[file-diet] Refactor: pkg/workflow/awf_helpers.go exceeds 800 lines (1131 LOC) #48621

Overview

The file pkg/workflow/awf_helpers.go has grown to 1131 lines, making it difficult to maintain and test. This task involves refactoring it into smaller, focused files with improved test coverage.

Current State

• File: pkg/workflow/awf_helpers.go
• Size: 1131 lines
• Test Coverage: awf_helpers_test.go is 2480 lines (~2.2x ratio) — good overall coverage, but concentrated in one large test file that should split alongside the source
• Complexity: Mixes several distinct concerns — AWF command/argument construction, firewall version-capability gating, container digest resolution, ARC/DinD chroot rewriting, and env-var exclusion logic — in a single 26-function file

Refactoring Strategy

Proposed File Splits

1. awf_command_builder.go

   • Functions: BuildAWFCommand, BuildAWFArgs, GetAWFCommandPrefix, WrapCommandInShell
   • Responsibility: Constructing the awf command line and argument list used to wrap agentic engine execution
   • Estimated LOC: ~550

2. awf_capabilities.go

   • Functions: awfVersionAtLeast, awfSupportsExcludeEnv, awfSupportsCliProxy, awfSupportsAllowHostPorts, awfSupportsDockerHostPathPrefix, awfSupportsTokenSteering, awfSupportsChrootConfig, awfSupportsContainerRuntime, awfSupportsLegacySecurity, awfSupportsAPIProxyProviders
   • Responsibility: Firewall version-gated feature capability checks (consider collapsing into a single table-driven lookup during the split)
   • Estimated LOC: ~90

3. awf_env.go

   • Functions: ComputeAWFExcludeEnvVarNames, addCliProxyGHTokenToEnv, applyDefaultMaxAICreditsEnvToMap, injectMaxAICreditsExpression
   • Responsibility: Environment variable computation/injection for the AWF sandbox (exclusions, GH token, max-AI-credits expression)
   • Estimated LOC: ~150

4. awf_digest.go

   • Functions: buildAWFImageTagWithDigests, lookupContainerDigest
   • Responsibility: Resolving and pinning container image digests for AWF images
   • Estimated LOC: ~60

5. awf_arc_dind.go

   • Functions: rewriteArcDindPath, rewriteArcDindEngineCommand, buildModelsJSONPathExportScript, buildArcDindChrootConfigPatchBody, buildArcDindChrootConfigPatchBodyBash
   • Responsibility: ARC/DinD-specific path rewriting and chroot config patching
   • Estimated LOC: ~80

6. awf_helpers.go (remaining)

   • Functions: shouldUseWorkflowCallNetworkAllowedInput, buildWorkflowCallNetworkAllowedUpdateScript
   • Responsibility: Workflow-call network-allowed input handling
   • Estimated LOC: ~100

Shared Utilities

No new shared utility file needed; keep helpers colocated with their consuming domain per above split.

Interface Abstractions

• Consider a firewallCapability table (map[string]constants.Version]) consumed by a single awfSupports(firewallConfig *FirewallConfig, name string) bool to eliminate the 9 near-duplicate predicate functions, exposing typed wrapper constants for call-site clarity if needed.

Implementation Guidelines

1. Preserve Behavior: Ensure all existing functionality works identically
2. Maintain Exports: Keep public API unchanged (exported functions/types)
3. Add Tests First: Write tests for each new file before refactoring
4. Incremental Changes: Split one module at a time
5. Run Tests Frequently: Verify make test-unit passes after each split
6. Update Imports: Ensure all import paths are correct
7. Document Changes: Add comments explaining module boundaries

Acceptance Criteria

• Original file is split into 6 focused files
• Each new file is under 500 lines (except command builder, which may need a further internal split of BuildAWFCommand/BuildAWFArgs if it exceeds 500 lines)
• All tests pass (make test-unit)
• Test coverage is ≥80% for new files
• No breaking changes to public API
• Code passes linting (make lint)
• Build succeeds (make build)

Priority: Medium
Effort: Medium — 26 functions across 6 well-separated domains, existing tests provide a strong safety net
Expected Impact: Improved maintainability, easier testing, reduced complexity

Generated by 🧹 Daily File Diet · sonnet50 · 54.2 AIC · ⌖ 9.04 AIC · ⊞ 9.5K · ◷

• expires on Jul 30, 2026, 5:16 AM UTC-08:00