[Test Coverage] Branch coverage for container-stop, config-file, and main-action by github-actions[bot] · Pull Request #5902 · github/gh-aw-firewall

github-actions · 2026-07-04T09:16:08Z

Summary

Adds targeted branch-coverage tests for three source files that had identified uncovered branches in the coverage report.

Files covered

src/container-stop.ts

fixSquidLogPermissionsBeforeShutdown: non-zero exit code path with non-empty stderr
fixSquidLogPermissionsBeforeShutdown: (no stderr) fallback when stderr is empty but exit code is non-zero

src/config-file.ts

loadAwfFileConfig parse-error catch block: String(error) fallback when the thrown value is not an Error instance

src/commands/main-action.ts

redactConfigForLogging: additionalEnv object path — all env key values replaced with [REDACTED]
redactConfigForLogging: additionalEnv null/falsy short-circuit branch
redactConfigForLogging: additionalEnv non-object string pass-through
createMainAction: skip probeSplitFilesystem when dockerHostPathPrefix is already configured
createMainAction: auto-apply detected DinD path prefix and emit info log
createMainAction: log warning when split filesystem detected but no known prefix resolved
createMainAction: config.dnsServers undefined → nullish-coalescing fallback

New test files

File	Tests
`src/container-stop-coverage.test.ts`	2
`src/config-file-branches.test.ts`	1
`src/commands/main-action-coverage.test.ts`	7

All 10 new tests pass. No existing tests were modified or removed.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Test Coverage Improver · 269.1 AIC · ⊞ 5.3K · ◷

Cover the following uncovered branches identified in the coverage report: container-stop.ts: - fixSquidLogPermissionsBeforeShutdown: log message when exit code is non-zero with non-empty stderr - fixSquidLogPermissionsBeforeShutdown: '(no stderr)' fallback in the debug message when stderr is empty but exit code is non-zero config-file.ts: - loadAwfFileConfig parse-error catch block: String(error) fallback used when the thrown value is not an Error instance commands/main-action.ts: - redactConfigForLogging: additionalEnv object path (keys replaced with [REDACTED]) - redactConfigForLogging: additionalEnv null/falsy short-circuit branch - redactConfigForLogging: additionalEnv non-object value pass-through - createMainAction: skip probeSplitFilesystem when dockerHostPathPrefix is already configured - createMainAction: auto-apply detected DinD path prefix and log info - createMainAction: log warning when split filesystem detected but no prefix resolved - createMainAction: dnsServers undefined nullish-coalescing fallback Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Adds targeted Jest unit tests to increase branch coverage for key runtime paths in AWF’s container shutdown, config parsing, and main CLI action logic—without changing production behavior.

Changes:

Added coverage tests for fixSquidLogPermissionsBeforeShutdown non-zero exit-code logging branches.
Added a config parsing test covering the String(error) fallback when non-Error values are thrown during YAML parsing.
Added coverage tests for main-action config redaction branches and DinD split-filesystem detection/logging branches.

Show a summary per file

File	Description
`src/container-stop-coverage.test.ts`	Adds tests for `fixSquidLogPermissionsBeforeShutdown` non-zero exit-code logging (stderr vs `(no stderr)` fallback).
`src/config-file-branches.test.ts`	Adds a test to force the `String(error)` fallback in `loadAwfFileConfig` parse error handling.
`src/commands/main-action-coverage.test.ts`	Adds tests covering `redactConfigForLogging(additionalEnv)` branches and `createMainAction` DinD probe/prefix and DNS logging branches.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 3/3 changed files
Comments generated: 1
Review effort level: Low

+/** Minimal WrapperConfig stub reused across tests. */
+const BASE_STUB_CONFIG = {
+  allowedDomains: ['github.com'],
+  blockedDomains: undefined,
+  agentCommand: 'echo hi',
+  logLevel: 'info',
+  keepContainers: false,
+  workDir: '/tmp/awf-test',
+  imageRegistry: 'ghcr.io/github/gh-aw-firewall',
+  imageTag: 'latest',
+  buildLocal: false,
+  dnsServers: ['8.8.8.8'],
+  awfDockerHost: undefined,
+  proxyLogsDir: undefined,
+  auditDir: undefined,
+  sessionStateDir: undefined,
+  dockerHostPathPrefix: undefined,
+} as unknown as import('../types').WrapperConfig;


lpcox · 2026-07-04T13:30:22Z

@copilot address review feedback

Copilot · 2026-07-04T13:37:18Z

@copilot address review feedback

Addressed in 41ab8b4. I merged the branch-coverage cases into src/commands/main-action.test.ts, removed src/commands/main-action-coverage.test.ts, and validated with targeted Jest tests plus lint/build.

github-actions · 2026-07-04T13:38:38Z

✅ Copilot review passed with no inline comments.

@github-actions[bot] Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-07-04T13:38:54Z

❌ Smoke Gemini reports failed. Facets need polishing...

Smoke test completed. Some tests failed.

github-actions · 2026-07-04T13:38:54Z

✅ Build Test Suite completed successfully!

github-actions · 2026-07-04T13:38:54Z

🔑 Smoke Copilot PAT PAT auth validated. All systems operational. ✅

github-actions · 2026-07-04T13:38:54Z

✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓

github-actions · 2026-07-04T13:38:55Z

🔌 Smoke Services — All services reachable! ✅

github-actions · 2026-07-04T13:38:55Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

github-actions · 2026-07-04T13:38:57Z

✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓

github-actions · 2026-07-04T13:38:57Z

🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation...

github-actions · 2026-07-04T13:38:57Z

Chroot tests failed Smoke Chroot failed - See logs for details.

github-actions · 2026-07-04T13:38:58Z

✅ Contribution Check completed successfully!

PR follows the applicable CONTRIBUTING.md guidelines; no contribution-guidelines comment needed.

github-actions · 2026-07-04T13:39:00Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-07-04T13:39:04Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

github-actions · 2026-07-04T13:39:05Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-07-04T13:39:19Z

✅ Smoke Claude passed

github-actions · 2026-07-04T13:40:34Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	98.59%	98.76%	📈 +0.17%
Statements	98.52%	98.68%	📈 +0.16%
Functions	99.44%	99.58%	📈 +0.14%
Branches	94.34%	94.69%	📈 +0.35%

📁 Per-file Coverage Changes (3 files)

File	Lines (Before → After)	Statements (Before → After)
`src/workdir-setup.ts`	93.2% → 94.9% (+1.69%)	93.2% → 94.9% (+1.69%)
`src/container-stop.ts`	95.7% → 100.0% (+4.35%)	95.7% → 100.0% (+4.35%)
`src/commands/main-action.ts`	93.6% → 100.0% (+6.39%)	93.7% → 100.0% (+6.32%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-07-04T13:43:30Z

Smoke Test: Copilot BYOK (Direct) Mode

✅ GitHub connectivity (HTTP 200)
✅ File write/read test
✅ BYOK inference test (api-proxy → api.githubcopilot.com)
✅ MCP connectivity

Status: PASS — Direct BYOK mode working via api-proxy sidecar

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-07-04T13:43:39Z

🔬 Smoke Test Results

Test	Status
GitHub MCP Connectivity	✅
GitHub.com HTTP	⚠️ pre-step vars not expanded
File Write/Read	⚠️ pre-step vars not expanded

Overall: PASS (MCP connectivity verified)
PR author: @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-07-04T13:43:45Z

Smoke Test: Claude Engine Validation

Check	Result
API Status	✅ PASS
GH Check	✅ PASS
File Status	✅ PASS

Overall Result: PASS ✅

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Smoke Claude for #5902 · 35.8 AIC · ⊞ 3.3K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-04T13:44:01Z

Smoke Test: GitHub Actions Services Connectivity

Redis PING: ❌ Network is unreachable
PostgreSQL pg_isready: ❌ No response
PostgreSQL SELECT 1: ❌ Network is unreachable

Overall: FAIL — host.docker.internal (172.17.0.1) is not reachable from this environment.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-07-04T13:44:08Z

Smoke Test: PAT Auth — PASS

Test	Result
GitHub MCP connectivity	✅
File write/read	✅
Auth mode	PAT (COPILOT_GITHUB_TOKEN)

Overall: PASS — @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 PAT report filed by Smoke Copilot PAT
_{Add label ready-for-aw to run again}

github-actions · 2026-07-04T13:44:29Z

@lpcox

PR Titles:
${{ steps.smoke-data.outputs.SMOKE_PR_DATA }}

GitHub MCP PR Data: ✅
GitHub.com connectivity: ✅
File write/read: ✅
BYOK inference: ✅

Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)

Overall: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)
_{Add label ready-for-aw to run again}

github-actions · 2026-07-04T13:45:28Z

🔬 Smoke Test: API Proxy OpenTelemetry Tracing

Scenario	Result	Notes
1. Module Loading	✅ Pass	`otel.js` loads successfully; `isEnabled: true` (FileSpanExporter active as fallback). Exports: `startRequestSpan`, `setTokenAttributes`, `setBudgetAttributes`, `endSpan`, `endSpanError`, `shutdown`, `isEnabled` + internal helpers.
2. Test Suite	✅ Pass	59 tests, 2 suites (`otel.test.js` + `otel-fanout.test.js`) — all passed in 2.4 s.
3. Env Var Forwarding	✅ Pass	`src/services/api-proxy-env-config.ts` forwards `GH_AW_OTLP_ENDPOINTS`, `OTEL_EXPORTER_OTLP_ENDPOINT`, `OTEL_EXPORTER_OTLP_HEADERS`, `GITHUB_AW_OTEL_TRACE_ID`, `GITHUB_AW_OTEL_PARENT_SPAN_ID`, `OTEL_SERVICE_NAME` into the api-proxy container.
4. Token Tracker Integration	✅ Pass	`onUsage` callback present in `token-tracker-http.js` (lines 283/324/374) — confirmed OTEL hook point.
5. OTEL Diagnostics	✅ Pass (no live traffic)	No proxied requests in this smoke run; fallback `FileSpanExporter` writes to `/var/log/api-proxy/otel.jsonl` when no OTLP endpoint configured — graceful degradation confirmed.

All 5 scenarios pass. ✅

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-07-04T13:45:44Z

Recent merged PRs:
${{ steps.smoke-data.outputs.SMOKE_PR_DATA }}

MCP connectivity: ✅
GitHub.com connectivity: ✅
File I/O test: ✅
BYOK inference test: ✅

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)

PASS

cc @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)
_{Add label ready-for-aw to run again}

github-actions · 2026-07-04T13:46:01Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	All passed	✅ PASS
Node.js	execa	✅	All passed	✅ PASS
Node.js	p-limit	✅	All passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Build Test Suite for #5902 · 39.4 AIC · ⊞ 6.9K · ◷
_{Add label ready-for-aw to run again}

lpcox requested a review from Copilot July 4, 2026 13:08

lpcox marked this pull request as ready for review July 4, 2026 13:08

Copilot started reviewing on behalf of lpcox July 4, 2026 13:08 View session

Copilot AI reviewed Jul 4, 2026

View reviewed changes

Copilot started work on behalf of lpcox July 4, 2026 13:33 View session

test: consolidate main-action coverage into existing suite

41ab8b4

Copilot finished work on behalf of lpcox July 4, 2026 13:37

Copilot AI requested a review from lpcox July 4, 2026 13:37

lpcox added the ready-for-aw label Jul 4, 2026

lpcox temporarily deployed to aoai-model July 4, 2026 13:39 — with GitHub Actions Inactive

github-actions Bot added the smoke-copilot-byok label Jul 4, 2026

github-actions Bot added the smoke-copilot label Jul 4, 2026

github-actions Bot added the smoke-claude label Jul 4, 2026

github-actions Bot added the smoke-copilot-pat label Jul 4, 2026

lpcox temporarily deployed to aoai-model July 4, 2026 13:44 — with GitHub Actions Inactive

github-actions Bot added the smoke-copilot-byok-aoai-entra label Jul 4, 2026

lpcox temporarily deployed to aoai-model July 4, 2026 13:44 — with GitHub Actions Inactive

github-actions Bot added the smoke-copilot-byok-aoai-apikey label Jul 4, 2026

github-actions Bot added the build-test label Jul 4, 2026

lpcox merged commit daefe51 into main Jul 4, 2026
84 of 88 checks passed

lpcox deleted the test-coverage/branch-coverage-improvements-a4a167af544cfbcc branch July 4, 2026 14:22

Uh oh!

Conversation

github-actions Bot commented Jul 4, 2026

Summary

Files covered

New test files

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

lpcox commented Jul 4, 2026

Uh oh!

Copilot AI commented Jul 4, 2026

Uh oh!

github-actions Bot commented Jul 4, 2026

Uh oh!

github-actions Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 4, 2026

Uh oh!

github-actions Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 4, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

github-actions Bot commented Jul 4, 2026

Smoke Test: Copilot BYOK (Direct) Mode

Uh oh!

github-actions Bot commented Jul 4, 2026

🔬 Smoke Test Results

Uh oh!

github-actions Bot commented Jul 4, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Jul 4, 2026

Smoke Test: GitHub Actions Services Connectivity

Uh oh!

github-actions Bot commented Jul 4, 2026

Smoke Test: PAT Auth — PASS

Uh oh!

github-actions Bot commented Jul 4, 2026

Uh oh!

github-actions Bot commented Jul 4, 2026 •

edited

Loading

github-actions Bot commented Jul 4, 2026 •

edited

Loading

github-actions Bot commented Jul 4, 2026 •

edited

Loading

github-actions Bot commented Jul 4, 2026 •

edited

Loading

github-actions Bot commented Jul 4, 2026 •

edited

Loading

github-actions Bot commented Jul 4, 2026 •

edited

Loading

github-actions Bot commented Jul 4, 2026 •

edited

Loading

github-actions Bot commented Jul 4, 2026 •

edited

Loading

github-actions Bot commented Jul 4, 2026 •

edited

Loading

github-actions Bot commented Jul 4, 2026 •

edited

Loading

github-actions Bot commented Jul 4, 2026 •

edited

Loading

github-actions Bot commented Jul 4, 2026 •

edited

Loading

github-actions Bot commented Jul 4, 2026 •

edited

Loading