[file-diet] File Diet: refactor pkg/workflow/awf_helpers.go (1148 lines)

[github-actions]

Overview

The file pkg/workflow/awf_helpers.go has grown to 1148 lines, making it difficult to maintain and test. This task involves refactoring it into smaller, focused files with improved test coverage.

Current State

• File: pkg/workflow/awf_helpers.go
• Size: 1148 lines
• Test Coverage: pkg/workflow/awf_helpers_test.go exists at 2697 lines (~2.35x ratio) — good raw volume, but concentrated on a monolithic file
• Complexity: Mixes command/argument construction, environment variable filtering, container digest lookups, shell wrapping, and a long block of awfSupports* feature-flag helper functions

Full File Analysis

Function Inventory (29 top-level functions)

• shouldUseWorkflowCallNetworkAllowedInput (L123)
• buildModelsJSONPathExportScript (L130)
• rewriteArcDindPath (L138)
• rewriteArcDindEngineCommand (L142)
• applyDefaultMaxAICreditsEnvToMap (L153)
• injectMaxAICreditsExpression (L182)
• buildWorkflowCallNetworkAllowedUpdateScript (L197)
• BuildAWFCommand (L229) — ~400 lines, by far the largest single function in the file
• BuildAWFArgs (L630) — ~180 lines
• GetAWFCommandPrefix (L809)
• buildAWFImageTagWithDigests (L838)
• lookupContainerDigest (L875)
• WrapCommandInShell (L898)
• ComputeAWFExcludeEnvVarNames (L930) — ~100 lines
• addCliProxyGHTokenToEnv (L1028)
• awfSupportsExcludeEnv (L1041)
• awfVersionAtLeast (L1049)
• awfSupportsCliProxy (L1059)
• awfSupportsAllowHostPorts (L1065)
• awfSupportsDockerHostPathPrefix (L1071)
• awfSupportsTokenSteering (L1077)
• awfSupportsChrootConfig (L1083)
• awfSupportsContainerRuntime (L1090)
• awfSupportsLegacySecurity (L1097)
• awfSupportsDefaultAiCreditsPricing (L1103)
• awfSupportsAPIProxyProviders (L1109)
• awfSupportsBoundedQueries (L1115)
• buildArcDindChrootConfigPatchBody (L1126)
• buildArcDindChrootConfigPatchBodyBash (L1139)

Complexity Hotspots

• BuildAWFCommand (L229–629, ~400 lines) is a single function responsible for assembling the entire awf invocation: network config, credit limits, chroot config, ARC/DinD path rewriting, and image digest resolution. This is the primary refactoring target.
• BuildAWFArgs (L630–808, ~180 lines) duplicates much of the same conditional logic as BuildAWFCommand for constructing an argument-list variant, indicating overlapping responsibility that could share a common builder/options struct.
• The 12 awfSupports* / awfVersionAtLeast functions (L1041–1125) form a clearly separable "feature capability" module — all pure version-gate checks against FirewallConfig.
• ARC/DinD path- and command-rewriting helpers (rewriteArcDindPath, rewriteArcDindEngineCommand, buildArcDindChrootConfigPatchBody*) form another cohesive, small module.

Refactoring Strategy

Proposed File Splits

1. awf_command_builder.go

   • Functions: BuildAWFCommand, BuildAWFArgs, GetAWFCommandPrefix, WrapCommandInShell
   • Responsibility: Core assembly of the awf CLI invocation (command string and argument list variants)
   • Estimated LOC: ~650

2. awf_feature_flags.go

   • Functions: awfVersionAtLeast, awfSupportsExcludeEnv, awfSupportsCliProxy, awfSupportsAllowHostPorts, awfSupportsDockerHostPathPrefix, awfSupportsTokenSteering, awfSupportsChrootConfig, awfSupportsContainerRuntime, awfSupportsLegacySecurity, awfSupportsDefaultAiCreditsPricing, awfSupportsAPIProxyProviders, awfSupportsBoundedQueries
   • Responsibility: Version-gated feature capability checks against FirewallConfig
   • Estimated LOC: ~90

3. awf_env.go

   • Functions: ComputeAWFExcludeEnvVarNames, addCliProxyGHTokenToEnv, applyDefaultMaxAICreditsEnvToMap, injectMaxAICreditsExpression
   • Responsibility: Environment variable computation/filtering and AI-credit expression injection for the AWF container
   • Estimated LOC: ~150

4. awf_arc_dind.go

   • Functions: rewriteArcDindPath, rewriteArcDindEngineCommand, buildArcDindChrootConfigPatchBody, buildArcDindChrootConfigPatchBodyBash, buildAWFImageTagWithDigests, lookupContainerDigest
   • Responsibility: ARC/DinD-specific path rewriting, chroot config patch bodies, and image digest resolution
   • Estimated LOC: ~150

Shared Utilities

Extract common functionality into:

• awf_helpers.go (retained, trimmed): keep only small shared scaffolding (buildModelsJSONPathExportScript, shouldUseWorkflowCallNetworkAllowedInput, buildWorkflowCallNetworkAllowedUpdateScript) plus the AWFCommandConfig type and any package-level constants used across the new files
• Consider extracting a shared internal awfCommandOptions struct/builder used by both BuildAWFCommand and BuildAWFArgs to eliminate the current logic duplication between them

Interface Abstractions

• Introduce a small awfFeatureGate interface (or keep as free functions grouped in awf_feature_flags.go) so command-builder code depends on a narrow capability-check surface rather than the full FirewallConfig struct — improves testability and mockability.

Test Coverage Plan

1. awf_command_builder_test.go

   • Test cases: BuildAWFCommand with network-allowed/disallowed configs, max-AI-credits injection, chroot config variants, ARC/DinD path rewriting integration, BuildAWFArgs equivalence with BuildAWFCommand, GetAWFCommandPrefix prefix correctness, WrapCommandInShell quoting/escaping edge cases
   • Target coverage: >80%

2. awf_feature_flags_test.go

   • Test cases: each awfSupports* function across version boundaries (below/at/above min version), awfVersionAtLeast with malformed/missing version strings
   • Target coverage: >80%

3. awf_env_test.go

   • Test cases: ComputeAWFExcludeEnvVarNames with core secret var overlaps, addCliProxyGHTokenToEnv when proxy enabled/disabled, applyDefaultMaxAICreditsEnvToMap default vs explicit values, injectMaxAICreditsExpression expression substitution correctness
   • Target coverage: >80%

4. awf_arc_dind_test.go

   • Test cases: rewriteArcDindPath/rewriteArcDindEngineCommand with and without ARC/DinD enabled, chroot config patch body generation (JSON and bash variants), buildAWFImageTagWithDigests/lookupContainerDigest with cached vs missing digests

Implementation Guidelines

1. Preserve Behavior: Ensure all existing functionality works identically
2. Maintain Exports: Keep public API unchanged (exported functions/types)
3. Add Tests First: Write tests for each new file before refactoring
4. Incremental Changes: Split one module at a time
5. Run Tests Frequently: Verify make test-unit passes after each split
6. Update Imports: Ensure all import paths are correct
7. Document Changes: Add comments explaining module boundaries

Acceptance Criteria

• Original file is split into 4 focused files (plus trimmed awf_helpers.go)
• Each new file is under 700 lines (with BuildAWFCommand/BuildAWFArgs deduplication ideally bringing awf_command_builder.go under 500)
• All tests pass (make test-unit)
• Test coverage is ≥80% for new files
• No breaking changes to public API
• Code passes linting (make lint)
• Build succeeds (make build)

Additional Context

• Repository Guidelines: Follow patterns in .github/agents/developer.instructions.agent.md
• Code Organization: Prefer many small files grouped by functionality
• Testing: Match existing test patterns in pkg/workflow/*_test.go

---

Priority: Medium
Effort: Medium — high line count concentrated in two large functions (BuildAWFCommand, BuildAWFArgs) with significant existing test coverage to preserve/migrate
Expected Impact: Improved maintainability, easier testing, reduced complexity

Generated by 🧹 Daily File Diet · auto · 78.8 AIC · ⊞ 9.8K · ◷

• expires on Aug 9, 2026, 5:01 AM UTC-08:00

[github-actions]

🍪 Issue Monster selected this for Copilot

I’ve identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 2.71 AIC · ⊞ 10.5K · ◷