feat: add DAP events to project audit

Changes

This MR implements 5 DAP (Duo Agent Platform) session lifecycle audit events at the project level to track all session state transitions.

How to replicate

1. Checkout duo/feature/581004-add-dap-events-to-project-audit in your GDK

2. Navigate to an open issue and click on Generate MR with Duo (or start any other remote flow)

   

3. Navigate to Secure/Audit event and confirm that the Duo related events were logged

   

4. Repeat step 2. but this time cancel the flow before it could finish (Automate/Sessions/<your running session>/Details -> Cancel session)

   

5. Check the audit events and confirm that the right events were logged.

   

Generated by Duo:

🤖

Audit Event YAML Definitions

Created 5 new audit event type definitions in config/audit_events/types/:

• duo_session_created.yml - Triggered when a Duo session is created
• duo_session_started.yml - Triggered when a session transitions from created → running
• duo_session_finished.yml - Triggered when a session completes successfully
• duo_session_failed.yml - Triggered when a session fails (drop event)
• duo_session_stopped.yml - Triggered when a session is manually stopped

All definitions follow the required schema with:

• feature_category: duo_agent_platform
• milestone: '18.8'
• saved_to_database: true
• streamed: true
• scope: [Project]

Service Integration

CreateWorkflowService (ee/app/services/ai/duo_workflows/create_workflow_service.rb):

• Added audit event creation after workflow creation
• Event: duo_session_created with message "Created Duo session"
• Supports both project and namespace-level workflows

UpdateWorkflowStatusService (ee/app/services/ai/duo_workflows/update_workflow_status_service.rb):

• Implemented audit_event_for_status_change method with status-to-event mapping:
  • start → duo_session_started ("Started Duo session")
  • finish → duo_session_finished ("Completed Duo session")
  • drop → duo_session_failed ("Duo session failed")
  • stop → duo_session_stopped ("Duo session stopped")
• Includes workflow definition and ID in target details

Test Coverage

Added comprehensive test coverage in:

• ee/spec/services/ai/duo_workflows/create_workflow_service_spec.rb - Tests for session creation event
• ee/spec/services/ai/duo_workflows/update_workflow_status_service_spec.rb - Tests for all 4 status transition events

All audit events use Gitlab::Audit::Auditor.audit() for automatic IP address capture, database persistence, and streaming to external services.

🤖

Relates to #581004 (closed) and &19760