fix(arc-dind): remove --docker-host-path-prefix CLI flag and add explicit workspace mount#44145
Conversation
The CLI flag --docker-host-path-prefix was still emitted at runtime via the DOCKER_HOST probe, even though PR #43222 removed it from the JSON config. AWF's translateBindMountHostPath() was translating GITHUB_WORKSPACE to a non-existent path under the prefix, causing the agent to see an empty workspace. Changes: - Remove --docker-host-path-prefix CLI flag from the DOCKER_HOST probe. With sysroot-stage active, all bind-mount paths are on the shared work volume and visible to the Docker daemon without translation. - Add explicit --mount for ${GITHUB_WORKSPACE} in arc-dind mode so AWF can mount the real workspace path into the agent container. - Preserve the chroot config patch inside the DOCKER_HOST probe (still needed for chroot identity configuration). - Remove dead constants (awfArcDindHostPathPrefixFlag, awfArcDindPrefixArgsVarName) that are no longer used. Fixes: gh-aw#34896 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
This PR fixes an ARC/DinD workspace visibility bug by stopping gh-aw from emitting the --docker-host-path-prefix CLI flag at runtime (which could override config and translate workspace paths incorrectly) and by adding an explicit bind mount of ${GITHUB_WORKSPACE} into the AWF container for the arc-dind topology.
Changes:
- Removed emission of
--docker-host-path-prefixfrom the DOCKER_HOST probe logic (while preserving the DOCKER_HOST-guarded chroot config patch behavior). - Added an explicit
--mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw"workspace mount forarc-dind. - Updated unit tests to stop asserting the removed prefix behavior and to assert presence/absence of the new/removed args.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/firewall_args_test.go | Updates assertions to ensure --docker-host-path-prefix is not emitted and the workspace mount is present for arc-dind. |
| pkg/workflow/awf_helpers.go | Removes runtime prefix-flag emission from the DOCKER_HOST probe and adds explicit workspace mounting for arc-dind. |
| pkg/workflow/awf_helpers_test.go | Simplifies DOCKER_HOST probe tests to only validate --docker-host passthrough behavior. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 3/3 changed files
- Comments generated: 2
- Review effort level: Low
| // docker-host-path-prefix is no longer emitted (removed for sysroot, gh-aw#34896) | ||
| if strings.Contains(stepContent, `GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS="--docker-host-path-prefix`) { | ||
| t.Error("Expected command NOT to emit --docker-host-path-prefix (sysroot handles path visibility)") | ||
| } |
| // NOTE: --docker-host-path-prefix is intentionally NOT passed. With sysroot-stage | ||
| // active, all bind-mount source paths are on the shared work volume and visible to | ||
| // the Docker daemon without translation. The prefix caused AWF to translate | ||
| // GITHUB_WORKSPACE to a non-existent path, resulting in an empty workspace (gh-aw#34896). | ||
| // The probe block is preserved for the chroot config patch which still requires the |
|
@copilot please run the
|
Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
…ath-prefix-flag Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
Addressed in 447cd88. I fixed the unresolved review feedback, updated the wasm goldens and regenerated lock files, merged the latest |
|
@copilot run pr-finisher skill |
|
🚀 Smoke Antigravity MISSION COMPLETE! Antigravity has spoken. ✨ |
|
🚀 Smoke Pi MISSION COMPLETE! Pi delivered. 🥧 |
|
🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨ |
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 |
|
✅ All tools validated successfully! Agent Container Smoke Test confirms agent container is ready. |
|
🚀 Smoke Gemini MISSION COMPLETE! Gemini has spoken. ✨ |
|
📰 BREAKING: Smoke Copilot - AOAI (apikey) is now investigating this pull request. Sources say the story is developing... |
|
📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing... |
|
📰 BREAKING: Smoke Copilot - AOAI (Entra) is now investigating this pull request. Sources say the story is developing... |
Agent Container Tool Check
Result: 12/12 tools available ✅ Overall Status: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
Smoke Test Results
Overall Status: FAIL Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "localhost"See Network Configuration for more information.
|
Comment MemoryNote This comment is managed by comment memory.It stores persistent context for this thread in the code block at the top of this comment. Warning Firewall blocked 6 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
|
Comment MemoryNote This comment is managed by comment memory.It stores persistent context for this thread in the code block at the top of this comment. Warning Firewall blocked 6 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
💥 Automated smoke test review - all systems nominal!
Warning
Firewall blocked 6 domains
The following domains were blocked by the firewall during workflow execution:
accounts.google.comandroid.clients.google.comclients2.google.comcontentautofill.googleapis.comsafebrowsingohttpgateway.googleapis.comwww.google.com
To allow these domains, add them to the
network.allowedlist in your workflow frontmatter:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
💥 [THE END] — Illustrated by Smoke Claude · 90.4 AIC · ⌖ 31.1 AIC · ⊞ 8.4K
Comment /smoke-claude to run again
| @@ -831,9 +831,7 @@ jobs: | |||
| if [[ "${DOCKER_HOST:-}" =~ ^tcp:// ]]; then | |||
There was a problem hiding this comment.
Nice cleanup removing unused GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS; the DOCKER_HOST guard reads clearly. (smoke test #14a)
| @@ -776,9 +776,7 @@ jobs: | |||
| if [[ "${DOCKER_HOST:-}" =~ ^tcp:// ]]; then | |||
There was a problem hiding this comment.
Consistent change across lock files — consider a shared template to reduce duplication. (smoke test #14b)
There was a problem hiding this comment.
Smoke review tools exercised successfully.
Warning
Firewall blocked 6 domains
The following domains were blocked by the firewall during workflow execution:
accounts.google.comandroid.clients.google.comclients2.google.comcontentautofill.googleapis.comsafebrowsingohttpgateway.googleapis.comwww.google.com
To allow these domains, add them to the
network.allowedlist in your workflow frontmatter:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
📰 BREAKING: Report filed by Smoke Copilot · 86.7 AIC · ⌖ 8.03 AIC · ⊞ 19K
Comment /smoke-copilot to run again
Add label smoke to run again
Ran a pr-finisher pass on |
|
Smoke test results: 1✅ 2❌ 3❌ 4❌ 5❌ 6✅ 7❌ 8✅. Overall ❌. @lpcox
|
|
🎉 This pull request is included in a new release. Release: |
Summary
Removes the
--docker-host-path-prefixCLI flag from all AWF invocations on ARC/DinD runners and replaces it with an explicit--mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw"bind-mount argument.Root cause (gh-aw#34896): On sysroot-stage ARC/DinD runners, all bind-mount source paths live on a shared work volume that the Docker daemon can already access directly. Passing
--docker-host-path-prefix ${RUNNER_TEMP}/gh-awcaused AWF to prepend that prefix toGITHUB_WORKSPACE, translating it to a non-existent path inside the container and producing an empty workspace during agent runs.Fix: Drop
--docker-host-path-prefixentirely. Add an unconditional--mount "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:rw"to the ARC/DinD branch ofBuildAWFCommandso the workspace is explicitly visible to AWF without path translation.Changed files
pkg/workflow/awf_helpers.goawfArcDindPrefixArgsVarNameandawfArcDindHostPathPrefixFlagconstants; removedarcDindPrefixArgsRefvariable; removedGH_AW_DOCKER_HOST_PATH_PREFIX_ARGSinit/assignment from probe; added explicit workspace mount to ARC/DinDexpandableArgs; simplified probe block to emit only when chroot patch is needed; updated all four AWF command format stringspkg/workflow/awf_helpers_test.gowantPrefixSetfield and all--docker-host-path-prefixassertions fromTestArcDindDockerHostDetection; removed unusedosimportpkg/workflow/firewall_args_test.goGH_AW_DOCKER_HOST_PATH_PREFIX_ARGSassertions with negative--docker-host-path-prefixabsence checks; added positive assertion for explicit workspace mount in the ARC/DinD subtestpkg/workflow/testdata/TestWasmGolden_AllEngines/*.goldenpkg/workflow/testdata/TestWasmGolden_CompileFixtures/*.golden.github/workflows/*.lock.ymlBehaviour change
Before: On
(redacted)DOCKER_HOSTdetection, the generated shell emittedGH_AW_DOCKER_HOST_PATH_PREFIX_ARGSand passed${GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS}toawf, causingGITHUB_WORKSPACE` to be translated to a non-existent path.After:
GH_AW_DOCKER_HOST_PATH_PREFIX_ARGSis removed entirely. Theif [[ ... =~ (redacted) ]]guard block is retained only when the chroot config patch body is non-empty. Theawfinvocation gains--mount "\$\{GITHUB_WORKSPACE}:\$\{GITHUB_WORKSPACE}:rw"in the ARC/DinD branch so the workspace is mounted directly.No breaking changes
The
--docker-hostpassthrough (GH_AW_DOCKER_HOST) is unchanged. All ARC/DinD runtime detection logic is preserved. The chroot config patch path is unaffected.