[Test Coverage] add branch coverage for ssl-key-storage and config-writer by github-actions[bot] · Pull Request #5667 · github/gh-aw-firewall

github-actions · 2026-06-29T09:59:06Z

Adds targeted Jest tests to improve branch coverage for two security-critical modules that were below the 80% threshold.

Changes

`src/ssl-key-storage.test.ts` (new — 11 tests)

Targets ssl-key-storage.ts which had 65% branch coverage (7 uncovered branches out of 20). Covers:

mountSslTmpfs — success path (return true) was never exercised; existing ssl-bump.test.ts always rejects mount commands
secureWipeFile — six edge-case branches:
- Zero-size file: if (size > 0) false branch — no write/fsync, still deletes
- Non-regular file: !stat.isFile() true — error caught and logged, no write
- ENOENT on openSync: early return inside outer catch
- Close error suppressed: inner catch in finally block
- ENOENT on post-wipe unlinkSync: early return without retry
- Non-ENOENT unlinkSync error: retry unlink + debug log
cleanupSslKeyMaterial — two additional branch paths:
- ssl_db/ exists but ssl_db/certs/ does not → cert-iteration loop skipped
- ssl_db/ does not exist → outer if false branch

`src/config-writer-branches.test.ts` (new — 3 tests)

Targets config-writer.ts which had 78.94% branch coverage (just under the 80% threshold). Covers:

writeAuditArtifacts — symlink guard for auditDir (creates real symlink, asserts throw)
copySeccompProfile — dist-relative alt-path fallback when the src/../containers/ path is absent
initializeSslBump — wrapping of non-Error string rejections from generateSessionCa

Test results

PASS src/ssl-key-storage.test.ts       (11 tests)
PASS src/config-writer-branches.test.ts (3 tests)

All 14 new tests pass. No existing tests modified or removed.

Generated by Test Coverage Improver · 253.1 AIC · ⊞ 5.9K · ◷

ssl-key-storage.ts (65% → ~90%+ branches): - mountSslTmpfs: cover success path (return true) - secureWipeFile: zero-size file, non-regular file, ENOENT on open, suppressed close error in finally, ENOENT/non-ENOENT on post-wipe unlink (including retry path) - cleanupSslKeyMaterial: ssl_db exists but certs/ sub-dir absent config-writer.ts (78.94% → 80%+ branches): - writeAuditArtifacts: auditDir symlink guard - copySeccompProfile: dist-relative alt-path fallback - initializeSslBump: non-Error rejection string wrapping Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

This PR adds targeted Jest unit tests to raise branch coverage for two security-critical modules (ssl-key-storage.ts and config-writer.ts) that were previously below the 80% threshold. The changes fit into the repo’s existing Jest-based testing strategy by adding focused test files under src/ to exercise previously untested error/edge branches.

Changes:

Add direct unit tests for ssl-key-storage.ts to cover tmpfs-mount success/failure and multiple secureWipeFile + cleanupSslKeyMaterial edge branches.
Add a small branch-focused test suite for config-writer.ts covering audit-dir symlink hardening, seccomp-profile alternate path fallback, and non-Error rejection wrapping in SSL Bump initialization.

Show a summary per file

File	Description
src/ssl-key-storage.test.ts	Adds direct unit tests that cover previously unexercised branches in SSL key tmpfs mounting and secure wipe / cleanup behaviors.
src/config-writer-branches.test.ts	Adds branch-focused tests to cover symlink hardening, seccomp-profile fallback path behavior, and SSL Bump error wrapping in config writing.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 2/2 changed files
Comments generated: 0
Review effort level: Low

github-actions · 2026-06-29T13:58:10Z

✅ Copilot review passed with no inline comments.

@github-actions[bot] Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-06-29T14:00:02Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	98.16%	98.41%	📈 +0.25%
Statements	98.10%	98.34%	📈 +0.24%
Functions	99.54%	99.54%	➡️ +0.00%
Branches	94.14%	94.43%	📈 +0.29%

📁 Per-file Coverage Changes (3 files)

File	Lines (Before → After)	Statements (Before → After)
`src/workdir-setup.ts`	92.7% → 94.5% (+1.82%)	92.7% → 94.5% (+1.82%)
`src/config-writer.ts`	82.8% → 84.9% (+2.15%)	82.8% → 84.9% (+2.15%)
`src/ssl-key-storage.ts`	86.6% → 100.0% (+13.44%)	86.6% → 100.0% (+13.44%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

lpcox · 2026-06-29T14:31:01Z

@copilot fix this failing ci check https://github.com/github/gh-aw-firewall/pull/5667/checks?check_run_id=84071218422

github-actions · 2026-06-29T14:31:11Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

github-actions · 2026-06-29T14:31:11Z

✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓

github-actions · 2026-06-29T14:31:11Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

github-actions · 2026-06-29T14:31:11Z

🔌 Smoke Services — All services reachable! ✅

github-actions · 2026-06-29T14:31:12Z

✅ Smoke Gemini completed. All facets verified. 💎

github-actions · 2026-06-29T14:31:14Z

🔑 Smoke Copilot PAT PAT auth validated. All systems operational. ✅

github-actions · 2026-06-29T14:31:16Z

✅ Contribution Check completed successfully!

Contribution guidelines review complete for PR #5667: no important missing items found; no comment needed.

github-actions · 2026-06-29T14:31:21Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-06-29T14:31:23Z

✅ Smoke Claude passed

github-actions · 2026-06-29T14:31:24Z

✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓

github-actions · 2026-06-29T14:31:28Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

github-actions · 2026-06-29T14:31:39Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-06-29T14:31:47Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-06-29T14:32:02Z

✅ Build Test Suite completed successfully!

github-actions · 2026-06-29T14:34:23Z

Smoke Test: Copilot BYOK (Direct) Mode

All tests passed ✅

✅ GitHub MCP connectivity
✅ GitHub.com connectivity (HTTP 200)
✅ File write/read operations
✅ BYOK inference path active (api-proxy → api.githubcopilot.com)

Status: PASS (Direct BYOK mode via COPILOT_PROVIDER_API_KEY)

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-06-29T14:34:29Z

🔥 Smoke Test Results — Auth mode: PAT (COPILOT_GITHUB_TOKEN)

Test	Result
GitHub MCP connectivity	✅
GitHub.com HTTP	✅ 200
File write/read	✅

Overall: PASS

PR: "[Test Coverage] add branch coverage for ssl-key-storage and config-writer" by @github-actions[bot]

🔑 PAT report filed by Smoke Copilot PAT

github-actions · 2026-06-29T14:34:49Z

Smoke Test: Claude Engine Validation

API check: ✅ PASS
gh check: ✅ PASS
File check: ✅ PASS

Overall result: PASS

Generated by Smoke Claude for #5667 · 58.2 AIC · ⊞ 3.3K · ◷

github-actions · 2026-06-29T14:35:25Z

@lpcox - MCP connectivity: ✅

GitHub.com connectivity: ✅
File write/read: ✅
Direct BYOK inference: ✅

Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra

Overall: PASS

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

github-actions · 2026-06-29T14:35:33Z

🔬 Smoke Test Results

Test	Status
GitHub MCP (list PRs)	✅
github.com connectivity (HTTP 200)	✅
File write/read	⚠️ pre-step outputs not expanded

PR: [Test Coverage] add branch coverage for ssl-key-storage and config-writer
Author: @github-actions[bot]

Overall: PASS (core engine tests pass; pre-step template variable expansion issue noted)

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-06-29T14:36:09Z

Smoke Test: Gemini Engine Validation

GitHub MCP Testing: ❌ (Tools not available in this environment)
- PR found via git: refactor: deduplicate BYOK COPILOT_MODEL test scaffolding (refactor: deduplicate BYOK COPILOT_MODEL test scaffolding #5661)
GitHub.com Connectivity: ❌ (Status 400 / SSL Error 35)
File Writing Testing: ✅
Bash Tool Testing: ✅

Overall Status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini

github-actions · 2026-06-29T14:36:27Z

🔍 Smoke Test: API Proxy OpenTelemetry Tracing

Scenario	Result	Notes
1. Module Loading	✅ Pass	`otel.js` loads successfully; exports `startRequestSpan`, `setTokenAttributes`, `setBudgetAttributes`, `endSpan`, `endSpanError`, `shutdown`, `isEnabled`. `_init()` runs on load, `_enabled = true`.
2. Test Suite	✅ Pass	`otel.test.js` and `otel-fanout.test.js` exist with full coverage of module init, `_parseOtlpHeaders`, span creation, token attributes, parent context propagation, and graceful degradation.
3. Env Var Forwarding	✅ Pass	`src/services/api-proxy-env-config.ts` forwards all required OTEL env vars via `pickEnvVars`: `GH_AW_OTLP_ENDPOINTS`, `OTEL_EXPORTER_OTLP_ENDPOINT`, `OTEL_EXPORTER_OTLP_HEADERS`, `GITHUB_AW_OTEL_TRACE_ID`, `GITHUB_AW_OTEL_PARENT_SPAN_ID`, plus explicit `OTEL_SERVICE_NAME`.
4. Token Tracker Integration	✅ Pass	`token-tracker-http.js` `finalizeHttpTracking()` accepts `onUsage` callback (invoked with `normalizedUsage` + model) and `onSpanEnd` callback — both are the OTEL hook points for span decoration and completion.
5. OTEL Diagnostics	✅ Pass (file fallback)	No OTLP endpoint configured in this smoke run; spans fall back to `/var/log/api-proxy/otel.jsonl` per the `FileSpanExporter` path in `_init()`. No export errors expected.

All scenarios pass. OTEL tracing integration is fully implemented and functional.

📡 OTel tracing validated by Smoke OTel Tracing

github-actions · 2026-06-29T14:36:50Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	`Python 3.12.13`	`Python 3.12.3`	❌ NO
Node.js	`v24.17.0`	`v22.23.0`	❌ NO
Go	`go1.22.12`	`go1.22.12`	✅ YES

Overall: ❌ Tests did not pass — Python and Node.js versions differ between host and chroot environments.

Tested by Smoke Chroot

github-actions · 2026-06-29T14:37:18Z

@github-actions[bot]

refactor: deduplicate BYOK COPILOT_MODEL test scaffolding #5661 refactor: deduplicate BYOK COPILOT_MODEL test scaffolding — ✅
refactor(tests): deduplicate signal-handler tests with shared helper and it.each #5660 refactor(tests): deduplicate signal-handler tests with shared helper and it.each — ✅
GitHub.com HTTP — ✅
File write/read — ✅
BYOK inference — ✅

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)

Overall: PASS

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

github-actions · 2026-06-29T14:37:22Z

Smoke Test: Services Connectivity — ❌ FAIL

Check	Result
Redis PING (`host.docker.internal:6379`)	❌ Timeout
PostgreSQL `pg_isready` (`host.docker.internal:5432`)	❌ No response
PostgreSQL `SELECT 1`	❌ Not attempted (pg_isready failed)

host.docker.internal resolves to 172.17.0.1 but both ports timed out — service containers appear unreachable from this runner.

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-06-29T14:37:46Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	All passed	✅ PASS
Node.js	execa	✅	All passed	✅ PASS
Node.js	p-limit	✅	All passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for #5667 · 68.1 AIC · ⊞ 7.8K · ◷

github-actions · 2026-06-29T14:37:53Z

Merged PRs:

refactor: deduplicate BYOK COPILOT_MODEL test scaffolding
refactor(tests): deduplicate signal-handler tests with shared helper and it.each
✅ GitHub reads
✅ GitHub title check
✅ File write/read
✅ Discussion comment
✅ Build
Overall: PASS

🔮 The oracle has spoken through Smoke Codex

lpcox requested a review from Copilot June 29, 2026 13:50

Copilot started reviewing on behalf of lpcox June 29, 2026 13:51 View session

Copilot AI reviewed Jun 29, 2026

View reviewed changes

lpcox marked this pull request as ready for review June 29, 2026 13:58

lpcox added the ready-for-aw label Jun 29, 2026

Copilot started work on behalf of lpcox June 29, 2026 14:31 View session

lpcox temporarily deployed to aoai-model June 29, 2026 14:31 — with GitHub Actions Inactive

github-actions Bot mentioned this pull request Jun 29, 2026

[aw] No-Op Runs #5368

Open

github-actions Bot added the smoke-copilot-byok label Jun 29, 2026

github-actions Bot added the smoke-copilot-pat label Jun 29, 2026

github-actions Bot added the smoke-claude label Jun 29, 2026

lpcox temporarily deployed to aoai-model June 29, 2026 14:35 — with GitHub Actions Inactive

github-actions Bot added the smoke-copilot-byok-aoai-entra label Jun 29, 2026

lpcox temporarily deployed to aoai-model June 29, 2026 14:35 — with GitHub Actions Inactive

github-actions Bot added smoke-copilot smoke-gemini labels Jun 29, 2026

github-actions Bot added the smoke-copilot-byok-aoai-apikey label Jun 29, 2026

github-actions Bot added the build-test label Jun 29, 2026

github-actions Bot added the smoke-codex label Jun 29, 2026

Copilot AI requested a review from lpcox June 29, 2026 14:37

lpcox merged commit 4a13ee4 into main Jun 29, 2026
88 of 90 checks passed

lpcox deleted the test/ssl-key-storage-config-writer-coverage-4714765a010c8946 branch June 29, 2026 15:18

github-actions Bot mentioned this pull request Jun 29, 2026

Internalize unused provider session ID helper #5680

Merged

Uh oh!

Conversation

github-actions Bot commented Jun 29, 2026

Changes

src/ssl-key-storage.test.ts (new — 11 tests)

src/config-writer-branches.test.ts (new — 3 tests)

Test results

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

github-actions Bot commented Jun 29, 2026

Uh oh!

github-actions Bot commented Jun 29, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

lpcox commented Jun 29, 2026

Uh oh!

github-actions Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 29, 2026

Uh oh!

github-actions Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 29, 2026

Smoke Test: Copilot BYOK (Direct) Mode

Uh oh!

github-actions Bot commented Jun 29, 2026

🔥 Smoke Test Results — Auth mode: PAT (COPILOT_GITHUB_TOKEN)

Uh oh!

github-actions Bot commented Jun 29, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Jun 29, 2026

Uh oh!

github-actions Bot commented Jun 29, 2026

🔬 Smoke Test Results

Uh oh!

github-actions Bot commented Jun 29, 2026

Smoke Test: Gemini Engine Validation

Uh oh!

github-actions Bot commented Jun 29, 2026

`src/ssl-key-storage.test.ts` (new — 11 tests)

`src/config-writer-branches.test.ts` (new — 3 tests)

github-actions Bot commented Jun 29, 2026 •

edited

Loading

github-actions Bot commented Jun 29, 2026 •

edited

Loading

github-actions Bot commented Jun 29, 2026 •

edited

Loading

github-actions Bot commented Jun 29, 2026 •

edited

Loading

github-actions Bot commented Jun 29, 2026 •

edited

Loading

github-actions Bot commented Jun 29, 2026 •

edited

Loading

github-actions Bot commented Jun 29, 2026 •

edited

Loading

github-actions Bot commented Jun 29, 2026 •

edited

Loading

github-actions Bot commented Jun 29, 2026 •

edited

Loading

github-actions Bot commented Jun 29, 2026 •

edited

Loading

github-actions Bot commented Jun 29, 2026 •

edited

Loading

github-actions Bot commented Jun 29, 2026 •

edited

Loading

github-actions Bot commented Jun 29, 2026 •

edited

Loading