Align sandbox integration tests with rootless AWF command default#42606
Merged
Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
Fix sandbox integration tests for rootless AWF default
Align sandbox integration tests with rootless AWF command default
Jul 1, 2026
Copilot created this pull request from a session on behalf of
pelikhan
July 1, 2026 01:27
View session
pelikhan
marked this pull request as ready for review
July 1, 2026 01:28
Contributor
There was a problem hiding this comment.
Pull request overview
Updates sandbox integration tests to align with the newer default of invoking AWF rootlessly (no sudo -E) when firewall enablement is expected, by shifting assertions from the legacy sudo-prefixed command to the awf --config ... invocation shape.
Changes:
- Updated sandbox test assertions to look for
awf --config ...instead ofsudo -E awf. - Adjusted test messaging/comments to reflect rootless-by-default behavior.
- Regenerated (or otherwise modified)
pr-code-quality-reviewer.lock.ymlmetadata (body hash).
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/sandbox_agent_tools_default_test.go | Updates auto-enabled firewall test to assert the rootless AWF invocation form. |
| pkg/workflow/sandbox_agent_false_test.go | Updates sandbox-agent-related tests to assert the rootless AWF invocation form in compiled lock output. |
| .github/workflows/pr-code-quality-reviewer.lock.yml | Updates generated workflow lock metadata (body hash). |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 3/3 changed files
- Comments generated: 4
- Review effort level: Low
Comment on lines
+264
to
+265
| // Verify AWF is present (rootless by default) | ||
| assert.Contains(t, lockStr, "awf --config ", "Expected rootless AWF invocation to be present when auto-enabled") |
Comment on lines
+109
to
112
| // Verify that AWF installation IS present (rootless by default) | ||
| if !strings.Contains(lockStr, "awf --config ") { | ||
| t.Error("Expected AWF firewall to be enabled, but did not find rootless 'awf --config' command in lock file") | ||
| } |
Comment on lines
155
to
158
| // With network restrictions and no sandbox config, firewall should be enabled by default | ||
| if !strings.Contains(lockStr, "sudo -E awf") { | ||
| t.Error("Expected firewall to be enabled by default with network restrictions, but did not find 'sudo -E awf' command in lock file") | ||
| if !strings.Contains(lockStr, "awf --config ") { | ||
| t.Error("Expected firewall to be enabled by default with network restrictions, but did not find rootless 'awf --config' command in lock file") | ||
| } |
| @@ -1,4 +1,4 @@ | |||
| # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"0a7a1cc9a9d3e316b42d163c8f7452df59e96a2dd1056a07170aca6d955bd9ca","body_hash":"4b304b423080e4bab9d72281c704a8436fe09fa92cf666fe179d4681a922d405","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.65","copilot-sdk":"1.0.4"}} | |||
| # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"0a7a1cc9a9d3e316b42d163c8f7452df59e96a2dd1056a07170aca6d955bd9ca","body_hash":"3741a05e0a954d005c6a5d50b7567b198260ad61d940646d75c20b3b923c1606","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.65","copilot-sdk":"1.0.4"}} | |||
Contributor
|
🎉 This pull request is included in a new release. Release: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Recent CI failures came from sandbox integration tests asserting
sudo -E awfeven though AWF now runs rootless by default in these paths. This change updates assertions to validate firewall enablement via the rootless invocation shape.Problem alignment
awf --config ...), not legacy sudo-prefixed execution.Targeted test updates
pkg/workflow/sandbox_agent_false_test.gosandbox.agent: awf enables firewalldefault sandbox enables firewall (awf)pkg/workflow/sandbox_agent_tools_default_test.goauto-enabled firewall adds edit and bash toolsBehavioral intent preserved