Found while reviewing #6046.
Problem
All eight WorkflowAuditor.Log* methods hand-copy the same four-step prologue:
source := w.extractSource(ctx)
subjects := w.extractSubjects(ctx)
event := NewAuditEvent(...)
w.attachDelegation(ctx, event)
At pkg/audit/workflow_auditor.go lines 63-73, 115-125, 168-178, 208-218, 248-258, 286-296, 326-336, and 364-374 — LogWorkflowStarted/Completed/Failed/TimedOut and LogStepStarted/Completed/Failed/Skipped.
Why it is worth fixing
This is not just tidiness. #6046 added attachDelegation to all eight methods by hand, and only two of the eight were covered by tests — so six could have shipped without the call and the suite would have stayed green. Those six included every terminal event (failed / timed-out), which is what an investigator actually reads.
A follow-up PR closed that with a table over all eight methods, but a test table is a guardrail, not a fix: it catches the omission after the fact and has to be extended by hand every time a ninth Log* method appears.
Suggested fix
A private helper:
func (w *WorkflowAuditor) newEvent(ctx context.Context, eventType, outcome string) *AuditEvent
That collapses ~40 lines of repetition to one call site per method and makes "did every method attach the delegation chain?" unanswerable by construction rather than by test. The eight-case delegation table can then shrink to a single test on the helper.
Low risk — the prologue is identical in all eight, so this is a mechanical extraction with no behavior change. Deliberately kept out of the review-fix PR to keep that one test-only.
Found while reviewing #6046.
Problem
All eight
WorkflowAuditor.Log*methods hand-copy the same four-step prologue:At
pkg/audit/workflow_auditor.golines 63-73, 115-125, 168-178, 208-218, 248-258, 286-296, 326-336, and 364-374 —LogWorkflowStarted/Completed/Failed/TimedOutandLogStepStarted/Completed/Failed/Skipped.Why it is worth fixing
This is not just tidiness. #6046 added
attachDelegationto all eight methods by hand, and only two of the eight were covered by tests — so six could have shipped without the call and the suite would have stayed green. Those six included every terminal event (failed / timed-out), which is what an investigator actually reads.A follow-up PR closed that with a table over all eight methods, but a test table is a guardrail, not a fix: it catches the omission after the fact and has to be extended by hand every time a ninth
Log*method appears.Suggested fix
A private helper:
That collapses ~40 lines of repetition to one call site per method and makes "did every method attach the delegation chain?" unanswerable by construction rather than by test. The eight-case delegation table can then shrink to a single test on the helper.
Low risk — the prologue is identical in all eight, so this is a mechanical extraction with no behavior change. Deliberately kept out of the review-fix PR to keep that one test-only.