[log] Add debug logging to guard-policy, arc-dind, and validation helpers

[github-actions]

Overview

Adds namespace-based debug logging (pkg/logger) to five files across the CLI and workflow compiler packages. All changes are additive instrumentation gated by the DEBUG environment variable — no functional or output behavior changes, except one no-op early-return guard.

Files changed

File	Namespace	Notes
pkg/cli/compile_guard_policy_report.go	cli:compile_guard_policy_report	Logs when guard-policy fields are absent, when strict mode/tools are unavailable, and when the dry-run report is printed.
pkg/workflow/awf_arc_dind.go	workflow:awf_arc_dind	Logs engine command path rewriting for arc-dind, missing cached image digests, and the final built AWF image tag.
pkg/workflow/compiler_yaml_main_job.go	(existing compilerYamlLog)	Logs checkout-step generation and completion of main job step generation per workflow.
pkg/workflow/runner_topology_validation.go	(existing runnerTopologyValidationLog)	Logs AWF version checks below the arc-dind minimum, detected root-requiring operations, and successful rootless validation.
pkg/workflow/safe_outputs_allowed_labels_validation.go	(existing safeOutputsAllowedLabelsValidationLog)	Adds an early-return guard when no allowed-labels fields are configured, plus a log line for the number of fields validated.

Behavior notes

• All logging is opt-in via DEBUG=* or scoped namespaces (e.g. DEBUG=cli:compile_guard_policy_report); no output changes in normal (non-debug) runs.
• The early-return in safe_outputs_allowed_labels_validation.go is a no-op optimization: with zero configs, the subsequent loop would not execute and nil would already be returned at the end — no observable behavior change.
• No breaking changes.> Generated by PR Description Updater for [log] Add debug logging to guard-policy, arc-dind, and validation helpers #51298 · auto · 38.8 AIC · ⌖ 4 AIC · ⊞ 6.9K · ◷

[gh-aw-bot]

@copilot Quick triage nudge for this PR.

Please refresh the branch if GitHub can update it cleanly, address the remaining items below, and run the pr-finisher skill before handing back to maintainers.

Open items (newest first):

• re-check reviewer feedback state and confirm any remaining maintainer-facing follow-up

Branch refresh was requested.

Run: https://github.com/github/gh-aw/actions/runs/31239156270

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 13.2 AIC · ⌖ 5.14 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot Quick triage nudge for this PR.

Please refresh the branch if GitHub can update it cleanly, address the remaining items below, and run the pr-finisher skill before handing back to maintaine...

Branch is current with origin/main. Local validation passes: make agent-report-progress (fmt + lint + impacted tests) all green. No unresolved review threads exist on this PR. Ready for maintainer review and CI re-trigger.

[github-actions]

Thanks for this logging enhancement! 📝 The changes look focused and well-intentioned. Here are a couple of items to strengthen the PR:

Test Coverage for Logging

• The new logging additions to guard-policy, arc-dind, and validation helpers lack test coverage. While debug logs are often low-risk, consider adding basic unit tests or integration tests that exercise the logging code paths to verify:
  • Logs are emitted at the expected points in execution
  • Log format and namespace consistency (cli:compile_guard_policy_report, workflow:awf_arc_dind, etc.) is correct
  • No regressions in the wrapped functions

CI Validation

• The PR notes that make build/make fmt could not be run in the authoring sandbox due to Go toolchain mismatch. Please confirm CI build, lint, and test checks pass before merge.

Once test coverage is added or CI validation confirms the build is clean, this should be ready for review. The logging structure and namespace convention are solid!

Generated by ✅ Contribution Check · auto · 58.8 AIC · ⌖ 3.48 AIC · ⊞ 8.7K · ◷

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.86.2