[Test Coverage] branch coverage: log-parser, workdir-setup, network-setup, preflight by github-actions[bot] · Pull Request #5923 · github/gh-aw-firewall

github-actions · 2026-07-05T09:27:18Z

Summary

Adds 30 new unit tests targeting previously uncovered branches in four security-relevant source files.

Files covered

File	Uncovered branches targeted
`src/logs/log-parser.ts`	`extractDomain` non-numeric port suffix (CONNECT and Host header); `parseAuditJsonlLine` missing method/decision, non-numeric dest port, invalid ISO timestamp, `ts`-only format, no timestamp
`src/workdir-setup.ts`	`ensureDirectory`/`assertRealDirectory` symlink and non-directory throws; `createMissingOwnedDirectorySegments` file-segment throw; `prepareLogDirectories` mcp-logs already-exists else branch; `prepareChrootHomeMounts` runnerToolCachePath outside home warn
`src/commands/network-setup.ts`	non-Error thrown by `parseDnsServers`, `detectUpstreamProxy`, `parseProxyUrl`; `no_proxy` env var propagation
`src/commands/preflight.ts`	non-Error in `validateAllowedDomains`; `blockDomains` option parsing; `blockDomainsFile` read failures (Error + non-Error); domain validation failure; deduplication

Test results

All 30 new tests pass. All existing tests (97) continue to pass.

Notes

No source changes; test-only PR
Uses jest.mock for all fs/process dependencies
Real filesystem used for symlink/non-directory tests in workdir-setup

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Test Coverage Improver · 395.9 AIC · ⊞ 5.3K · ◷

…p, preflight Cover 30 previously uncovered branches across four source files: - logs/log-parser.ts: extractDomain non-numeric port suffix in CONNECT and Host header; parseAuditJsonlLine missing method/decision fields, non-numeric dest port, invalid ISO timestamp with ts fallback, ts-only legacy format, and missing timestamp - workdir-setup.ts: ensureDirectory and assertRealDirectory symlink and non-directory error paths; createMissingOwnedDirectorySegments file- segment error; prepareLogDirectories mcp-logs already-exists else branch; prepareChrootHomeMounts runnerToolCachePath outside home warn - commands/network-setup.ts: non-Error thrown by parseDnsServers and detectUpstreamProxy/parseProxyUrl; no_proxy env var propagation - commands/preflight.ts: non-Error in validateAllowedDomains; block- domains option and file parsing; non-Error in blockDomainsFile; domain validation failure; deduplication Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

This PR adds a new Jest test suite intended to improve branch coverage for several security-relevant modules (log parsing, workdir setup, network setup, and preflight option validation) without changing production code.

Changes:

Add targeted branch-coverage unit tests for parseLogLine / parseAuditJsonlLine edge cases.
Add workdir setup tests covering symlink/non-directory error paths and runner tool-cache “outside home” warning path.
Add network/preflight tests for non-Error thrown values, no_proxy propagation, and blocked-domain parsing/validation/deduping.

Show a summary per file

File	Description
src/coverage-improvements.test.ts	New consolidated test file covering previously-uncovered branches across log parsing, workdir setup, network setup, and preflight validation.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 1/1 changed files
Comments generated: 2
Review effort level: Low

+
+// ─── workdir-setup.ts ─────────────────────────────────────────────────────────
+
+// Use real fs (not the mock factory) since we need symlink/non-dir setup.


+
+// ─── commands/network-setup.ts ────────────────────────────────────────────────
+
+jest.mock('./commands/network-setup', () => jest.requireActual('./commands/network-setup'));


lpcox · 2026-07-05T13:14:46Z

@copilot address review feedback

Copilot · 2026-07-05T13:16:44Z

@copilot address review feedback

Done in the latest commit:

Fixed the misleading comment at line 206 — it now accurately states the fs mock factory is in use.
Removed the redundant jest.mock('./commands/network-setup', () => jest.requireActual(...)) line at line 428.

All 30 tests continue to pass.

github-actions · 2026-07-05T13:18:52Z

✅ Copilot review passed with no inline comments.

@github-actions[bot] Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-07-05T13:19:12Z

✅ Smoke Gemini completed. All facets verified. 💎

Gemini smoke test completed. Status: FAIL. Results reported in PR #5923.

github-actions · 2026-07-05T13:19:13Z

✅ Build Test Suite completed successfully!

github-actions · 2026-07-05T13:19:13Z

✅ Contribution Check completed successfully!

PR #5923 follows the applicable CONTRIBUTING.md guidelines; no review comment needed.

github-actions · 2026-07-05T13:19:13Z

✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓

github-actions · 2026-07-05T13:19:13Z

✅ Smoke Claude passed

github-actions · 2026-07-05T13:19:13Z

✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓

github-actions · 2026-07-05T13:19:14Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

github-actions · 2026-07-05T13:19:16Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-07-05T13:19:16Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

github-actions · 2026-07-05T13:19:16Z

Chroot tests failed Smoke Chroot failed - See logs for details.

github-actions · 2026-07-05T13:19:18Z

🔑 Smoke Copilot PAT PAT auth validated. All systems operational. ✅

github-actions · 2026-07-05T13:19:18Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-07-05T13:19:19Z

🔌 Smoke Services — All services reachable! ✅

github-actions · 2026-07-05T13:19:21Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-07-05T13:20:38Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	98.72%	98.81%	📈 +0.09%
Statements	98.64%	98.73%	📈 +0.09%
Functions	99.58%	99.58%	➡️ +0.00%
Branches	94.69%	95.10%	📈 +0.41%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
`src/workdir-setup.ts`	93.2% → 97.5% (+4.23%)	93.2% → 97.5% (+4.23%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-07-05T13:23:30Z

✅ Smoke Test: Copilot BYOK (Direct) Mode - PASS

✅ GitHub MCP connectivity
✅ GitHub.com connectivity
✅ File write/read test
✅ BYOK inference (agent → api-proxy → api.githubcopilot.com)

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy sidecar.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-07-05T13:23:59Z

Smoke Test: Claude Engine Validation

Check	Result
API Status	✅ PASS
GH Check	✅ PASS
File Status	✅ PASS

Overall Result: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Smoke Claude for #5923 · 35.5 AIC · ⊞ 3.3K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-05T13:24:29Z

Smoke Test Results

Test	Status
GitHub MCP connectivity	✅
GitHub.com HTTP	✅ 200
File write/read	✅

Overall: PASS

Author: @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-07-05T13:24:30Z

🔬 Smoke Test: Copilot PAT Auth

Test	Status
GitHub MCP connectivity	✅
GitHub.com HTTP	✅
File write/read	✅

Overall: PASS
Auth mode: PAT (COPILOT_GITHUB_TOKEN)
cc @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 PAT report filed by Smoke Copilot PAT
_{Add label ready-for-aw to run again}

github-actions · 2026-07-05T13:24:36Z

Pre-fetched PR data: ${{ steps.smoke-data.outputs.SMOKE_PR_DATA }} ✅
GitHub.com connectivity: ✅
File I/O: ✅
Direct BYOK inference: ✅
Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)
Overall: PASS
@lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)
_{Add label ready-for-aw to run again}

github-actions · 2026-07-05T13:24:36Z

@lpcox

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)

MCP PR Data: ✅
GitHub.com connectivity: ✅
File write/read: ✅
BYOK inference: ✅

Status: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)
_{Add label ready-for-aw to run again}

github-actions · 2026-07-05T13:24:52Z

Smoke Test: Services Connectivity

Redis PING: ❌ Network is unreachable
PostgreSQL pg_isready: ❌ No response
PostgreSQL SELECT 1: ❌ Network is unreachable

Result: FAIL — host.docker.internal (172.17.0.1) is unreachable from this runner. Service containers are not accessible.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-07-05T13:24:53Z

Smoke test result: FAIL (Connectivity issues)

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini
_{Add label ready-for-aw to run again}

github-actions · 2026-07-05T13:25:02Z

Reviewed merged PRs:\n- refactor(api-proxy): centralize auth-header construction in shared helpers\n- refactor: split postprocess-smoke-workflows.ts into focused modules\n\nChecks:\n- GitHub query: ✅\n- Playwright: ✅\n- File write: ✅\n- Build: ✅\n\nOverall: PASS

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

awmgmcpg
registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

github-actions · 2026-07-05T13:27:30Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	All passed	✅ PASS
Node.js	execa	✅	All passed	✅ PASS
Node.js	p-limit	✅	All passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Build Test Suite for #5923 · 54.8 AIC · ⊞ 6.9K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-05T13:32:48Z

📡 OTel Tracing Smoke Test Results

Scenario	Status	Detail
1. Module Loading	✅	`otel.js` loads successfully, `isEnabled: true`, exports 13 functions
2. Test Suite	✅	59 tests passed, 0 failed (2 suites: `otel.test.js`, `otel-fanout.test.js`)
3. Env Var Forwarding	⚠️	Not in `api-proxy-service.ts` directly; OTEL vars forwarded via `api-proxy-env-config.ts` — expected during development
4. Token Tracker Integration	✅	`onUsage` callback present in `token-tracker-http.js`
5. OTEL Diagnostics	i️	No span file found — api-proxy OTEL not active in this run (no live LLM calls made)

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

lpcox requested a review from Copilot July 5, 2026 12:49

Copilot started reviewing on behalf of lpcox July 5, 2026 12:50 View session

Copilot AI reviewed Jul 5, 2026

View reviewed changes

Copilot started work on behalf of lpcox July 5, 2026 13:15 View session

lpcox marked this pull request as ready for review July 5, 2026 13:16

fix: address PR review feedback in coverage-improvements.test.ts

6111c2c

Copilot finished work on behalf of lpcox July 5, 2026 13:16

Copilot AI requested a review from lpcox July 5, 2026 13:16

lpcox added the ready-for-aw label Jul 5, 2026

lpcox temporarily deployed to aoai-model July 5, 2026 13:19 — with GitHub Actions Inactive

github-actions Bot added the smoke-copilot-byok label Jul 5, 2026

github-actions Bot added the smoke-claude label Jul 5, 2026

lpcox temporarily deployed to aoai-model July 5, 2026 13:24 — with GitHub Actions Inactive

github-actions Bot added smoke-copilot smoke-copilot-pat labels Jul 5, 2026

github-actions Bot added smoke-copilot-byok-aoai-entra smoke-copilot-byok-aoai-apikey labels Jul 5, 2026

lpcox temporarily deployed to aoai-model July 5, 2026 13:24 — with GitHub Actions Inactive

github-actions Bot added the smoke-codex label Jul 5, 2026

github-actions Bot mentioned this pull request Jul 5, 2026

[aw] No-Op Runs #5883

Open

github-actions Bot added the build-test label Jul 5, 2026

lpcox merged commit cc58654 into main Jul 5, 2026
86 of 88 checks passed

lpcox deleted the test/branch-coverage-improvements-1165faca16cdc99a branch July 5, 2026 14:36

github-actions Bot mentioned this pull request Jul 5, 2026

refactor(tests): split security-module-coverage.test.ts into per-module test files #5928

Merged


		// ─── workdir-setup.ts ─────────────────────────────────────────────────────────

		// Use real fs (not the mock factory) since we need symlink/non-dir setup.


		// ─── commands/network-setup.ts ────────────────────────────────────────────────

		jest.mock('./commands/network-setup', () => jest.requireActual('./commands/network-setup'));

Uh oh!

Conversation

github-actions Bot commented Jul 5, 2026

Summary

Files covered

Test results

Notes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

lpcox commented Jul 5, 2026

Uh oh!

Copilot AI commented Jul 5, 2026

Uh oh!

github-actions Bot commented Jul 5, 2026

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 5, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

github-actions Bot commented Jul 5, 2026

Uh oh!

github-actions Bot commented Jul 5, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Jul 5, 2026

Smoke Test Results

Uh oh!

github-actions Bot commented Jul 5, 2026

🔬 Smoke Test: Copilot PAT Auth

Uh oh!

github-actions Bot commented Jul 5, 2026

Uh oh!

github-actions Bot commented Jul 5, 2026

Uh oh!

github-actions Bot commented Jul 5, 2026

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading

github-actions Bot commented Jul 5, 2026 •

edited

Loading