Architecture Violations Detected — 2026-04-20

[github-actions]

Summary

• Analysis Period: Last 24 hours
• Files Analyzed: ~1,261 Go/JS source files (initial repository commit 99e30a3)
• Total Violations: 31+
• Date: 2026-04-20

Severity	Count
🚨 BLOCKER	0
⚠️ WARNING	31+
i️ INFO	0

---

⚠️ WARNING Violations

These violations should be addressed soon to prevent further structural debt.

---

File Size Warnings — CJS Files Exceeding 1000 Lines

Commit: 99e30a3 — [copilot-opt] Enforce MCP-only GitHub reads by removing direct gh API paths (#27358)

File	Lines
actions/setup/js/create_pull_request.cjs	1779
actions/setup/js/log_parser_shared.cjs	1703
actions/setup/js/handle_agent_failure.cjs	1590
actions/setup/js/update_project.cjs	1451
actions/setup/js/safe_output_handler_manager.cjs	1321
actions/setup/js/sanitize_content_core.cjs	1224
actions/setup/js/runtime_import.cjs	1022
actions/setup/js/safe_outputs_handlers.cjs	1009
pkg/workflow/cache.go	1002

Why it matters: Files this large are difficult to navigate, review, and reason about. They tend to accumulate unrelated logic and resist refactoring.

Suggested fixes:

• create_pull_request.cjs (1779 lines): Extract PR validation logic, conflict-resolution helpers, and body-formatting utilities into separate .cjs modules (e.g., create_pull_request_validation.cjs, create_pull_request_format.cjs)
• log_parser_shared.cjs (1703 lines): Split into domain-specific parsers — log line parsing, OTLP emission, and metric aggregation are distinct concerns
• handle_agent_failure.cjs (1590 lines): Extract failure classification, retry logic, and notification routing into focused files
• update_project.cjs (1451 lines): Separate GraphQL query builders from field-update orchestration
• safe_output_handler_manager.cjs (1321 lines): The manager should delegate to per-output-type handlers; split into safe_output_handler_*.cjs files
• sanitize_content_core.cjs (1224 lines): Separate input sanitization from output encoding, and isolate regex-based cleaning into a dedicated file
• pkg/workflow/cache.go (1002 lines): Extract cache-memory artifact upload/download helpers, TTL logic, and key-naming utilities into sub-files

---

Oversized Functions — Go Files

Commit: 99e30a3 — [copilot-opt] Enforce MCP-only GitHub reads by removing direct gh API paths (#27358)

File	Function	Estimated Lines
pkg/workflow/mcp_setup_generator.go	generateMCPSetup	~849
pkg/workflow/compiler_yaml_main_job.go	generateMainJobSteps	~619
pkg/workflow/notify_comment.go	buildConclusionJob	~562
pkg/workflow/safe_outputs_config.go	extractSafeOutputsConfig	~559
pkg/workflow/compiler_safe_outputs_job.go	buildConsolidatedSafeOutputsJob	~501
pkg/workflow/frontmatter_extraction_yaml.go	commentOutProcessedFieldsInOnSection	~488
pkg/workflow/mcp_config_custom.go	renderSharedMCPConfig	~495
pkg/cli/run_workflow_execution.go	RunWorkflowOnGitHub	~442
pkg/workflow/compiler_pre_activation_job.go	buildPreActivationJob	~429
pkg/workflow/repo_memory.go	extractRepoMemoryConfig	~400
pkg/cli/audit.go	AuditWorkflowRun	~356
pkg/workflow/compiler.go	validateWorkflowData	~369
pkg/parser/import_field_extractor.go	extractAllImportFields	~372
pkg/workflow/compiler_jobs.go	buildCustomJobs	~344
cmd/gh-aw/main.go	validateEngine	~411
cmd/gh-aw/main.go	init	~404
pkg/workflow/unified_prompt_step.go	collectPromptSections	~213
pkg/workflow/unified_prompt_step.go	generateUnifiedPromptCreationStep	~247
pkg/workflow/unified_prompt_step.go	buildSafeOutputsSections	~225
pkg/workflow/imports.go	mergeSafeOutputConfig	~239
pkg/cli/logs_download.go	downloadRunArtifacts	~267
pkg/cli/pr_command.go	transferPR	~227

Why it matters: Functions this large are impossible to unit test in isolation, accumulate mixed responsibilities, and create merge conflicts when multiple developers touch the same feature.

Suggested fixes by priority:

1. generateMCPSetup (~849 lines) in mcp_setup_generator.go — the most severe violation. This function handles per-tool rendering for Playwright, GitHub MCP, custom registries, etc. Each tool type should be extracted into its own generateXxxMCPSetup(...) helper, e.g., generatePlaywrightMCPSetup, generateGitHubMCPSetup, generateCustomMCPSetup. The main function becomes an orchestrator/dispatcher (~50 lines).

2. generateMainJobSteps (~619 lines) in compiler_yaml_main_job.go — extract distinct step-generation phases into helpers: generateCheckoutSteps, generateSetupRuntimeSteps, generateAgentRunStep, generatePostRunSteps, etc.

3. buildConclusionJob (~562 lines) in notify_comment.go — separate conclusion-comment rendering from job-dependency graph construction and OTLP span emission into dedicated helpers.

4. extractSafeOutputsConfig (~559 lines) in safe_outputs_config.go — this is a large parsing function; split parsing by section: parseMessagesConfig, parseDispatchConfig, parsePermissionsConfig, etc.

5. buildConsolidatedSafeOutputsJob (~501 lines) — extract step-list construction, environment variable injection, and permission assembly into named helpers.

6. validateEngine & init (~400+ lines each) in cmd/gh-aw/main.go — init() should register subcommands only; large engine-validation logic belongs in pkg/cli/ (e.g., engine_validation.go).

7. AuditWorkflowRun (~356 lines) in pkg/cli/audit.go — extract artifact downloading, log parsing, and report rendering phases into private helper functions.

---

Configuration

Thresholds from .architecture.yml:

• File size BLOCKER: 2000 lines
• File size WARNING: 1000 lines
• Function size: 200 lines
• Max public exports: 10

Action Checklist

• Split generateMCPSetup (~849 lines) into per-tool sub-functions — highest priority
• Split generateMainJobSteps (~619 lines) into step-phase helpers
• Refactor the 8 CJS files exceeding 1000 lines into focused modules
• Break up buildConclusionJob, extractSafeOutputsConfig, buildConsolidatedSafeOutputsJob
• Move validateEngine / init bloat from cmd/gh-aw/main.go to pkg/cli/
• Address remaining WARNING-level function-size violations in upcoming PRs
• Close this issue once all violations are resolved

🏛️ Thresholds are configured in .architecture.yml at the repository root.

🏛️ Architecture report by Architecture Guardian · ● 1.4M · ◷