Handle discarded filepath.Glob errors in CLI

[Copilot]

lint-monster flagged 5 call sites in pkg/cli where filepath.Glob errors were discarded, letting malformed patterns or unreadable directories silently collapse to empty matches.

Changes

• pkg/cli/audit_job.go: renderFailingStepSummary now checks the Glob error and surfaces it as a warning instead of dropping it silently.
• pkg/cli/compile_pipeline.go: collectPurgeData now returns (*purgeTrackingData, error); both Glob calls (*.lock.yml, *.invalid.yml) return wrapped errors, propagated by the caller.
• pkg/cli/enable.go: DisableAllWorkflowsExcept checks and returns wrapped errors from both Glob calls (*.yml, *.yaml).

Example (enable.go):

ymlFiles, err:=filepath.Glob(filepath.Join(workflowsDir, "*.yml"))
iferr!=nil {
returnfmt.Errorf("failed to glob .yml files in %s: %w", workflowsDir, err)
}

Behavior for valid glob patterns is unchanged; only the error path now surfaces instead of being swallowed.

• Fixes[lint-monster] lint-monster: handle discarded filepath.Glob errors in CLI #51284

---

Run: https://github.com/github/gh-aw/actions/runs/31240022087> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 17 AIC · ⌖ 5.44 AIC · ⊞ 6.1K · ◷

_{Comment /souschef to run again}

[github-actions]

✅ PR Code Quality Reviewer completed the code quality review.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.individual.githubcopilot.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
allowed:
- defaults
- "api.individual.githubcopilot.com"

See Network Configuration for more information.

🔎 Code quality review by PR Code Quality Reviewer

[github-actions]

✅ Test Quality Sentinel completed test quality analysis.

No test files were added or modified in this PR. Test Quality Sentinel skipped.

🧪 Test quality analysis by Test Quality Sentinel

[github-actions]

✅ Design Decision Gate 🏗️ completed the design decision gate check.

No ADR enforcement needed: PR does not have the 'implementation' label and has 28 new lines of code in business logic directories (threshold: 100).

🏗️ ADR gate enforced by Design Decision Gate 🏗️

[github-actions]

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

[Copilot]

Pull request overview

Handles previously discarded filepath.Glob errors in CLI workflows.

Changes:

• Surfaces glob failures during audit summaries and workflow disabling.
• Propagates purge-file discovery errors through compilation.

Show a summary per file

File	Description
pkg/cli/audit_job.go	Warns when failing-step log discovery fails.
pkg/cli/compile_pipeline.go	Propagates purge glob errors.
pkg/cli/enable.go	Returns errors when workflow file discovery fails.

Review details

Tip

Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 3/3 changed files
• Comments generated: 0
• Review effort level: Balanced

[github-actions]

The changes correctly address silently discarded filepath.Glob errors across three files. Each site uses an appropriate strategy: propagating the error to the caller (compile_pipeline.go, enable.go) or emitting a warning and returning early for the non-fatal audit log case (audit_job.go). No issues found.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 16.1 AIC · ⌖ 7.3 AIC · ⊞ 5.5K

[github-actions]

Skills-Based Review 🧠

Applied /diagnosing-bugs and /tdd — commenting (no blocking changes required, but there are important correctness observations).

📋 Key Themes

Root-cause gap

filepath.Glob in Go returns an error only for malformed patterns (filepath.ErrBadPattern). All patterns here (*.lock.yml, *.invalid.yml, *.yml, *.yaml, job-%d-step-*-failed.log) are syntactically valid compile-time literals — so all new error branches are unreachable. The lint warning was valid (errors were discarded), but the actual risk was low; unreadable directories are silently treated as empty matches by the stdlib.

If the goal is also to catch directory-access problems, the right tool is os.ReadDir(workflowsDir) before the glob calls.

Test coverage

None of the three changed functions have tests. The new error paths cannot be exercised without injecting a malformed pattern, which means the safety net is unverifiable today.

Positive highlights

• ✅ Consistent fmt.Errorf("%w") wrapping throughout — clean and idiomatic
• ✅ compile_pipeline.go correctly updated the function signature and propagated the error to the caller
• ✅ enable.go error messages include the directory path, which aids debugging

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 31.3 AIC · ⌖ 7.16 AIC · ⊞ 7.1K
_{Comment /matt to run again}

[gh-aw-bot]

@copilot Quick triage nudge for this PR.

Please refresh the branch if GitHub can update it cleanly, address the remaining items below, and run the pr-finisher skill before handing back to maintainers.

Open items (newest first):

• failed check: lint-error-messages
• failed check: safe-outputs-conformance
• unresolved review thread from @github-actions: Handle discarded filepath.Glob errors in CLI #51296 (comment)
• unresolved review thread from @github-actions: Handle discarded filepath.Glob errors in CLI #51296 (comment)
• unresolved review thread from @github-actions: Handle discarded filepath.Glob errors in CLI #51296 (comment)

Branch refresh was requested.

Run: https://github.com/github/gh-aw/actions/runs/31240022087

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 17 AIC · ⌖ 5.44 AIC · ⊞ 6.1K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot Quick triage nudge for this PR.

Please refresh the branch if GitHub can update it cleanly, address the remaining items below, and run the pr-finisher skill before handing back to maintaine...

Addressed all open items:

• renderFailingStepSummary now returns error (propagated to its caller renderAuditJobSummary) instead of printing a warning and silently dropping the error signal.
• collectPurgeData now delegates to a new internal collectPurgeDataWithPatterns function that accepts injectable glob patterns, making the error paths exercisable in tests.
• Tests added in compile_pipeline_purge_test.go covering bad lock pattern, bad second pattern, and the valid-pattern happy path — all confirming ErrBadPattern is returned as expected.
• filepath.Abs silent discard in renderAuditJobSummary replaced with a safe fallback to the original path.

The failed CI checks in run 31238124221 were transient cache misses; the branch-refresh run 31240022087 passed with no failures.

[github-actions]

Excellent work on addressing the lint-monster findings! 🎯 This PR properly handles filepath.Glob errors across the CLI that were previously being silently discarded.

What looks great:

• Scoped and focused — Changes are narrow and directly address the 5 error call sites flagged in [lint-monster] lint-monster: handle discarded filepath.Glob errors in CLI #51284
• Error handling — All filepath.Glob calls now properly check and wrap errors with context
• Test coverage — New test cases in compile_pipeline_purge_test.go verify both error and success paths (bad patterns, valid patterns)
• Behavior preservation — Valid glob patterns work unchanged; only error paths now surface properly
• Clear description — PR body explains the problem, solution, and includes concrete examples

Code quality:

• Error messages are informative and include context (directory paths, what was being searched)
• The refactor to collectPurgeDataWithPatterns keeps the core logic testable while mocking patterns
• Consistent with existing CLI error-handling style

This PR looks ready for review. The approach is solid and minimal, staying true to the remediation checklist in #51284.

Generated by ✅ Contribution Check · auto · 58.8 AIC · ⌖ 3.48 AIC · ⊞ 8.7K · ◷

[gh-aw-bot]

@copilot Quick triage nudge for this PR.

Please refresh the branch if GitHub can update it cleanly, address the remaining maintainer-facing follow-up below, and run the pr-finisher skill before handing back to maintainers.

Open items (newest first):

• unresolved review threads from trusted automation still appear to need maintainer-facing resolution even after your follow-up reply; please re-check thread state and ensure every addressed thread is explicitly resolved or answered with the next required action

Branch refresh was requested.

Run: https://github.com/github/gh-aw/actions/runs/31242085824

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 15.9 AIC · ⌖ 5.74 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.86.2