Compiler: enforce ARC/DinD daemon-visible paths and AWF v0.27.20 minimum#42815
Conversation
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
|
Hey
If you'd like a hand completing the implementation, you can assign this prompt to your coding agent:
|
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Config vs CLI flag recommendationsAfter auditing the AWF config file schema ( ✅ Already supported in config — use these instead of CLI flags
❌ CLI-only (gap) — requires AWF change
Recommended config shape for ARC/DinD{
"runner": { "topology": "arc-dind" },
"container": {
"dockerHostPathPrefix": "/host",
"containerWorkDir": "/home/runner/_work/repo/repo"
},
"logging": {
"proxyLogsDir": "${RUNNER_TEMP}/gh-aw/sandbox/firewall/logs",
"auditDir": "${RUNNER_TEMP}/gh-aw/sandbox/firewall/audit"
}
}Until github/gh-aw-firewall#5754 ships, awf \
--mount "${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro" \
--mount "${RUNNER_TEMP}/gh-aw/home:${RUNNER_TEMP}/gh-aw/home:rw" \
--mount "${RUNNER_TEMP}/gh-aw/sandbox/agent:${RUNNER_TEMP}/gh-aw/sandbox/agent:rw"Security noteThe |
…ix to AWF config
Move CLI flags that AWF already supports in its config schema into the
JSON config file instead of passing them as CLI arguments:
- logging.proxyLogsDir replaces --proxy-logs-dir (static path)
- logging.auditDir replaces --audit-dir (static path)
- container.dockerHostPathPrefix set when runner.topology is arc-dind
For ARC/DinD, --proxy-logs-dir and --audit-dir CLI flags remain as
runtime overrides because they use ${RUNNER_TEMP} paths that require
shell expansion (CLI overrides config per AWF precedence rules).
The --mount and --container-workdir flags remain as CLI arguments since
--mount requires gh-aw-firewall#5754 and --container-workdir needs
runtime shell variable expansion.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
This PR updates the compiler/runtime generation for runner.topology: arc-dind to use Docker-daemon-visible paths (under ${RUNNER_TEMP}/gh-aw) and enforces a minimum AWF version (v0.27.20) to avoid known split-filesystem mount failures.
Changes:
- Bump default AWF/firewall version to
v0.27.20and add anarc-dindminimum version gate with validation + tests. - Redirect ARC/DinD runtime-critical paths (tool cache, Copilot binary path selection, models path export, and overlay mounts) toward
${RUNNER_TEMP}/gh-aw. - Move static proxy/audit logging dirs into the generated AWF config JSON (with ARC/DinD intended to override via CLI), and refresh golden/lock fixtures accordingly.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/runner_topology_validation.go | Add ARC/DinD minimum AWF version enforcement during validation. |
| pkg/workflow/runner_topology_validation_test.go | Test coverage for the new ARC/DinD minimum-version gate. |
| pkg/constants/version_constants.go | Bump default firewall/AWF version and introduce AWFArcDindMinVersion. |
| pkg/workflow/compiler_yaml_main_job.go | Redirect RUNNER_TOOL_CACHE to ${RUNNER_TEMP}/gh-aw/tool-cache for ARC/DinD. |
| pkg/workflow/compiler_yaml_main_job_test.go | Test for ARC/DinD tool-cache redirection behavior. |
| pkg/workflow/copilot_engine_execution.go | Use ${RUNNER_TEMP}/gh-aw/bin/copilot when sandboxed + ARC/DinD. |
| pkg/workflow/awf_helpers.go | Add ARC/DinD path rewriting, overlay mounts, models path export selection, and logging flag/config changes. |
| pkg/workflow/awf_helpers_test.go | Add/adjust tests for ARC/DinD path prefix, models export, and rewriting helpers. |
| pkg/workflow/awf_config.go | Extend AWF config JSON schema emission to include logging and container docker-host-path-prefix. |
| pkg/workflow/awf_config_test.go | Assert logging section + dockerHostPathPrefix presence in generated config JSON. |
| pkg/workflow/firewall_args_test.go | Add ARC/DinD assertions for daemon-visible mounts/paths and Copilot binary relocation. |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden | Update expected AWF version/image tags and generated command/config shape. |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden | Update expected AWF version/image tags and generated command/config shape. |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/playwright-cli-mode.golden | Update expected AWF version/image tags and generated command/config shape. |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden | Update expected AWF version/image tags and generated command/config shape. |
| pkg/workflow/testdata/TestWasmGolden_AllEngines/pi.golden | Update expected AWF version/image tags and generated command/config shape. |
| pkg/workflow/testdata/TestWasmGolden_AllEngines/gemini.golden | Update expected AWF version/image tags and generated command/config shape. |
| pkg/workflow/testdata/TestWasmGolden_AllEngines/copilot.golden | Update expected AWF version/image tags and generated command/config shape. |
| pkg/workflow/testdata/TestWasmGolden_AllEngines/codex.golden | Update expected AWF version/image tags and generated command/config shape. |
| pkg/workflow/testdata/TestWasmGolden_AllEngines/claude.golden | Update expected AWF version/image tags and generated command/config shape. |
| .github/workflows/test-workflow.lock.yml | Regenerated lock with updated AWF version/image tags and config JSON shape. |
| .github/workflows/example-permissions-warning.lock.yml | Regenerated lock with updated AWF version/image tags and config JSON shape. |
| .github/workflows/codex-github-remote-mcp-test.lock.yml | Regenerated lock with updated AWF version/image tags and config JSON shape. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 32/278 changed files
- Comments generated: 4
- Review effort level: Low
| // Logging paths: static values are now in config (logging.proxyLogsDir, logging.auditDir). | ||
| // For ARC/DinD, CLI flags with ${RUNNER_TEMP} paths override the config at runtime. | ||
| if isArcDindTopology(config.WorkflowData) { | ||
| awfArgs = append(awfArgs, "--proxy-logs-dir", awfArcDindProxyLogsDirExpr) | ||
| awfArgs = append(awfArgs, "--audit-dir", awfArcDindAuditDirExpr) | ||
| } |
| // still overrides this at runtime, but setting it in config provides a static baseline. | ||
| if isArcDindTopology(config.WorkflowData) { | ||
| container.DockerHostPathPrefix = string(constants.TmpGhAwDir) | ||
| awfConfigLog.Printf("Container section: dockerHostPathPrefix=%s (arc-dind topology)", constants.TmpGhAwDir) | ||
| } |
| if !strings.Contains(stepContent, `--proxy-logs-dir '${RUNNER_TEMP}/gh-aw/sandbox/firewall/logs'`) { | ||
| t.Error("Expected proxy logs dir to be daemon-visible under ${RUNNER_TEMP}/gh-aw") | ||
| } |
| if !strings.Contains(stepContent, `--audit-dir '${RUNNER_TEMP}/gh-aw/sandbox/firewall/audit'`) { | ||
| t.Error("Expected audit dir to be daemon-visible under ${RUNNER_TEMP}/gh-aw") | ||
| } |
|
@copilot run pr-finisher skill |
🤖 PR Triage
Score breakdown: Impact 40 + Urgency 22 + Quality 12 Rationale: Compiler-critical path change fixing ARC/DinD daemon-visible path issues; 30 lock files regenerated. CI partially running (canary-go passing). Copilot reviewer has commented. Needs expedited human review to unblock ARC topology users.
|
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
|
💫 TO BE CONTINUED... Smoke Claude failed! Our hero faces unexpected challenges... |
|
✅ All tools validated successfully! Agent Container Smoke Test confirms agent container is ready. |
|
🚀 Smoke Pi MISSION COMPLETE! Pi delivered. 🥧 |
|
🚀 Smoke Antigravity MISSION COMPLETE! Antigravity has spoken. ✨ |
|
🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation... |
|
📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing... |
|
📰 BREAKING: Smoke Copilot - AOAI (apikey) is now investigating this pull request. Sources say the story is developing... |
|
📰 BREAKING: Smoke Copilot - AOAI (Entra) is now investigating this pull request. Sources say the story is developing... |
Smoke Test Gemini\n- GitHub Fetch: ✅\n- Web Fetch: ✅\n- File Write: ✅\n- Bash Execution: ✅\n- Build gh-aw: ❌\n\nOverall Status: FAILWarning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "localhost"See Network Configuration for more information.
|
Agent Container Tool Check
Result: 12/12 tools available ✅ Overall Status: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
|
Smoke test results:
Warning Firewall blocked 6 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
|
|
Compiler: enforce ARC/DinD daemon-visible paths and AWF v0.27.20 minimum Warning Firewall blocked 6 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
|
Comment MemoryNote This comment is managed by comment memory.It stores persistent context for this thread in the code block at the top of this comment. Warning Firewall blocked 6 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Smoke review done. Tools spoke.
Warning
Firewall blocked 6 domains
The following domains were blocked by the firewall during workflow execution:
accounts.google.comandroid.clients.google.comclients2.google.comcontentautofill.googleapis.comsafebrowsingohttpgateway.googleapis.comwww.google.com
To allow these domains, add them to the
network.allowedlist in your workflow frontmatter:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
📰 BREAKING: Report filed by Smoke Copilot · 675.6 AIC · ⌖ 16.2 AIC · ⊞ 19.2K
Comment /smoke-copilot to run again
Add label smoke to run again
|
🎉 This pull request is included in a new release. Release: |
runner.topology: arc-dindcurrently assumes host paths that are not visible to the DinD daemon (/tmp,/usr/local/bin, hosted toolcache), which can break container startup and runtime behavior. This change redirects ARC/DinD runtime-critical paths to${RUNNER_TEMP}/gh-awand aligns compiler output with split-filesystem requirements while preserving least-write-surface behavior.ARC/DinD path redirection in AWF command generation
--docker-host-path-prefixto${RUNNER_TEMP}/gh-aw./tmp/gh-aw/...references to${RUNNER_TEMP}/gh-aw/...in ARC/DinD mode.HOME=${RUNNER_TEMP}/gh-aw/homein ARC/DinD engine command execution.${RUNNER_TEMP}/gh-aw/sandbox/firewall/logs${RUNNER_TEMP}/gh-aw/sandbox/firewall/audit${RUNNER_TEMP}/gh-aw/models.jsonfor ARC/DinD model path export.Mount topology: ro base + rw overlays
${RUNNER_TEMP}/gh-awmounted read-only.${RUNNER_TEMP}/gh-aw/home${RUNNER_TEMP}/gh-aw/sandbox/agentCopilot binary/tool-cache relocation for ARC/DinD
${RUNNER_TEMP}/gh-aw/bin/copilotfor sandboxed Copilot execution when topology is ARC/DinD.RUNNER_TOOL_CACHEto${RUNNER_TEMP}/gh-aw/tool-cachein main job generation for ARC/DinD.Version gate for ARC/DinD safety
v0.27.20.v0.27.20) and validation error when an older effective AWF version is pinned.