Refactor mainAction: extract config-audit persistence and cleanup builder

[Copilot]

createMainAction still carried mixed responsibilities after earlier refactors, with config-audit persistence and cleanup-closure construction embedded inside a long orchestration path. This change isolates those concerns into focused helpers while keeping createMainAction behavior and API intact.

• Responsibility split in src/commands/main-action.ts

  • Extracted redactConfigForLogging(config) to centralize secret-key removal and agentCommand redaction.
  • Extracted persistConfigAuditArtifact(config, redactedConfig) to encapsulate audit artifact directory/file creation and error handling.
  • Extracted buildCleanupFn(config, getContainersStarted, getHostIptablesSetup) so cleanup lifecycle logic is defined as a reusable closure factory instead of inline action code.

• Orchestration simplification

  • mainAction now delegates redaction/audit persistence and cleanup creation via single-purpose calls, reducing local complexity and making control flow easier to scan.
  • Signal registration and workflow callbacks continue to use the same cleanup behavior through the generated performCleanup function.

• Testability hook

  • Exposed extracted internals via testHelpers (@internal) to enable direct unit coverage of the new helper boundaries without changing public command wiring.

const redactedConfig = redactConfigForLogging(config);
logger.debug('Configuration:', JSON.stringify(redactedConfig, null, 2));
persistConfigAuditArtifact(config, redactedConfig);

const performCleanup = buildCleanupFn(
  config,
  () => containersStarted,
  () => hostIptablesSetup,
);

[Copilot]

Pull request overview

This PR refactors createMainAction to better separate concerns by extracting (1) config redaction for logging/auditing, (2) audit artifact persistence, and (3) cleanup-closure construction into dedicated helper functions, while keeping the external behavior of the command intact. It also exposes these helpers via testHelpers to enable direct unit testing of the new boundaries.

Changes:

• Extracted redactConfigForLogging, persistConfigAuditArtifact, and buildCleanupFn out of the main orchestration path.
• Updated createMainAction to delegate to the new helpers for logging/audit persistence and cleanup handling.
• Added unit tests covering the extracted helpers via a new testHelpers export.

Show a summary per file

File	Description
src/commands/main-action.ts	Extracts redaction/audit persistence and cleanup builder helpers; wires createMainAction to use them; exports testHelpers for unit testing.
src/commands/main-action.test.ts	Imports testHelpers and adds direct unit coverage for the extracted helper functions.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Low

[github-actions]

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

[github-actions]

❌ Smoke Claude failed

[github-actions]

🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation...

[github-actions]

❌ Smoke Gemini reports failed. Facets need polishing...

[github-actions]

Chroot tests failed Smoke Chroot failed - See logs for details.

[github-actions]

Build Test Failed Build Test Suite - See logs for details

[github-actions]

❌ Smoke Copilot BYOK reports failed. BYOK mode investigation needed...

[github-actions]

🔌 Smoke Services — Service connectivity failed ⚠️

[github-actions]

📰 DEVELOPING STORY: Smoke Copilot reports failed. Our correspondents are investigating the incident...

[github-actions]

❌ Contribution Check failed. Please review the logs for details.

[github-actions]

❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

[github-actions]

📡 Smoke OTel Tracing reports failed. OTel tracing regression detected. ⚠️

[github-actions]

❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

[github-actions]

🔑 Smoke Copilot PAT reports failed. PAT auth path may have issues...

[github-actions]

🔑 Smoke Copilot PAT PAT auth validated. All systems operational. ✅

[github-actions]

✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓

[github-actions]

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	98.62%	98.63%	➡️ +0.01%
Statements	98.51%	98.52%	➡️ +0.01%
Functions	99.56%	99.42%	📉 -0.14%
Branches	94.42%	94.33%	📉 -0.09%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
src/commands/main-action.ts	94.9% → 93.6% (-1.26%)	94.9% → 93.7% (-1.19%)
src/workdir-setup.ts	93.0% → 94.8% (+1.74%)	93.0% → 94.8% (+1.74%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[github-actions]

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

[github-actions]

Smoke Test: Services Connectivity

• Redis PING: ❌ Network unreachable
• PostgreSQL pg_isready: ❌ No response
• PostgreSQL SELECT 1: ❌ Network unreachable

Result: FAIL — host.docker.internal (172.17.0.1) is unreachable from this runner. Service containers are not accessible.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Claude Engine Validation

Check	Result
API status	✅ PASS
gh check	✅ PASS
File status	✅ PASS

Overall result: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Smoke Claude for #5834 · 55.6 AIC · ⊞ 3.3K · ◷
_{Add label ready-for-aw to run again}

[github-actions]

🔬 Smoke Test Results

Test	Status
GitHub MCP connectivity	✅
GitHub.com HTTP (200)	✅
File write/read	✅

Overall: PASS 🎉

cc @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

[github-actions]

chore: upgrade gh-aw to v0.82.2 pre-release and recompile workflows
fix: chmod squid logs inside container before compose down
GitHub reads: ✅
CLI query: ✅
Page title check: ❌
File write/read: ✅
Discussion comment: ✅
Build: ✅
Overall: FAIL

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions]

@lpcox

• GitHub MCP connectivity: ✅
• GitHub.com connectivity: ✅
• File I/O: ✅
• BYOK inference: ✅

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)

Tested PR titles:
• chore: upgrade gh-aw to v0.82.2 pre-release and recompile workflows
• fix: chmod squid logs inside container before compose down

Overall: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)
_{Add label ready-for-aw to run again}

[github-actions]

🧪 Smoke Test: Copilot PAT Auth

Test	Result
GitHub MCP connectivity	✅
GitHub.com HTTP	✅ 200
File write/read	✅

Overall: PASS · Auth mode: PAT (COPILOT_GITHUB_TOKEN)

@lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 PAT report filed by Smoke Copilot PAT
_{Add label ready-for-aw to run again}

[github-actions]

✅ Smoke Test Results: Direct BYOK Mode

Test	Result
GitHub MCP	✅
github.com connectivity	✅
File I/O	✅
BYOK inference	✅

Mode: Direct BYOK (COPILOT_PROVIDER_API_KEY via api-proxy sidecar → api.githubcopilot.com)
Status: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

[github-actions]

🔍 Smoke Test: API Proxy OpenTelemetry Tracing

Scenario	Status	Notes
1. Module Loading	✅	otel.js loads successfully; exports: startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled + test internals. isEnabled() = true.
2. Test Suite	✅	59 tests passed, 0 failed across 2 suites (otel.test.js, otel-fanout.test.js).
3. Env Var Forwarding	✅	src/services/api-proxy-env-config.ts forwards GH_AW_OTLP_ENDPOINTS, OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_EXPORTER_OTLP_HEADERS, GITHUB_AW_OTEL_TRACE_ID, GITHUB_AW_OTEL_PARENT_SPAN_ID, OTEL_SERVICE_NAME to the api-proxy container.
4. Token Tracker Integration	✅	onUsage callback exists in token-tracker-http.js as the OTEL hook point; invoked via finalizeHttpTracking().
5. OTEL Diagnostics	✅ (degraded)	No remote OTLP endpoint configured; spans fall back to FileSpanExporter → /var/log/api-proxy/otel.jsonl. Graceful degradation confirmed.

All scenarios pass. OTEL tracing integration is functional.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Gemini Engine Validation

• GitHub MCP Testing: ✅
• GitHub.com Connectivity: ✅
• File Writing Testing: ✅
• Bash Tool Testing: ✅

PR Titles:

1. chore: upgrade gh-aw to v0.82.2 pre-release and recompile workflows
2. fix: chmod squid logs inside container before compose down

Overall status: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini
_{Add label ready-for-aw to run again}

[github-actions]

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)
_{Add label ready-for-aw to run again}

[github-actions]

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Build Test Suite for #5834 · 63.4 AIC · ⊞ 6.9K · ◷
_{Add label ready-for-aw to run again}