Skip to content

fix: propagate config fields to all layers - #6228

Closed
github-actions[bot] wants to merge 5 commits into
mainfrom
fix/propagate-security-mode-spec-mapping-7af346d908969769
Closed

fix: propagate config fields to all layers#6228
github-actions[bot] wants to merge 5 commits into
mainfrom
fix/propagate-security-mode-spec-mapping-7af346d908969769

Conversation

@github-actions

Copy link
Copy Markdown
Contributor

Config Consistency Audit Fix

This PR fixes gaps found by the config consistency auditor for recently merged PRs.

Gaps Found

PR Field Layer Missing
#6197 (feat: add --security-mode strict/compat) security.securityMode docs/awf-config-spec.md Section 5 CLI Mapping
#6209 (feat: rename --security-mode to --legacy-security) security.legacySecurity docs/awf-config-spec.md Section 5 CLI Mapping

What Was Fixed

Added two missing entries to the Section 5 CLI Mapping table in docs/awf-config-spec.md:

  • security.legacySecurity--legacy-security
  • security.securityMode--security-mode (deprecated)

Both fields are already present in all other required layers:

  • src/awf-config-schema.json and docs/awf-config.schema.json (identical)
  • src/types/security-options.ts
  • src/config-file.ts
  • src/config-mapper.ts

Verification Checklist

  • tsc --noEmit — no TypeScript errors (doc-only change)
  • Schemas are identical (no schema changes in this PR)
  • Spec now lists all security.* fields with CLI flags

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Config Consistency Auditor · 49.7 AIC · ⊞ 6.1K ·

…pec CLI mapping

Add missing Section 5 CLI mapping entries for two security fields introduced
in PRs #6197 and #6209:
- security.legacySecurity → --legacy-security
- security.securityMode → --security-mode (deprecated)

Both fields exist in src/awf-config-schema.json, src/types/security-options.ts,
src/config-file.ts, and src/config-mapper.ts but were not listed in the
docs/awf-config-spec.md Section 5 CLI Mapping table.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@lpcox
lpcox marked this pull request as ready for review July 14, 2026 23:34
Copilot AI review requested due to automatic review settings July 14, 2026 23:34

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Documents missing security configuration-to-CLI mappings.

Changes:

  • Adds mappings for legacySecurity and deprecated securityMode.
Show a summary per file
File Description
docs/awf-config-spec.md Adds security CLI mappings.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 1/1 changed files
  • Comments generated: 1
  • Review effort level: Medium

Comment thread docs/awf-config-spec.md Outdated
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
@github-actions

Copy link
Copy Markdown
Contributor Author

✅ Copilot review passed with no inline comments.

@github-actions[bot] Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

@github-actions

github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

Documentation Preview

Documentation build failed for this PR. View logs.

Built from commit 6821c28

@github-actions

github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤

@github-actions

github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

Contribution Check completed successfully!

PR #6228 follows the applicable CONTRIBUTING.md guidelines: it is a documentation-only mapping update, the description is clear and references related PRs, and the file is correctly located under docs/. No review comment is needed.

@github-actions

github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

@github-actions

github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

Smoke Gemini completed. All facets verified. 💎

@github-actions

github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

@github-actions

github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

@github-actions

github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

Build Test Suite completed successfully!

@github-actions

github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

@github-actions

github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

🔑 Smoke Copilot PAT PAT auth validated. All systems operational. ✅

@github-actions

github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

@github-actions

github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

@github-actions

github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

Smoke Claude passed

@github-actions

github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

🦎🟣 Smoke gVisor Claude reports failed. gVisor + Claude compatibility issue detected.

@github-actions

github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

🦎 Smoke gVisor reports failed. gVisor compatibility issue detected.

@github-actions

github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

🦎🏗️ Smoke gVisor Build Test reports failed. gVisor build compatibility issue detected.

@github-actions

github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

🔌 Smoke Services — All services reachable! ✅

@github-actions

github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

🐳🏗️ Smoke Docker Sbx Build Test completed. Docker sbx build test passed. ✅

@github-actions

github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

🐳🔮 Smoke Docker Sbx Codex completed. Docker sbx + Codex smoke test passed. ✅

@github-actions

github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

🦎🟣 Smoke gVisor Claude reports failed. gVisor + Claude compatibility issue detected.

@github-actions

github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

🦎 Smoke gVisor completed. gVisor smoke test passed. ✅

@github-actions

github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

🦎🔮 Smoke gVisor Codex completed. gVisor + Codex smoke test passed. ✅

@github-actions

Copy link
Copy Markdown
Contributor Author

Smoke Test: Claude Engine Validation

Check Result
API Status ✅ PASS
GH Check ✅ PASS
File Status ✅ PASS

Overall Result: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Smoke Claude for #6228 · 55.4 AIC · ⊞ 3.3K ·
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor Author

🔬 Smoke Test: PAT Auth

Test Result
GitHub MCP ✅ Connected
GitHub.com HTTP ⚠️ Pre-step data unavailable
File Write/Read ⚠️ Pre-step data unavailable

Overall: PARTIAL — template vars not expanded before agent execution.
Auth mode: PAT (COPILOT_GITHUB_TOKEN) | Author: @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 PAT report filed by Smoke Copilot PAT
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor Author

Smoke Test: Copilot BYOK (Direct) Mode

Test Status
GitHub MCP connectivity
GitHub.com connectivity
File write/read
BYOK inference (api-proxy → api.githubcopilot.com)

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com

Overall: PASS

cc @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK report filed by Smoke Copilot BYOK
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor Author

Smoke Test Results

Test Status
MCP Connectivity
GitHub.com HTTP
File Write/Read

Overall: PASS@lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor Author

Smoke Test: Services Connectivity

  • Redis PING: ❌ (Network unreachable)
  • PostgreSQL pg_isready: ❌ (No response)
  • PostgreSQL SELECT 1: ❌ (Network unreachable)

Overall: FAILhost.docker.internal (172.17.0.1) is unreachable from this runner.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔌 Service connectivity validated by Smoke Services
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor Author

🦎 gVisor Smoke Test Results

  • 🦎 gVisor runtime: unconfirmed (runc detected)
  • ✅ GitHub.com connectivity: HTTP 200
  • ✅ Network isolation: example.com blocked (timeout/000)
  • ⚠️ Pre-step vars not expanded (template literal issue)

Overall: PASS (runtime unconfirmed pending plumbing)

cc @lpcox

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

  • example.com
  • host.docker.internal

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"
    - "host.docker.internal"

See Network Configuration for more information.

🦎 gVisor smoke test by Smoke gVisor
Add label test-gvisor to run again

@github-actions

Copy link
Copy Markdown
Contributor Author

🦎🔮 gVisor + Codex runtime: confirmed\n✅ gVisor kernel detected\n✅ smoke file read: pass\n✅ github.com connectivity: 200\n❌ GitHub MCP PR-list check: denied by proxy\n✅ example.com blocked\nOverall status: FAIL

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

  • 172.30.0.1
  • example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "172.30.0.1"
    - "example.com"

See Network Configuration for more information.

🦎🔮 gVisor + Codex smoke test by Smoke gVisor Codex
Add label test-gvisor-codex to run again

@github-actions

Copy link
Copy Markdown
Contributor Author

Smoke Test: API Proxy OpenTelemetry Tracing

Scenario Result
S1: Module Loading otel.js loads successfully; exports: startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled, and internal helpers
S2: Test Suite ✅ 59 tests passed across otel.test.js + otel-fanout.test.js (0 failures)
S3: Env Var Forwarding src/services/api-proxy-env-config.ts forwards GH_AW_OTLP_ENDPOINTS, OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_EXPORTER_OTLP_HEADERS, GITHUB_AW_OTEL_TRACE_ID, and related vars to the api-proxy container
S4: Token Tracker Integration onUsage callback exists in token-tracker-http.js (lines 285/343) as the OTEL hook point
S5: OTEL Diagnostics i️ No live spans exported during static validation (no running container); file fallback writes to /var/log/api-proxy/otel.jsonl when no endpoint configured

Overall: ✅ All scenarios pass.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📡 OTel tracing validated by Smoke OTel Tracing
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor Author

Smoke Test: Gemini Engine Validation

  • GitHub MCP Testing: ❌ (Access policy filter: PRs are filtered out)
  • GitHub.com Connectivity: ❌ (curl status 000, exit 7)
  • File Writing Testing: ✅
  • Bash Tool Testing: ✅

Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor Author

🦎🏗️ gVisor Build Test Results

Test Status
gVisor runtime unconfirmed
GitHub.com connectivity
Node.js build (npm ci && npm run build)
Node.js tests (Jest subset)
Go build (color, uuid)
Go tests (color, uuid)
Network isolation

Overall: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • host.docker.internal

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "host.docker.internal"

See Network Configuration for more information.

🦎🏗️ gVisor build test by Smoke gVisor Build Test
Add label test-gvisor-build to run again

@github-actions

Copy link
Copy Markdown
Contributor Author

🔥 Smoke Test Results

Test Result
GitHub MCP connectivity ✅ Connected
GitHub.com HTTP ⚠️ Template vars unresolved
File write/read ⚠️ Template vars unresolved

Overall: PARTIAL — MCP connectivity confirmed; pre-computed smoke data was not injected (raw ${{ }} substitution variables in prompt).

cc @lpcox

📰 BREAKING: Report filed by Smoke Docker Sbx
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor Author

🏗️ Build Test Suite Results

Ecosystem Project Build/Install Tests Status
Bun elysia 1/1 passed ✅ PASS
Bun hono 1/1 passed ✅ PASS
C++ fmt N/A ✅ PASS
C++ json N/A ✅ PASS
Deno oak N/A 1/1 passed ✅ PASS
Deno std N/A 1/1 passed ✅ PASS
.NET hello-world N/A ✅ PASS
.NET json-parse N/A ✅ PASS
Go color passed ✅ PASS
Go env passed ✅ PASS
Go uuid passed ✅ PASS
Java gson 1/1 passed ✅ PASS
Java caffeine 1/1 passed ✅ PASS
Node.js clsx All passed ✅ PASS
Node.js execa All passed ✅ PASS
Node.js p-limit All passed ✅ PASS
Rust fd 1/1 passed ✅ PASS
Rust zoxide 1/1 passed ✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Build Test Suite for #6228 · 34.2 AIC · ⊞ 6.9K ·
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor Author

🐳🏗️ Docker Sbx Build Test Results

Test Status
GitHub.com connectivity
Node.js build (npm ci && npm run build)
Node.js tests (Jest subset)
Go build (color, uuid)
Go tests (color, uuid)
Network isolation

Overall: FAIL

🐳🏗️ Docker sbx build test by Smoke Docker Sbx Build Test
Add label test-docker-sbx-build to run again

@github-actions

Copy link
Copy Markdown
Contributor Author

Chroot Version Comparison

Runtime Host Version Chroot Version Match?
Python Python 3.12.13 Python 3.12.3 ❌ NO
Node.js v24.18.0 v22.23.1 ❌ NO
Go go1.22.12 go1.22.12 ✅ YES

ALL_TESTS_PASSED: false — Python and Node.js versions differ between host and chroot.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Tested by Smoke Chroot
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor Author

🐳🟣 Docker sbx + Claude

  • ✅ GitHub MCP connectivity
  • ✅ github.com reachable (HTTP 200)
  • ✅ File write/read
  • ❌ Network isolation — example.com returned HTTP 200 (expected block)

Overall: FAIL (egress control did not block non-allowlisted domain)

🐳🟣 Docker sbx + Claude smoke test by Smoke Docker Sbx Claude
Add label test-docker-sbx-claude to run again

@github-actions

Copy link
Copy Markdown
Contributor Author

🐳🔮 Docker sbx + Codex\n✅ GitHub MCP: list_pull_requests reachable\n✅ GitHub.com: 200\n✅ File read: smoke artifact matched\n❌ Network isolation: example.com returned 200 (expected blocked)\nOverall: FAIL

🐳🔮 Docker sbx + Codex smoke test by Smoke Docker Sbx Codex
Add label test-docker-sbx-codex to run again

@github-actions

Copy link
Copy Markdown
Contributor Author

Smoke Test

  • fix: exclude GITHUB_TOKEN from agent container when API proxy is enabled
  • fix: update CI workflow tests for new compiler action path format
  • ✅ GitHub reads
  • ❌ Playwright check
  • ✅ File write/read
  • ⚠️ Discussion lookup only
  • ❌ Build (npm ci timed out)
  • Overall: FAIL

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

  • awmgmcpg
  • registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
Add label ready-for-aw to run again

@lpcox lpcox closed this Jul 15, 2026
@lpcox lpcox reopened this Jul 15, 2026
@lpcox lpcox closed this Jul 15, 2026
@lpcox lpcox reopened this Jul 15, 2026
@lpcox lpcox closed this Jul 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants