[log] Add debug logging to internal/cmd/tracing.go by github-actions[bot] · Pull Request #11650 · github/gh-aw-mcpg

github-actions · 2026-08-21T23:35:30Z

Summary

Adds meaningful debug logging to internal/cmd/tracing.go, specifically to ensureTracingConfig and applyTracingOverrides, which previously had zero debug logging despite containing real control-flow branching around tracing configuration.

Changes

Using the file's existing shared debugLog logger (logger.ForFile(), declared in internal/cmd/root.go):

ensureTracingConfig: log when the gateway's tracing config is nil and gets lazily initialized.
applyTracingOverrides:
- Log the computed shouldInitTracingConfig decision before branching.
- Log when the sample rate is explicitly overridden via CLI flag.
- Log the final resolved endpoint/serviceName after applying overrides.
- Log when no tracing overrides are needed (skip path).

No function signatures changed; log arguments only reference already-computed local variables (no side effects introduced).

Validation

go build -o awmg . — succeeds
go vet ./internal/cmd/... — clean
go test ./internal/cmd/... — passing

Notes

Per the workflow constraints, exactly 1 file was modified and no test files were touched.

Generated by Go Logger Enhancement · auto · 208.1 AIC · ⊞ 13K · ◷

Add debug log calls to ensureTracingConfig and applyTracingOverrides to help troubleshoot tracing configuration decisions (empty config init, whether overrides are needed, sample-rate override, and resulting endpoint/serviceName). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Adds debug visibility to tracing configuration override paths.

Changes:

Logs tracing initialization and override decisions.
Logs sample-rate overrides and skip paths.

Show a summary per file

File	Description
`internal/cmd/tracing.go`	Adds tracing configuration debug logs.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Files reviewed: 1/1 changed files
Comments generated: 1
Review effort level: Balanced

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

github-actions · 2026-08-22T16:57:38Z

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned (3 issues, 3 PRs, README.md, 3 commits)	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all 7 tools absent from catalog	BLOCKED	⚠️
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes	`gh` unauthenticated (no GH_TOKEN)	BLOCKED	⚠️
E	CLI	GraphQL mutations	`gh` unauthenticated (no GH_TOKEN)	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Gaps (not failures):

Part B: All 7 write tools (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) are absent from the MCP tool catalog exposed by the gateway. This confirms the gh-aw framework's GITHUB_READ_ONLY=1 defense-in-depth (tools never registered by backend), but cannot independently confirm gateway-level DIFC/guard enforcement since write tools never reach a write-capable backend. Result: INCONCLUSIVE per methodology.
Parts D & E: gh CLI is not authenticated (GH_TOKEN not set); all REST write and GraphQL mutation probes cannot be executed. No writes were attempted, no writes leaked. Result: INCONCLUSIVE.

No writes leaked. FAIL condition was not triggered.

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

github-actions · 2026-08-22T16:57:59Z

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Tool catalog: 23 tools exposed — all read-only. Zero write tools registered (GITHUB_READ_ONLY=1 backend enforcement).

Part	Surface	Op	Result	Expected	Status
A1	MCP	list_issues	3 issues returned	ALLOWED	✅
A2	MCP	list_pull_requests	3 PRs returned	ALLOWED	✅
A3	MCP	get_file_contents README.md	content returned	ALLOWED	✅
A4	MCP	list_commits	3 commits returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all absent from catalog ("unknown tool")	BLOCKED	⚠️
C1	CLI	list_issues	data returned	ALLOWED	✅
C2	CLI	get_file_contents	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Part B: All 7 write tools absent from the MCP catalog — GITHUB_READ_ONLY=1 prevents the backend from registering write tools entirely. This confirms the framework-level defense-in-depth but does not independently confirm mcpg's own DIFC/guard enforcement layer (which would require a write-capable backend). No write leaked.

⚠️ Parts D/E: gh is unauthenticated (GH_TOKEN not set). REST and GraphQL write blocking could not be validated via token-scope boundary in this run. These rows are INCONCLUSIVE, not PASS.

Run: §32586131675

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

github-actions · 2026-08-22T17:00:09Z

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned via CLI proxy	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	tool absent from catalog	BLOCKED	⚠️
C	CLI	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment)	gh unauthenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Part B: All 7 write targets absent from MCP tool catalog (23 read-only tools registered, 0 write tools). Backend runs with GITHUB_READ_ONLY=1, which prevents write tool registration at the backend level — this is gh-aw's own defense-in-depth, not independent mcpg/DIFC enforcement confirmation. No write leaked; no write tool was callable.

⚠️ Parts D & E: gh CLI is unauthenticated in this environment (GH_TOKEN invalid, HTTP 401). All REST/GraphQL write attempts return 401 Bad credentials — the token-scope boundary and gateway proxy enforcement could not be independently confirmed for this runtime. Not a write leak; unauthenticated responses are not successful writes.

No writes succeeded in any part. Result is INCONCLUSIVE (not FAIL) — same methodology gap as the default and gvisor runs for this workflow.

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime

github-actions Bot added automation enhancement New feature or request labels Aug 21, 2026

lpcox marked this pull request as ready for review August 22, 2026 16:48

Copilot AI balanced review requested due to automatic review settings August 22, 2026 16:48

Copilot started reviewing on behalf of lpcox August 22, 2026 16:49 View session

Copilot AI reviewed Aug 22, 2026

View reviewed changes

Comment thread internal/cmd/tracing.go Outdated

This comment has been minimized.

Sign in to view

github-actions Bot added the readonly-stress-pass-gvisor label Aug 22, 2026

This comment has been minimized.

Sign in to view

github-actions Bot added the readonly-stress-pass-default label Aug 22, 2026

This comment has been minimized.

Sign in to view

Potential fix for pull request finding

b11dde8

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

lpcox merged commit e6f1ff8 into main Aug 22, 2026
38 checks passed

lpcox deleted the log-enhancement-cmd-tracing-4e4bf90137650e9e branch August 22, 2026 17:24

Navigation Menu

Uh oh!

[log] Add debug logging to internal/cmd/tracing.go - #11650

[log] Add debug logging to internal/cmd/tracing.go#11650
lpcox merged 2 commits into
mainfrom
log-enhancement-cmd-tracing-4e4bf90137650e9e

github-actions Bot commented Aug 21, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

github-actions Bot commented Aug 22, 2026

Uh oh!

github-actions Bot commented Aug 22, 2026

Uh oh!

github-actions Bot commented Aug 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

github-actions Bot commented Aug 21, 2026

Summary

Changes

Validation

Notes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

github-actions Bot commented Aug 22, 2026

🔒 mcpg Read-Only Stress — gVisor

Uh oh!

github-actions Bot commented Aug 22, 2026

🔒 mcpg Read-Only Stress — default

Uh oh!

github-actions Bot commented Aug 22, 2026

🔒 mcpg Read-Only Stress — docker-sbx

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants