[Test Coverage] src/sbx-manager.ts by github-actions[bot] · Pull Request #6127 · github/gh-aw-firewall

github-actions · 2026-07-12T08:55:44Z

placeholder

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Test Coverage Improver · 59.2 AIC · ⊞ 5.3K · ◷

Add comprehensive unit tests for all uncovered paths in sbx-manager.ts: - sanitizeEnvForSbx: secret pattern filtering, override merging - SBX_DEFAULT_NAME: prefix and PID format validation - createSandbox: default name/port, auth failure paths (null/non-zero exit), sbx create failure, degenerate success detection, mount deduplication, rw/ro/2-segment mount formats, system path dedup - execInSandbox: exit codes (0/non-zero/null), timeout (124), unexpected error, workDir/tty/environment/timeoutMinutes options - removeSandbox: stop non-zero, stop throws, rm null exit, success logging - isSbxAvailable: true on success, false on throw Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Expands unit coverage for the sbx sandbox lifecycle manager.

Changes:

Tests environment sanitization and default naming.
Covers sandbox creation, execution, cleanup, and availability branches.
Verifies mount, timeout, environment, and error handling.

Show a summary per file

File	Description
`src/sbx-manager.test.ts`	Adds comprehensive sbx manager tests.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 1/1 changed files
Comments generated: 4
Review effort level: Medium

+      expect(result.PATH).toBe('/custom');
+    });
+
+    it('overrides cannot smuggle secret keys', () => {


+      expect(mockedLogger.info).toHaveBeenCalledWith(
+        expect.stringContaining('http://172.30.0.10:3128'),
+      );


+      expect(mockedLogger.info).toHaveBeenCalledWith(
+        expect.stringContaining('http://172.30.0.10:8080'),
+      );


lpcox · 2026-07-12T14:04:13Z

@copilot Fix the code for all comments in this review thread.

When a review comment includes a suggested change, apply the suggestion exactly.

Do not make changes beyond what is described in the linked review thread.

Copilot · 2026-07-12T14:10:51Z

@copilot Fix the code for all comments in this review thread.

When a review comment includes a suggested change, app...

Fixed all four issues in cb802d5:

Test name at line 70 — renamed to 'overrides take precedence even for secret-like key names' to accurately describe the behaviour.
Implementation (sbx-manager.ts) — createSandbox now sets env.DOCKER_SANDBOXES_PROXY = proxyUrl instead of deleting it, so Squid proxy chaining is actually applied at sandbox creation time.
Proxy tests (lines 134–136 and 146–148) — both tests now assert on the execa invocation (env.DOCKER_SANDBOXES_PROXY value) rather than log output, catching regressions where the port/URL is discarded.
Test at line 124 — changed to expect(name).toBe(SBX_DEFAULT_NAME) so a regression that stops using the exported constant is detected.

The existing "uses shell agent" test at line 83 was also updated to expect DOCKER_SANDBOXES_PROXY to be present (and correct) since the implementation now sets it.

github-actions · 2026-07-12T14:33:48Z

✅ Copilot review passed with no inline comments.

@github-actions[bot] Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-07-12T14:35:35Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	98.30%	98.95%	📈 +0.65%
Statements	98.23%	98.90%	📈 +0.67%
Functions	99.07%	99.33%	📈 +0.26%
Branches	93.85%	95.11%	📈 +1.26%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)
`src/sbx-manager.ts`	62.1% → 100.0% (+37.90%)	60.6% → 100.0% (+39.40%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-07-12T15:25:52Z

✅ Smoke Claude passed

github-actions · 2026-07-12T15:25:52Z

🔌 Smoke Services — All services reachable! ✅

github-actions · 2026-07-12T15:25:53Z

✅ Build Test Suite completed successfully!

github-actions · 2026-07-12T15:25:53Z

🔑 Smoke Copilot PAT PAT auth validated. All systems operational. ✅

github-actions · 2026-07-12T15:25:54Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

github-actions · 2026-07-12T15:25:55Z

✅ Smoke Gemini completed. All facets verified. 💎

Checking connectivity

github-actions · 2026-07-12T15:25:55Z

✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓

github-actions · 2026-07-12T15:25:55Z

📰 DEVELOPING STORY: Smoke Docker Sbx reports failed. Our correspondents are investigating the incident...

github-actions · 2026-07-12T15:25:56Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

github-actions · 2026-07-12T15:25:57Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

github-actions · 2026-07-12T15:25:57Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-07-12T15:25:58Z

❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

github-actions · 2026-07-12T15:25:59Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-07-12T15:26:03Z

✅ Contribution Check completed successfully!

github-actions · 2026-07-12T15:26:04Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-07-12T15:30:10Z

🔬 Smoke Test Results

Test	Status
GitHub MCP connectivity	✅
GitHub.com HTTP	⚠️ pre-step data unavailable (template vars not expanded)
File write/read	⚠️ pre-step data unavailable (template vars not expanded)

Overall: PASS (MCP verified; pre-step outputs not injected into prompt)

Author: @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-07-12T15:30:20Z

Smoke Test Results: Copilot BYOK (Direct) Mode

✅ GitHub API connectivity (HTTP 200)
✅ File write/read test
✅ BYOK inference path (api-proxy → api.githubcopilot.com)

Status: PASS

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy sidecar.
@lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-07-12T15:30:23Z

Smoke Test: Claude Engine Validation

Check	Result
API Status	✅ PASS
GH Check	✅ PASS
File Status	✅ PASS

Overall Result: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Smoke Claude for #6127 · 55.1 AIC · ⊞ 3.3K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-12T15:30:37Z

Smoke Test: Copilot PAT Auth

Test	Result
GitHub MCP connectivity	✅
GitHub.com HTTP	✅ (200)
File write/read	⚠️ (template vars not substituted)

Overall: PASS (core connectivity verified)
Author: @lpcox | Auth mode: PAT (COPILOT_GITHUB_TOKEN)

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 PAT report filed by Smoke Copilot PAT
_{Add label ready-for-aw to run again}

github-actions · 2026-07-12T15:30:47Z

@lpcox

Smoke Test Results:

MCP connectivity: ✅
GitHub.com connectivity: ✅
File write/read: ✅
BYOK inference: ✅

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)

Overall: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)
_{Add label ready-for-aw to run again}

github-actions · 2026-07-12T15:30:55Z

Thanks for adding comprehensive unit coverage for src/sbx-manager.ts. Before merging, please replace the placeholder PR description with a clear summary of what changed and reference any related issue, or state that none exists, as required by CONTRIBUTING.md under Pull Request requirements. The tests and file organization otherwise align with the applicable contribution guidelines.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Contribution Check for #6127 · 3.88 AIC · ⊞ 19.3K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-12T15:31:06Z

Smoke Test: Services Connectivity

Redis PING: ❌ (Network is unreachable)
PostgreSQL pg_isready: ❌ (no response)
PostgreSQL SELECT 1: ❌ (Network is unreachable)

Overall: FAIL — host.docker.internal is not reachable from this environment.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-07-12T15:31:36Z

Smoke Test: API Proxy OpenTelemetry Tracing

Scenario	Result	Notes
Module Loading	✅ Pass	`otel.js` loads; exports: `startRequestSpan`, `setTokenAttributes`, `setBudgetAttributes`, `endSpan`, `endSpanError`, `shutdown`, `isEnabled`, and internal helpers
Test Suite	✅ Pass	59 tests passed across `otel.test.js` and `otel-fanout.test.js` (2 suites)
Env Var Forwarding	✅ Pass	`api-proxy-env-config.ts` forwards `OTEL_EXPORTER_OTLP_ENDPOINT`, `OTEL_EXPORTER_OTLP_HEADERS`, `GITHUB_AW_OTEL_TRACE_ID`, `GITHUB_AW_OTEL_PARENT_SPAN_ID`, `OTEL_SERVICE_NAME` (defaults to `awf-api-proxy`)
Token Tracker Integration	✅ Pass	`onUsage` callback exists in `token-tracker-http.js` as the OTEL hook point
OTEL Diagnostics	✅ Pass	Graceful degradation confirmed; falls back to file-based spans at `/var/log/api-proxy/otel.jsonl` when no endpoint configured

All 5 scenarios passed.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-07-12T15:32:08Z

Smoke test: PASS

Merged PRs reviewed:

feat: add gVisor smoke tests for Claude, Codex, and build workloads
chore: upgrade gh-aw to v0.82.8 pre-release and recompile workflows

Checks:

GitHub PR review: ✅
GitHub CLI PR query: ✅
GitHub discussion query: ✅
Playwright title check: ✅
File write/read: ✅
Build: ✅

Overall: PASS

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

awmgmcpg
registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

github-actions · 2026-07-12T15:32:24Z

Chroot Version Comparison

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.3	❌ NO
Node.js	v24.18.0	v22.23.1	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Result: Not all tests passed — Python and Node.js versions differ between host and chroot environments.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions · 2026-07-12T15:33:06Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Build Test Suite for #6127 · 35.9 AIC · ⊞ 6.9K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-12T15:33:15Z

Smoke Test: Gemini Engine Validation

GitHub MCP Testing: ❌ (Cannot reach API)
GitHub.com Connectivity: ❌ (Connection failed)
File Writing Testing: ✅ (PASS)
Bash Tool Testing: ✅ (PASS)

Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini
_{Add label ready-for-aw to run again}

lpcox marked this pull request as ready for review July 12, 2026 14:00

Copilot AI review requested due to automatic review settings July 12, 2026 14:00

Copilot started reviewing on behalf of lpcox July 12, 2026 14:00 View session

Copilot AI reviewed Jul 12, 2026

View reviewed changes

Copilot started work on behalf of lpcox July 12, 2026 14:04 View session

fix: set DOCKER_SANDBOXES_PROXY in sbx create env, fix tests

cb802d5

Copilot AI requested a review from lpcox July 12, 2026 14:11

Copilot finished work on behalf of lpcox July 12, 2026 14:11

lpcox added the ready-for-aw label Jul 12, 2026

lpcox had a problem deploying to aoai-model July 12, 2026 15:26 — with GitHub Actions Failure

github-actions Bot added the smoke-copilot-byok label Jul 12, 2026

github-actions Bot added the smoke-claude label Jul 12, 2026

github-actions Bot added the smoke-copilot-pat label Jul 12, 2026

github-actions Bot added the smoke-copilot-byok-aoai-apikey label Jul 12, 2026

github-actions Bot mentioned this pull request Jul 12, 2026

[aw] Smoke Docker Sbx failed #6141

Open

github-actions Bot added the smoke-codex label Jul 12, 2026

lpcox temporarily deployed to aoai-model July 12, 2026 15:32 — with GitHub Actions Inactive

github-actions Bot added the smoke-copilot-byok-aoai-entra label Jul 12, 2026

lpcox temporarily deployed to aoai-model July 12, 2026 15:32 — with GitHub Actions Inactive

github-actions Bot mentioned this pull request Jul 12, 2026

[aw] Smoke Copilot BYOK AOAI (Entra) failed #6142

Open

github-actions Bot added the build-test label Jul 12, 2026

Uh oh!

Conversation

github-actions Bot commented Jul 12, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

lpcox commented Jul 12, 2026

Uh oh!

Copilot AI commented Jul 12, 2026

Uh oh!

github-actions Bot commented Jul 12, 2026

Uh oh!

github-actions Bot commented Jul 12, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

github-actions Bot commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 12, 2026

Uh oh!

github-actions Bot commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 12, 2026

🔬 Smoke Test Results

Uh oh!

github-actions Bot commented Jul 12, 2026

Smoke Test Results: Copilot BYOK (Direct) Mode

Uh oh!

github-actions Bot commented Jul 12, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Jul 12, 2026

Smoke Test: Copilot PAT Auth

Uh oh!

github-actions Bot commented Jul 12, 2026

Uh oh!

github-actions Bot commented Jul 12, 2026

Uh oh!

github-actions Bot commented Jul 12, 2026 •

edited

Loading

github-actions Bot commented Jul 12, 2026 •

edited

Loading

github-actions Bot commented Jul 12, 2026 •

edited

Loading

github-actions Bot commented Jul 12, 2026 •

edited

Loading

github-actions Bot commented Jul 12, 2026 •

edited

Loading

github-actions Bot commented Jul 12, 2026 •

edited

Loading

github-actions Bot commented Jul 12, 2026 •

edited

Loading

github-actions Bot commented Jul 12, 2026 •

edited

Loading

github-actions Bot commented Jul 12, 2026 •

edited

Loading

github-actions Bot commented Jul 12, 2026 •

edited

Loading

github-actions Bot commented Jul 12, 2026 •

edited

Loading

github-actions Bot commented Jul 12, 2026 •

edited

Loading

github-actions Bot commented Jul 12, 2026 •

edited

Loading

github-actions Bot commented Jul 12, 2026 •

edited

Loading