test: split Cloud Hypervisor runtime backend suites by Copilot · Pull Request #8024 · github/gh-aw-firewall

Copilot · 2026-09-02T17:11:26Z

The Cloud Hypervisor runtime backend tests combined boot lifecycle, readiness, execution, diagnostics, and pure environment mapping coverage in one flat suite. This separates the standalone mapping cases and adds feature-oriented navigation to the backend suite.

Environment and path mapping
- Added cloud-hypervisor-runtime-backend.env-mapping.test.ts for isolated guest-environment and compatibility coverage.
- Preserves coverage for credential sanitization, proxy variables, runner-path export mapping, and unsupported topology validation.
Runtime backend lifecycle
- Grouped existing manager-backed tests under focused describe blocks:
  - startup and preflight
  - readiness probing
  - diagnostics and cleanup
  - execution and cancellation

describe('Cloud Hypervisor runtime backend environment and path mapping', () => {
  it('maps only exported runner paths and keeps the guest home in the writable workspace', () => {
    // ...
  });
});

Fixes [Refactoring] Split test file into focused suites by feature area #8013

Copilot

🟢 Approval recommended

The refactor preserves coverage and behavior, with only a non-blocking indentation issue.

Pull request overview

Splits Cloud Hypervisor backend tests into focused suites without changing production behavior.

Changes:

Extracts environment/path mapping tests into a standalone file.
Groups lifecycle tests by feature area.

File summaries

File	Description
`src/cloud-hypervisor-runtime-backend.test.ts`	Organizes lifecycle tests into nested suites.
`src/cloud-hypervisor-runtime-backend.env-mapping.test.ts`	Adds isolated mapping and compatibility coverage.

Review details

Files reviewed: 2/2 changed files
Comments generated: 1
Review effort level: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

    eligibilitySpy.mockRestore();
  });

+  describe('startup and preflight', () => {


lpcox · 2026-09-02T21:11:08Z

@copilot address review feedback

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot · 2026-09-02T21:13:03Z

@copilot address review feedback

Applied the nested-suite indentation convention throughout src/cloud-hypervisor-runtime-backend.test.ts in commit a0a4229. The diff is formatting-only; the targeted Jest command could not run because dependencies (jest) are not installed in the sandbox.

github-actions · 2026-09-02T21:59:01Z

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-09-02T23:54:38Z

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation

github-actions · 2026-09-02T23:54:39Z

✅ Smoke Claude passed

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by Smoke Claude for #8024

github-actions · 2026-09-02T23:54:40Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-09-02T23:54:43Z

❌ Contribution Check failed. Please review the logs for details.

Generated by Contribution Check for #8024

github-actions · 2026-09-02T23:54:43Z

❌ Smoke Gemini reports failed. Facets need polishing...

💎 Faceted by Smoke Gemini

github-actions · 2026-09-02T23:54:43Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

Warning

Firewall blocked 7 domains

The following domains were blocked by the firewall during workflow execution:

accounts.google.com
android.clients.google.com
clients2.google.com
contentautofill.googleapis.com
msfeed25.pkgs.visualstudio.com
www.google.com
www.gstatic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-09-02T23:54:43Z

🔌 Smoke Services — All services reachable! ✅

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-09-02T23:54:43Z

✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

github-actions · 2026-09-02T23:54:45Z

✅ Build Test Suite completed successfully!

Generated by Build Test Suite for #8024

github-actions · 2026-09-02T23:54:47Z

❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

github-actions · 2026-09-02T23:54:48Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-09-02T23:54:49Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

📡 OTel tracing validated by Smoke OTel Tracing

github-actions · 2026-09-02T23:54:50Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-09-02T23:54:51Z

📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Docker Sbx

github-actions · 2026-09-02T23:55:28Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

Tested by Smoke Chroot

github-actions · 2026-09-02T23:58:02Z

Smoke Test: Copilot BYOK (Direct Mode) ✅ PASS

✅ GitHub MCP connectivity verified
✅ github.com HTTP 200 confirmed
✅ File write/read test passed
✅ BYOK inference (agent → api-proxy → api.githubcopilot.com) working

Running in direct BYOK mode via COPILOT_PROVIDER_API_KEY.

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-09-02T23:58:04Z

Smoke Test Results (Copilot Engine)

MCP connectivity: ✅ (PR test: validate shared-gateway enclave smoke #8026, Mount the configured container working directory when no other mount exposes it #8021 fetched)
GitHub.com connectivity: ✅ (HTTP 200)
File write/read: ✅

Overall: PASS

cc @lpcox

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-09-02T23:58:19Z

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (github.com) reachable: allowed=200
✅ Blocked domain (example.com) denied: 403 CONNECT tunnel failed

Overall: PASS

cc @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-09-02T23:58:22Z

Smoke Test: Claude Engine Validation

Check	Status
API	✅ PASS
gh CLI	✅ PASS
File	✅ PASS

Overall result: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by Smoke Claude for #8024 · claude · haiku45 · 35 AIC · ⊞ 4.5K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-09-02T23:58:45Z

Smoke Test Results: GitHub Actions Services Connectivity

Redis PING: ❌ (Temporary failure in name resolution)
PostgreSQL pg_isready: ❌ (no response)
PostgreSQL SELECT 1: ❌ (could not translate host name)

Overall: FAIL — host.docker.internal did not resolve from within the AWF sandbox.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-09-02T23:59:19Z

Smoke Test: API Proxy OTEL Tracing — Results

✅ Scenario 1 (Module Loading): otel.js loads successfully, exports startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled, plus internal helpers.
✅ Scenario 2 (Test Suite): 3 suites / 68 tests passed (otel.test.js, otel-fanout.test.js, otel-workload-identity.test.js).
✅ Scenario 3 (Env Var Forwarding): env-passthrough.ts forwards GITHUB_AW_OTEL_TRACE_ID/GITHUB_AW_OTEL_PARENT_SPAN_ID/COPILOT_OTEL_FILE_EXPORTER_PATH into the agent container; api-proxy-env-config.ts's buildOtelEnv() forwards OTEL_EXPORTER_OTLP_ENDPOINT(S), OTEL_EXPORTER_OTLP_HEADERS, and the trace/parent-span vars into the api-proxy container.
✅ Scenario 4 (Token Tracker Integration): onUsage callback present in token-tracker-http.js (invoked after normalized usage extraction) as the OTEL hook point.
✅ Scenario 5 (OTEL Diagnostics): /tmp/gh-aw/otel.jsonl contains an exported span (resourceSpans with service/workflow/run attributes), confirming spans were exported during the run.

All scenarios pass — no unexpected failures.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-09-02T23:59:28Z

Smoke Test: Docker Sbx — PR #8024 "test: split Cloud Hypervisor runtime backend suites"

✅ GitHub MCP connectivity (verified via PR list)
✅ github.com connectivity (HTTP 200)
✅ File write/read test

Overall: PASS

cc @Copilot (author), @lpcox (assignee)

📰 BREAKING: Report filed by Smoke Docker Sbx
_{Add label ready-for-aw to run again}

github-actions · 2026-09-02T23:59:37Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	pkg ok	✅ PASS
Go	env	✅	pkg ok	✅ PASS
Go	uuid	✅	pkg ok	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — PASS

Notes:

All repositories cloned successfully.
Java required setting a custom Maven localRepository (/tmp/gh-aw/agent/m2repo) since the default ~/.m2/repository path was not writable in this sandbox; unrelated to the firewall itself.

Generated by Build Test Suite for #8024 · copilot · auto · 41.5 AIC · ⊞ 12K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-09-03T00:00:13Z

Smoke test: FAIL
Merged PRs: #8026 test: validate shared-gateway enclave smoke; #8021 Mount the configured container working directory when no other mount exposes it
Merged PR review: ✅
safeinputs-gh PR query: ❌
Playwright github.com title: ✅
File write + cat: ✅
Discussion query/comment: ❌
AWF build (npm ci && npm run build): ✅
Overall: FAIL

Warning

Firewall blocked 7 domains

The following domains were blocked by the firewall during workflow execution:

accounts.google.com
android.clients.google.com
clients2.google.com
contentautofill.googleapis.com
msfeed25.pkgs.visualstudio.com
www.google.com
www.gstatic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

github-actions · 2026-09-03T00:01:32Z

test: validate shared-gateway enclave smoke
Mount the configured container working directory when no other mount exposes it
❌ MCP connectivity mismatch
✅ GitHub.com connectivity
✅ File I/O test
✅ BYOK inference test
Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra
Overall status: FAIL
@lpcox @Copilot

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)
_{Add label ready-for-aw to run again}

github-actions · 2026-09-03T00:03:44Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.14	Python 3.12.14	✅ YES
Node.js	v24.19.0	v22.23.2	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Overall: FAILED — Node.js version differs between host and chroot environment (v24.19.0 vs v22.23.2). Label not added since not all tests passed.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

Initial plan

c9db1e8

Copilot AI assigned Copilot and lpcox Sep 2, 2026

Copilot started work on behalf of lpcox September 2, 2026 17:11 View session

Copilot AI linked an issue Sep 2, 2026 that may be closed by this pull request

[Refactoring] Split test file into focused suites by feature area #8013

Closed

test: split runtime backend env mapping tests

f454f12

Copilot AI changed the title ~~[WIP] Refactor test file into focused suites by feature area~~ test: split Cloud Hypervisor runtime backend suites Sep 2, 2026

Copilot finished work on behalf of lpcox September 2, 2026 17:16

Copilot AI requested a review from lpcox September 2, 2026 17:16

lpcox marked this pull request as ready for review September 2, 2026 17:18

Copilot AI balanced review requested due to automatic review settings September 2, 2026 17:18

Copilot started reviewing on behalf of lpcox September 2, 2026 17:19 View session

Copilot AI reviewed Sep 2, 2026

View reviewed changes

Comment thread src/cloud-hypervisor-runtime-backend.test.ts

eligibilitySpy.mockRestore();

});

describe('startup and preflight', () => {

Copilot started work on behalf of lpcox September 2, 2026 21:11 View session

test: indent nested runtime backend suites

a0a4229

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot finished work on behalf of lpcox September 2, 2026 21:13

lpcox added the ready-for-aw label Sep 2, 2026

lpcox temporarily deployed to aoai-model September 2, 2026 23:54 — with GitHub Actions Inactive

github-actions Bot added smoke-copilot-byok smoke-copilot labels Sep 2, 2026

github-actions Bot added the smoke-copilot-network-isolation Copilot network-isolation egress smoke test label Sep 2, 2026

github-actions Bot added the smoke-claude label Sep 2, 2026

github-actions Bot added the smoke-docker-sbx label Sep 2, 2026

github-actions Bot added the build-test label Sep 2, 2026

github-actions Bot mentioned this pull request Sep 3, 2026

[aw] Smoke Copilot BYOK AOAI (api-key) hit engine rate limit (HTTP 429) #8043

Closed

lpcox temporarily deployed to aoai-model September 3, 2026 00:01 — with GitHub Actions Inactive

lpcox merged commit 4990592 into main Sep 3, 2026
182 of 186 checks passed

lpcox deleted the copilot/refactor-split-test-file-by-feature branch September 3, 2026 00:21

Uh oh!

Conversation

Copilot AI commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

lpcox commented Sep 2, 2026

Uh oh!

Copilot AI commented Sep 2, 2026

Uh oh!

github-actions Bot commented Sep 2, 2026

Uh oh!

github-actions Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 2, 2026

Uh oh!

github-actions Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 2, 2026

Uh oh!

github-actions Bot commented Sep 2, 2026

Smoke Test Results (Copilot Engine)

Uh oh!

github-actions Bot commented Sep 2, 2026

Uh oh!

github-actions Bot commented Sep 2, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Sep 2, 2026

Uh oh!

github-actions Bot commented Sep 2, 2026

Smoke Test: API Proxy OTEL Tracing — Results

Uh oh!

github-actions Bot commented Sep 2, 2026

Uh oh!

github-actions Bot commented Sep 2, 2026

🏗️ Build Test Suite Results

Uh oh!

github-actions Bot commented Sep 3, 2026

Copilot AI commented Sep 2, 2026 •

edited

Loading

github-actions Bot commented Sep 2, 2026 •

edited

Loading

github-actions Bot commented Sep 2, 2026 •

edited

Loading

github-actions Bot commented Sep 2, 2026 •

edited

Loading

github-actions Bot commented Sep 2, 2026 •

edited

Loading

github-actions Bot commented Sep 2, 2026 •

edited

Loading

github-actions Bot commented Sep 2, 2026 •

edited

Loading

github-actions Bot commented Sep 2, 2026 •

edited

Loading

github-actions Bot commented Sep 2, 2026 •

edited

Loading

github-actions Bot commented Sep 2, 2026 •

edited

Loading

github-actions Bot commented Sep 2, 2026 •

edited

Loading

github-actions Bot commented Sep 2, 2026 •

edited

Loading

github-actions Bot commented Sep 2, 2026 •

edited

Loading

github-actions Bot commented Sep 2, 2026 •

edited

Loading

github-actions Bot commented Sep 2, 2026 •

edited

Loading