[Test Coverage] host-iptables-chain.ts rethrow branch by github-actions[bot] · Pull Request #6362 · github/gh-aw-firewall

github-actions · 2026-07-18T08:43:23Z

Summary

Covers the previously untested rethrow branch (line 13) in checkPermissionsAndSetupChain from src/host-iptables-chain.ts.

What was missing

When iptables --version fails with a non-ENOENT error (e.g. an unexpected system error), the error is re-thrown as-is. This branch existed but had 0% coverage, leaving host-iptables-chain.ts at ~90% branch coverage.

What was added

One new describe block in src/host-iptables-chain-branches.test.ts with a test that mocks execa to reject with a plain Error on the iptables --version call, then asserts the same error is re-thrown.

Coverage impact

File	Before	After
host-iptables-chain.ts (branch)	~90%	100%

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Test Coverage Improver · 55.1 AIC · ⊞ 5.3K · ◷

Add a test for the case where iptables --version fails with a non-ENOENT error, causing the error to be re-thrown as-is (line 13 of host-iptables-chain.ts). This was the only uncovered branch in the host-iptables module (~97.61% → 100% branch coverage). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Adds a test for non-ENOENT failures from iptables --version.

Changes:

Mocks an unexpected execa failure.
Verifies rejection behavior.

Show a summary per file

File	Description
`src/host-iptables-chain-branches.test.ts`	Adds the targeted error-path test.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 1/1 changed files
Comments generated: 1
Review effort level: Medium

github-actions · 2026-07-18T15:33:36Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	98.94%	98.68%	📉 -0.26%
Statements	98.86%	98.49%	📉 -0.37%
Functions	99.35%	99.24%	📉 -0.11%
Branches	95.16%	94.55%	📉 -0.61%

📁 Per-file Coverage Changes (4 files)

File	Lines (Before → After)	Statements (Before → After)
`src/sbx-manager.ts`	96.6% → 96.6% (-0.05%)	96.2% → 96.1% (-0.07%)
`src/services/agent-volumes/etc-mounts.ts`	98.3% → 98.4% (+0.03%)	98.3% → 98.4% (+0.05%)
`src/artifact-permissions.ts`	97.3% → 97.4% (+0.14%)	97.3% → 97.4% (+0.14%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

✨ New Files (1 files)

src/config/mount-policy.ts: 80.2% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

github-actions · 2026-07-18T15:38:39Z

✅ Copilot review passed with no inline comments.

@github-actions[bot] Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-07-18T15:38:59Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-07-18T15:38:59Z

✅ Smoke Gemini completed. All facets verified. 💎

github-actions · 2026-07-18T15:39:00Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

github-actions · 2026-07-18T15:39:01Z

🔑 Smoke Copilot PAT PAT auth validated. All systems operational. ✅

github-actions · 2026-07-18T15:39:01Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

github-actions · 2026-07-18T15:39:02Z

🔌 Smoke Services — All services reachable! ✅

github-actions · 2026-07-18T15:39:02Z

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

github-actions · 2026-07-18T15:39:03Z

✅ Build Test Suite completed successfully!

github-actions · 2026-07-18T15:39:03Z

📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-07-18T15:39:04Z

✅ Smoke Claude passed

github-actions · 2026-07-18T15:39:05Z

❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

github-actions · 2026-07-18T15:39:05Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

github-actions · 2026-07-18T15:39:05Z

✅ Contribution Check completed successfully!

PR #6362 is a test-only coverage change; it includes the needed test addition, and no documentation or file-organization issue is apparent from the provided context.

github-actions · 2026-07-18T15:39:11Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-07-18T15:39:12Z

✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓

github-actions · 2026-07-18T15:43:39Z

Smoke Test: Copilot PAT Auth — INCOMPLETE

⚠️ Pre-computed test data was not injected (template variables unresolved).

Test	Result
GitHub MCP connectivity	⚠️ N/A
GitHub.com HTTP status	⚠️ N/A
File write/read	⚠️ N/A

Overall: INCONCLUSIVE — workflow template variables were not substituted before agent execution.

Auth mode: PAT (COPILOT_GITHUB_TOKEN)

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 PAT report filed by Smoke Copilot PAT
_{Add label ready-for-aw to run again}

github-actions · 2026-07-18T15:43:39Z

Smoke test: Copilot network isolation egress

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (api.github.com): HTTP 200
✅ Blocked domain (example.com): blocked (403)

Overall: PASS @lpcox

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

awmgmcpg
example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-07-18T15:43:46Z

Smoke Test: Claude Engine Validation

Check	Result
API Status	✅ PASS
GH Check	✅ PASS
File Status	✅ PASS

Overall Result: PASS ✅

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Smoke Claude for #6362 · 56.2 AIC · ⊞ 3.3K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-18T15:43:59Z

🔥 Smoke Test: Copilot BYOK (Direct) Mode

✅ GitHub.com Connectivity - HTTP 200
✅ File Write/Read - I/O working
✅ BYOK Inference - Direct inference via api-proxy → api.githubcopilot.com

Status: PASS
Mode: Direct BYOK (COPILOT_PROVIDER_API_KEY) via api-proxy sidecar

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-07-18T15:44:12Z

Smoke Test: Gemini Engine Validation

PR Titles: [REDACTED] (Filtered by secrecy policy)
GitHub MCP Testing: ❌
GitHub.com Connectivity: ❌ (Status 000)
File Writing Testing: ✅
Bash Tool Testing: ✅

Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini
_{Add label ready-for-aw to run again}

github-actions · 2026-07-18T15:44:15Z

Smoke Test Results (direct BYOK via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)

Pre-fetched PR data validated ✅
GitHub.com connectivity ✅
Agent file I/O ✅
BYOK inference ✅

PASS

cc @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)
_{Add label ready-for-aw to run again}

github-actions · 2026-07-18T15:44:24Z

Smoke Test: GitHub Actions Services Connectivity

Redis (PING): ❌ host.docker.internal — name resolution failure
PostgreSQL pg_isready: ❌ no response
PostgreSQL SELECT 1: ❌ connection failed

Overall: FAIL

host.docker.internal is not resolvable; fallback to 172.17.0.1 also unreachable.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-07-18T15:45:07Z

Chroot Version Comparison

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.3	❌ NO
Node.js	v24.18.0	v22.23.1	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Not all runtimes matched — ALL_TESTS_PASSED=false. The smoke-chroot label was not applied.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions · 2026-07-18T15:45:22Z

Smoke Test

Smoke Copilot: grant PR write permissions required by safe outputs ✅
chore: upgrade gh-aw to v0.82.13 pre-release and recompile workflows ✅
GitHub PR list: ✅
Playwright title check: ✅
File write/read: ✅
Build: ✅
Overall: PASS

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

awmgmcpg
registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

github-actions · 2026-07-18T15:46:10Z

Smoke Test: API Proxy OpenTelemetry Tracing

Scenario	Status	Notes
Scenario 1: Module Loading	✅ Pass	`otel.js` loads successfully
Scenario 2: Test Suite	✅ Pass	All OTEL tests passed
Scenario 3: Env Var Forwarding	✅ Pass	OTEL env vars forwarded to api-proxy container
Scenario 4: Token Tracker Integration	✅ Pass	`onUsage` callback present in `token-tracker-http.js`
Scenario 5: OTEL Diagnostics	⏳ Pending	Step not yet run (job still in progress at time of check)

Overall: 4/5 scenarios confirmed passing; Scenario 5 pending job completion.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-07-18T15:46:57Z

🔥 Smoke Test Results

Test	Result
GitHub MCP connectivity	✅ Connected (data filtered by policy)
GitHub.com HTTP	✅ 200
File write/read	⚠️ Template vars unexpanded (pre-step data unavailable)

Overall: PASS (core connectivity verified)

cc @lpcox

📰 BREAKING: Report filed by Smoke Docker Sbx
_{Add label ready-for-aw to run again}

github-actions · 2026-07-18T15:47:05Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	passed	✅ PASS
Go	env	✅	passed	✅ PASS
Go	uuid	✅	passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Build Test Suite for #6362 · 33.8 AIC · ⊞ 7.1K · ◷
_{Add label ready-for-aw to run again}

PR #6366 changed the smoke-copilot agent job to issues:write / pull-requests:write, but the gh-aw compiler (v0.82.13) forbids write permissions on the agent job — writes must flow through safe-outputs' scoped app token. As a result the lock file's frontmatter_hash could not be regenerated and stayed at the read-perm value (008d5a5c), while the .md advertised write perms. This mismatch made the 'Check workflow lock file' activation step fail on every open PR (CI builds the branch merged with main), e.g. #6362, even for PRs that never touched smoke-copilot. Revert issues/pull-requests to read (safe-outputs already handles the comment/label writes) and recompile so .md and lock are consistent. Copilot-Session: 23717692-af7a-4e03-a156-5b696c3f01bd Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

lpcox marked this pull request as ready for review July 18, 2026 15:30

Copilot AI review requested due to automatic review settings July 18, 2026 15:30

Copilot started reviewing on behalf of lpcox July 18, 2026 15:30 View session

Copilot AI reviewed Jul 18, 2026

View reviewed changes

Comment thread src/host-iptables-chain-branches.test.ts Outdated

Potential fix for pull request finding

54914a2

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

lpcox added the ready-for-aw label Jul 18, 2026

lpcox had a problem deploying to aoai-model July 18, 2026 15:39 — with GitHub Actions Failure

github-actions Bot added the smoke-copilot-network-isolation Copilot network-isolation egress smoke test label Jul 18, 2026

github-actions Bot added the smoke-claude label Jul 18, 2026

github-actions Bot mentioned this pull request Jul 18, 2026

[aw] No-Op Runs #5883

Closed

github-actions Bot added the smoke-copilot-byok label Jul 18, 2026

github-actions Bot added the smoke-copilot-byok-aoai-apikey label Jul 18, 2026

github-actions Bot added the smoke-codex label Jul 18, 2026

lpcox temporarily deployed to aoai-model July 18, 2026 15:45 — with GitHub Actions Inactive

github-actions Bot added the smoke-copilot-byok-aoai-entra label Jul 18, 2026

lpcox temporarily deployed to aoai-model July 18, 2026 15:46 — with GitHub Actions Inactive

github-actions Bot added the smoke-docker-sbx label Jul 18, 2026

github-actions Bot added the build-test label Jul 18, 2026

lpcox mentioned this pull request Jul 18, 2026

fix(smoke-copilot): revert agent job to read-only perms to unblock CI #6369

Merged

lpcox merged commit 26b8515 into main Jul 18, 2026
138 of 142 checks passed

lpcox deleted the test-coverage/host-iptables-chain-rethrow-f0b459b398842955 branch July 18, 2026 15:52

github-actions Bot mentioned this pull request Jul 18, 2026

refactor: extract shared copyEnvEntries helper to eliminate duplicated env-filtering loops #6370

Merged

Uh oh!

Conversation

github-actions Bot commented Jul 18, 2026

Summary

What was missing

What was added

Coverage impact

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

github-actions Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Coverage Regression Detected

Overall Coverage

Uh oh!

github-actions Bot commented Jul 18, 2026

Uh oh!

github-actions Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 18, 2026

Uh oh!

github-actions Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 18, 2026

Smoke Test: Copilot PAT Auth — INCOMPLETE

Uh oh!

github-actions Bot commented Jul 18, 2026

Uh oh!

github-actions Bot commented Jul 18, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Jul 18, 2026

🔥 Smoke Test: Copilot BYOK (Direct) Mode

Uh oh!

github-actions Bot commented Jul 18, 2026

Smoke Test: Gemini Engine Validation

Uh oh!

github-actions Bot commented Jul 18, 2026

github-actions Bot commented Jul 18, 2026 •

edited

Loading

github-actions Bot commented Jul 18, 2026 •

edited

Loading

github-actions Bot commented Jul 18, 2026 •

edited

Loading

github-actions Bot commented Jul 18, 2026 •

edited

Loading

github-actions Bot commented Jul 18, 2026 •

edited

Loading

github-actions Bot commented Jul 18, 2026 •

edited

Loading

github-actions Bot commented Jul 18, 2026 •

edited

Loading

github-actions Bot commented Jul 18, 2026 •

edited

Loading

github-actions Bot commented Jul 18, 2026 •

edited

Loading

github-actions Bot commented Jul 18, 2026 •

edited

Loading

github-actions Bot commented Jul 18, 2026 •

edited

Loading

github-actions Bot commented Jul 18, 2026 •

edited

Loading

github-actions Bot commented Jul 18, 2026 •

edited

Loading

github-actions Bot commented Jul 18, 2026 •

edited

Loading

github-actions Bot commented Jul 18, 2026 •

edited

Loading