[log] oidc: add debug logging to provider.go

[github-actions]

Adds logOIDC debug logging calls to internal/oidc/provider.go to improve traceability for OIDC token lifecycle operations.

Changes

File modified: internal/oidc/provider.go (4 new log calls)

Location	Log call	Purpose
NewProvider	logOIDC.Printf("Creating OIDC provider: requestURL=%s, hasToken=%v", ...)	Log provider initialization
fetchToken	logOIDC.Printf("OIDC token HTTP response: status=%d, bodyLen=%d", ...)	Log HTTP response before error check
extractJWTExpiry	logOIDC.Printf("Parsing JWT expiry: partCount=%d, payloadLen=%d", ...)	Log JWT parsing entry point
extractJWTExpiry	logOIDC.Printf("JWT expiry parsed: exp=%d, expiresAt=%s", ...)	Log successful expiry extraction

The extractJWTExpiry function previously had zero debug visibility — these additions make it much easier to diagnose JWT parsing failures and token expiry edge cases.

Existing logger reused

The file already declares var logOIDC = logger.New("oidc:provider") — no new logger was added.

Enable with: DEBUG=oidc:* ./awmg --config config.toml

Validation

• go build ./... ✅
• go vet ./... ✅
• go test ./internal/oidc/... ✅ (all 10 tests pass)
• go test ./internal/... ✅ (one pre-existing unrelated failure in internal/config)

Warning

⚠️ Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• invalidhostthatdoesnotexist12345.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "invalidhostthatdoesnotexist12345.com"

See Network Configuration for more information.

Generated by Go Logger Enhancement · ● 4.2M · ◷

[Copilot]

Pull request overview

Adds additional debug logging to the OIDC provider implementation to improve traceability around provider initialization, token HTTP responses, and JWT expiry parsing.

Changes:

• Log provider construction inputs (request URL + whether a token is present).
• Log token HTTP response metadata (status code and response body length).
• Log JWT expiry parsing entry/exit (payload sizing and parsed expiry time).

Show a summary per file

File	Description
internal/oidc/provider.go	Adds new logOIDC.Printf calls around provider initialization, token fetch response handling, and JWT expiry extraction to aid debugging.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 1

[Copilot]

Logging the raw requestURL can leak potentially sensitive environment-provided data (e.g., internal hostnames or query parameters) and is inconsistent with the repo’s guidance to sanitize/truncate env values before logging. Consider logging only that the URL is set (and maybe its host/path), or pass it through sanitize.SanitizeString/sanitize.TruncateSecret before printing.

Suggested change

	logOIDC.Printf("Creating OIDC provider: requestURL=%s, hasToken=%v", requestURL, requestToken != "")
	requestURLLogValue := "set=false"
	if requestURL != "" {
	requestURLLogValue = "set=true"
	if parsedURL, err := url.Parse(requestURL); err == nil {
	requestURLLogValue = fmt.Sprintf(
	"set=true, scheme=%s, host=%s, path=%s",
	parsedURL.Scheme,
	parsedURL.Host,
	parsedURL.Path,
	)
	}
	}
	logOIDC.Printf("Creating OIDC provider: requestURL={%s}, hasToken=%v", requestURLLogValue, requestToken != "")