Deduplicate baseline agent-volume test config fixture by Copilot · Pull Request #6180 · github/gh-aw-firewall

Copilot · 2026-07-13T13:34:57Z

The agent-volume test suites were carrying identical baseline WrapperConfig fixtures in multiple files. That duplication risks silent drift in security-sensitive bind-mount and Docker-socket coverage.

What changed
- Added a shared makeAgentVolumeConfig() test helper in src/services/agent-volumes/test-utils.ts
- Replaced duplicated inline makeConfig() fixtures in the affected agent-volume suites with the shared helper
Touched suites
- src/services/agent-volumes/docker-socket-branches.test.ts
- src/services/agent-volumes/workspace-mounts.test.ts
Related cleanup
- Updated src/services/agent-volumes/docker-host-staging.test.ts to use the same shared fixture so the baseline config is defined in one place across adjacent agent-volume tests
Effect
- Keeps the default agent-volume test policy centralized
- Reduces the chance that equivalent-looking suites diverge in effective WrapperConfig coverage over time

// src/services/agent-volumes/test-utils.ts
export function makeAgentVolumeConfig(overrides: Partial<WrapperConfig> = {}): WrapperConfig {
  return {
    allowDomains: 'example.com',
    agentCommand: 'echo test',
    workDir: '/tmp/awf-test',
    ...overrides,
  } as WrapperConfig;
}

Copilot

Pull request overview

Centralizes the baseline WrapperConfig fixture used across agent-volume unit tests to prevent drift in security-sensitive bind-mount and Docker socket coverage.

Changes:

Added a shared makeAgentVolumeConfig() helper for agent-volume test suites.
Updated the workspace mounts, docker socket, and docker-host staging tests to use the shared helper instead of duplicated inline fixtures.

Show a summary per file

File	Description
src/services/agent-volumes/test-utils.ts	Introduces shared baseline `WrapperConfig` fixture helper for agent-volume tests.
src/services/agent-volumes/workspace-mounts.test.ts	Replaces local `makeConfig()` fixture with `makeAgentVolumeConfig()`.
src/services/agent-volumes/docker-socket-branches.test.ts	Uses shared fixture helper for docker socket branch tests.
src/services/agent-volumes/docker-host-staging.test.ts	Uses shared fixture helper for docker-host staging tests.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 4/4 changed files
Comments generated: 2
Review effort level: Low

+export function makeAgentVolumeConfig(overrides: Partial<WrapperConfig> = {}): WrapperConfig {
+  return {
+    allowDomains: 'example.com',
+    agentCommand: 'echo test',
+    workDir: '/tmp/awf-test',


@@ -0,0 +1,10 @@
+import { WrapperConfig } from '../../types';


lpcox · 2026-07-13T14:40:09Z

@copilot address review feedback

Copilot · 2026-07-13T14:42:44Z

@copilot address review feedback

Done in af77c66's follow-up commit:

Renamed test-utils.ts → agent-volumes.test-utils.ts so it matches the *.test-utils.ts pattern excluded from the production build by tsconfig.json
Changed import { WrapperConfig } to import type { WrapperConfig } to avoid emitting a runtime require for a type-only dependency
Updated the three importing test files accordingly

github-actions · 2026-07-13T14:51:03Z

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-07-13T14:51:27Z

🔌 Smoke Services — All services reachable! ✅

github-actions · 2026-07-13T14:51:29Z

🔑 Smoke Copilot PAT PAT auth validated. All systems operational. ✅

github-actions · 2026-07-13T14:51:31Z

❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

github-actions · 2026-07-13T14:51:33Z

✅ Smoke Gemini completed. All facets verified. 💎

Attempting to list PRs via safeoutputs noop as a probe (this is a placeholder)

github-actions · 2026-07-13T14:51:37Z

✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓

github-actions · 2026-07-13T14:51:37Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

github-actions · 2026-07-13T14:51:37Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-07-13T14:51:38Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

github-actions · 2026-07-13T14:51:39Z

✅ Smoke Claude passed

github-actions · 2026-07-13T14:51:40Z

✅ Build Test Suite completed successfully!

github-actions · 2026-07-13T14:51:40Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-07-13T14:51:41Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

github-actions · 2026-07-13T14:51:50Z

📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-07-13T14:51:50Z

✅ Contribution Check completed successfully!

PR #6180 follows the applicable CONTRIBUTING.md guidelines: it is a focused TypeScript test-fixture refactor, keeps tests alongside source, includes the relevant test changes, and has a clear description. No documentation update or related-issue reference is required for this test-only cleanup.

github-actions · 2026-07-13T14:53:13Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	98.92%	98.95%	📈 +0.03%
Statements	98.88%	98.91%	📈 +0.03%
Functions	99.34%	99.34%	➡️ +0.00%
Branches	95.11%	95.11%	➡️ +0.00%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

✨ New Files (1 files)

src/services/agent-volumes/agent-volumes.test-utils.ts: 100.0% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-07-13T14:56:56Z

Smoke Test: Copilot BYOK (Direct) Mode

✅ GitHub.com connectivity (HTTP 200)
❌ File write/read test
✅ BYOK inference test (prompt received)
✅ Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com

Overall: PARTIAL — File test failed; inference path working.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-07-13T14:57:06Z

Smoke Test: Services Connectivity

Redis PING: ❌ Network unreachable
PostgreSQL pg_isready: ❌ No response
PostgreSQL SELECT 1: ❌ Network unreachable

Overall: FAIL — host.docker.internal is not reachable from this environment.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-07-13T14:57:06Z

Smoke Test: PAT Auth

Test	Result
GitHub MCP	connected
GitHub.com HTTP	pre-step data not injected
File Write/Read	pre-step data not injected

Overall: PARTIAL - MCP OK; template vars not expanded.
Auth mode: PAT (COPILOT_GITHUB_TOKEN) | Author: @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 PAT report filed by Smoke Copilot PAT
_{Add label ready-for-aw to run again}

github-actions · 2026-07-13T14:57:14Z

Gemini Smoke Test Results

GitHub MCP: ❌ (Tools missing/unreachable)
Connectivity: ❌ (curl code 7)
File Writing: ✅
Bash Tool: ✅

Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini
_{Add label ready-for-aw to run again}

github-actions · 2026-07-13T14:57:20Z

Smoke Test: Claude Engine Validation

Check	Result
API Status	✅ PASS
GH Check	✅ PASS
File Status	✅ PASS

Overall Result: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Smoke Claude for #6180 · 55.1 AIC · ⊞ 3.3K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-13T14:57:29Z

Smoke Test: API Proxy OTEL Tracing

Scenario	Result	Notes
1. Module loading	✅ Pass	`otel.js` loads cleanly; exports: `startRequestSpan`, `setTokenAttributes`, `setBudgetAttributes`, `endSpan`, `endSpanError`, `shutdown`, `isEnabled` + internal helpers
2. Test suite	✅ Pass	59 tests passed across `otel.test.js` + `otel-fanout.test.js` (2 suites, 0 failures)
3. Env var forwarding	✅ Pass	`src/services/api-proxy-env-config.test.ts` confirms all OTEL vars forwarded to container
4. Token-tracker integration	✅ Pass	`onUsage` callback present in `token-tracker-http.js` as the OTEL hook point
5. OTEL diagnostics	✅ Pass	`FileSpanExporter` writes to `/var/log/api-proxy/otel.jsonl` as local fallback when no endpoint configured

All 5 scenarios pass.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-07-13T14:57:34Z

Smoke test: PASS\nMerged PRs:\n- fix: add mode: gh-proxy to smoke-sink-visibility workflows\n- docs: add D5 failure mode — stale gVisor release pin returns 404\nChecks: PR history ✅ | GitHub title ✅ | file write ✅ | build ✅ | discussion ✅\nOverall: PASS

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

awmgmcpg
registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

github-actions · 2026-07-13T14:58:53Z

@lpcox
Validated merged PRs: ✅
GitHub.com connectivity: ✅
File write/read sandbox: ✅
BYOK inference path: ✅
Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)
Overall: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)
_{Add label ready-for-aw to run again}

github-actions · 2026-07-13T14:58:58Z

🔥 Smoke Test: Docker Sbx — PARTIAL PASS

Test	Result
GitHub MCP connectivity	✅
GitHub.com HTTP connectivity	⚠️ pre-step data unavailable
File write/read	⚠️ pre-step data unavailable

PR: Deduplicate baseline agent-volume test config fixture
Author: @Copilot | Assignees: @lpcox @Copilot

⚠️ Pre-computed step outputs were not resolved — smoke-data step may not have run.

📰 BREAKING: Report filed by Smoke Docker Sbx
_{Add label ready-for-aw to run again}

github-actions · 2026-07-13T14:59:02Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.3	❌ NO
Node.js	v24.18.0	v22.23.1	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Result: Not all tests passed — Python and Node.js versions differ between host and chroot environment.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions · 2026-07-13T14:59:40Z

Smoke Test Results

Test	Status
GitHub MCP Connectivity	⚠️ MCP unavailable in agent
GitHub.com HTTP	⚠️ Pre-step template vars not expanded
File Write/Read	⚠️ Pre-step template vars not expanded

Overall: ⚠️ INCONCLUSIVE — workflow template variables were not rendered before reaching the agent; pre-computed test data was unavailable.

Author: @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-07-13T15:02:01Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	all passed	✅ PASS
Node.js	execa	✅	all passed	✅ PASS
Node.js	p-limit	✅	all passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Build Test Suite for #6180 · 129.6 AIC · ⊞ 6.9K · ◷
_{Add label ready-for-aw to run again}

Initial plan

7019b7f

Copilot AI assigned Copilot and lpcox Jul 13, 2026

Copilot started work on behalf of lpcox July 13, 2026 13:36 View session

Copilot AI linked an issue Jul 13, 2026 that may be closed by this pull request

[Duplicate Code] Agent-volume tests repeat the baseline WrapperConfig fixture #6166

Closed

test: dedupe agent-volume config fixtures

af77c66

Copilot AI changed the title ~~[WIP] Fix duplicate Code in agent-volume test suites~~ Deduplicate baseline agent-volume test config fixture Jul 13, 2026

Copilot finished work on behalf of lpcox July 13, 2026 13:39

Copilot AI requested a review from lpcox July 13, 2026 13:39

lpcox marked this pull request as ready for review July 13, 2026 13:51

Copilot AI review requested due to automatic review settings July 13, 2026 13:51

Copilot started reviewing on behalf of lpcox July 13, 2026 13:51 View session

Copilot AI reviewed Jul 13, 2026

View reviewed changes

Copilot started work on behalf of lpcox July 13, 2026 14:40 View session

fix: rename test-utils to agent-volumes.test-utils

7c72ad3

Copilot finished work on behalf of lpcox July 13, 2026 14:43

lpcox added the ready-for-aw label Jul 13, 2026

lpcox had a problem deploying to aoai-model July 13, 2026 14:51 — with GitHub Actions Failure

github-actions Bot added the smoke-claude label Jul 13, 2026

github-actions Bot added the smoke-codex label Jul 13, 2026

github-actions Bot mentioned this pull request Jul 13, 2026

[aw] No-Op Runs #5883

Closed

github-actions Bot added the smoke-copilot-byok-aoai-apikey label Jul 13, 2026

lpcox temporarily deployed to aoai-model July 13, 2026 15:00 — with GitHub Actions Inactive

github-actions Bot added the smoke-copilot-byok-aoai-entra label Jul 13, 2026

lpcox temporarily deployed to aoai-model July 13, 2026 15:01 — with GitHub Actions Inactive

github-actions Bot mentioned this pull request Jul 13, 2026

[aw] Smoke Copilot BYOK AOAI (Entra) failed #6188

Closed

github-actions Bot added the build-test label Jul 13, 2026

lpcox merged commit 175e0c9 into main Jul 13, 2026
133 of 135 checks passed

lpcox deleted the copilot/fix-duplicate-code-agent-volume-tests branch July 13, 2026 16:11

github-actions Bot mentioned this pull request Jul 13, 2026

feat: add --security-mode strict|compat with strict as default #6197

Merged

		@@ -0,0 +1,10 @@
		import { WrapperConfig } from '../../types';

Uh oh!

Conversation

Copilot AI commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

lpcox commented Jul 13, 2026

Uh oh!

Copilot AI commented Jul 13, 2026

Uh oh!

github-actions Bot commented Jul 13, 2026

Uh oh!

github-actions Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 13, 2026

Uh oh!

github-actions Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 13, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

github-actions Bot commented Jul 13, 2026

Smoke Test: Copilot BYOK (Direct) Mode

Uh oh!

github-actions Bot commented Jul 13, 2026

Smoke Test: Services Connectivity

Uh oh!

github-actions Bot commented Jul 13, 2026

Smoke Test: PAT Auth

Uh oh!

github-actions Bot commented Jul 13, 2026

Gemini Smoke Test Results

Uh oh!

github-actions Bot commented Jul 13, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Jul 13, 2026

Smoke Test: API Proxy OTEL Tracing

Uh oh!

github-actions Bot commented Jul 13, 2026

Copilot AI commented Jul 13, 2026 •

edited

Loading

github-actions Bot commented Jul 13, 2026 •

edited

Loading

github-actions Bot commented Jul 13, 2026 •

edited

Loading

github-actions Bot commented Jul 13, 2026 •

edited

Loading

github-actions Bot commented Jul 13, 2026 •

edited

Loading

github-actions Bot commented Jul 13, 2026 •

edited

Loading

github-actions Bot commented Jul 13, 2026 •

edited

Loading

github-actions Bot commented Jul 13, 2026 •

edited

Loading

github-actions Bot commented Jul 13, 2026 •

edited

Loading

github-actions Bot commented Jul 13, 2026 •

edited

Loading

github-actions Bot commented Jul 13, 2026 •

edited

Loading

github-actions Bot commented Jul 13, 2026 •

edited

Loading

github-actions Bot commented Jul 13, 2026 •

edited

Loading

github-actions Bot commented Jul 13, 2026 •

edited

Loading