Agentic Workflow Audit — 2026-03-12

[github-actions[bot]]

Daily audit of agentic workflow runs for 2026-03-12. This report covers workflow health, recent failures, trends, and key findings from the last 24 hours.

Note: The gh aw logs MCP tool requires GitHub CLI authentication (not available in this environment). Analysis was performed using the audit tool on specific runs, GitHub MCP issue/commit search, and the Workflow Health Dashboard from issue #20479. The fix for the cryptic exit status 1 error was merged today in commit 610ca86.

---

Summary

Metric	Value
Overall Health Score	72/100 (stable, flat from Mar 11)
Total Workflows	166
Healthy	158 (95%)
Critical/Warning	8 (5%)
Active Failures Audited	2
P1 Issues (Persistent)	1 (day 16+)
Commits Today	8+

---

Workflow Health Trend

Health score has been stable at 72/100 since March 11, recovering from a dip to 70 on March 10. The primary drag remains the persistent P1 lockdown token issue affecting 4 workflows. Two major workflows (Smoke Codex, Duplicate Code Detector) recovered on March 11 and remain healthy today.

---

Estimated Token & Cost Trends

Token usage estimated based on known workflow activity (~93K tokens for a single 16-min agent run, ~$0.50/hour across all engines). March 12 shows a partial day (audit ran at ~05:42 UTC). Note: actual token metrics are not exposed through the current API access level.

---

Critical Issues 🚨

P1 (Persistent, Day 16+): GH_AW_GITHUB_TOKEN Missing

4 workflows blocked: Issue Monster, PR Triage Agent, Daily Issues Report, Org Health Report

All use lockdown: true which requires a custom GitHub token not currently provisioned. See tracking issue #20315.

Requires admin intervention — no programmatic fix path available.

---

Failures Audited Today

Go Logger Enhancement — Run (a href="https://github.com/github/gh-aw/actions/runs/22972502171")#177(/a) (FAILURE)

• Duration: 17.9 minutes (agent job: 16.3 min)
• Engine: Claude
• Tool calls: 46 Read + 114 bash commands
• Safe outputs: 0
• Root cause: Agent entered extensive read-only code exploration mode (46 file reads, 114 bash commands exploring the codebase for logger patterns) and never produced any output. After ~16 minutes, the agent was killed and orphan processes were cleaned up.
• Firewall: All clean (113 requests to api.anthropic.com, 1 to raw.githubusercontent.com)
• Pattern: Same "agent timeout without output" pattern seen in jsweep. The agent needs better guidance to call noop or produce partial output when it cannot complete the full task.
• Failure issue: #20587

Smoke Gemini — Run (a href="https://github.com/github/gh-aw/actions/runs/22981480373")#322(/a) (NO SAFE OUTPUT)

• Duration: 4.2 minutes
• Engine: Gemini (auto-gemini-3)
• Safe outputs: 0 (safe-output-items.jsonl is empty)
• Detection: Passed (threat detection ran, no issues found)
• Root cause: Smoke Gemini runs on a schedule trigger without issue/PR context. The Gemini engine completes successfully but produces no meaningful output, resulting in no safe-output calls.
• Pattern: This is a recurring issue for schedule-triggered smoke tests that need context to act on. The workflow health dashboard noted "100% failure rate on schedule (run [Custom Engine Test] Test Issue Created by Custom Engine #322 Mar 11) — likely add_comment context error on schedule trigger."
• Failure issue: #20618

---

New Issues Today (Created by Workflows)

Issue	Title	Type
#20636	Contribution Check Report — no PRs evaluated	Warning
#20629	compile --actionlint reports zero errors but exits nonzero	Community Bug
#20618	Smoke Gemini failed (no safe outputs)	Failure

---

Notable Fixes Merged Today (8 commits)

Key improvements in the last 24 hours

Commit	Fix
610ca86	fix: logs MCP tool surfaces actionable error instead of cryptic "exit status 1" — directly relevant to this audit!
9bc291d	Fix cross-repo activation checkout for event-driven relay workflows
3dc6207	Enforce draft as policy in create-pull-request, not agent-overridable fallback
a94e102	Disable Codex web search by default; enable only when web-search tool is configured
609de9b	Grant contents/pull-requests: write to sync_actions reusable workflow call
7e87025	Add standardized error code USE-001 to handle_noop_message.cjs
2a4e122	Major refactor: replace inlined Go builtin engine definitions with embedded shared agentic workflow files
9122b7f	Reimplement APM artifact pack/unpack support

---

Recurring Patterns & Recommendations

Priority	Pattern	Recommendation
P1 — URGENT	GH_AW_GITHUB_TOKEN missing for lockdown: true workflows	Admin must provision secret — tracking #20315 (day 16)
P2 — HIGH	Agent timeout without safe output (go-logger, jsweep)	Add timeout guidance to workflow prompts: "if analysis complete but no changes needed, call noop with summary"
P2 — HIGH	Smoke Gemini no-output on schedule	Add issue context guard for schedule trigger; consider removing schedule trigger if tool needs context
P3 — MEDIUM	Contribution Check: no PRs evaluated	Verify filter step is producing pr-filter-results.json correctly
INFO	compile --actionlint false negative	Community issue #20629 — distinguish lint findings from tooling integration failures

---

Audit Tool Limitation

The gh aw logs MCP tool currently requires GitHub CLI authentication, which is not available in this workflow's environment. This limits the ability to aggregate metrics across all workflow runs. The fix merged today in 610ca86 improves error visibility. Future audit runs should benefit from a token being provisioned for the audit workflow.

---

References:

• §22988339899 — this audit run
• §22972502171 — Go Logger failure
• §22981480373 — Smoke Gemini failure

AI generated by Agentic Workflow Audit Agent · history

• expires on Mar 13, 2026, 5:54 AM UTC