refactor(compile): reduce complexity of build_conclusion_job in agentic_pipeline.rs

[github-actions]

What was complex

build_conclusion_job in src/compile/agentic_pipeline.rs was flagged by Clippy's too_many_lines lint at 195/100 lines. It mixed several distinct concerns in one function body: building the Conclusion job's steps, applying per-tool (noop/missing-tool/missing-data) config as flat env vars, and hoisting upstream job results (Agent/Detection/SafeOutputs[/_Reviewed]/custom jobs) into job-level variables + step env wiring.

What changed

Extracted two well-named helper functions, keeping build_conclusion_job's public signature and behavior unchanged:

• apply_conclusion_tool_config_env — applies a single per-tool config (noop / missing-tool / missing-data) onto the Conclusion step as flat AW_<TOOL>_* env vars, using early returns (let-else) instead of nested if let chains.
• hoist_conclusion_job_results — hoists upstream job $[dependencies...] results into job-level JobVariables and wires the corresponding $(name) macro env vars onto the Conclusion step, returning (Vec<JobVariable>, BashStep).

build_conclusion_job now calls these helpers in a loop / single call instead of inlining ~150 lines of logic.

Before / after

• Before: build_conclusion_job flagged at 195/100 lines by clippy::too_many_lines.
• After: the function no longer appears in the too_many_lines clippy report for this file at all.

Verification

• cargo test --bin ado-aw — all 3229 tests pass (1 ignored, unrelated to this change).
• cargo clippy --all-targets --all-features — clean except one pre-existing, unrelated warning in create_work_item.rs.
• No public API/behavior change; only internal decomposition.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• spsprodeus21.vssps.visualstudio.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "spsprodeus21.vssps.visualstudio.com"

See Network Configuration for more information.

Generated by Cyclomatic Complexity Reducer · auto · 91 AIC · ⌖ 11.8 AIC · ⊞ 11.4K · ◷

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
1 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
1 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

✅ PR Security Reviewer completed the security review.

🔒 Security review by PR Security Reviewer

[github-actions]

✅ Compiler Contract Reviewer completed the compiler contract review.

🏗️ Compiler contract review by Compiler Contract Reviewer

[github-actions]

✅ Rust Code Quality Reviewer completed the Rust code quality review.

🦀 Rust code quality review by Rust Code Quality Reviewer

[github-actions]

✅ Test Quality Sentinel completed the test quality analysis.

Test Quality review: this PR is a pure, line-for-line extraction refactor of build_conclusion_job in src/compile/agentic_pipeline.rs into two helper functions (apply_conclusion_tool_config_env, hoist_conclusion_job_results). No production logic changed and no new test files were touched. Existing tests for build_conclusion_job already exercise this code path unchanged, so no additional test coverage is required. No findings.

🧪 Test quality analysis by Test Quality Sentinel

[github-actions]

Security review: no regressions found

This is a pure mechanical refactor extracting apply_conclusion_tool_config_env and hoist_conclusion_job_results out of build_conclusion_job. Diffed line-by-line against main: the sanitize.rs calls on title-prefix/work-item-type/area-path/iteration-path are preserved unchanged, the report-as-work-item bool/string handling (avoiding the JSON-quoting inversion bug) is preserved, the $[dependencies...] runtime-expression hoist into job variables (vs. step env, per the ADO evaluation-context comment) is preserved, and no token/credential handling is touched. No new sinks, no widened validation, no behavior change. Security-neutral.

🔒 Security review by PR Security Reviewer · auto · 21.8 AIC · ⌖ 3.46 AIC · ⊞ 11.7K
_{Comment /review to run again}

[github-actions]

Verdict: COMMENT — no merge-blocking issues found.

Reviewed the two extracted helpers (apply_conclusion_tool_config_env, hoist_conclusion_job_results) against the original inline logic in build_conclusion_job. This is a faithful, pure mechanical extraction:

• Control flow is preserved 1:1 (if let/continue → let-else/early-return is behavior-equivalent).
• All env var names, job-variable hoisting, and $[dependencies...] expressions are unchanged.
• No new unwrap()/expect() introduced, error propagation via ? on prefix.id(...) is preserved.
• rust-critic sub-agent returned no findings on this diff.

No inline comments needed.

🦀 Rust code quality review by Rust Code Quality Reviewer · auto · 25.7 AIC · ⌖ 2.23 AIC · ⊞ 11.5K
_{Comment /review to run again}

[github-actions]

Pure mechanical extraction — two closures (apply_conclusion_tool_config_env, hoist_conclusion_job_results) pulled out of build_conclusion_job with identical logic and no signature/behavior changes. Verified: cargo build succeeds and a line-by-line diff shows the extracted bodies are byte-identical to the inlined originals (only indentation/braces differ). No front-matter grammar, safe-output tool, typed IR, or generated-artefact changes accompany this PR, so none of the compiler-contract drift checks apply (no .gen.ts/.gen.json changes needed since filter_ir.rs/Fact are untouched; no .lock.yml drift since no .github/workflows/*.md changed; no docs pages need updates). Nothing to flag.

🏗️ Compiler contract review by Compiler Contract Reviewer · auto · 24.4 AIC · ⌖ 2.77 AIC · ⊞ 12.7K
_{Comment /review to run again}