P2.1, P2.2, P2.3: Local duplicate consolidation

P2.1: Collapsed byte-identical templatable env-var builders
- Extracted buildTemplatableEnvVar from buildTemplatableBoolEnvVar and buildTemplatableIntEnvVar
- Kept original function names as thin wrappers for readability

P2.2: Extracted anomaly-marker formatting (8 sites)
- Added formatAnomalyTag(bool) string to audit_math_helpers.go
- Added formatAnomalyNote(bool, string) string to audit_math_helpers.go
- Replaced all 8 inline anomaly formatting blocks in audit_diff_render.go

P2.3: Used sortedMapKeys at 3 map[string]string sites
- safe_outputs_config_helpers.go
- safe_scripts.go
- safe_outputs_app_config.go

All changes build successfully

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Author: Copilot

pkg/cli/audit_diff_render.go

@@ -150,10 +150,7 @@ func renderFirewallDiffMarkdownSection(diff *FirewallDiff) {
 		for _, entry := range diff.NewDomains {
 			total := entry.Run2Allowed + entry.Run2Blocked
 			statusIcon := firewallStatusEmoji(entry.Run2Status)
-			anomalyTag := ""
-			if entry.IsAnomaly {
-				anomalyTag = " ⚠️"
-			}
+			anomalyTag := formatAnomalyTag(entry.IsAnomaly)
 			fmt.Fprintf(os.Stdout, "- %s `%s` (%d requests, %s)%s\n", statusIcon, entry.Domain, total, entry.Run2Status, anomalyTag)
 		}
 		fmt.Fprintln(os.Stdout)
@@ -173,10 +170,7 @@ func renderFirewallDiffMarkdownSection(diff *FirewallDiff) {
 		for _, entry := range diff.StatusChanges {
 			icon1 := firewallStatusEmoji(entry.Run1Status)
 			icon2 := firewallStatusEmoji(entry.Run2Status)
-			anomalyTag := ""
-			if entry.IsAnomaly {
-				anomalyTag = " ⚠️"
-			}
+			anomalyTag := formatAnomalyTag(entry.IsAnomaly)
 			fmt.Fprintf(os.Stdout, "- `%s`: %s %s → %s %s%s\n", entry.Domain, icon1, entry.Run1Status, icon2, entry.Run2Status, anomalyTag)
 		}
 		fmt.Fprintln(os.Stdout)
@@ -205,10 +199,7 @@ func renderMCPToolsDiffMarkdownSection(diff *MCPToolsDiff) {
 	if len(diff.NewTools) > 0 {
 		fmt.Fprintf(os.Stdout, "**New tools (%d)**\n", len(diff.NewTools))
 		for _, entry := range diff.NewTools {
-			anomalyTag := ""
-			if entry.IsAnomaly {
-				anomalyTag = " ⚠️"
-			}
+			anomalyTag := formatAnomalyTag(entry.IsAnomaly)
 			fmt.Fprintf(os.Stdout, "- `%s/%s` (%d calls)%s\n", entry.ServerName, entry.ToolName, entry.Run2CallCount, anomalyTag)
 		}
 		fmt.Fprintln(os.Stdout)
@@ -225,10 +216,7 @@ func renderMCPToolsDiffMarkdownSection(diff *MCPToolsDiff) {
 	if len(diff.ChangedTools) > 0 {
 		fmt.Fprintf(os.Stdout, "**Changed tools (%d)**\n", len(diff.ChangedTools))
 		for _, entry := range diff.ChangedTools {
-			anomalyTag := ""
-			if entry.IsAnomaly {
-				anomalyTag = " ⚠️"
-			}
+			anomalyTag := formatAnomalyTag(entry.IsAnomaly)
 			errInfo := ""
 			if entry.Run1ErrorCount > 0 || entry.Run2ErrorCount > 0 {
 				errInfo = fmt.Sprintf(", errors: %d → %d", entry.Run1ErrorCount, entry.Run2ErrorCount)
@@ -327,10 +315,7 @@ func renderFirewallDiffPrettySection(diff *FirewallDiff) {
 		}
 		for _, entry := range diff.NewDomains {
 			total := entry.Run2Allowed + entry.Run2Blocked
-			anomalyNote := ""
-			if entry.IsAnomaly {
-				anomalyNote = "⚠️ " + entry.AnomalyNote
-			}
+			anomalyNote := formatAnomalyNote(entry.IsAnomaly, entry.AnomalyNote)
 			config.Rows = append(config.Rows, []string{
 				entry.Domain,
 				firewallStatusEmoji(entry.Run2Status) + " " + entry.Run2Status,
@@ -365,10 +350,7 @@ func renderFirewallDiffPrettySection(diff *FirewallDiff) {
 			Rows:    make([][]string, 0, len(diff.StatusChanges)),
 		}
 		for _, entry := range diff.StatusChanges {
-			anomalyNote := ""
-			if entry.IsAnomaly {
-				anomalyNote = "⚠️ " + entry.AnomalyNote
-			}
+			anomalyNote := formatAnomalyNote(entry.IsAnomaly, entry.AnomalyNote)
 			config.Rows = append(config.Rows, []string{
 				entry.Domain,
 				firewallStatusEmoji(entry.Run1Status) + " " + entry.Run1Status,
@@ -415,10 +397,7 @@ func renderMCPToolsDiffPrettySection(diff *MCPToolsDiff) {
 			Rows:    make([][]string, 0, len(diff.NewTools)),
 		}
 		for _, entry := range diff.NewTools {
-			anomalyNote := ""
-			if entry.IsAnomaly {
-				anomalyNote = "⚠️ " + entry.AnomalyNote
-			}
+			anomalyNote := formatAnomalyNote(entry.IsAnomaly, entry.AnomalyNote)
 			config.Rows = append(config.Rows, []string{
 				entry.ServerName,
 				entry.ToolName,
@@ -452,10 +431,7 @@ func renderMCPToolsDiffPrettySection(diff *MCPToolsDiff) {
 			Rows:    make([][]string, 0, len(diff.ChangedTools)),
 		}
 		for _, entry := range diff.ChangedTools {
-			anomalyNote := ""
-			if entry.IsAnomaly {
-				anomalyNote = "⚠️ " + entry.AnomalyNote
-			}
+			anomalyNote := formatAnomalyNote(entry.IsAnomaly, entry.AnomalyNote)
 			config.Rows = append(config.Rows, []string{
 				entry.ServerName,
 				entry.ToolName,

pkg/cli/audit_math_helpers.go

@@ -57,3 +57,21 @@ func formatFloatDelta(value1, value2 float64) string {
 	}
 	return fmt.Sprintf("%.3f", delta)
 }
+
+// formatAnomalyTag returns a warning emoji suffix for markdown rendering
+// when isAnomaly is true, otherwise returns an empty string.
+func formatAnomalyTag(isAnomaly bool) string {
+	if isAnomaly {
+		return " ⚠️"
+	}
+	return ""
+}
+
+// formatAnomalyNote returns a formatted anomaly note for table rendering
+// with a warning emoji prefix when isAnomaly is true, otherwise returns an empty string.
+func formatAnomalyNote(isAnomaly bool, anomalyNote string) string {
+	if isAnomaly {
+		return "⚠️ " + anomalyNote
+	}
+	return ""
+}

pkg/workflow/safe_outputs_app_config.go

@@ -293,11 +293,7 @@ func (c *Compiler) buildGitHubAppTokenMintStepWithMeta(app *GitHubAppConfig, per
 		}
 
 		// Extract and sort keys for deterministic ordering
-		keys := make([]string, 0, len(permissionFields))
-		for key := range permissionFields {
-			keys = append(keys, key)
-		}
-		sort.Strings(keys)
+		keys := sortedMapKeys(permissionFields)
 
 		// Add permissions in sorted order
 		for _, key := range keys {

pkg/workflow/safe_outputs_config_helpers.go

@@ -2,7 +2,6 @@ package workflow
 
 import (
 	"encoding/json"
-	"sort"
 
 	"github.com/github/gh-aw/pkg/logger"
 	"github.com/github/gh-aw/pkg/stringutil"
@@ -24,11 +23,7 @@ func buildNormalizedSortedJSON(names []string, valueFn func(string) string) (str
 		values[normalizedName] = valueFn(normalizedName)
 	}
 
-	keys := make([]string, 0, len(values))
-	for k := range values {
-		keys = append(keys, k)
-	}
-	sort.Strings(keys)
+	keys := sortedMapKeys(values)
 
 	ordered := make(map[string]string, len(keys))
 	for _, k := range keys {

pkg/workflow/safe_scripts.go

@@ -2,7 +2,6 @@ package workflow
 
 import (
 	"encoding/json"
-	"sort"
 	"strings"
 
 	"github.com/github/gh-aw/pkg/logger"
@@ -105,11 +104,7 @@ func buildCustomSafeOutputScriptsJSON(data *WorkflowData) string {
 	}
 
 	// Sort keys for deterministic output
-	keys := make([]string, 0, len(scriptMapping))
-	for k := range scriptMapping {
-		keys = append(keys, k)
-	}
-	sort.Strings(keys)
+	keys := sortedMapKeys(scriptMapping)
 
 	ordered := make(map[string]string, len(keys))
 	for _, k := range keys {

pkg/workflow/templatables.go

@@ -156,11 +156,11 @@ func (t *TemplatableBool) String() string {
 	return string(*t)
 }
 
-// buildTemplatableBoolEnvVar returns a YAML environment variable entry for a
-// templatable boolean field. If value is a GitHub Actions expression it is
+// buildTemplatableEnvVar returns a YAML environment variable entry for a
+// templatable field. If value is a GitHub Actions expression it is
 // embedded unquoted so that GitHub Actions can evaluate it at runtime;
 // otherwise the literal string is quoted. Returns nil if value is nil.
-func buildTemplatableBoolEnvVar(envVarName string, value *string) []string {
+func buildTemplatableEnvVar(envVarName string, value *string) []string {
 	if value == nil {
 		return nil
 	}
@@ -171,6 +171,14 @@ func buildTemplatableBoolEnvVar(envVarName string, value *string) []string {
 	return []string{fmt.Sprintf("          %s: %q\n", envVarName, v)}
 }
 
+// buildTemplatableBoolEnvVar returns a YAML environment variable entry for a
+// templatable boolean field. If value is a GitHub Actions expression it is
+// embedded unquoted so that GitHub Actions can evaluate it at runtime;
+// otherwise the literal string is quoted. Returns nil if value is nil.
+func buildTemplatableBoolEnvVar(envVarName string, value *string) []string {
+	return buildTemplatableEnvVar(envVarName, value)
+}
+
 // AddTemplatableBool adds a templatable boolean field to the handler config.
 //
 // The stored JSON value depends on the content of *value:
@@ -200,14 +208,7 @@ func (b *handlerConfigBuilder) AddTemplatableBool(key string, value *string) *ha
 // embedded unquoted so that GitHub Actions can evaluate it at runtime;
 // otherwise the literal string is quoted. Returns nil if value is nil.
 func buildTemplatableIntEnvVar(envVarName string, value *string) []string {
-	if value == nil {
-		return nil
-	}
-	v := *value
-	if isExpression(v) {
-		return []string{fmt.Sprintf("          %s: %s\n", envVarName, v)}
-	}
-	return []string{fmt.Sprintf("          %s: %q\n", envVarName, v)}
+	return buildTemplatableEnvVar(envVarName, value)
 }
 
 // AddTemplatableInt adds a templatable integer field to the handler config.