refactor: extract shared copyEnvEntries helper to eliminate duplicated env-filtering loops by Copilot · Pull Request #6370 · github/gh-aw-firewall

Copilot · 2026-07-18T15:53:52Z

Four files each re-implemented a nearly identical for...of Object.entries() loop to copy/filter environment variables into a target object, with slightly different allow/deny rules. Drift in this security-sensitive isolation code is risky.

Changes

src/env-utils.ts — new copyEnvEntries(source, target, options) helper covering all four call-site variants:
- excludedKeys / allowKeys — set-based deny with selective override (proxy var passthrough)
- noOverwrite — skip keys already present in target
- keyPredicate — arbitrary key filter (OTEL_ prefix, secret-pattern negation)
- maxValueSizeBytes + onSkippedOversized — size cap with callback for --env-all passthrough
env-passthrough.ts, observability-environment.ts, github-actions-environment.ts, sbx-manager.ts — each inline loop replaced with a copyEnvEntries call

// Before (repeated in 4 places with minor variations):
for (const [key, value] of Object.entries(process.env)) {
  if (value !== undefined && !excludedEnvVars.has(key) && !Object.prototype.hasOwnProperty.call(environment, key)) {
    environment[key] = value;
  }
}

// After — e.g. the OTEL forwarding case:
copyEnvEntries(process.env, environment, {
  excludedKeys: excludedEnvVars,
  noOverwrite: true,
  keyPredicate: (key) => key.startsWith('OTEL_'),
});

src/env-utils.test.ts — 10 new tests covering each option and their interactions

Fixes [Duplicate Code] Environment filtering and passthrough loops are reimplemented across agent setup #6358

Copilot

Pull request overview

Centralizes environment-variable copying and filtering to reduce duplication and security-policy drift.

Changes:

Adds configurable copyEnvEntries.
Migrates four environment-building call sites.
Adds unit coverage for filters, precedence, callbacks, and size boundaries.

Show a summary per file

File	Description
`src/env-utils.ts`	Adds the shared filtering helper.
`src/env-utils.test.ts`	Tests helper behavior and option interactions.
`src/sbx-manager.ts`	Uses the helper for secret filtering.
`src/services/agent-environment/env-passthrough.ts`	Uses it for bounded host passthrough.
`src/services/agent-environment/observability-environment.ts`	Uses it for OTEL forwarding.
`src/services/agent-environment/github-actions-environment.ts`	Uses it for env-file and explicit overrides.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 6/6 changed files
Comments generated: 0
Review effort level: Medium

lpcox · 2026-07-18T18:22:57Z

@copilot merge main

…-code-environment-filtering

Copilot · 2026-07-18T18:24:55Z

@copilot merge main

Done — merged main into the branch (merge commit ce60d8a5). No conflicts; src/sbx-manager.ts auto-merged cleanly.

github-actions · 2026-07-18T18:32:21Z

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-07-18T18:32:40Z

✅ Smoke Gemini completed. All facets verified. 💎

github-actions · 2026-07-18T18:32:40Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-07-18T18:32:41Z

✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓

github-actions · 2026-07-18T18:32:41Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

github-actions · 2026-07-18T18:32:41Z

✅ Build Test Suite completed successfully!

github-actions · 2026-07-18T18:32:42Z

🔌 Smoke Services — All services reachable! ✅

github-actions · 2026-07-18T18:32:42Z

✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓

github-actions · 2026-07-18T18:32:43Z

🔑 Smoke Copilot PAT PAT auth validated. All systems operational. ✅

github-actions · 2026-07-18T18:32:43Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-07-18T18:32:51Z

📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-07-18T18:32:53Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

github-actions · 2026-07-18T18:32:59Z

✅ Contribution Check completed successfully!

PR #6370 follows the contribution guidelines in CONTRIBUTING.md; no comment needed.

github-actions · 2026-07-18T18:34:34Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	98.64%	98.68%	📈 +0.04%
Statements	98.46%	98.50%	📈 +0.04%
Functions	99.24%	99.24%	➡️ +0.00%
Branches	94.55%	94.55%	➡️ +0.00%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
`src/services/agent-environment/env-passthrough.ts`	96.8% → 96.3% (-0.48%)	96.8% → 96.3% (-0.48%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-07-18T18:35:37Z

Smoke Test: Claude Engine Validation

Check	Result
API Status	✅ PASS
GH Check	✅ PASS
File Status	✅ PASS

Overall Result: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Smoke Claude for #6370 · 55.4 AIC · ⊞ 3.3K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-18T18:35:48Z

🔬 Smoke Test Results

Test	Result
GitHub MCP connectivity	✅
GitHub.com HTTP	✅ 200
File write/read	⚠️ Template vars not substituted (pre-step skipped)

Overall: PASS (core connectivity verified)

Author: @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-07-18T18:35:54Z

Smoke Test: Copilot BYOK (Direct) Mode ✅ PASS

✅ GitHub MCP connectivity confirmed
✅ GitHub.com connectivity (HTTP 200)
✅ File write/read test passed
✅ BYOK inference active (api-proxy → api.githubcopilot.com)

Running in direct BYOK mode via COPILOT_PROVIDER_API_KEY path.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-07-18T18:35:58Z

🔒 Smoke Test: Copilot Network Isolation Egress — @lpcox

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (api.github.com): HTTP 200
✅ Blocked domain (example.com): 403 / connection denied

Overall: PASS

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

awmgmcpg
example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-07-18T18:36:00Z

Smoke Test: Copilot PAT Auth

Test	Result
GitHub MCP connectivity	✅
GitHub.com HTTP	⚠️ (pre-step vars not resolved)
File write/read	⚠️ (pre-step vars not resolved)

Overall: PARTIAL — template expressions were not expanded at runtime. MCP reachable.
Auth mode: PAT (COPILOT_GITHUB_TOKEN) | Author: @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 PAT report filed by Smoke Copilot PAT
_{Add label ready-for-aw to run again}

github-actions · 2026-07-18T18:36:09Z

Smoke Test Results

GitHub MCP Testing: ❌ (Tools missing)
GitHub.com Connectivity: ❌ (HTTP 000)
File Writing Testing: ✅
Bash Tool Testing: ✅

PRs Reviewed:

fix: don't mask Copilot CLI's ~/.copilot/config.json (fix: don't mask Copilot CLI's ~/.copilot/config.json #6374)
[Test Coverage] host-iptables-chain.ts rethrow branch ([Test Coverage] host-iptables-chain.ts rethrow branch #6362)

Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini
_{Add label ready-for-aw to run again}

github-actions · 2026-07-18T18:36:23Z

Smoke Test: Services Connectivity

Check	Result
Redis PING	❌ `host.docker.internal` unreachable (name resolution failure)
PostgreSQL pg_isready	❌ No response
PostgreSQL SELECT 1	❌ Connection failed

Overall: FAIL

host.docker.internal does not resolve; fallback via 172.17.0.1 also unreachable. Service containers appear inaccessible from this runner sandbox.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-07-18T18:36:37Z

@lpcox and assignees:

GitHub MCP Testing: pre-fetched data validated ✅
GitHub.com connectivity: ✅
File write/read test: ❌
Direct BYOK inference: ✅

Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra

Overall: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)
_{Add label ready-for-aw to run again}

github-actions · 2026-07-18T18:36:41Z

PR: refactor: extract shared copyEnvEntries helper to eliminate duplicated env-filtering loops

Checks:

GitHub reads: ✅
GitHub query: ✅
Playwright title: ✅
File write/read: ✅
Build: ✅

Overall: PASS

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

awmgmcpg
registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

github-actions · 2026-07-18T18:36:56Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.3	❌
Node.js	v24.18.0	v22.23.1	❌
Go	go1.22.12	go1.22.12	✅

⚠️ Not all tests passed. Python and Node.js versions differ between host and chroot environments.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions · 2026-07-18T18:37:08Z

🔬 OTEL Tracing Smoke Test Results

Scenario	Result	Notes
S1: Module Loading	✅ Pass	`otel.js` loads; exports: `startRequestSpan`, `setTokenAttributes`, `setBudgetAttributes`, `endSpan`, `endSpanError`, `shutdown`, `isEnabled`
S2: Test Suite	✅ Pass	59 tests passed across `otel.test.js` and `otel-fanout.test.js` (0 failures)
S3: Env Var Forwarding	✅ Pass	`api-proxy-env-config.ts` forwards `GH_AW_OTLP_ENDPOINTS`, `OTEL_EXPORTER_OTLP_ENDPOINT`, `OTEL_EXPORTER_OTLP_HEADERS`, `GITHUB_AW_OTEL_TRACE_ID`, `GITHUB_AW_OTEL_PARENT_SPAN_ID`, `OTEL_SERVICE_NAME`
S4: Token Tracker Integration	✅ Pass	`onUsage` callback exists in `token-tracker-http.js` as OTEL hook point
S5: Graceful Degradation	✅ Pass	Without OTLP endpoint, `isEnabled()` returns `true` using `FileSpanExporter` fallback (writes to `/var/log/api-proxy/otel.jsonl`) — no errors

All 5 scenarios pass. OTEL tracing integration is fully functional.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-07-18T18:38:01Z

@lpcox

GitHub MCP Testing: ✅
GitHub.com Connectivity: ✅
File Write/Read Test: ✅
BYOK Inference Test: ✅

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)

Overall: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)
_{Add label ready-for-aw to run again}

github-actions · 2026-07-18T18:39:57Z

🔥 Smoke Test: Docker Sbx Validation

Test	Result
GitHub MCP connectivity	⚠️ PR data filtered by secrecy policy
GitHub.com HTTP connectivity	⚠️ Pre-step output not expanded
File write/read	⚠️ Pre-step output not expanded

Overall Status: INCONCLUSIVE — GitHub Actions template variables (${{ steps.smoke-data.outputs.* }}) were not expanded before being passed to this agent. Pre-computed test data was unavailable.

📰 BREAKING: Report filed by Smoke Docker Sbx
_{Add label ready-for-aw to run again}

github-actions · 2026-07-18T18:40:47Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	PASS	✅ PASS
Go	env	✅	PASS	✅ PASS
Go	uuid	✅	PASS	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	All passed	✅ PASS
Node.js	execa	✅	All passed	✅ PASS
Node.js	p-limit	✅	All passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Note: Java initially encountered LocalRepositoryNotAccessibleException (Maven local repo dir owned by root). Fixed by using -Dmaven.repo.local=/tmp/gh-aw/agent/m2. All tests passed after fix.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Build Test Suite for #6370 · 113.5 AIC · ⊞ 7.1K · ◷
_{Add label ready-for-aw to run again}

Initial plan

bcba651

Copilot AI assigned Copilot and lpcox Jul 18, 2026

Copilot AI linked an issue Jul 18, 2026 that may be closed by this pull request

[Duplicate Code] Environment filtering and passthrough loops are reimplemented across agent setup #6358

Closed

Copilot started work on behalf of lpcox July 18, 2026 15:54 View session

refactor: extract shared copyEnvEntries helper, closes #6358

cf12f1f

Copilot AI changed the title ~~[WIP] Fix duplicate code in environment filtering and passthrough loops~~ refactor: extract shared copyEnvEntries helper to eliminate duplicated env-filtering loops Jul 18, 2026

Copilot AI requested a review from lpcox July 18, 2026 16:02

Copilot finished work on behalf of lpcox July 18, 2026 16:02

lpcox marked this pull request as ready for review July 18, 2026 16:13

Copilot AI review requested due to automatic review settings July 18, 2026 16:13

Copilot started reviewing on behalf of lpcox July 18, 2026 16:14 View session

Copilot AI reviewed Jul 18, 2026

View reviewed changes

Copilot started work on behalf of lpcox July 18, 2026 18:23 View session

Merge remote-tracking branch 'origin/main' into copilot/fix-duplicate…

ce60d8a

…-code-environment-filtering

Copilot finished work on behalf of lpcox July 18, 2026 18:25

lpcox added the ready-for-aw label Jul 18, 2026

lpcox enabled auto-merge (squash) July 18, 2026 18:32

github-actions Bot added the smoke-claude label Jul 18, 2026

github-actions Bot added the smoke-copilot label Jul 18, 2026

github-actions Bot added the smoke-copilot-byok label Jul 18, 2026

github-actions Bot added the smoke-copilot-network-isolation Copilot network-isolation egress smoke test label Jul 18, 2026

github-actions Bot mentioned this pull request Jul 18, 2026

[aw] No-Op Runs #5883

Closed

lpcox temporarily deployed to aoai-model July 18, 2026 18:36 — with GitHub Actions Inactive

github-actions Bot added smoke-copilot-byok-aoai-entra smoke-codex labels Jul 18, 2026

lpcox temporarily deployed to aoai-model July 18, 2026 18:36 — with GitHub Actions Inactive

github-actions Bot added the smoke-copilot-byok-aoai-apikey label Jul 18, 2026

lpcox merged commit 386c364 into main Jul 18, 2026
142 checks passed

lpcox deleted the copilot/fix-duplicate-code-environment-filtering branch July 18, 2026 18:44

Uh oh!

Conversation

Copilot AI commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

lpcox commented Jul 18, 2026

Uh oh!

Copilot AI commented Jul 18, 2026

Uh oh!

github-actions Bot commented Jul 18, 2026

Uh oh!

github-actions Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 18, 2026

Uh oh!

github-actions Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 18, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

github-actions Bot commented Jul 18, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Jul 18, 2026

🔬 Smoke Test Results

Uh oh!

github-actions Bot commented Jul 18, 2026

Smoke Test: Copilot BYOK (Direct) Mode ✅ PASS

Uh oh!

github-actions Bot commented Jul 18, 2026

Uh oh!

github-actions Bot commented Jul 18, 2026

Smoke Test: Copilot PAT Auth

Uh oh!

github-actions Bot commented Jul 18, 2026

Smoke Test Results

Uh oh!

github-actions Bot commented Jul 18, 2026

Smoke Test: Services Connectivity

Uh oh!

github-actions Bot commented Jul 18, 2026

Uh oh!

github-actions Bot commented Jul 18, 2026

Uh oh!

Copilot AI commented Jul 18, 2026 •

edited

Loading

github-actions Bot commented Jul 18, 2026 •

edited

Loading

github-actions Bot commented Jul 18, 2026 •

edited

Loading

github-actions Bot commented Jul 18, 2026 •

edited

Loading

github-actions Bot commented Jul 18, 2026 •

edited

Loading

github-actions Bot commented Jul 18, 2026 •

edited

Loading

github-actions Bot commented Jul 18, 2026 •

edited

Loading

github-actions Bot commented Jul 18, 2026 •

edited

Loading

github-actions Bot commented Jul 18, 2026 •

edited

Loading

github-actions Bot commented Jul 18, 2026 •

edited

Loading

github-actions Bot commented Jul 18, 2026 •

edited

Loading

github-actions Bot commented Jul 18, 2026 •

edited

Loading