From 5b78a92353808cb698a308c26adc1e6b70a1e4f5 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 1 Jul 2026 01:23:47 +0000 Subject: [PATCH 1/2] Plan sandbox AWF expectation fix Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .github/workflows/pr-code-quality-reviewer.lock.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr-code-quality-reviewer.lock.yml b/.github/workflows/pr-code-quality-reviewer.lock.yml index 1f717f90488..04978da5dfe 100644 --- a/.github/workflows/pr-code-quality-reviewer.lock.yml +++ b/.github/workflows/pr-code-quality-reviewer.lock.yml @@ -1,4 +1,4 @@ -# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"0a7a1cc9a9d3e316b42d163c8f7452df59e96a2dd1056a07170aca6d955bd9ca","body_hash":"4b304b423080e4bab9d72281c704a8436fe09fa92cf666fe179d4681a922d405","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.65","copilot-sdk":"1.0.4"}} +# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"0a7a1cc9a9d3e316b42d163c8f7452df59e96a2dd1056a07170aca6d955bd9ca","body_hash":"3741a05e0a954d005c6a5d50b7567b198260ad61d940646d75c20b3b923c1606","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.65","copilot-sdk":"1.0.4"}} # gh-aw-manifest: {"version":1,"secrets":["GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e","version":"v6.4.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.16"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.16"},{"image":"ghcr.io/github/gh-aw-firewall/cli-proxy:0.27.16"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.16"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.3.32","digest":"sha256:63e46b56dfd70895a701b6fc6dd0189e11e2d875f327f1781e81b31848735477","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.3.32@sha256:63e46b56dfd70895a701b6fc6dd0189e11e2d875f327f1781e81b31848735477"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.5.0","digest":"sha256:e25564dccc9110a70a77b9df560cbde11aa392fcb5f08b9abe5c4ebc6d146ea4","pinned_image":"ghcr.io/github/github-mcp-server:v1.5.0@sha256:e25564dccc9110a70a77b9df560cbde11aa392fcb5f08b9abe5c4ebc6d146ea4"}]} # This file was automatically generated by gh-aw. DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md # From 8c9de543f155f0eec460cb35ac3d0e6edbdf3230 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 1 Jul 2026 01:26:30 +0000 Subject: [PATCH 2/2] Fix sandbox tests for rootless AWF default Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- pkg/workflow/sandbox_agent_false_test.go | 10 +++++----- pkg/workflow/sandbox_agent_tools_default_test.go | 4 ++-- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/pkg/workflow/sandbox_agent_false_test.go b/pkg/workflow/sandbox_agent_false_test.go index cfbe6a25199..97d3a8ac73c 100644 --- a/pkg/workflow/sandbox_agent_false_test.go +++ b/pkg/workflow/sandbox_agent_false_test.go @@ -106,9 +106,9 @@ Test workflow to verify sandbox.agent: awf enables firewall. lockStr := string(lockContent) - // Verify that AWF installation IS present - if !strings.Contains(lockStr, "sudo -E awf") { - t.Error("Expected AWF firewall to be enabled, but did not find 'sudo -E awf' command in lock file") + // Verify that AWF installation IS present (rootless by default) + if !strings.Contains(lockStr, "awf --config ") { + t.Error("Expected AWF firewall to be enabled, but did not find rootless 'awf --config' command in lock file") } }) @@ -153,8 +153,8 @@ Test workflow to verify default sandbox.agent behavior (awf). lockStr := string(lockContent) // With network restrictions and no sandbox config, firewall should be enabled by default - if !strings.Contains(lockStr, "sudo -E awf") { - t.Error("Expected firewall to be enabled by default with network restrictions, but did not find 'sudo -E awf' command in lock file") + if !strings.Contains(lockStr, "awf --config ") { + t.Error("Expected firewall to be enabled by default with network restrictions, but did not find rootless 'awf --config' command in lock file") } }) } diff --git a/pkg/workflow/sandbox_agent_tools_default_test.go b/pkg/workflow/sandbox_agent_tools_default_test.go index 5273499b583..88300ac8e8b 100644 --- a/pkg/workflow/sandbox_agent_tools_default_test.go +++ b/pkg/workflow/sandbox_agent_tools_default_test.go @@ -261,8 +261,8 @@ Test workflow where firewall is auto-enabled via network restrictions. // Verify that bash tool is present assert.Contains(t, lockStr, "bash", "Expected bash tool to be enabled when firewall is auto-enabled") - // Verify AWF is present - assert.Contains(t, lockStr, "sudo -E awf", "Expected AWF to be present when auto-enabled") + // Verify AWF is present (rootless by default) + assert.Contains(t, lockStr, "awf --config ", "Expected rootless AWF invocation to be present when auto-enabled") }) }