Extract shared AnalysisBase from DomainAnalysis/FirewallAnalysis

[Copilot]

DomainAnalysis and FirewallAnalysis duplicated DomainBuckets + TotalRequests + allowed/blocked counts with parallel AddMetrics implementations, creating drift risk.

Changes

• domain_buckets.go — New AnalysisBase struct embedding DomainBuckets, TotalRequests, AllowedRequests, BlockedRequests; single addBaseMetrics implementation; mergeDomainList helper for deduped domain union
• access_log.go — DomainAnalysis embeds AnalysisBase; renames AllowedCount/BlockedCount → AllowedRequests/BlockedRequests; AddMetrics reduced to one call
• firewall_log.go — FirewallAnalysis embeds AnalysisBase instead of three separate fields; AddMetrics only handles RequestsByDomain merging
• logs_report_firewall.go, logs_usage_activity.go — Field reference updates
• 15 test files — Updated to nested struct literal syntax

// Before: two hand-synced structs
type DomainAnalysis struct {
    DomainBuckets
    TotalRequests   int
    AllowedCount    int
    BlockedCount    int
}
type FirewallAnalysis struct {
    DomainBuckets
    TotalRequests   int
    AllowedRequests int
    BlockedRequests int
    RequestsByDomain map[string]DomainRequestStats
}

// After: one base, each type adds only what's unique
type AnalysisBase struct {
    DomainBuckets
    TotalRequests   int
    AllowedRequests int
    BlockedRequests int
}
type DomainAnalysis struct{ AnalysisBase }
type FirewallAnalysis struct {
    AnalysisBase
    RequestsByDomain map[string]DomainRequestStats
}

Domain-list merging (previously only in FirewallAnalysis.AddMetrics) is now handled once in addBaseMetrics, so both types get it automatically.

[Copilot]

Pull request overview

Extracts shared domain counters and merging logic into AnalysisBase, reducing duplication between access and firewall analysis.

Changes:

• Adds shared metrics and domain-union logic.
• Embeds AnalysisBase in both analysis types.
• Updates consumers and tests for renamed fields and nested literals.

Show a summary per file

File	Description
pkg/cli/domain_buckets.go	Adds AnalysisBase and domain merging.
pkg/cli/access_log.go	Migrates access analysis to the shared base.
pkg/cli/firewall_log.go	Migrates firewall analysis to the shared base.
pkg/cli/logs_report_firewall.go	Updates access counter references.
pkg/cli/logs_usage_activity.go	Builds nested shared-base values.
pkg/cli/access_log_test.go	Updates access-analysis tests.
pkg/cli/audit_agent_example_test.go	Updates example firewall fixtures.
pkg/cli/audit_agent_output_test.go	Updates agent-output fixtures.
pkg/cli/audit_cross_run_test.go	Updates cross-run fixtures.
pkg/cli/audit_diff_test.go	Updates firewall-diff fixtures.
pkg/cli/audit_report_test.go	Updates audit-report fixtures.
pkg/cli/audit_test.go	Updates audit fixtures.
pkg/cli/firewall_log_integration_test.go	Updates integration fixtures.
pkg/cli/firewall_log_test.go	Updates firewall merge tests.
pkg/cli/log_aggregation_test.go	Updates shared aggregation tests.
pkg/cli/logs_episode_test.go	Updates episode fixtures.
pkg/cli/logs_report_test.go	Updates report aggregation fixtures.
pkg/cli/logs_summary_test.go	Updates summary serialization fixture.
pkg/cli/logs_usage_activity_test.go	Updates usage-summary fixture.
pkg/cli/observability_insights_test.go	Updates observability fixtures.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 20/20 changed files
• Comments generated: 2
• Review effort level: Medium

[gh-aw-bot]

@copilot please run the pr-finisher skill, address any unresolved review feedback, investigate the failed checks listed on this PR if applicable, and rerun checks once the branch is ready.

Generated by 👨‍🍳 PR Sous Chef · 8.18 AIC · ⌖ 7.29 AIC · ⊞ 7.5K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot please run the pr-finisher skill, address any unresolved review feedback, investigate the failed checks listed on this PR if applicable, and rerun checks once the branch is ready.

...

Both review threads addressed in commits 2bc78cf and c1cf401:

1. JSON wire-name break (pkg/cli/access_log.go) — Added MarshalJSON/UnmarshalJSON to DomainAnalysis that map AllowedRequests/BlockedRequests to/from the original allowed_count/blocked_count JSON keys. A TestDomainAnalysisJSONWireNames test verifies the stable wire names and full round-trip.

2. Missing domain-merge test coverage (pkg/cli/log_aggregation_test.go) — Expanded TestDomainAnalysisAddMetrics with domain data containing duplicates across the two analyses, asserting that addBaseMetrics produces a sorted, deduplicated union for both AllowedDomains and BlockedDomains.

Local fmt, lint, and targeted tests are all green. Pre-existing failures (TestCloseExistingOrgIssuesByMarkerSkipsPRsAndPaginates) are confirmed pre-existing on the base commit and unrelated to these changes. CI re-trigger needed for final green signal.

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.82.12