[Test Coverage] host-iptables-chain.ts / host-iptables-validation.ts by github-actions[bot] · Pull Request #5866 · github/gh-aw-firewall

github-actions · 2026-07-03T09:20:55Z

Summary

Adds src/host-iptables-chain-branches.test.ts to cover two remaining uncovered branches identified by the coverage report.

Branches covered

host-iptables-chain.ts line 20
checkPermissionsAndSetupChain — the DOCKER-USER list command fails with ENOENT / not found (second catch block). Previously only the --version ENOENT path and the Permission denied stderr path were tested. This adds coverage for the case where the DOCKER-USER inspection itself is the first indication that iptables is missing.

host-iptables-validation.ts line 34
isMissingIptablesError — the '' branch of the ternary error instanceof Error ? error.message : ''. Fires when a non-Error value is thrown (plain object, string, null). Previously only Error instances were exercised in tests.

Tests added

7 new focused unit tests in src/host-iptables-chain-branches.test.ts
All 166 host-iptables tests pass
No existing tests modified

Coverage impact

File	Before	After
`host-iptables-chain.ts`	95.23% stmts / 80% branch	100% stmts / 100% branch
`host-iptables-validation.ts`	100% stmts / 96.87% branch	100% stmts / 100% branch

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Test Coverage Improver · 119.8 AIC · ⊞ 5.3K · ◷

Add host-iptables-chain-branches.test.ts targeting two remaining uncovered branches from the coverage report: 1. host-iptables-chain.ts line 20: checkPermissionsAndSetupChain DOCKER-USER list fails with ENOENT emits user-readable 'iptables is required but was not found'. 2. host-iptables-validation.ts line 34: isMissingIptablesError with non-Error thrown values takes the empty-string branch of the ternary. 7 new tests; all 166 host-iptables tests pass. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Adds targeted Jest unit tests to close the remaining uncovered branch paths in the host iptables code, improving confidence in error-handling behavior without changing runtime logic.

Changes:

Add new branch-coverage tests for checkPermissionsAndSetupChain when the DOCKER-USER inspection fails with an iptables-missing error.
Add tests for isMissingIptablesError when the thrown/caught value is not an Error instance (exercising the ternary fallback branch).

Show a summary per file

File	Description
`src/host-iptables-chain-branches.test.ts`	Adds focused unit tests to cover previously-unexercised error-handling branches in host iptables chain setup and validation helpers.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 1/1 changed files
Comments generated: 2
Review effort level: Low

+ * 1. host-iptables-chain.ts line 20:
+ *    `throw new Error('iptables is required but was not found...')` inside the
+ *    DOCKER-USER check catch block — triggered when the DOCKER-USER list command
+ *    fails with an ENOENT / "not found" error.
+ *
+ * 2. host-iptables-validation.ts line 34:
+ *    `error instanceof Error ? error.message : ''` — the `''` fallback branch
+ *    exercised when `isMissingIptablesError` receives a non-Error thrown value
+ *    (e.g. a plain object or string).


lpcox · 2026-07-03T12:33:06Z

@copilot address review feedback

Copilot · 2026-07-03T13:04:40Z

@copilot address review feedback

Done in afa94f9. Removed source line numbers from the header JSDoc, the inline separator comment, and the describe() title — all locations now describe branches by function/expression name only.

github-actions · 2026-07-03T13:31:48Z

✅ Copilot review passed with no inline comments.

@github-actions[bot] Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-07-03T13:32:01Z

✅ Smoke Claude passed

github-actions · 2026-07-03T13:32:02Z

✅ Smoke Gemini completed. All facets verified. 💎

Researching PRs via MCP

github-actions · 2026-07-03T13:32:02Z

🔑 Smoke Copilot PAT PAT auth validated. All systems operational. ✅

github-actions · 2026-07-03T13:32:03Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-07-03T13:32:04Z

✅ Contribution Check completed successfully!

PR #5866 follows the applicable CONTRIBUTING.md guidelines; no contribution-guidelines comment needed.

github-actions · 2026-07-03T13:32:04Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

github-actions · 2026-07-03T13:32:05Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-07-03T13:32:05Z

🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation...

github-actions · 2026-07-03T13:32:06Z

🔌 Smoke Services — All services reachable! ✅

github-actions · 2026-07-03T13:32:07Z

✅ Build Test Suite completed successfully!

github-actions · 2026-07-03T13:32:08Z

Chroot tests failed Smoke Chroot failed - See logs for details.

github-actions · 2026-07-03T13:32:09Z

✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓

github-actions · 2026-07-03T13:32:14Z

✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓

github-actions · 2026-07-03T13:32:20Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

github-actions · 2026-07-03T13:33:33Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	98.59%	98.65%	📈 +0.06%
Statements	98.52%	98.57%	📈 +0.05%
Functions	99.43%	99.43%	➡️ +0.00%
Branches	94.32%	94.39%	📈 +0.07%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
`src/workdir-setup.ts`	93.0% → 94.8% (+1.74%)	93.0% → 94.8% (+1.74%)
`src/host-iptables-chain.ts`	97.6% → 100.0% (+2.39%)	97.6% → 100.0% (+2.39%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-07-03T13:36:14Z

Smoke Test: Claude Engine Validation

Check	Result
API Status	✅ PASS
GH Check	✅ PASS
File Status	✅ PASS

Overall Result: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Smoke Claude for #5866 · 35.6 AIC · ⊞ 3.3K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-03T13:36:58Z

Smoke Test: Copilot BYOK (Direct) Mode ✅ PASS

✅ BYOK Inference: Working
✅ Environment: Configured correctly
✅ Mode Detection: Direct BYOK via api-proxy → api.githubcopilot.com

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-07-03T13:37:03Z

Smoke Test: Services Connectivity

Redis PING: ❌ Network unreachable
PostgreSQL pg_isready: ❌ No response
PostgreSQL SELECT 1: ❌ Network unreachable

Overall: FAIL — host.docker.internal (172.17.0.1) is not reachable from this runner. Service containers may not be running or the host network bridge is unavailable.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-07-03T13:37:05Z

Smoke Test: Copilot PAT Auth — PASS ✅

Test	Result
GitHub MCP connectivity	✅
GitHub.com HTTP	✅
File write/read	✅

Overall: PASS — Auth mode: PAT (COPILOT_GITHUB_TOKEN)

Author: @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 PAT report filed by Smoke Copilot PAT
_{Add label ready-for-aw to run again}

github-actions · 2026-07-03T13:37:35Z

🔬 Smoke Test Results

Test	Status
GitHub MCP Connectivity	✅
GitHub.com HTTP	⚠️ pre-step data unavailable
File Write/Read	⚠️ pre-step data unavailable

Overall: PARTIAL — Copilot engine reachable; pre-computed data not injected (template vars unsubstituted).

Author: @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-07-03T13:38:12Z

🔍 Smoke Test: API Proxy OpenTelemetry Tracing

Scenario	Result	Notes
1. Module Loading	✅	`otel.js` loads successfully; exports: `startRequestSpan`, `setTokenAttributes`, `setBudgetAttributes`, `endSpan`, `endSpanError`, `shutdown`, `isEnabled` + internal helpers
2. Test Suite	✅	45 tests passed, 0 failed across `otel.test.js` and `otel-fanout.test.js`
3. Env Var Forwarding	✅	`api-proxy-env-config.ts` forwards `GH_AW_OTLP_ENDPOINTS`, `OTEL_EXPORTER_OTLP_ENDPOINT`, `OTEL_EXPORTER_OTLP_HEADERS`, `GITHUB_AW_OTEL_TRACE_ID`, `GITHUB_AW_OTEL_PARENT_SPAN_ID`, `OTEL_SERVICE_NAME` to the container
4. Token Tracker Integration	✅	`onUsage` callback exists in `token-tracker-http.js`; invoked with normalized usage data as the OTEL hook point
5. OTEL Diagnostics	✅	No remote endpoint configured → graceful fallback to `FileSpanExporter` writing `/var/log/api-proxy/otel.jsonl`; `isEnabled()` returns `true`

All 5 scenarios pass. OTEL tracing integration is fully functional.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-07-03T13:38:13Z

Smoke Test Results

GitHub MCP: ✅ (Reviewing last 2 merged PRs)
GitHub.com Connectivity: ❌ (Status 000/Failed)
File Writing: ✅
Bash Tool: ✅

Overall Status: FAIL (Connectivity failed)

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini
_{Add label ready-for-aw to run again}

github-actions · 2026-07-03T13:39:50Z

@lpcox
Merged PRs:
${{ steps.smoke-data.outputs.SMOKE_PR_DATA }} ✅
GitHub.com connectivity: ✅
File write/read: ✅
BYOK inference: ✅

Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra

Overall: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)
_{Add label ready-for-aw to run again}

github-actions · 2026-07-03T13:40:32Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	All passed	✅ PASS
Node.js	execa	✅	All passed	✅ PASS
Node.js	p-limit	✅	All passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Build Test Suite for #5866 · 95.4 AIC · ⊞ 6.9K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-03T13:40:40Z

@lpcox

✅ GitHub MCP connectivity
✅ GitHub.com connectivity
✅ File I/O test
✅ BYOK inference

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)

Overall: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)
_{Add label ready-for-aw to run again}

lpcox marked this pull request as ready for review July 3, 2026 12:23

Copilot AI review requested due to automatic review settings July 3, 2026 12:23

Copilot started reviewing on behalf of lpcox July 3, 2026 12:23 View session

Copilot AI reviewed Jul 3, 2026

View reviewed changes

Copilot started work on behalf of lpcox July 3, 2026 13:02 View session

refactor(tests): remove line numbers from test comments/titles

afa94f9

Copilot finished work on behalf of lpcox July 3, 2026 13:04

Copilot AI requested a review from lpcox July 3, 2026 13:04

lpcox added the ready-for-aw label Jul 3, 2026

lpcox temporarily deployed to aoai-model July 3, 2026 13:32 — with GitHub Actions Inactive

github-actions Bot added the smoke-claude label Jul 3, 2026

github-actions Bot added the smoke-copilot-byok label Jul 3, 2026

github-actions Bot added the smoke-copilot-pat label Jul 3, 2026

github-actions Bot mentioned this pull request Jul 3, 2026

[aw] No-Op Runs #5858

Closed

github-actions Bot added the smoke-gemini label Jul 3, 2026

github-actions Bot mentioned this pull request Jul 3, 2026

[aw] Smoke Gemini is missing required tool #5874

Closed

lpcox temporarily deployed to aoai-model July 3, 2026 13:39 — with GitHub Actions Inactive

github-actions Bot added the smoke-copilot-byok-aoai-entra label Jul 3, 2026

lpcox temporarily deployed to aoai-model July 3, 2026 13:39 — with GitHub Actions Inactive

github-actions Bot added the build-test label Jul 3, 2026

github-actions Bot added the smoke-copilot-byok-aoai-apikey label Jul 3, 2026

lpcox merged commit 96d1f42 into main Jul 3, 2026
85 of 88 checks passed

lpcox deleted the test-coverage/host-iptables-chain-branches-415d41dc90615319 branch July 3, 2026 14:50

Uh oh!

Conversation

github-actions Bot commented Jul 3, 2026

Summary

Branches covered

Tests added

Coverage impact

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

lpcox commented Jul 3, 2026

Uh oh!

Copilot AI commented Jul 3, 2026

Uh oh!

github-actions Bot commented Jul 3, 2026

Uh oh!

github-actions Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 3, 2026

Uh oh!

github-actions Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 3, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

github-actions Bot commented Jul 3, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Jul 3, 2026

Uh oh!

github-actions Bot commented Jul 3, 2026

Smoke Test: Services Connectivity

Uh oh!

github-actions Bot commented Jul 3, 2026

Smoke Test: Copilot PAT Auth — PASS ✅

Uh oh!

github-actions Bot commented Jul 3, 2026

🔬 Smoke Test Results

Uh oh!

github-actions Bot commented Jul 3, 2026

github-actions Bot commented Jul 3, 2026 •

edited

Loading

github-actions Bot commented Jul 3, 2026 •

edited

Loading

github-actions Bot commented Jul 3, 2026 •

edited

Loading

github-actions Bot commented Jul 3, 2026 •

edited

Loading

github-actions Bot commented Jul 3, 2026 •

edited

Loading

github-actions Bot commented Jul 3, 2026 •

edited

Loading

github-actions Bot commented Jul 3, 2026 •

edited

Loading

github-actions Bot commented Jul 3, 2026 •

edited

Loading

github-actions Bot commented Jul 3, 2026 •

edited

Loading

github-actions Bot commented Jul 3, 2026 •

edited

Loading

github-actions Bot commented Jul 3, 2026 •

edited

Loading

github-actions Bot commented Jul 3, 2026 •

edited

Loading

github-actions Bot commented Jul 3, 2026 •

edited

Loading