Fix rootless cleanup diagnostics obscuring startup failures by Copilot · Pull Request #6935 · github/gh-aw-firewall

Copilot · 2026-08-04T21:20:57Z

Summary

reuse the rootless artifact permission-error classifier for direct cleanup chmod failures
demote expected EPERM/EACCES cleanup failures to concise debug output
retain warnings for unexpected cleanup failures
verify cleanup leaves the primary startup error as the last prominent diagnostic

…6924) * Initial plan * fix(api-proxy): preserve explicit provider models * fix: preserve alias semantics during nested resolution Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2e281ab2-e1f4-42a2-9798-47863526dc60 * ci: accept unreachable npm CLI advisories Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2e281ab2-e1f4-42a2-9798-47863526dc60 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Landon Cox <landon.cox@microsoft.com> Copilot-Session: 2e281ab2-e1f4-42a2-9798-47863526dc60

… auth (#6923) * Initial plan * feat: add OTLP workload identity auth * fix(api-proxy): bind OTLP WIF to one endpoint Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2e281ab2-e1f4-42a2-9798-47863526dc60 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Landon Cox <landon.cox@microsoft.com> Copilot-Session: 2e281ab2-e1f4-42a2-9798-47863526dc60

…6918) Upgrade the gh-aw extension to the latest pre-release (v0.84.3) and recompile all agentic workflows. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Reuse the rootless artifact permission classification for direct cleanup chmod failures. Add coverage for diagnostic ordering and unexpected failures. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

… into fix-rootless-cleanup-diagnostics

github-actions · 2026-08-04T22:43:53Z

Documentation Preview

Documentation build failed for this PR. View logs.

Built from commit 97cdc20

lpcox · 2026-08-04T22:44:18Z

Superseded by a clean PR branch based on the current main branch; the implementation is unchanged.

github-actions · 2026-08-04T22:45:53Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	98.94%	98.97%	📈 +0.03%
Statements	98.83%	98.85%	📈 +0.02%
Functions	99.19%	99.19%	➡️ +0.00%
Branches	95.15%	95.14%	📉 -0.01%

📁 Per-file Coverage Changes (3 files)

File	Lines (Before → After)	Statements (Before → After)
`src/artifact-preservation.ts`	96.3% → 96.3% (+0.07%)	96.3% → 96.4% (+0.07%)
`src/artifact-permissions.ts`	97.4% → 97.9% (+0.48%)	97.4% → 97.9% (+0.48%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copilot

🟡 Not ready to approve

Standalone EPERM/EACCES codes remain misclassified, and unrelated security-sensitive changes exceed the described scope.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

Addresses #6934 by demoting expected rootless cleanup permission failures, but also includes substantial unrelated telemetry, model-routing, security, and workflow changes.

Changes:

Reuses the artifact permission-error classifier during cleanup and adds regression coverage.
Adds GCP workload identity authentication for OTLP exports.
Changes model alias precedence and regenerates several workflows.

File summaries

File	Description
`src/services/api-proxy-env-config.ts`	Forwards OTLP workload identity credentials.
`src/services/api-proxy-env-config.test.ts`	Tests OTLP credential forwarding.
`src/artifact-preservation.ts`	Demotes benign cleanup permission failures.
`src/artifact-preservation-errors.test.ts`	Tests cleanup diagnostic severity.
`src/artifact-permissions.ts`	Extracts the shared permission-error classifier.
`docs/api-proxy-sidecar.md`	Documents OTLP workload identity federation.
`containers/api-proxy/test-helpers/otel-test-utils.js`	Resets new OTLP environment variables.
`containers/api-proxy/server.startup-model-validation.test.js`	Tests direct model precedence.
`containers/api-proxy/otel.js`	Connects workload identity to OTLP exporters.
`containers/api-proxy/otel-workload-identity.test.js`	Tests workload identity configuration.
`containers/api-proxy/otel-workload-identity.js`	Implements OTLP workload identity.
`containers/api-proxy/otel-fanout.test.js`	Tests endpoint-specific authentication.
`containers/api-proxy/otel-exporters.js`	Supports dynamic export headers.
`containers/api-proxy/model-resolver.test.js`	Tests alias/model name collisions.
`containers/api-proxy/model-resolver.js`	Prioritizes explicit provider models.
`containers/api-proxy/key-validation.js`	Updates model resolution diagnostics.
`containers/api-proxy/Dockerfile`	Packages the workload identity module.
`.grype.yaml`	Adds vulnerability exceptions.
`.github/workflows/smoke-docker-sbx.lock.yml`	Regenerates the Docker sbx workflow.
`.github/workflows/smoke-bounded-queries.lock.yml`	Regenerates bounded-query smoke coverage.
`.github/workflows/smoke-bounded-queries-sbx.lock.yml`	Regenerates sbx bounded-query coverage.
`.github/workflows/smoke-bounded-queries-gvisor.lock.yml`	Regenerates gVisor bounded-query coverage.
`.github/workflows/smoke-bounded-agents.lock.yml`	Regenerates bounded-agent coverage.
`.github/workflows/smoke-bounded-agents-gvisor.lock.yml`	Regenerates gVisor bounded-agent coverage.
`.github/workflows/auth-doctor-updater.lock.yml`	Refreshes action pins and schedule.
`.github/skills/agentic-workflows/SKILL.md`	Adds an observability guidance reference.
`.github/aw/actions-lock.json`	Corrects setup action SHAs.

Review details

Files reviewed: 30/84 changed files
Comments generated: 4
Review effort level: Balanced

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

@@ -163,6 +163,7 @@ function buildProxyRoutingEnv(networkConfig: NetworkConfig): Record<string, stri
 * api-proxy spans are children of the workflow trace.
 */
 function buildOtelEnv(): Record<string, string> {
+  const workloadIdentityConfigured = Boolean(process.env.GH_AW_OTLP_WORKLOAD_IDENTITY?.trim());


+  return /(?:^|\n)(?:chown|chmod):.*(?:operation not permitted|permission denied|\bEPERM\b|\bEACCES\b)/i.test(
+    details.join('\n'),
+  );


+  # AWF does not pass remote input to npm's brace expansion code. npm 12.0.1,
+  # the latest official release as of 2026-08-04, still bundles 5.0.7; retain
+  # this acceptance only until an official npm release bundles >=5.0.9.


+  #   No official npm release contains the fix yet: npm 12.0.1, the latest
+  #   release as of 2026-08-04, still bundles ip-address 10.2.0. Hand-patching
+  #   npm's internal dependency tree would replace a verified upstream artifact
+  #   with a locally modified distribution.


github-actions · 2026-08-04T23:11:40Z

⏳ Copilot review left inline comments.

@copilot To proceed:

Ask @copilot to address the review feedback (reply to this comment or the review thread)
Once the fix is pushed, add the ready-for-aw label to trigger agentic CI smoke tests

Initial plan

ae13a3e

Copilot AI assigned Copilot and lpcox Aug 4, 2026

Copilot AI linked an issue Aug 4, 2026 that may be closed by this pull request

Rootless cleanup chmod warning obscures the primary AWF startup failure #6934

Closed

Copilot started work on behalf of lpcox August 4, 2026 21:33 View session

Copilot stopped work on behalf of lpcox due to an error August 4, 2026 21:37
An unexpected error occurred. For more details, see the detailed logs in GitHub Actions.

Copilot AI requested a review from lpcox August 4, 2026 21:37

Copilot AI and others added 5 commits August 4, 2026 15:23

chore: upgrade gh-aw to v0.84.3 pre-release and recompile workflows (#…

8188dcb

…6918) Upgrade the gh-aw extension to the latest pre-release (v0.84.3) and recompile all agentic workflows. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

fix: demote benign cleanup permission errors

1012464

Reuse the rootless artifact permission classification for direct cleanup chmod failures. Add coverage for diagnostic ordering and unexpected failures. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Merge remote-tracking branch 'origin/copilot/fix-chmod-warning-issue'…

093a634

… into fix-rootless-cleanup-diagnostics

lpcox changed the title ~~[WIP] Fix rootless cleanup chmod warning obscuring AWF startup failure~~ Fix rootless cleanup diagnostics obscuring startup failures Aug 4, 2026

lpcox marked this pull request as ready for review August 4, 2026 22:43

Copilot AI balanced review requested due to automatic review settings August 4, 2026 22:43

Copilot started reviewing on behalf of lpcox August 4, 2026 22:44 View session

lpcox closed this Aug 4, 2026

Copilot AI reviewed Aug 4, 2026

View reviewed changes

lpcox had a problem deploying to aoai-model August 4, 2026 23:11 — with GitHub Actions Failure

lpcox temporarily deployed to aoai-model August 4, 2026 23:13 — with GitHub Actions Inactive

lpcox temporarily deployed to aoai-model August 4, 2026 23:14 — with GitHub Actions Inactive

This was referenced Aug 4, 2026

fix: demote benign rootless cleanup errors #6939

Merged

feat(cli): add API proxy reflection mode #6936

Merged

Navigation Menu

Uh oh!

Fix rootless cleanup diagnostics obscuring startup failures - #6935

Fix rootless cleanup diagnostics obscuring startup failures#6935
lpcox with Copilot wants to merge 6 commits into
mainfrom
copilot/fix-chmod-warning-issue

Copilot AI commented Aug 4, 2026 •

edited by lpcox

Loading

Uh oh!

github-actions Bot commented Aug 4, 2026

Uh oh!

lpcox commented Aug 4, 2026

Uh oh!

github-actions Bot commented Aug 4, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Aug 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Copilot AI commented Aug 4, 2026 • edited by lpcox Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

github-actions Bot commented Aug 4, 2026

Documentation Preview

Uh oh!

lpcox commented Aug 4, 2026

Uh oh!

github-actions Bot commented Aug 4, 2026

⚠️ Coverage Regression Detected

Overall Coverage

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Not ready to approve

Uh oh!

github-actions Bot commented Aug 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Aug 4, 2026 •

edited by lpcox

Loading