ci: raise agent audit turn limit and preserve logs (#571)

* ci: raise agent audit turn limit and preserve logs

The Friday test-health audit hit the 30-turn cap on its first-ever run
(2026-04-24) and the agent log was discarded with the self-hosted
runner. Heavier recipes need more room, and the next failure should be
diagnosable.

- Raise --max-turns from 30 to 50
- Switch --output-format from text to stream-json so events are emitted
  during the run instead of only at process exit; prefix with
  stdbuf -oL -eL to line-buffer the pipe
- Upload /tmp/claude-audit-log.txt and /tmp/audit-<suite>.md as an
  artifact (if: always(), 14-day retention) using the upload-artifact
  SHA already pinned in build-notebooks.yml

Signed-off-by: Andre Manoel <amanoel@nvidia.com>

* ci: disambiguate audit artifact name across run attempts

actions/upload-artifact@v4+ rejects duplicate names within a workflow,
and re-running a failed run reuses the same github.run_id. Append
github.run_attempt so re-runs upload successfully instead of failing at
the exact moment the artifact is most useful.

Found by Codex review of #571.

Signed-off-by: Andre Manoel <amanoel@nvidia.com>

* ci: only upload agent log on failure

Raise the bar for persisting the full verbose stream-json event log:
we only need it when we're actually debugging a failure, and the audit
report itself still lands in the step summary on success. Shrinks the
window where tool inputs, read file contents, or other verbose-stream
detail could end up in a 14-day artifact.

Addresses the minor privacy finding from Codex review of #571.

Signed-off-by: Andre Manoel <amanoel@nvidia.com>

* ci: drop raw agent log from job summary

With --output-format stream-json the previous tail -100 of the agent
log emitted raw NDJSON into the GH Actions UI summary, which is
unreadable. The audit report itself (/tmp/audit-<suite>.md) already
carries the human-readable payload, and the full event stream is
available as an on-failure artifact, so the raw tail was redundant and
worse than nothing for the summary surface.

Also rewords the fallback message to point at the artifact when no
report lands (typically a failure).

Signed-off-by: Andre Manoel <amanoel@nvidia.com>

---------

Signed-off-by: Andre Manoel <amanoel@nvidia.com>

Author: andreatgretel

.github/workflows/agentic-ci-daily.yml

@@ -174,11 +174,11 @@ jobs:
             | sed "s|{{date}}|$(date -u +%Y-%m-%d)|g" \
             | sed "s|{{memory_path}}|.agentic-ci-state|g")
 
-          claude \
+          stdbuf -oL -eL claude \
             --model "$AGENTIC_CI_MODEL" \
             -p "$PROMPT" \
-            --max-turns 30 \
-            --output-format text \
+            --max-turns 50 \
+            --output-format stream-json \
             --verbose \
             2>&1 | tee /tmp/claude-audit-log.txt
 
@@ -205,6 +205,17 @@ jobs:
               json.dump(state, f, indent=2)
           "
 
+      - name: Upload agent log
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: claude-audit-log-${{ matrix.suite }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            /tmp/claude-audit-log.txt
+            /tmp/audit-${{ matrix.suite }}.md
+          retention-days: 14
+          if-no-files-found: ignore
+
       - name: Write job summary
         if: always()
         env:
@@ -216,15 +227,5 @@ jobs:
           if [ -s "/tmp/audit-${SUITE}.md" ]; then
             cat "/tmp/audit-${SUITE}.md" >> "$GITHUB_STEP_SUMMARY"
           else
-            echo "No report generated." >> "$GITHUB_STEP_SUMMARY"
-          fi
-
-          if [ -s "/tmp/claude-audit-log.txt" ]; then
-            echo "" >> "$GITHUB_STEP_SUMMARY"
-            echo "<details><summary>Agent log</summary>" >> "$GITHUB_STEP_SUMMARY"
-            echo "" >> "$GITHUB_STEP_SUMMARY"
-            echo '```' >> "$GITHUB_STEP_SUMMARY"
-            tail -100 /tmp/claude-audit-log.txt >> "$GITHUB_STEP_SUMMARY"
-            echo '```' >> "$GITHUB_STEP_SUMMARY"
-            echo "</details>" >> "$GITHUB_STEP_SUMMARY"
+            echo "No report generated. See the \`claude-audit-log-*\` artifact on failures for the full event stream." >> "$GITHUB_STEP_SUMMARY"
           fi