Add debug logging to add-workflow code paths (#61710)

Author: github-actions[bot]

pkg/cli/add_command.go

@@ -204,6 +204,7 @@ func rejectBootstrapProfileForRegularAdd(sources []string, profile *resolvedBoot
 		requestedSources = profile.PackageID
 	}
 
+	addLog.Printf("Rejecting plain add for package %s: aw.yml config requires add-wizard", profile.PackageID)
 	return fmt.Errorf("package %s declares aw.yml config, so 'gh aw add' cannot run its interactive setup. Expected interactive setup via add-wizard for packages with aw.yml config. Example: gh aw add-wizard %s", profile.PackageID, requestedSources)
 }
 

pkg/cli/add_interactive_orchestrator.go

@@ -115,6 +115,7 @@ func RunAddInteractive(ctx context.Context, config *AddInteractiveConfig) error
 		// Local writes stop before remote-only follow-up: repository secret updates,
 		// bootstrap mutations, workflow status polling, and optional dispatch all require
 		// the workflow changes to be present on GitHub.
+		addInteractiveLog.Print("User chose to write files locally; skipping PR and remote follow-up steps")
 		printBootstrapConfigTODO(os.Stderr, remainingBootstrapProfile)
 		config.showLocalWriteInstructions()
 		return nil
@@ -162,8 +163,10 @@ func (c *AddInteractiveConfig) applyBootstrapConfigIfNeeded(ctx context.Context,
 		return nil
 	}
 	if c.hasWriteAccess {
+		addInteractiveLog.Print("Applying bootstrap config: user has write access")
 		return executeBootstrapConfigForAdd(ctx, c.RepoOverride, c.WorkflowSpecs, profile, c.UseCopilotRequests, c.Verbose, c.DisableGitHubAppPermissionInference)
 	}
+	addInteractiveLog.Print("Skipping bootstrap config application: user lacks write access")
 	printBootstrapConfigTODO(os.Stderr, profile)
 	return nil
 }
@@ -240,6 +243,7 @@ func (c *AddInteractiveConfig) prepareAndConfirmAddInteractive() (workflowFiles
 	}
 
 	if !createPR {
+		addInteractiveLog.Print("Wizard stopping before init/secret steps: user declined PR creation")
 		return workflowFiles, nil, "", "", false, nil
 	}
 

pkg/cli/add_package_manifest_skills.go

@@ -126,6 +126,7 @@ func resolvePackageSkillDirFiles(ctx context.Context, owner, repo, ref, host, sk
 // auto-scanned for .md files.
 func resolvePackageAgentFiles(ctx context.Context, owner, repo, packagePath, ref, host string, explicitAgentFiles []string) ([]string, []string, error) {
 	if len(explicitAgentFiles) > 0 {
+		addPackageManifestLog.Printf("Using %d explicit agent file(s) from manifest for %s/%s", len(explicitAgentFiles), owner, repo)
 		var agentFiles []string
 		for _, f := range explicitAgentFiles {
 			if strings.HasPrefix(filepath.ToSlash(f), constants.GithubDir) {
@@ -153,6 +154,7 @@ func resolvePackageAgentFiles(ctx context.Context, owner, repo, packagePath, ref
 			}
 		}
 	}
+	addPackageManifestLog.Printf("Auto-scanned %d agent file(s) for %s/%s (path=%q)", len(agentFiles), owner, repo, packagePath)
 	return agentFiles, nil, nil
 }
 
@@ -214,6 +216,7 @@ func scanRepositoryPackageInstallablePaths(ctx context.Context, owner, repo, pac
 		}
 	}
 
+	addPackageManifestLog.Printf("Scanned %d installable path(s) under %s/%s (path=%q)", len(collected), owner, repo, packagePath)
 	return collected, nil
 }
 
@@ -224,6 +227,7 @@ func resolveRepositoryPackageDocsPath(ctx context.Context, owner, repo, packageP
 	if _, err := downloadPackageFileFromGitHubForHost(ctx, owner, repo, readmePath, ref, host); err == nil {
 		return readmePath, nil
 	} else if isRepositoryFileNotFound(err) {
+		addPackageManifestLog.Printf("Package %s missing required README.md at %q", packageID, readmePath)
 		return "", fmt.Errorf("repository %q is not a valid Agentic Workflow package: missing required README.md at %q. Add a README.md describing the package. Example:\n# My Package\n\nDescribe what this package does", packageID, readmePath)
 	} else {
 		return "", fmt.Errorf("failed to read package README %q from %s/%s@%s (check the repository, ref, and network connectivity): %w", readmePath, owner, repo, ref, err)

pkg/cli/add_workflow_content.go

@@ -37,14 +37,17 @@ func validateWorkflowDestination(githubWorkflowsDir, workflowName, sourceRepo st
 	if sourceRepo != "" {
 		existingSourceRepo := readSourceRepoFromFile(existingFile)
 		if existingSourceRepo == sourceRepo {
+			addLog.Printf("Destination %s already exists from same source repo %s, skipping", existingFile, sourceRepo)
 			fmt.Fprintln(os.Stderr, console.FormatInfoMessage("Workflow from same source already exists, skipping: "+existingFile))
 			return true, nil
 		}
 	}
 	if opts.FromWildcard {
+		addLog.Printf("Destination %s already exists, skipping due to wildcard add", existingFile)
 		fmt.Fprintln(os.Stderr, console.FormatWarningMessage(fmt.Sprintf("Workflow '%s' already exists in .github/workflows/. Skipping.", workflowName)))
 		return true, nil
 	}
+	addLog.Printf("Destination %s already exists and force/wildcard not set, rejecting", existingFile)
 	return false, fmt.Errorf("workflow '%s' already exists in .github/workflows/. Use a different name with -n flag, remove the existing workflow first, or use --force to overwrite", workflowName)
 }
 
@@ -85,15 +88,19 @@ func compileAddedWorkflow(ctx context.Context, destFile string, workflowSpec *Wo
 func validateWorkflowSecurity(resolved *ResolvedWorkflow, opts AddOptions) error {
 	if !opts.DisableSecurityScanner {
 		if findings := workflow.ScanMarkdownSecurity(string(resolved.Content)); len(findings) > 0 {
+			addLog.Printf("Security scan failed for %s: %d finding(s)", resolved.Spec.WorkflowPath, len(findings))
 			fmt.Fprintln(os.Stderr, console.FormatErrorMessage("Security scan failed for workflow"))
 			fmt.Fprintln(os.Stderr, workflow.FormatSecurityFindings(findings, resolved.Spec.WorkflowPath))
 			return fmt.Errorf("workflow '%s' failed security scan: %d issue(s) detected", resolved.Spec.WorkflowPath, len(findings))
 		}
 		if opts.Verbose {
 			fmt.Fprintln(os.Stderr, console.FormatSuccessMessage("Security scan passed"))
 		}
-	} else if opts.Verbose {
-		fmt.Fprintln(os.Stderr, console.FormatWarningMessage("Security scanning disabled"))
+	} else {
+		addLog.Print("Security scanning disabled for this add")
+		if opts.Verbose {
+			fmt.Fprintln(os.Stderr, console.FormatWarningMessage("Security scanning disabled"))
+		}
 	}
 	return nil
 }
@@ -121,9 +128,11 @@ func fetchWorkflowDependencies(ctx context.Context, workflowSpec *WorkflowSpec,
 	// For remote workflows, fetch and save all dependencies (includes, imports, dispatch workflows, resources)
 	if workflowSpec.RawURL != "" {
 		// Generic URL imports carry no GitHub repo context; dependency fetching is skipped.
+		addLog.Print("Skipping dependency fetch: raw URL workflow spec")
 		return nil
 	}
 	if !isLocalWorkflowPath(workflowSpec.WorkflowPath) {
+		addLog.Printf("Fetching remote dependencies for %s", workflowSpec.WorkflowPath)
 		return fetchAllRemoteDependencies(ctx, string(sourceContent), workflowSpec, githubWorkflowsDir, opts.Verbose, opts.Force, tracker)
 	}
 	if sourceInfo == nil || !sourceInfo.IsLocal {
@@ -325,6 +334,7 @@ func trackAndWriteWorkflowFile(destFile string, content string, fileExists bool,
 	if err != nil {
 		return fmt.Errorf("failed to read back destination file '%s': %w", destFile, err)
 	}
+	addLog.Printf("Wrote workflow file %s (%d bytes, existed=%t)", destFile, len(writtenContent), fileExists)
 	if !opts.Quiet {
 		fmt.Fprintln(os.Stderr, console.FormatSuccessMessage("Added workflow: "+filepath.Base(destFile)))
 		if opts.Verbose {