fix: propagate config fields to all layers - #7054
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
@copilot resolve merge conflicts |
…pec-mapping-e0a887dca99fb772 # Conflicts: # docs/awf-config-spec.md Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Merge conflicts resolved in 31174d3.
|
There was a problem hiding this comment.
Pull request overview
Documents the missing enclave script interpreter config mapping.
Changes:
- Adds
enclaves.executors.script.interpreteras config-only. - References Unified Enclaves §14.
Show a summary per file
| File | Description |
|---|---|
docs/awf-config-spec.md |
Adds the interpreter CLI-mapping entry. |
Review details
Tip
Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
- Files reviewed: 1/1 changed files
- Comments generated: 1
- Review effort level: Balanced
| - `enclaves.executors.script.enabled` → *(config-only; no CLI equivalent, see §14)* | ||
| - `enclaves.executors.script.runtime` → *(config-only; no CLI equivalent, see §14)* | ||
| - `enclaves.executors.script.image` → *(config-only; no CLI equivalent, see §14)* | ||
| - `enclaves.executors.script.interpreter` → *(config-only; no CLI equivalent, see §14)* |
|
@copilot address review feedback |
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
|
✅ Copilot review passed with no inline comments. @github-actions[bot] Add the |
|
📰 DEVELOPING STORY: Smoke Docker Sbx reports failed to deliver outputs. Our correspondents are investigating the incident... |
|
❌ Smoke Claude failed to deliver outputs |
|
❌ Smoke Copilot BYOK reports failed to deliver outputs. BYOK mode investigation needed... |
|
📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅ |
|
🛡️ Smoke Copilot Network Isolation reports failed to deliver outputs while checking network isolation. Investigate the egress model. |
|
❌ Smoke Copilot BYOK AOAI (api-key) reports failed to deliver outputs. AOAI BYOK (api-key) mode investigation needed... |
|
✅ Smoke Gemini completed. All facets verified. 💎 Smoke test completed with partial failure (connectivity). Comment added to PR #7054. |
|
❌ Smoke Copilot BYOK AOAI (Entra) reports failed to deliver outputs. AOAI BYOK (Entra) mode investigation needed... |
|
📰 DEVELOPING STORY: Smoke Copilot reports failed to deliver outputs. Our correspondents are investigating the incident... |
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 |
|
🔌 Smoke Services — All services reachable! ✅ |
|
Build Test Failed Build Test Suite - See logs for details |
|
🚀 Security Guard has started processing this pull request |
|
✅ Contribution Check completed successfully! Contribution check complete: the PR follows CONTRIBUTING.md. The description is clear, references the related PRs, and the change is docs-only with no new code or tests required. No comment needed. |
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded. |
Smoke Test: Claude Engine Validation
Overall result: PASS
|
🔐 Smoke Test: Copilot BYOK (Direct Mode) — PASS
Mode: Direct BYOK via
|
|
Smoke Test: Copilot Engine —
Recent merged PRs: #7067, #7027 Overall: PASS
|
|
|
|
Smoke Test: Copilot Network Isolation Egress Enforcement EGRESS_RESULT allow=pass deny=pass ✅ Allowed domain (github.com) reachable — Overall status: PASS cc Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
OTEL Tracing Smoke Test Results
All checked scenarios pass.
|
|
Smoke Test: GitHub Actions Services Connectivity
Overall: FAIL —
|
Smoke Test
Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "registry.npmjs.org"See Network Configuration for more information.
|
|
Add A19/B19 runner doctor entries: ARC/DinD safeoutputs mount + rootless cleanup chmod noise: ✅ Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra
|
Chroot Version Comparison Results
Overall: FAILED - Node.js version mismatch between host and chroot environments. The smoke-chroot label was not added since not all tests passed.
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — PASS Note: Java Maven builds required overriding
|
|
|
Smoke Test: Docker Sbx —
Overall: PASS Recent merged PRs: #7067, #7027
|
Config Consistency Audit
Audited merged PRs from the last 7 days that touched configuration layers (schema, spec, types, env-var wiring). Found one gap and fixed it.
Gap found
enclaves.*(enabled,privateRepos[],executors.script.*,executors.agent.*— 30 leaf paths)docs/awf-config-spec.mdenclaves.*rows to the CLI Mapping table, following the existingboundedAgents.*/boundedQueries.*convention (config-only, no CLI equivalent, pointing readers to §16 Unified Enclaves)Verification performed
src/awf-config-schema.jsonalready contained allenclavesproperties (script + agent executor fields,privateRepos,enabled). Diffed againstdocs/awf-config.schema.json— identical, no drift.src/types/enclave-options.tsalready definesEnclavesConfig/RawEnclavesConfigwith all fields;src/config-file.tsalready exposesenclaves?: RawEnclavesConfig(correctly non-sensitive/config-file-eligible — no key/secret/token/credential fields present).enclaves.*fields are non-sensitive (domains, runtime names, timeouts, limits) — correctly present insrc/config-file.ts, not routed to env vars.enclaves.*— this PR adds it.Checks run
npx tsc --noEmit— passes, no errors.npx jest config-file schema— 281 tests passed (8 suites).diff src/awf-config-schema.json docs/awf-config.schema.json— identical.No other gaps found in the other 15 reviewed PRs (#6990, #6988, #6970, #6963, #6950, #6936, #6908, #6903, #6894, #6889, #6876, #6874, #6872, #6869) — they either only touched the spec/docs (no new fields), were internal refactors, or already had complete cross-layer coverage.