audit: verbose-only error silencing in AuditWorkflowRun produces silent partial failures

[github-actions]

Problem

In pkg/cli/audit.go, the AuditWorkflowRun function (lines 450–543) contains 8+ analysis sub-steps that silently discard errors when verbose=false. This is the default operating mode, meaning users never see these failures.

// pkg/cli/audit.go:451-453
jobDetails, err := fetchJobDetails(run.DatabaseID, verbose)
if err != nil && verbose {
    fmt.Fprintln(os.Stderr, console.FormatWarningMessage(...))
}
// When !verbose: error is silenced; jobDetails is nil; downstream code proceeds with nil

The same if err != nil && verbose pattern appears at lines 451, 457, 463, 469, 475, 481, 498, and more — covering job details, missing tools, missing data, noops, MCP failures, access logs, firewall logs, policy analysis, MCP tool usage, and token usage.

Impact

• Severity: High
• Affected files: pkg/cli/audit.go (8+ locations)
• Risk: Silent partial failures produce audit reports that look complete but are missing data (job details, firewall analysis, etc.) with no indication to the user. This is especially dangerous in automated/CI usage where verbose=false is the default.

Recommendation

Decouple diagnostic verbosity from error visibility. Errors should always be surfaced (at minimum via the auditLog logger), while the details can remain behind the verbose flag:

// Before (silences errors in non-verbose mode)
jobDetails, err := fetchJobDetails(run.DatabaseID, verbose)
if err != nil && verbose {
    fmt.Fprintln(os.Stderr, console.FormatWarningMessage(...))
}

// After (always logs; stderr output stays verbose-gated)
jobDetails, err := fetchJobDetails(run.DatabaseID, verbose)
if err != nil {
    auditLog.Printf("fetchJobDetails failed: %v", err)
    if verbose {
        fmt.Fprintln(os.Stderr, console.FormatWarningMessage(...))
    }
}

Alternatively, consider collecting partial-failure warnings and surfacing them as a summary even in non-verbose mode.

Validation

• Verify that auditLog is always enabled or that the log level is appropriate
• Ensure no regression in existing audit tests
• Test with verbose=false to confirm warnings appear in logs
• Review all if err != nil && verbose occurrences (lines 452, 458, 464, 470, 476, 482, 499, and following)

Estimated Effort: Medium

---

Found by Sergo — Serena Go static analysis, run 2026-05-07

Generated by Sergo - Serena Go Expert · ● 578.5K · ◷

• expires on May 14, 2026, 4:59 AM UTC

[github-actions]

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · ● 91.4K · ◷