Harden enclave-only GitHub Issues smoke test by lpcox · Pull Request #8102 · github/gh-aw-firewall

lpcox · 2026-09-04T16:57:37Z

Summary

remove the primary agent's GitHub MCP tools, GitHub token, and external network allowlist
discover an open github/gh-aw issue inside the enclave and return only bounded metadata
cap enclave execution to one invocation and 1 KiB of output
verify the generated gateway policy exposes GitHub only to the enclave identity

Validation

gh aw compile smoke-enclave-issues-read --approve
npx ts-node scripts/ci/postprocess-smoke-workflows.ts
npm test -- --runInBand scripts/ci/smoke-enclave-workflow.test.ts scripts/ci/apply-general-workflow-patches.test.ts

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 77d87aa0-d2a1-439a-a514-a0938b8239ca

Copilot

Copilot review overview

🟡 Changes recommended

The enclave prompt uses an incompatible state value and misinterprets the list_issues response shape, preventing successful validation.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 2

New issues introduced by this change (2)

Severity	Finding
	`.github/workflows/smoke-enclave-issues-read.md` — The pinned `github-mcp-server:v1.11.0` advertises `state` as an enum containing only `OPEN` and…
	`.github/workflows/smoke-enclave-issues-read.md` — In the pinned GitHub MCP server, `list_issues` returns an object shaped like `{issues, totalCount,…

What changed in this PR

Hardens the enclave Issues smoke test by isolating GitHub access to the enclave and bounding its output.

Changes:

Removes primary-agent GitHub credentials, tools, and network access.
Limits enclave execution and dynamically selects an open issue.
Expands tests for gateway policy and disclosure bounds.

File	Description
`.github/workflows/smoke-enclave-issues-read.md`	Defines hardened workflow behavior.
`.github/workflows/smoke-enclave-issues-read.lock.yml`	Regenerates the compiled workflow.
`scripts/ci/smoke-enclave-workflow.test.ts`	Verifies isolation and limits.
`.github/aw/actions-lock.json`	Pins the updated setup action.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 77d87aa0-d2a1-439a-a514-a0938b8239ca

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Resolve generated workflow conflicts by recompiling the enclave issue-read workflow and reapplying repository post-processing. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 77d87aa0-d2a1-439a-a514-a0938b8239ca

…oke' into copilot/harden-enclave-issues-smoke

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 77d87aa0-d2a1-439a-a514-a0938b8239ca

github-actions · 2026-09-04T21:07:35Z

✅ Copilot review passed with no inline comments.

@lpcox Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-09-04T21:23:49Z

🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation...

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-09-04T21:23:50Z

✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

github-actions · 2026-09-04T21:23:51Z

✅ Build Test Suite completed successfully!

Generated by Build Test Suite for #8102

github-actions · 2026-09-04T21:23:52Z

🔌 Smoke Services — All services reachable! ✅

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-09-04T21:23:54Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-09-04T21:23:55Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-09-04T21:23:55Z

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation

github-actions · 2026-09-04T21:23:58Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

Tested by Smoke Chroot

github-actions · 2026-09-04T21:23:58Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-09-04T21:23:58Z

❌ Smoke Claude failed

Generated by Smoke Claude for #8102

github-actions · 2026-09-04T21:23:59Z

📰 DEVELOPING STORY: Smoke Docker Sbx reports failed. Our correspondents are investigating the incident...

📰 BREAKING: Report filed by Smoke Docker Sbx

github-actions · 2026-09-04T21:24:05Z

❌ Smoke Gemini reports failed. Facets need polishing...

💎 Faceted by Smoke Gemini

github-actions · 2026-09-04T21:24:10Z

✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

github-actions · 2026-09-04T21:24:21Z

❌ Contribution Check failed. Please review the logs for details.

Generated by Contribution Check for #8102

github-actions · 2026-09-04T21:24:36Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

📡 OTel tracing validated by Smoke OTel Tracing

github-actions · 2026-09-04T21:27:31Z

Smoke Test: Copilot BYOK (Direct Mode) — PASS ✅

✅ MCP connectivity (PRs fetched correctly)
✅ GitHub.com connectivity (HTTP 200)
✅ File write/read test
✅ BYOK inference path active (agent → api-proxy → api.githubcopilot.com)

Running in direct BYOK mode via COPILOT_PROVIDER_API_KEY.

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-09-04T21:27:41Z

@lpcox Smoke test results for Copilot network-isolation egress enforcement:

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (api.github.com) reachable: allowed=200
✅ Non-allowed domain (example.com) blocked: CONNECT tunnel failed 403

Overall: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-09-04T21:27:53Z

Smoke Test: Copilot Engine — @lpcox

✅ GitHub MCP connectivity (PR chore: upgrade gh-aw workflows to v0.88.4 #8093, chore: update model-to-API mapping (2026-09-04) #8089 fetched)
✅ GitHub.com connectivity (HTTP 200)
✅ File write/read test passed

Overall: PASS

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-09-04T21:28:35Z

Smoke Test Results: FAIL ❌

Redis PING: ❌ (Temporary failure in name resolution)
PostgreSQL pg_isready: ❌ (no response)
PostgreSQL SELECT 1: ❌ (could not translate host name)

Overall: FAIL — host.docker.internal did not resolve; sandbox cannot reach host service containers.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-09-04T21:28:55Z

@lpcox
MCP PR listing: ❌ (unexpected result)
GitHub.com connectivity: ✅
File write/read: ✅
BYOK inference: ✅
Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy -> Azure OpenAI (Foundry, o4-mini-aw)
Overall: FAIL

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)
_{Add label ready-for-aw to run again}

github-actions · 2026-09-04T21:29:11Z

chore: upgrade gh-aw workflows to v0.88.4
chore: update model-to-API mapping

MCP connectivity ✅
GitHub.com connectivity ✅
File write/read ✅
BYOK inference ✅

Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra

Overall status: PASS

@lpcox

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)
_{Add label ready-for-aw to run again}

github-actions · 2026-09-04T21:29:13Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.14	Python 3.12.14	✅ YES
Node.js	v24.20.0	v22.23.2	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Overall: FAILED — Node.js version mismatch between host and chroot environments. The smoke-chroot label was not added since not all tests passed.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions · 2026-09-04T21:30:00Z

OTel Tracing Smoke Test Results

✅ Scenario 1 (Module Loading): otel.js loads successfully; isEnabled() → true; exports include startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled, plus internal exporter/parsing helpers.
✅ Scenario 2 (Test Suite): 3 suites / 68 tests passed (otel.test.js, otel-fanout.test.js, otel-workload-identity.test.js).
✅ Scenario 3 (Env Var Forwarding): env-passthrough.ts forwards GITHUB_AW_OTEL_TRACE_ID/GITHUB_AW_OTEL_PARENT_SPAN_ID; api-proxy-env-config.ts forwards GH_AW_OTLP_ENDPOINTS, OTEL_EXPORTER_OTLP_ENDPOINT, and both trace context vars.
✅ Scenario 4 (Token Tracker Integration): token-tracker-http.js implements the onUsage callback hook (invoked after usage normalization).
✅ Scenario 5 (OTEL Diagnostics): workflow-level otel.jsonl shows exported spans (e.g. gh-aw.agent.setup) with valid trace/span IDs and gen_ai attributes; confirms end-to-end OTLP export path is functioning.

All scenarios pass. No regressions detected.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-09-04T21:30:00Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1 pkg ok	✅ PASS
Go	env	✅	1 pkg ok	✅ PASS
Go	uuid	✅	1 pkg ok	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	all passed	✅ PASS
Node.js	execa	✅	all passed	✅ PASS
Node.js	p-limit	✅	all passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — PASS

Notes:

Java: ~/.m2 was not writable by the runner user by default; used an alternate local repository path (/tmp/gh-aw/agent/m2repo) via -s settings file with the squid-proxy HTTP/HTTPS proxy config. Both projects compiled and tests passed through the firewall proxy without issue.
All other ecosystems ran cleanly with no clone, install, build, or test failures.

Generated by Build Test Suite for #8102 · copilot · auto · 33.3 AIC · ⊞ 12K · ◷
_{Add label ready-for-aw to run again}

test: isolate enclave issue reads

ffea0ab

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 77d87aa0-d2a1-439a-a514-a0938b8239ca

Copilot AI balanced review requested due to automatic review settings September 4, 2026 16:57

Copilot started reviewing on behalf of lpcox September 4, 2026 16:58 View session

Copilot AI reviewed Sep 4, 2026

View reviewed changes

Comment thread .github/workflows/smoke-enclave-issues-read.md Outdated

Comment thread .github/workflows/smoke-enclave-issues-read.md Outdated

lpcox and others added 10 commits September 4, 2026 10:33

fix: deduplicate enclave gateway credentials

d83689b

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 77d87aa0-d2a1-439a-a514-a0938b8239ca

fix: configure enclave GitHub guard

d7370d9

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 77d87aa0-d2a1-439a-a514-a0938b8239ca

fix: defer enclave-only GitHub checks

d710dbb

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 77d87aa0-d2a1-439a-a514-a0938b8239ca

fix: tolerate enclave-only gateway checks

f389461

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 77d87aa0-d2a1-439a-a514-a0938b8239ca

fix: stage enclave repositories with host token

8be8c43

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 77d87aa0-d2a1-439a-a514-a0938b8239ca

Update documentation for issue response handling

55f21a4

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Update list_issues state value to uppercase

7ce8b7d

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Merge remote-tracking branch 'origin/copilot/harden-enclave-issues-sm…

12ba80a

…oke' into copilot/harden-enclave-issues-smoke

chore: regenerate enclave smoke workflow

1e7650b

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 77d87aa0-d2a1-439a-a514-a0938b8239ca

lpcox added the ready-for-aw label Sep 4, 2026

lpcox deployed to aoai-model September 4, 2026 21:24 — with GitHub Actions Active

github-actions Bot mentioned this pull request Sep 4, 2026

[aw] Smoke Claude failed #8108

Closed

github-actions Bot added smoke-copilot-byok smoke-copilot-network-isolation Copilot network-isolation egress smoke test labels Sep 4, 2026

github-actions Bot added the smoke-copilot label Sep 4, 2026

lpcox deployed to aoai-model September 4, 2026 21:28 — with GitHub Actions Active

github-actions Bot added the smoke-copilot-byok-aoai-apikey label Sep 4, 2026

github-actions Bot added the smoke-copilot-byok-aoai-entra label Sep 4, 2026

lpcox deployed to aoai-model September 4, 2026 21:29 — with GitHub Actions Active

This was referenced Sep 4, 2026

[aw] Smoke Docker Sbx failed #8110

Closed

[aw] Contribution Check hit engine rate limit (HTTP 429) #8112

Closed

github-actions Bot added the build-test label Sep 4, 2026

lpcox merged commit ff89c4d into main Sep 4, 2026
169 of 178 checks passed

lpcox deleted the copilot/harden-enclave-issues-smoke branch September 4, 2026 21:38

This was referenced Sep 4, 2026

docs: add runner doctor A24 for read-only ARC/DinD credential overlays #8114

Merged

Use ****** for GHEC Copilot data-residency targets #8113

Merged

Uh oh!

Conversation

lpcox commented Sep 4, 2026

Summary

Validation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Sep 4, 2026

Uh oh!

github-actions Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 4, 2026

Uh oh!

github-actions Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 4, 2026

Uh oh!

github-actions Bot commented Sep 4, 2026

Uh oh!

github-actions Bot commented Sep 4, 2026

Uh oh!

github-actions Bot commented Sep 4, 2026

Smoke Test Results: FAIL ❌

Uh oh!

github-actions Bot commented Sep 4, 2026

Uh oh!

github-actions Bot commented Sep 4, 2026

Uh oh!

github-actions Bot commented Sep 4, 2026

Chroot Version Comparison Results

Uh oh!

github-actions Bot commented Sep 4, 2026

Uh oh!

github-actions Bot commented Sep 4, 2026

🏗️ Build Test Suite Results

Uh oh!

github-actions Bot commented Sep 4, 2026 •

edited

Loading

github-actions Bot commented Sep 4, 2026 •

edited

Loading

github-actions Bot commented Sep 4, 2026 •

edited

Loading

github-actions Bot commented Sep 4, 2026 •

edited

Loading

github-actions Bot commented Sep 4, 2026 •

edited

Loading

github-actions Bot commented Sep 4, 2026 •

edited

Loading

github-actions Bot commented Sep 4, 2026 •

edited

Loading

github-actions Bot commented Sep 4, 2026 •

edited

Loading

github-actions Bot commented Sep 4, 2026 •

edited

Loading

github-actions Bot commented Sep 4, 2026 •

edited

Loading

github-actions Bot commented Sep 4, 2026 •

edited

Loading

github-actions Bot commented Sep 4, 2026 •

edited

Loading

github-actions Bot commented Sep 4, 2026 •

edited

Loading

github-actions Bot commented Sep 4, 2026 •

edited

Loading