engine binary for threat-detect execution
		steps = append(steps, c.buildInstallDetectionEngineForExternalDetectorStep(data)...)

		// Step 9: Prepare any engine-specific config files needed by threat-detect.
		steps = append(steps, c.buildPrepareDetectionEngineConfigForExternalDetectorStep(data)...)