fix(audit): remove failure_analysis, surface stderr in MCP error messages#18955
Merged
fix(audit): remove failure_analysis, surface stderr in MCP error messages#18955
Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Fix failure_analysis to surface actual errors from logs
fix(audit): remove failure_analysis, surface stderr in MCP error messages
Mar 1, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Removes the auto-generated failure_analysis from the audit tool output and improves MCP error messaging by surfacing actionable stderr content when gh aw audit fails.
Changes:
- Removed
FailureAnalysistypes/logic and stopped emitting/renderingfailure_analysisin audit reports. - Updated MCP
audittool error handling to prefer trimmedstderrovererr.Error()when constructing the main error message. - Updated/removed tests that previously asserted on
failure_analysis.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/cli/mcp_tools_privileged.go | Prefer stderr for MCP audit error messages to provide actionable context. |
| pkg/cli/audit_report.go | Removes FailureAnalysis from AuditData and stops generating it in buildAuditData. |
| pkg/cli/audit_report_analysis.go | Deletes generateFailureAnalysis implementation. |
| pkg/cli/audit_report_render.go | Removes console rendering for the failure analysis section. |
| pkg/cli/audit_report_test.go | Drops failure analysis tests and updates assertions to validate extracted step-log errors. |
| pkg/cli/audit_agent_output_test.go | Removes JSON-structure expectations around failure_analysis. |
| pkg/cli/audit_agent_example_test.go | Removes failure analysis assertions from the example failure scenario. |
Comments suppressed due to low confidence (2)
pkg/cli/audit_report_test.go:1399
- In this subtest, the assertions now validate
data.Errorsextracted from step logs, but the subtest name (thet.Run(...)just above) still refers to building an "error summary". Please rename the subtest to reflect the new behavior so the intent remains clear when reading test output.
data := buildAuditData(processedRun, metrics, nil)
require.NotEmpty(t, data.Errors, "Should have errors extracted from step logs for failed run")
assert.Contains(t, data.Errors[0].Message, "Lockdown mode is enabled",
"Error should contain the actual error from the step log")
pkg/cli/mcp_tools_privileged.go:305
errorDatafor the audit tool omits the executed command/args, which makes debugging harder and is inconsistent with the logs tool above (it includes a "command" field). Consider adding the joinedcmdArgsstring toerrorDatahere as well so structured consumers can reproduce failures more easily.
// Build detailed error data
errorData := map[string]any{
"error": err.Error(),
"exit_code": exitCode,
"stdout": outputStr,
"stderr": stderr,
"run_id_or_url": args.RunIDOrURL,
}
// Use stderr content as the main message when available (provides actionable details)
mainMsg := strings.TrimSpace(stderr)
if mainMsg == "" {
mainMsg = err.Error()
}
return nil, nil, newMCPError(jsonrpc.CodeInternalError, "failed to audit workflow run: "+mainMsg, errorData)
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two bugs in the
auditMCP tool degraded error reporting quality: auto-generatedfailure_analysisalways returned "No specific errors identified" for failed runs, and invalid run IDs returned an opaqueexit status 1with no actionable context.Remove
failure_analysisPer @pelikhan's review: failure analysis is better left to agents. The auto-generated analysis was structurally broken — it only inspected pre-extracted
errors[]which was empty for runs where the agent executed, soerror_summarywas always the default string regardless of what was inagent-stdio.log.Removed:
FailureAnalysisstruct,generateFailureAnalysis,renderFailureAnalysis, and all references acrossaudit_report.go,audit_report_analysis.go,audit_report_render.go, and test files.Surface stderr in MCP audit errors
When
gh aw auditexits non-zero, the MCP tool was building its error message fromerr.Error()(exit status 1) while the human-readable message (e.g. "workflow run 99999999999 not found. Please verify the run ID...") was buried inerrorData.stderr.The detailed error data map (
stdout,stderr,exit_code) is still included for structured consumers.Warning
Firewall rules blocked me from connecting to one or more addresses (expand for details)
I tried to connect to the following addresses, but was blocked by firewall rules:
https://api.github.com/graphql/usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw security 64/bin/go docker pull�� test/concurrent-image:v1.0.0 go /usr/bin/git -json GO111MODULE x_amd64/compile git(http block)https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1/usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha /tmp/go-build2491041519/b421/_pkg_.a -trimpath ache/node/24.13.1/x64/bin/node -p main -lang=go1.25 ache/node/24.13.1/x64/bin/node 1989�� 4N_hV3O2Cg4KalLpCxFj/4N_hV3O2Cg4KalLpCxFj -dwarf=false /usr/bin/git go1.25.0 -c=4 -nolocalimports git(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v3/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha 0724-27865/test-3817069586 GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env ithub-script/git/ref/tags/v8 GO111MODULE 1/x64/bin/node GOINSECURE GOMOD GOMODCACHE 1/x64/bin/node(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v5/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha -b feature-branch /usr/bin/git npx prettier --cgit GOPROXY nch,headSha,disp--show-toplevel git rev-�� --show-toplevel sh /usr/bin/git ub/workflows /opt/hostedtoolcrev-parse 64/bin/go git(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel go /usr/bin/git ithub/workflows GO111MODULE x_amd64/vet git rev-�� --show-toplevel x_amd64/vet /usr/bin/git -json GO111MODULE 64/pkg/tool/linu--show-toplevel git(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v6/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha /tmp/gh-aw-add-gitattributes-test2059866421/.github/workflows/test.md /tmp/gh-aw-add-gitattributes-test2059866421/.github/workflows/test.lock.yml /opt/hostedtoolcache/node/24.13.1/x64/bin/node GOSUMDB GOWORK 64/bin/go node /tmp�� /tmp/TestHashConsistency_GoAndJavaScript1656668779/001/test-simple-frontmatter.md go /usr/bin/git ck 'scripts/**/*git GO111MODULE 64/bin/go git(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha -v GOPROXY /usr/bin/git GOSUMDB GOWORK layTitle git -C /tmp/gh-aw-test-runs/20260301-010724-27865/test-419121033/.github/workflows rev-parse /usr/bin/git ck 'scripts/**/*git GO111MODULE 64/bin/go git(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel x_amd64/compile /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� --show-toplevel go(http block)https://api.github.com/repos/actions/github-script/git/ref/tags/v8/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE go k/gh�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD ode-gyp-bin/node-json ache/go/1.25.0/xGO111MODULE(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha go1.25.0 -c=4 -nolocalimports -importcfg /tmp/go-build2491041519/b392/importcfg -pack /tmp/go-build2491041519/b392/_testmain.go env 6855118/b405/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE b/gh-aw/pkg/stri-o GOMODCACHE go(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD erignore ache/go/1.25.0/xGO111MODULE env 6855118/b417/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/actions/setup-go/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha f/tags/v999.999.999 GOPROXY 1041519/b435/vet.cfg GOSUMDB GOWORK layTitle git rev-�� --show-toplevel go /usr/bin/git ck 'scripts/**/*git GO111MODULE 64/bin/go git(http block)https://api.github.com/repos/actions/setup-node/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha /v1.0.0 GOPROXY /opt/hostedtoolcache/node/24.13.1/x64/bin/node GOSUMDB GOWORK 64/bin/go node /tmp�� /tmp/TestHashConsistency_GoAndJavaScript1656668779/001/test-complex-frontmatter-with-tools.md go /usr/bin/git ck 'scripts/**/*git GO111MODULE 64/bin/go git(http block)https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha -json GO111MODULE g_.a GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile env 1041519/b405/_pkg_.a GO111MODULE 1041519/b405=> GOINSECURE b/gh-aw/pkg/parsrev-parse GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts/usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh run download 1 --dir test-logs/run-1 go /usr/bin/git ithub/workflows/git GO111MODULE 1/x64/bin/node git rev-�� --show-toplevel 1/x64/bin/node /usr/bin/git --noprofile GOPROXY /usr/bin/git git(http block)https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts/usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh run download 12345 --dir test-logs/run-12345 go /usr/bin/git -json GO111MODULE 1/x64/bin/node git rev-�� --show-toplevel 1/x64/bin/node /usr/bin/git -json GO111MODULE /usr/bin/git git(http block)https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts/usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env hub/workflows GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh run download 12346 --dir test-logs/run-12346 go /usr/bin/git sistency_GoAndJagit GO111MODULE /bin/sh git rev-�� --show-toplevel /bin/sh /usr/bin/git echo "��� All vagit(http block)https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts/usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile(http block)/usr/bin/gh gh run download 2 --dir test-logs/run-2 go /usr/bin/git ithub-script/gitgit GO111MODULE 1/x64/bin/node git rev-�� --show-toplevel 1/x64/bin/node /usr/bin/git :latest GOPROXY /usr/bin/git git(http block)https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts/usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go estl�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh run download 3 --dir test-logs/run-3 ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile /usr/bin/git 1041519/b424/_pkgit GO111MODULE 1/x64/bin/node git rev-�� --show-toplevel 1/x64/bin/node /usr/bin/git image:v1.0.0 GOPROXY /usr/bin/git git(http block)https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts/usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh run download 4 --dir test-logs/run-4 ache/go/1.25.0/x64/pkg/tool/linux_amd64/link e/git 1041519/b421/tesgit GO111MODULE 1/x64/bin/node e/git rev-�� --show-toplevel 1/x64/bin/node /usr/bin/git e: ${{ secrets.Tgit GOPROXY 1041519/b421/_pk--show-toplevel git(http block)https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts/usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh run download 5 --dir test-logs/run-5 go /usr/bin/git sistency_GoAndJagit GO111MODULE ache/node/24.13..github/workflows/test.md git rev-�� --show-toplevel bash /usr/bin/git sistency_WithImpgit GOPROXY /usr/bin/git git(http block)https://api.github.com/repos/github/gh-aw/actions/workflows/usr/bin/gh gh workflow list --json name,state,path GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE go env ck 'scripts/**/*GOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE sh(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE x_amd64/link env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE Zm/GFtmVa307QDDNuUCuh0B/7zrZo2ypVmaEewr479zV(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env 3669849299/.github/workflows GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999/usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha -json GO111MODULE At,event,headBranch,headSha,displayTitle GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/nonexistent/repo/actions/runs/12345/usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion t0 GO111MODULE epo.git git rev-�� --show-toplevel /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/compile /usr/bin/git /tmp/go-build249git -trimpath /usr/bin/git git(http block)https://api.github.com/repos/owner/repo/actions/workflows/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE go m/_n�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo /usr/bin/git .test GO111MODULE ortcfg.link git 1/x6�� --show-toplevel VUr98Iun0wk_kdWL8D/o45KJWS6_470XCa_4V22/jVtXMMqsrLOcWH7fjhqo /usr/bin/git -json GO111MODULE g_.a git(http block)https://api.github.com/repos/owner/repo/contents/file.md/tmp/go-build2491041519/b380/cli.test /tmp/go-build2491041519/b380/cli.test -test.testlogfile=/tmp/go-build2491041519/b380/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE ortcfg k/gh�� 35126d5394e2a1caGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD erignore ache/go/1.25.0/xGO111MODULE(http block)/tmp/go-build1549291269/b001/cli.test /tmp/go-build1549291269/b001/cli.test -test.paniconexit0 -test.timeout=10m0s -test.count=1 rev-�� --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git -json GO111MODULE tartedAt,updated--show-toplevel git rev-�� --show-toplevel go /usr/bin/git 0724-27865/test-git GO111MODULE .cfg git(http block)https://api.github.com/repos/test-owner/test-repo/actions/secrets/usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD GOMODCACHE go env ck 'scripts/**/*GOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name --show-toplevel 64/pkg/tool/linux_amd64/vet 1/x64/bin/node -json GO111MODULE ache/go/1.25.0/x--show-toplevel git 1/x6�� --show-toplevel go /usr/bin/git 15785216/.githubgit GO111MODULE .cfg git(http block)If you need me to access, download, or install something from one of these locations, you can either:
Original prompt
💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.