refactor(detect): remove step summary output from the detection job

[davidslater]

Created by GitHub Ace · View Session

What

The detection job no longer writes anything to the GitHub Actions step summary.

Removed:

• pkg/stepsummary — the artifact inventory Markdown table
• pkg/detector/summary.go — the rendered-prompt block (FormatPromptSummary) and the verdict block (FormatVerdictSummary, AppendStepSummary)
• The --step-summary flag (and its GITHUB_STEP_SUMMARY default) on both threat-detect and threat-detect conclude, plus the related path-collision checks
• ThreatMarker and the <!-- gh-aw-threat-* --> marker constants, which were only ever rendered into the verdict summary

Kept

• The JSONL run log (--log-file) still records the full recursive artifact inventory, prompt metadata, and verdict.
• conclude still writes its self-contained job-log diagnostics, including the ThreatHeadline that distinguishes a tooling failure (agent_failure/parse_error) from a real security finding.
• Result-file vs $GITHUB_OUTPUT/$GITHUB_ENV collision rejection in conclude, and --log-file vs --output collision rejection in the detection run.

Docs & spec

• specs/threat-detection-spec.md: TD-20c rewritten to state the detector MUST NOT write to the step summary; TD-20g and TD-20h removed; TD-20i reduced to the job-log headline contract.
• specs/usage-spec.md (U-09), README.md, DEVGUIDE.md, CLAUDE.md updated accordingly.

Verification

make fmt lint build test passes. gosec findings are unchanged from the pre-existing baseline (only reduced by the deleted files).

[Copilot]

Pull request overview

Removes GitHub Actions step-summary output while retaining JSONL observability and job-log diagnostics.

Changes:

• Removes step-summary flags, writers, markers, and tests.
• Preserves run-log inventory and conclusion diagnostics.
• Updates specifications and documentation.

Show a summary per file

File	Description
specs/usage-spec.md	Documents JSONL-only inventory.
specs/threat-detection-spec.md	Revises summary-output requirements.
README.md	Removes step-summary usage.
DEVGUIDE.md	Updates inventory guidance.
CLAUDE.md	Updates repository guidance.
cmd/threat-detect/main.go	Removes detection summary output.
cmd/threat-detect/main_test.go	Removes summary tests.
cmd/threat-detect/logfile_test.go	Removes summary assertions.
cmd/threat-detect/conclude.go	Removes verdict-summary output.
cmd/threat-detect/conclude_test.go	Updates conclusion tests.
pkg/detector/reason.go	Removes summary markers.
pkg/detector/reason_test.go	Removes marker tests.
pkg/detector/summary.go	Deletes summary rendering.
pkg/detector/summary_test.go	Deletes renderer tests.
pkg/stepsummary/stepsummary.go	Deletes inventory summary writer.
pkg/stepsummary/stepsummary_test.go	Deletes writer tests.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 16/16 changed files
• Comments generated: 1
• Review effort level: Balanced

[davidslater]

This states that the rendered prompt remains surfaced through the run log or conclude, but prompt_built records only prompt metadata (main.go:344-355) and conclude reports only the verdict. With FormatPromptSummary deleted, the rendered prompt is no longer surfaced anywhere, so the normative text should say that explicitly rather than promising unavailable diagnostics.

Good catch — fixed in e50029e. TD-20c now reads:

TD-20c: The detector MUST NOT write to the GitHub Actions step summary. The artifact inventory defined by TD-17b is surfaced through the run log (TD-20a) only, and the conclusion verdict through the run log and the conclude diagnostics (TD-20d). The rendered prompt itself is not surfaced: the run log records only its metadata (byte count, resolved workflow name/description, custom-prompt provenance, scaffolding detection).