updated workflows

[lpcox]

No description provided.

[github-actions]

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	98.92%	98.95%	📈 +0.03%
Statements	98.86%	98.89%	📈 +0.03%
Functions	99.35%	99.35%	➡️ +0.00%
Branches	95.11%	95.11%	➡️ +0.00%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
src/log-directory-setup.ts	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[Copilot]

Pull request overview

Updates generated agentic workflows to newer gh-aw tooling and AWF v0.27.34.

Changes:

• Pins updated setup actions and AWF container digests.
• Uses prebuilt rootless AWF binaries and sparse checkouts.
• Consolidates generated helper-script usage.

Show a summary per file

File	Description
.github/workflows/test-coverage-reporter.lock.yml	Updates generated coverage workflow runtime.
.github/workflows/smoke-gemini.lock.yml	Updates Gemini smoke workflow runtime.
.github/workflows/smoke-claude.lock.yml	Updates Claude smoke workflow runtime.
.github/workflows/network-isolation-test.lock.yml	Updates setup action pin.
.github/workflows/firewall-issue-dispatcher.lock.yml	Updates dispatcher runtime and images.
.github/workflows/duplicate-code-detector.lock.yml	Updates detector runtime and images.
.github/workflows/copilot-token-usage-analyzer.lock.yml	Updates analyzer runtime and images.
.github/workflows/contribution-check.lock.yml	Updates contribution-check runtime.
.github/workflows/build-test-network-isolation.lock.yml	Updates setup action pin.
.github/workflows/agentics-maintenance.yml	Updates maintenance action and CLI references.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 33/58 changed files
• Comments generated: 5
• Review effort level: Medium

[github-actions]

⏳ Copilot review left inline comments.

@lpcox To proceed:

1. Ask @copilot to address the review feedback (reply to this comment or the review thread)
2. Once the fix is pushed, add the ready-for-aw label to trigger agentic CI smoke tests

[github-actions]

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

[github-actions]

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

[github-actions]

🚀 Security Guard has started processing this pull request

[github-actions]

❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

[github-actions]

✅ Smoke Gemini completed. All facets verified. 💎

[github-actions]

🔑 Smoke Copilot PAT PAT auth validated. All systems operational. ✅

[github-actions]

🔌 Smoke Services — All services reachable! ✅

[github-actions]

❌ Contribution Check failed. Please review the logs for details.

[github-actions]

❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

[github-actions]

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

[github-actions]

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

[github-actions]

📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤

[github-actions]

✅ Smoke Claude passed

[github-actions]

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

[github-actions]

✅ Build Test Suite completed successfully!

[github-actions]

Smoke Test Results

Test	Status
GitHub MCP connectivity	✅ tool available
GitHub.com HTTP	⚠️ pre-step data unavailable
File write/read	⚠️ pre-step data unavailable

Overall: PASS (core connectivity confirmed)

PR author: @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Claude Engine Validation

Check	Result
API Status	✅ PASS
GH Check	✅ PASS
File Status	✅ PASS

Overall Result: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Smoke Claude for #6281 · 55.4 AIC · ⊞ 3.3K · ◷
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: PAT Auth — PARTIAL

Test	Result
GitHub MCP connectivity	✅
GitHub.com HTTP	⚠️ (pre-step template vars unresolved)
File write/read	⚠️ (pre-step template vars unresolved)

Overall: PARTIAL — pre-step steps.smoke-data.outputs were not interpolated before agent ran.
Auth mode: PAT (COPILOT_GITHUB_TOKEN) | Author: @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 PAT report filed by Smoke Copilot PAT
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: API Proxy OpenTelemetry Tracing

Scenario	Status	Notes
1. Module Loading	✅	otel.js loads; exports: startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled + internals
2. Test Suite	✅	59 tests passed (2 suites: otel.test.js, otel-fanout.test.js)
3. Env Var Forwarding	⚠️	No OTEL env var forwarding found in src/services/api-proxy-service.ts — not yet wired (expected-pending)
4. Token Tracker Integration	✅	onUsage callback exists in token-tracker-http.js (line 343) as OTEL hook point
5. OTEL Diagnostics	✅	1 span exported to /tmp/gh-aw/otel.jsonl (file fallback); span: gh-aw.agent.setup with gen_ai.system=github_models

Summary: 4/5 pass. Scenario 3 (OTEL env var forwarding in api-proxy-service.ts) is not yet implemented — expected-pending during development.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Copilot BYOK (Direct) — PASS

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com

Test	Result
GitHub MCP connectivity	✅
GitHub.com connectivity	✅
File write/read	✅
BYOK inference	✅

Overall: PASS — @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

[github-actions]

Gemini Engine Smoke Test Results

1. GitHub MCP Testing: ✅ PASS (Found PRs updated workflows #6276, fix: allow --env proxy overrides + move net isolation check into AWF container #6267; titles filtered)
2. GitHub.com Connectivity: ❌ FAIL (HTTP 000, DNS SERVFAIL)
3. File Writing Testing: ✅ PASS
4. Bash Tool Testing: ✅ PASS

Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Services Connectivity

Check	Result
Redis PING	❌ host.docker.internal DNS not resolvable
PG pg_isready	❌ No response
PG SELECT 1	❌ DNS not resolvable

Overall: ❌ FAIL

All checks failed — agent runs inside AWF sandbox (172.30.0.20/24) with no route to host network. host.docker.internal does not resolve and Docker bridge 172.17.0.1 is unreachable.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

[github-actions]

updated workflows
fix: allow --env proxy overrides + move net isolation check into AWF container
GitHub page title: ❌
Smoke file: ✅
Discussion note: ✅
AWF build: ❌
Overall: FAIL

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions]

🔥 Smoke Test Results

Test	Status
GitHub MCP connectivity	✅ Connected
GitHub.com HTTP	⚠️ Template vars not expanded
File write/read	⚠️ Template vars not expanded

Overall: PARTIAL — MCP connectivity verified; pre-computed test data was not interpolated (raw ${{ }} in prompt). Author: @lpcox

📰 BREAKING: Report filed by Smoke Docker Sbx
_{Add label ready-for-aw to run again}

[github-actions]

Chroot Version Comparison

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.3	❌ NO
Node.js	v24.18.0	v22.23.1	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

⚠️ Not all versions match between host and chroot environments.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

[github-actions]

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	passed	✅ PASS
Go	env	✅	passed	✅ PASS
Go	uuid	✅	passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Build Test Suite for #6281 · 75.1 AIC · ⊞ 6.9K · ◷
_{Add label ready-for-aw to run again}