feat: dedicated MCP logs artifact upload to close telemetry observability gap by Copilot · Pull Request #48700 · github/gh-aw

Copilot · 2026-07-28T17:46:30Z

gateway.jsonl and rpc-messages.jsonl were missing from ~5/8 sampled workflow runs because /tmp/gh-aw/mcp-logs/ had no chmod before upload (unlike firewall logs) and relied solely on the fragile unified agent artifact.

Changes

New compiler step: Fix MCP logs permissions — runs chmod -R a+rX /tmp/gh-aw/mcp-logs/ 2>/dev/null || true before upload, mirroring the firewall chmod pattern
New compiler step: Upload MCP logs — dedicated actions/upload-artifact step producing a mcp-logs-{workflow-name} artifact, independent of the unified upload; if: always(), continue-on-error: true, if-no-files-found: ignore
ArtifactSetMCP updated — --artifacts mcp now downloads both agent and mcp-logs artifacts
New constants — MCPLogsArtifactBaseName = "mcp-logs", TmpMcpLogsDirExpr (ARC/DinD path expression)
Tests — mcp_logs_upload_test.go updated to assert the new steps and artifact name for both Playwright and non-Playwright workflows
264 .lock.yml files recompiled from updated compiler

Step order in every agentic job post-fix:

Stop MCP Gateway
→ Secret redaction
→ Parse MCP Gateway logs
→ Print firewall logs (chmod via print_firewall_logs.sh)
→ Fix MCP logs permissions  ← new
→ Upload MCP logs           ← new (mcp-logs-{name} artifact)
→ Upload agent artifacts    (unified)

Fixes [deep-report] Close the MCP telemetry observability gap - rpc-messages.jsonl/gateway.jsonl missing on most sampled runs #48674

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 8.29 AIC · ⌖ 7.59 AIC · ⊞ 7.2K · ◷
_{Comment /souschef to run again}

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Pull request overview

Adds dedicated MCP telemetry artifact uploads to improve observability when unified agent artifacts are incomplete.

Changes:

Adds MCP log permission repair and dedicated upload steps.
Extends --artifacts mcp and introduces shared artifact/path constants.
Recompiles workflow lockfiles and adds compiler tests.

Show a summary per file

File	Description
`pkg/workflow/compiler_yaml_artifacts.go`	Generates dedicated MCP artifact steps.
`pkg/workflow/compiler_yaml_post_agent.go`	Wires MCP upload into post-agent processing.
`pkg/workflow/mcp_logs_upload_test.go`	Tests generated MCP upload steps.
`pkg/constants/job_constants.go`	Defines the MCP artifact base name.
`pkg/constants/constants.go`	Defines the ARC/DinD MCP path.
`pkg/cli/logs_artifact_set.go`	Extends the MCP artifact filter.
`.github/workflows/*.lock.yml`	Recompiles generated workflows with MCP upload steps.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 270/270 changed files
Comments generated: 5
Review effort level: Medium

+	// independent of the unified agent artifact, closing the observability gap reported in
+	// gh-aw#48674.  A chmod step runs first to handle edge-case permission differences
+	// (e.g. tool sub-containers writing files with a different UID in AWF isolation mode).
+	c.generateMCPLogsArtifactUpload(yaml, data.Name, data, artifactPrefixExprForDownstreamJob(data))


+	yaml.WriteString("      - name: Fix MCP logs permissions\n")
+	yaml.WriteString("        if: always()\n")
+	yaml.WriteString("        continue-on-error: true\n")
+	yaml.WriteString("        run: chmod -R a+rX /tmp/gh-aw/mcp-logs/ 2>/dev/null || true\n")


+	mcpLogsPath := constants.TmpMcpLogsDir
+	if isArcDindTopology(data) {
+		mcpLogsPath = constants.TmpMcpLogsDirExpr
+	}


 	ArtifactSetActivation: {constants.ActivationArtifactName},
 	ArtifactSetAgent:      {constants.AgentArtifactName},
-	ArtifactSetMCP:        {constants.AgentArtifactName},
+	ArtifactSetMCP:        {constants.AgentArtifactName, constants.MCPLogsArtifactBaseName},


+	sanitizedName := strings.ToLower(SanitizeWorkflowName(workflowName))
+	artifactName := prefix + constants.MCPLogsArtifactBaseName + "-" + sanitizedName


github-actions · 2026-07-28T18:47:45Z

PR Triage

Category: feature
Risk: medium
Priority score: 63/100 (impact 30, urgency 13, quality 20)
Recommendation: batch_review (batch: mcp-telemetry-observability)

Adds dedicated MCP logs artifact upload; touches 270 files (mostly regenerated .lock.yml), core logic change is small and isolated. OpenTelemetry/observability-related — labeled otel and flagged for @mnkeifer per triage policy. CI: reviewer check in progress.

Generated by 🔧 PR Triage Agent · sonnet50 · 34.8 AIC · ⌖ 4.95 AIC · ⊞ 7.5K · ◷

github-actions · 2026-07-28T19:45:32Z

⚠️ PR Code Quality Reviewer failed during code quality review.

github-actions · 2026-07-28T19:45:37Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

github-actions · 2026-07-28T19:45:46Z

❌ Design Decision Gate 🏗️ failed during design decision gate check.

github-actions · 2026-07-28T19:46:31Z

✅ Test Quality Sentinel completed test quality analysis.

github-actions

Review Summary

The PR addresses a real observability gap (missing MCP logs), but has four blocking issues already detailed in inline comments:

artifactMatchesFilter mismatch — ArtifactSetMCP includes "mcp-logs" as a filter, but generated artifacts are named "mcp-logs-{workflow}". The match logic checks HasSuffix("-mcp-logs") — this never matches a name prefixed with mcp-logs-. --artifacts mcp silently downloads nothing new. Fix: add strings.HasPrefix(name, f+"-") to artifactMatchesFilter.
chmod can't fix cross-UID files — chmod -R a+rX fails when files are owned by a different UID (the exact AWF isolation case claimed in the comment). The || true suppresses the error, so unreadable files stay unreadable and the upload silently captures nothing.
ARC/DinD path inconsistency — The chmod step hardcodes /tmp/gh-aw/mcp-logs/ (line 92) while the upload step uses the dynamic ${{ runner.temp }}/gh-aw/mcp-logs/ for ARC/DinD. The chmod runs on the wrong path on ARC runners; both steps must use the same resolved mcpLogsPath variable.
Step ordering — chmod emitted after redactor — Fix MCP logs permissions is inserted after secret redaction. The redactor skips unreadable files (EACCES), so for files that are unreadable at redaction time, the chmod comes too late to help. Move chmod before the redaction step.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 30.9 AIC · ⌖ 5.31 AIC · ⊞ 5K

github-actions · 2026-07-28T19:51:40Z

🧪 Test Quality Sentinel Report

✅ Test Quality Score: 85/100 — Excellent

Analyzed 2 test(s): 2 design, 0 implementation, 0 violation(s).

📊 Metrics (2 tests)

Metric	Value
Analyzed	2 (Go: 2, JS: 0)
✅ Design	2 (100%)
⚠️ Implementation	0 (0%)
Edge/error coverage	1 (50%)
Duplicate clusters	0
Inflation	NO
🚨 Violations	0

Test	File	Classification	Issues
`TestMCPLogsUpload`	`pkg/workflow/mcp_logs_upload_test.go`	design_test / behavioral_contract	Happy-path only; no compile-error assertions
`TestMCPLogsUploadWithoutPlaywright`	`pkg/workflow/mcp_logs_upload_test.go`	design_test / behavioral_contract	Edge case: negative assertion (no mkdir without Playwright) ✅

🔍 Test Analysis

TestMCPLogsUpload — Compiles a Playwright workflow and asserts on the generated YAML. Verifies step ordering (Stop MCP Gateway → Fix MCP logs permissions → Upload MCP logs → Upload agent artifacts), artifact naming, action version pinning, and if: always() guard. Strong behavioral contract coverage. Minor: no negative or error-path assertions (e.g., compile failure).

TestMCPLogsUploadWithoutPlaywright — Compiles a non-Playwright workflow and confirms MCP logs upload step is always present, mkdir for playwright dir is absent (good negative assertion), and dedicated upload steps still appear. The negative assertion is a well-calibrated edge case.

Build tag: //go:build !integration present on line 1 ✅
Mock libraries: none ✅
Goroutine-leak guard: not present (acceptable for compilation tests)

Verdict

✅ passed. 0% implementation tests (threshold: 30%). No violations.

🧪 Test quality analysis by Test Quality Sentinel · sonnet46 · 22.8 AIC · ⌖ 14.7 AIC · ⊞ 8.1K · ◷
_{Comment /review to run again}

github-actions

✅ Test Quality Sentinel: 85/100. 0% implementation tests (threshold: 30%). No violations.

github-actions

Skills-Based Review 🧠

Applied /codebase-design and /diagnosing-bugs — requesting changes on correctness issues that would prevent the fix from working end-to-end.

📋 Key Themes

Bugs (5 existing inline comments cover these)

chmod hardcodes /tmp/gh-aw/mcp-logs/ — on ARC/DinD the computed mcpLogsPath is ${{ runner.temp }}/gh-aw/mcp-logs/, but the chmod still targets the hardcoded literal, leaving permissions unfixed before the dedicated upload.
artifactMatchesFilter won't match mcp-logs-{name} — the filter entry "mcp-logs" only matches artifacts whose name equals "mcp-logs" or ends in "-mcp-logs". The generated artifact is named mcp-logs-{workflow} (prefix, not suffix), so --artifacts mcp silently skips it.
ARC/DinD path mismatch for dedicated upload — the chmod hardcoding compounds with the ARC path expression used for upload, meaning files on ARC remain unreadable before upload.
Download directory structure — actions/upload-artifact creates mcp-logs-{name}/gateway.jsonl; the download path is not flattened for the new artifact, requiring consumers to account for the extra directory level.
chmod can't repair cross-UID files — the stated different-UID scenario (AWF isolation) cannot be fixed by chmod as a non-root user; failures are silently suppressed, which can mask the root cause.

Positive Highlights

✅ Step order (Stop MCP Gateway → chmod → Upload MCP logs → Upload agent artifacts) is correct and well-tested.
✅ if: always(), continue-on-error: true, and if-no-files-found: ignore make this gracefully safe for workflows without an MCP gateway.
✅ Good unit tests covering Playwright and non-Playwright paths.
✅ The concept of a dedicated MCP logs artifact is sound and closes the right gap.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 42.7 AIC · ⌖ 4.71 AIC · ⊞ 6.7K
_{Comment /matt to run again}

Documents the architectural decision to add a dedicated mcp-logs-{name} artifact upload step to every agentic workflow, independent of the unified agent artifact, to close the MCP telemetry observability gap (gh-aw#48674).

Done

pelikhan · 2026-07-28T20:23:53Z

@copilot run pr-finisher skill

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-07-28T20:49:07Z

@copilot run pr-finisher skill

Completed a full pr-finisher pass and pushed fixes in commit d0aefcc. This addresses the MCP review findings (pre-redaction permissions fix, ARC/DinD MCP log mirroring, mcp-logs artifact matching/flattening, and updated tests/goldens).

pelikhan · 2026-07-28T21:32:48Z

@copilot refactor code as part of the stop MCp gateway sh script

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-07-28T21:43:47Z

@copilot refactor code as part of the stop MCp gateway sh script

Done in 58f697c. I refactored actions/setup/sh/stop_mcp_gateway.sh to centralize MCP log permission repair in the stop script (including root-owned log fallback handling) while preserving existing shutdown behavior.

pelikhan · 2026-07-28T21:50:21Z

@copilot remove added step, not needed anymore, recompile

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-07-28T22:04:42Z

@copilot remove added step, not needed anymore, recompile

Done in 0831011. I removed the added Fix MCP logs permissions workflow step and recompiled the lock files.

Initial plan

3304504

Copilot AI assigned Copilot and pelikhan Jul 28, 2026

Copilot started work on behalf of pelikhan July 28, 2026 17:47 View session

Copilot AI linked an issue Jul 28, 2026 that may be closed by this pull request

[deep-report] Close the MCP telemetry observability gap - rpc-messages.jsonl/gateway.jsonl missing on most sampled runs #48674

Open

feat: add dedicated MCP logs artifact upload for telemetry observability

d8c5973

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Close the MCP telemetry observability gap~~ feat: dedicated MCP logs artifact upload to close telemetry observability gap Jul 28, 2026

Copilot finished work on behalf of pelikhan July 28, 2026 18:30

Copilot AI requested a review from pelikhan July 28, 2026 18:30

pelikhan marked this pull request as ready for review July 28, 2026 18:38

Copilot AI review requested due to automatic review settings July 28, 2026 18:38

Copilot started reviewing on behalf of pelikhan July 28, 2026 18:39 View session

Copilot AI reviewed Jul 28, 2026

View reviewed changes

github-actions Bot added otel pr-action:batch_review pr-agent:github-copilot pr-priority:medium pr-risk:medium pr-type:feature labels Jul 28, 2026

github-actions Bot added the pr-batch:mcp-telemetry-observability label Jul 28, 2026

This was referenced Jul 28, 2026

[PR Triage Report] PR Triage Report — 2026-07-28 (5 PRs) #48708

Open

[pr-sous-chef] pr-sous-chef run report #48464

Closed

github-actions Bot requested changes Jul 28, 2026

View reviewed changes

github-actions Bot approved these changes Jul 28, 2026

View reviewed changes

github-actions Bot previously requested changes Jul 28, 2026

View reviewed changes

github-actions Bot mentioned this pull request Jul 28, 2026

[aw] Design Decision Gate 🏗️ failed #48721

Open

Copilot started work on behalf of pelikhan July 28, 2026 20:24 View session

fix: address MCP log upload review feedback end-to-end

d0aefcc

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan July 28, 2026 20:50

pelikhan added the smoke label Jul 28, 2026

Copilot started work on behalf of pelikhan July 28, 2026 21:33 View session

refactor: centralize MCP log permission repair in stop script

58f697c

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan July 28, 2026 21:44

Copilot started work on behalf of pelikhan July 28, 2026 21:50 View session

chore: remove redundant MCP permissions workflow step

0831011

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan July 28, 2026 22:05

github-actions Bot added pr-action:fast_track pr-priority:high labels Jul 29, 2026

		sanitizedName := strings.ToLower(SanitizeWorkflowName(workflowName))
		artifactName := prefix + constants.MCPLogsArtifactBaseName + "-" + sanitizedName

Uh oh!

Conversation

Copilot AI commented Jul 28, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

github-actions Bot commented Jul 28, 2026

PR Triage

Uh oh!

github-actions Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Review Summary

Uh oh!

github-actions Bot commented Jul 28, 2026

🧪 Test Quality Sentinel Report

Verdict

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Skills-Based Review 🧠

Bugs (5 existing inline comments cover these)

Positive Highlights

Uh oh!

pelikhan commented Jul 28, 2026

Uh oh!

Copilot AI commented Jul 28, 2026

Uh oh!

pelikhan commented Jul 28, 2026

Uh oh!

Copilot AI commented Jul 28, 2026

Uh oh!

pelikhan commented Jul 28, 2026

Uh oh!

Copilot AI commented Jul 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Jul 28, 2026 •

edited by github-actions Bot

Loading

github-actions Bot commented Jul 28, 2026 •

edited

Loading

github-actions Bot commented Jul 28, 2026 •

edited

Loading

github-actions Bot commented Jul 28, 2026 •

edited

Loading

github-actions Bot commented Jul 28, 2026 •

edited

Loading