[test-improver] Improve tests for proxy TLS certificate generation

[github-actions]

File analyzed

internal/proxy/tls_test.go (testing internal/proxy/tls.go)

Improvements made

Added TestGenerateSelfSignedTLS_WritePEMErrors, a table-driven test that exercises the previously-uncovered writePEM failure branches inside GenerateSelfSignedTLS. It pre-creates each target file (ca.crt, server.crt, server.key) as a directory so the corresponding os.OpenFile call in writePEM fails with "is a directory", forcing GenerateSelfSignedTLS to return the wrapped error (failed to write CA cert / failed to write server cert / failed to write server key) and a nil *TLSConfig. Uses require/assert per project conventions.

Coverage before/after (internal/proxy package)

• Before: GenerateSelfSignedTLS 76.5%, package total 94.6%
• After: GenerateSelfSignedTLS 82.4%, package total 94.9%

Test output

go test -v ./internal/proxy/ -run TestGenerateSelfSignedTLS
--- PASS: TestGenerateSelfSignedTLS (0.01s)
    (10 subtests, all PASS)
--- PASS: TestGenerateSelfSignedTLS_WritePEMErrors (0.00s)
    --- PASS: TestGenerateSelfSignedTLS_WritePEMErrors/ca.crt_write_failure
    --- PASS: TestGenerateSelfSignedTLS_WritePEMErrors/server.crt_write_failure
    --- PASS: TestGenerateSelfSignedTLS_WritePEMErrors/server.key_write_failure
PASS

Also verified:

• go test -count=2 ./internal/proxy/ — stable, no flakes
• go vet ./internal/proxy/ — clean
• gofmt -l internal/proxy/tls_test.go — no output (already formatted)

No existing tests were modified or removed.

Generated by Test Improver · auto · 61.5 AIC · ⊞ 8.1K · ◷

[Copilot]

Pull request overview

Adds targeted coverage for TLS certificate file-write failures in the proxy package.

Changes:

• Adds table-driven tests for CA, server certificate, and private-key write failures.
• Verifies wrapped errors and nil TLS configuration results.

Show a summary per file

File	Description
internal/proxy/tls_test.go	Tests all writePEM failure branches in GenerateSelfSignedTLS.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Balanced

[github-actions]

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/list_prs/get_file/list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	MCP -32602 unknown tool	BLOCKED	✅
C	CLI	reads	gh unauthenticated — not testable	N/A	⚠️
D	CLI	REST writes	gh unauthenticated — all refused	BLOCKED	✅
E	CLI	GraphQL mutations	gh unauthenticated — all refused	BLOCKED	✅

Notes:

• Part B: gateway exposes only read tools; all 7 write tools absent → MCP error -32602. Gateway enforcement confirmed.
• Parts C/D/E: gh CLI not authenticated; all calls blocked at auth layer.

Overall: PASS

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	unknown tool (-32602)	BLOCKED	✅
C	CLI	reads (list_issues/get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	unauthenticated (no GH_TOKEN)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	unauthenticated (no GH_TOKEN)	BLOCKED	✅

Notes:

• Part B: Gateway enforces read-only by exposing only 22 read-only MCP tools; all write tool calls return Error [-32602]: unknown tool. This is the gateway enforcement boundary — write tools are absent from the allowed tool set.
• Parts D & E: gh CLI is not authenticated (GH_TOKEN not set), so all REST/GraphQL write attempts fail at auth before reaching GitHub API.

Overall: PASS

References: §30962329952

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/PRs/commits, get_file)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all refused: unknown tool	BLOCKED	✅
C	CLI	reads (list_issues, get_file)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	blocked: gh unauthenticated (no GH_TOKEN, EXIT:4)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	blocked: gh unauthenticated (no GH_TOKEN, EXIT:4)	BLOCKED	✅

Overall: PASS

Note on Part B: Gateway enforces read-only by not exposing write tools at all (Error [-32602]: unknown tool). This is a gateway-level enforcement — write tools are absent from the gateway-proxied tool list.
Note on Parts D/E: gh CLI has no GH_TOKEN in this sandbox, so all REST/GraphQL write attempts are blocked at the authentication layer (exit code 4).

References: §30962329914

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime