fix(arc-dind): mount workspace correctly and unify artifact roots#43222
Conversation
Bug A: The agent sees an empty workspace because dockerHostPathPrefix
translates the workspace mount source to a non-existent path. With
sysroot-stage active, the Docker daemon can see all needed paths via:
- Shared work volume (/home/runner/_work/) for workspace & RUNNER_TEMP
- Sysroot named volume for system binaries
- Kernel VFS for /dev, /sys
Remove dockerHostPathPrefix from the AWF config — it's unnecessary and
harmful when sysroot provides all system paths.
Bug B: The agent artifact upload spans two path roots (/tmp/gh-aw/ and
${{ runner.temp }}/gh-aw/), causing upload-artifact to compute '/' as
the common ancestor. This creates a nested directory layout that breaks
downstream artifact downloads (detection job can't find agent_output.json).
Fix by:
1. Rewriting all /tmp/gh-aw/ artifact paths to ${{ runner.temp }}/gh-aw/
2. Adding a consolidation step that copies /tmp/gh-aw/ contents to the
runner.temp location before upload
Fixes: gh-aw#34896
There was a problem hiding this comment.
Pull request overview
This pull request fixes ARC/DinD runtime issues by (1) stopping emission of dockerHostPathPrefix in the AWF config (avoids translating the workspace mount source to a non-existent host path), and (2) unifying agent artifact roots by rewriting /tmp/gh-aw/... artifact paths to ${{ runner.temp }}/gh-aw/... and adding a consolidation step prior to upload.
Changes:
- Removed
dockerHostPathPrefixemission for ARC/DinD AWF config generation, and updated the corresponding unit test. - Added ARC/DinD artifact-path rewriting (
/tmp/gh-aw/...→${{ runner.temp }}/gh-aw/...) to ensure a single artifact root. - Added an ARC/DinD consolidation step to copy
/tmp/gh-aw/contents into${RUNNER_TEMP}/gh-aw/before unified artifact upload, plus unit tests for the rewrite helper.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/compiler_yaml_main_job.go | Rewrites ARC/DinD artifact paths to a single root and emits a consolidation step before the unified upload. |
| pkg/workflow/awf_config.go | Stops emitting dockerHostPathPrefix for ARC/DinD to prevent empty-workspace behavior. |
| pkg/workflow/awf_config_test.go | Updates ARC/DinD test expectation to assert dockerHostPathPrefix is not present. |
| pkg/workflow/arc_dind_artifacts.go | Introduces ARC/DinD artifact path rewrite helper and YAML emission for consolidation step. |
| pkg/workflow/arc_dind_artifacts_test.go | Adds unit tests validating ARC/DinD path rewrite behavior. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 5/5 changed files
- Comments generated: 1
- Review effort level: Low
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
|
🚀 Smoke Gemini MISSION COMPLETE! Gemini has spoken. ✨ |
|
✅ All tools validated successfully! Agent Container Smoke Test confirms agent container is ready. |
|
🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨ |
|
🌑 The shadows whisper... Smoke Codex failed to deliver outputs. The oracle requires further meditation... |
|
🚀 Smoke Antigravity MISSION COMPLETE! Antigravity has spoken. ✨ |
|
🚀 Smoke Pi MISSION COMPLETE! Pi delivered. 🥧 Smoke test completed; created issue summary. PR comment/label skipped because workflow lacks triggering PR context for safeoutputs despite pull-request-number metadata. |
|
📰 BREAKING: Smoke Copilot - AOAI (Entra) is now investigating this pull request. Sources say the story is developing... |
|
📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing... |
|
📰 BREAKING: Smoke Copilot - AOAI (apikey) is now investigating this pull request. Sources say the story is developing... |
Agent Container Tool Check
Result: 12/12 tools available ✅ Overall Status: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
Smoke Test Results
Overall status: FAIL Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "localhost"See Network Configuration for more information.
|
|
Caution agentic threat detected DetailsThe threat detection engine failed to produce results. Review the workflow run logs for details. Pull request created: #43228
|
Comment MemoryNote This comment is managed by comment memory.It stores persistent context for this thread in the code block at the top of this comment. Warning Firewall blocked 6 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
|
|
Smoke test results for PR 43222:
Overall Status: FAIL
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
💥 Automated smoke test review - all systems nominal!
Warning
Firewall blocked 6 domains
The following domains were blocked by the firewall during workflow execution:
accounts.google.comandroid.clients.google.comclients2.google.comcontentautofill.googleapis.comsafebrowsingohttpgateway.googleapis.comwww.google.com
To allow these domains, add them to the
network.allowedlist in your workflow frontmatter:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
💥 [THE END] — Illustrated by Smoke Claude · 94.2 AIC · ⌖ 31.4 AIC · ⊞ 8.7K
Comment /smoke-claude to run again
| // artifact upload. This prevents upload-artifact from computing "/" as the common | ||
| // ancestor (which happens when paths span both /tmp/gh-aw/ and the runner.temp tree), | ||
| // causing a nested directory layout that breaks downstream artifact downloads. | ||
| func rewriteTmpGhAwPathsForArcDind(paths []string) []string { |
There was a problem hiding this comment.
Nice helper — the doc comment clearly explains why the single-root rewrite is needed. Consider a table-driven test for edge cases like empty input.
| yaml.WriteString(" if: always()\n") | ||
| yaml.WriteString(" shell: bash\n") | ||
| yaml.WriteString(" run: |\n") | ||
| // Use rsync-like cp to merge /tmp/gh-aw/ into ${RUNNER_TEMP}/gh-aw/ without |
There was a problem hiding this comment.
The --no-clobber fallback chain is pragmatic. A brief inline note on why cp is preferred over rsync (availability) would help future readers.
|
Smoke tests summary:
|
SmokePR: fix(arc-dind): mount workspace correctly and unify artifact roots Warning Firewall blocked 6 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
|
Comment MemoryNote This comment is managed by comment memory.It stores persistent context for this thread in the code block at the top of this comment. Warning Firewall blocked 6 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
|
There was a problem hiding this comment.
Smoke bot comment review. Tool path worked.
Warning
Firewall blocked 6 domains
The following domains were blocked by the firewall during workflow execution:
accounts.google.comandroid.clients.google.comclients2.google.comcontentautofill.googleapis.comsafebrowsingohttpgateway.googleapis.comwww.google.com
To allow these domains, add them to the
network.allowedlist in your workflow frontmatter:
network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "safebrowsingohttpgateway.googleapis.com"
- "www.google.com"See Network Configuration for more information.
📰 BREAKING: Report filed by Smoke Copilot · 103.1 AIC · ⌖ 4.99 AIC · ⊞ 19.1K
Comment /smoke-copilot to run again
Add label smoke to run again
Summary
Fixes two ARC/DinD runtime bugs (gh-aw#34896) that caused the agent to see an empty workspace and artifact downloads to fail.
Changes
Bug A — Empty workspace (
dockerHostPathPrefixremoved)BuildAWFConfigJSONpreviously setcontainer.DockerHostPathPrefix = awfArcDindRootPathExprfor thearc-dindtopology so the DinD daemon could resolve runner paths. With the sysroot-stage now active, the Docker daemon accesses the workspace through the shared work volume (/home/runner/_work/), system binaries through the sysroot named volume, and kernel VFS from the daemon's own kernel. Setting the prefix incorrectly translated the workspace bind-mount source (e.g./prefix/home/runner/_work/repo) to a non-existent path, causing the agent to see an empty workspace.pkg/workflow/awf_config.go— removes thedockerHostPathPrefixassignment forarc-dind; updated comment explains why it must remain unset.pkg/workflow/awf_config_test.go— test updated to assertdockerHostPathPrefixis absent from the generated config JSON.Bug B — Broken artifact downloads (unified artifact root)
On ARC/DinD, agent output files (
agent_output.json,safe_outputs.ndjson,aw-prompts/, patches, MCP logs) are written to/tmp/gh-aw/during execution, but firewall logs land under${{ runner.temp }}/gh-aw/. When both roots were passed toupload-artifact, it computed/as the common ancestor and created a nested directory layout that broke downstream artifact downloads.pkg/workflow/arc_dind_artifacts.go(new file) — adds two helpers:rewriteTmpGhAwPathsForArcDind(paths): rewrites/tmp/gh-aw/...artifact paths to${{ runner.temp }}/gh-aw/...soupload-artifactsees a single root.(*Compiler).generateArcDindArtifactConsolidationStep: emits aConsolidate artifacts for ARC/DinDworkflow step (if: always()) that copies files from/tmp/gh-aw/into${RUNNER_TEMP}/gh-aw/usingcp -a --no-clobber(with fallback), merging agent outputs with firewall logs before upload.pkg/workflow/compiler_yaml_main_job.go— integrates both helpers:collectArtifactPaths: callsrewriteTmpGhAwPathsForArcDindon collected paths when the topology isarc-dind.generatePostAgentCollectionAndUpload: emits the consolidation step before the artifact upload step when the topology isarc-dind.pkg/workflow/arc_dind_artifacts_test.go(new file) — unit tests forrewriteTmpGhAwPathsForArcDindcovering prefix rewrite, passthrough for existingrunner.temppaths, and passthrough for unrelated paths.Affected topology
arc-dindonly. Standard hosted-runner and ARC non-DinD topologies are unaffected.Testing
rewriteTmpGhAwPathsForArcDind(3 subtests).BuildAWFConfigJSONtest updated to assert absence ofdockerHostPathPrefix.