fix(ci): resolve integration test suite failures on main by Mossaka · Pull Request #1151 · github/gh-aw-firewall

Mossaka · 2026-03-05T18:34:19Z

Summary

Fixes three groups of integration test failures in test-integration-suite.yml that have been failing on main since the workflow was added on Feb 26.

Volume Mounts (source code fix)

Custom --mount paths (e.g., /tmp/test:/data:ro) were invisible inside the agent container because chroot mode (always enabled) does chroot /host, making paths not under /host inaccessible
Fix: docker-manager.ts now prefixes custom mount container paths with /host (e.g., /data becomes /host/data) so they're accessible after chroot

API Proxy Tests (test fixes)

JSON.parse(result.stdout) and header assertions failed because stdout contained Docker build output mixed with actual curl output when --build-local is used
Fix: Added extractLastJson() and extractCommandOutput() helpers in tests/fixtures/stdout-helpers.ts to isolate command output from Docker build noise. Converted header-based assertions (curl -i) to use JSON response body instead

One-Shot Token Tests (source code + test fixes)

AWF_ONE_SHOT_TOKEN_DEBUG env var was not forwarded to the container, so [one-shot-token] debug log assertions always failed
COPILOT_GITHUB_TOKEN was never forwarded to the container in non-api-proxy mode
Python inline scripts used single quotes inside single-quoted bash commands, causing shell syntax errors with parentheses in comments
NORMAL_VAR tests used options.env which doesn't reach the container; needed cliEnv (explicit -e flags)
Fix: Forward AWF_ONE_SHOT_TOKEN_DEBUG and COPILOT_GITHUB_TOKEN in docker-manager.ts, use heredoc for Python scripts, use cliEnv for non-sensitive vars

Test plan

Unit tests pass locally (821/821)
TypeScript compiles without errors
Integration test suite CI workflow passes (volume-mounts, api-proxy, one-shot-tokens)
No regressions in other integration test groups

🤖 Generated with Claude Code

Three groups of integration test failures fixed: 1. **Volume Mounts** (docker-manager.ts): Custom --mount paths were not visible inside the agent container because chroot mode (always enabled) does `chroot /host`, making paths like /data invisible. Fixed by prefixing the container path with /host (e.g., /data -> /host/data) so mounts are accessible after chroot. 2. **API Proxy Tests** (observability + rate-limit): Tests used JSON.parse(result.stdout) and header assertions, but stdout contained Docker build output mixed with curl output when --build-local is used. Added extractLastJson() and extractCommandOutput() helpers to isolate actual command output from Docker build noise. Converted header-based assertions to use JSON response body instead of curl -i headers. 3. **One-Shot Token Tests**: Multiple issues fixed: - AWF_ONE_SHOT_TOKEN_DEBUG env var was not forwarded to the container, so debug log assertions always failed. Added forwarding in docker-manager. - COPILOT_GITHUB_TOKEN was never forwarded to the container in non-api-proxy mode, causing token caching tests to fail. Added to selective forwarding. - Python inline scripts used single quotes inside single-quoted bash commands, causing shell syntax errors. Converted to heredoc syntax. - NORMAL_VAR tests used options.env which doesn't reach the container; switched to cliEnv which uses explicit -e flags. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

github-actions · 2026-03-05T18:35:13Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	82.03%	82.18%	📈 +0.15%
Statements	82.01%	82.12%	📈 +0.11%
Functions	82.50%	82.50%	➡️ +0.00%
Branches	74.20%	74.03%	📉 -0.17%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
`src/docker-manager.ts`	83.1% → 83.7% (+0.55%)	82.4% → 82.8% (+0.40%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-03-05T18:38:47Z

Build Test: Node.js Results

Project	Install	Tests	Status
clsx	✅	✅	PASS
execa	✅	✅	PASS
p-limit	✅	✅	PASS

Overall: ✅ PASS

Generated by Build Test Node.js for issue #1151

github-actions · 2026-03-05T18:38:50Z

.NET Build Test Results

Project	Restore	Build	Run	Status
hello-world	✅	✅	✅	PASS
json-parse	✅	✅	✅	PASS

Overall: PASS

Run output

hello-world:

Hello, World!
```

**json-parse:**
```
{
  "Name": "AWF Test",
  "Version": 1,
  "Success": true
}
Name: AWF Test, Success: True

Generated by Build Test .NET for issue #1151

github-actions · 2026-03-05T18:38:50Z

Build Test: Deno ✅

Project	Tests	Status
oak	1/1	✅ PASS
std	1/1	✅ PASS

Overall: PASS

Deno version: 2.7.4

Generated by Build Test Deno for issue #1151

github-actions · 2026-03-05T18:39:02Z

C++ Build Test Results

Project	CMake	Build	Status
fmt	✅	✅	PASS
json	✅	✅	PASS

Overall: PASS 🎉

Generated by Build Test C++ for issue #1151

github-actions · 2026-03-05T18:39:06Z

🧪 Bun Build Test Results

Project	Install	Tests	Status
elysia	✅	1/1	PASS
hono	✅	1/1	PASS

Overall: ✅ PASS

Bun v1.3.10 — all tests passed successfully.

Generated by Build Test Bun for issue #1151

github-actions · 2026-03-05T18:39:11Z

PR titles: fix(test): resolve integration test suite failures on main; fix: speed up firewall shutdown by ~10s
GitHub MCP merged PRs ✅
Safeinputs gh pr list ✅
Playwright title check ✅
Tavily search (tool unavailable) ❌
File write ✅
Bash cat ✅
Discussion comment ✅
Build npm ci && npm run build ✅
Overall status: FAIL

🔮 The oracle has spoken through Smoke Codex for issue #1151

github-actions · 2026-03-05T18:39:15Z

Smoke Test Results — Run #22731026835

✅ GitHub MCP — Last 2 merged PRs: #1078 "fix: add explicit execute directive to smoke-codex to prevent noop", #1070 "chore: investigate issue duplication detector workflow failure"
✅ Playwright — github.com title contains "GitHub"
✅ File Write — /tmp/gh-aw/agent/smoke-test-copilot-22731026835.txt created
✅ Bash — File verified via cat

Overall: PASS | PR by @Mossaka

📰 BREAKING: Report filed by Smoke Copilot for issue #1151

github-actions · 2026-03-05T18:39:20Z

Rust Build Test Results

Project	Build	Tests	Status
fd	✅	1/1	PASS
zoxide	✅	1/1	PASS

Overall: PASS ✅

Generated by Build Test Rust for issue #1151

github-actions · 2026-03-05T18:40:12Z

Java Build Test Results

Project	Compile	Tests	Status
gson	✅	1/1	PASS
caffeine	✅	1/1	PASS

Overall: ✅ PASS

All projects compiled and tested successfully against Maven Central via the AWF proxy.

Generated by Build Test Java for issue #1151

github-actions · 2026-03-05T18:40:36Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.12	Python 3.12.3	❌ NO
Node.js	v24.14.0	v20.20.0	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Result: Tests did not fully pass — Python and Node.js versions differ between host and chroot environments.

Tested by Smoke Chroot for issue #1151

github-actions · 2026-03-05T18:41:03Z

Go Build Test Results

Project	Download	Tests	Status
color	✅	1/1	PASS
env	✅	1/1	PASS
uuid	✅	1/1	PASS

Overall: PASS ✅

Generated by Build Test Go for issue #1151

github-actions · 2026-03-05T18:41:17Z

Smoke test results (run 22731026947)

✅ GitHub MCP — #1003: chore(deps): bump all-npm-dependencies; #1078: fix: add explicit execute directive to smoke-codex
✅ Playwright — github.com title contains "GitHub"
✅ File write — /tmp/gh-aw/agent/smoke-test-claude-22731026947.txt created
✅ Bash verify — file contents confirmed

Overall: PASS

💥 [THE END] — Illustrated by Smoke Claude for issue #1151

- npm audit fix for minimatch ReDoS (GHSA-7r86-cg39-jmmj, GHSA-23c5-xmqv-rm74) - npm audit fix --force for svgo DoS (GHSA-xpqw-6gx7-v673) in docs-site - Remaining 4 moderate lodash vulnerabilities require breaking @astrojs/check upgrade Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

github-actions · 2026-03-05T18:50:49Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	82.03%	82.18%	📈 +0.15%
Statements	82.01%	82.12%	📈 +0.11%
Functions	82.50%	82.50%	➡️ +0.00%
Branches	74.20%	74.03%	📉 -0.17%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
`src/docker-manager.ts`	83.1% → 83.7% (+0.55%)	82.4% → 82.8% (+0.40%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-03-05T19:01:51Z

Go Build Test Results ✅

Project	Download	Tests	Status
color	✅	PASS	PASS
env	✅	PASS	PASS
uuid	✅	PASS	PASS

Overall: PASS

Generated by Build Test Go for issue #1151

github-actions · 2026-03-05T19:01:55Z

🧪 Build Test: Bun

Project	Install	Tests	Status
elysia	✅	1/1	PASS
hono	✅	1/1	PASS

Overall: ✅ PASS

Bun version: 1.3.10

Generated by Build Test Bun for issue #1151

github-actions · 2026-03-05T19:02:03Z

fix: add explicit execute directive to smoke-codex to prevent noop
fix(deps): resolve high-severity rollup vulnerability in docs-site
fix(ci): resolve integration test suite failures on main
fix: speed up firewall shutdown by ~10s
Tests: GitHub MCP ✅, safeinputs-gh ✅, Playwright ✅, Tavily ❌, File ✅, Bash ✅, Discussion ✅, Build ✅
Overall status: FAIL

🔮 The oracle has spoken through Smoke Codex for issue #1151

github-actions · 2026-03-05T19:02:54Z

Java Build Test Results ☕

Project	Compile	Tests	Status
gson	✅	1/1	PASS
caffeine	✅	1/1	PASS

Overall: PASS ✅

All Java projects compiled and passed their tests successfully via Maven (using Squid proxy at 172.30.0.10:3128).

Generated by Build Test Java for issue #1151

github-actions · 2026-03-05T19:03:30Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.12	Python 3.12.3	❌ NO
Node.js	v24.14.0	v20.20.0	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Overall: ❌ Not all tests passed — Python and Node.js versions differ between host and chroot environment.

Tested by Smoke Chroot for issue #1151

…ll escaping Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

github-actions · 2026-03-05T19:24:41Z

Build Test: Deno ✅

Project	Tests	Status
oak	1/1	✅ PASS
std	1/1	✅ PASS

Overall: PASS

Deno 2.7.4 · All 2 tests passed

Generated by Build Test Deno for issue #1151

github-actions · 2026-03-05T19:24:43Z

Build Test: Bun Results ✅

Project	Install	Tests	Status
elysia	✅	1/1	PASS
hono	✅	1/1	PASS

Overall: PASS

Bun version: 1.3.10

Generated by Build Test Bun for issue #1151

github-actions · 2026-03-05T19:24:57Z

Build Test: Node.js ✅

Project	Install	Tests	Status
clsx	✅	PASS	✅ PASS
execa	✅	PASS	✅ PASS
p-limit	✅	PASS	✅ PASS

Overall: PASS

Generated by Build Test Node.js for issue #1151

github-actions · 2026-03-05T19:25:01Z

Go Build Test Results

Project	Download	Tests	Status
color	✅	PASS	✅ PASS
env	✅	PASS	✅ PASS
uuid	✅	PASS	✅ PASS

Overall: ✅ PASS

Generated by Build Test Go for issue #1151

github-actions · 2026-03-05T19:25:05Z

🔬 Smoke test results for @Mossaka (no assignees):

✅ GitHub MCP: Last 2 merged PRs: fix(squid): run Squid container as non-root user #1153 fix(squid): run Squid container as non-root user, fix(deps): resolve minimatch ReDoS and ajv vulnerabilities #1152 fix(deps): resolve minimatch ReDoS and ajv vulnerabilities
✅ Playwright: github.com title contains "GitHub"
✅ File write: /tmp/gh-aw/agent/smoke-test-copilot-22732817895.txt created
✅ Bash: File verified via cat

Overall: PASS

📰 BREAKING: Report filed by Smoke Copilot for issue #1151

github-actions · 2026-03-05T19:25:06Z

Rust Build Test Results

Project	Build	Tests	Status
fd	✅	1/1	PASS
zoxide	✅	1/1	PASS

Overall: ✅ PASS

Generated by Build Test Rust for issue #1151

github-actions · 2026-03-05T19:25:08Z

.NET Build Test Results

Project	Restore	Build	Run	Status
hello-world	✅	✅	✅	PASS
json-parse	✅	✅	✅	PASS

Overall: PASS

Run Output

hello-world:

Hello, World!
```

**json-parse:**
```
{
  "Name": "AWF Test",
  "Version": 1,
  "Success": true
}
Name: AWF Test, Success: True

Generated by Build Test .NET for issue #1151

github-actions · 2026-03-05T19:25:43Z

PRs: fix(squid): run Squid container as non-root user; fix(deps): resolve minimatch ReDoS and ajv vulnerabilities
GitHub MCP (last 2 merged PRs) ✅
Safeinputs GH PR list ✅
Playwright title contains GitHub ✅
Tavily web search ❌ (tool unavailable)
File write + cat ✅
Discussion query + comment ✅
Build (npm ci && npm run build) ✅
Overall: FAIL

🔮 The oracle has spoken through Smoke Codex for issue #1151

github-actions · 2026-03-05T19:26:01Z

Java Build Test Results

Project	Compile	Tests	Status
gson	✅	1/1	PASS
caffeine	✅	1/1	PASS

Overall: PASS ✅

Generated by Build Test Java for issue #1151

github-actions · 2026-03-05T19:26:05Z

Smoke Test Results — PASS

✅ GitHub MCP: fix(squid): run Squid container as non-root user #1153 fix(squid): run Squid container as non-root user / chore(deps-dev): bump minimatch from 10.2.1 to 10.2.4 #1073 chore(deps-dev): bump minimatch
✅ Playwright: GitHub page title verified contains "GitHub"
✅ File Write: /tmp/gh-aw/agent/smoke-test-claude-22732817906.txt created
✅ Bash: File contents confirmed via cat

💥 [THE END] — Illustrated by Smoke Claude for issue #1151

github-actions · 2026-03-05T19:26:16Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.12	Python 3.12.3	❌ NO
Node.js	v24.14.0	v20.20.0	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Result: ❌ Not all versions match — the chroot environment uses different Python and Node.js versions than the host runner.

Tested by Smoke Chroot for issue #1151

github-actions · 2026-03-05T19:28:58Z

C++ Build Test Results

Project	CMake	Build	Status
fmt	✅	✅	PASS
json	✅	✅	PASS

Overall: PASS ✅

Generated by Build Test C++ for issue #1151

The X-Request-ID injection test checked that stdout doesn't contain '<script>', but container entrypoint logs in stdout can contain angle brackets. Instead, verify the x-request-id response header contains a valid UUID (proving the proxy rejected the injected value). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

github-actions · 2026-03-05T19:47:38Z

C++ Build Test Results

Project	CMake	Build	Status
fmt	✅	✅	PASS
json	✅	✅	PASS

Overall: PASS ✅

Generated by Build Test C++ for issue #1151

github-actions · 2026-03-05T19:47:53Z

Smoke Test Results

✅ GitHub MCP: fix(security): eliminate TOCTOU race conditions in ssl-bump.ts #1159 fix(security): eliminate TOCTOU race conditions in ssl-bump.ts, fix(security): stop logging partial token values #1158 fix(security): stop logging partial token values
✅ Playwright: Page title contains "GitHub"
✅ File write: /tmp/gh-aw/agent/smoke-test-claude-22733678105.txt created
✅ Bash: File verified via cat

Overall: PASS

💥 [THE END] — Illustrated by Smoke Claude for issue #1151

github-actions · 2026-03-05T19:48:03Z

🟢 Build Test: Go — PASS

Project	Download	Tests	Status
color	✅	PASS	✅ PASS
env	✅	PASS	✅ PASS
uuid	✅	PASS	✅ PASS

Overall: PASS — All 3 projects built and tested successfully.

Generated by Build Test Go for issue #1151

github-actions · 2026-03-05T19:48:04Z

Smoke Test Results — @Mossaka

✅ GitHub MCP: Last 2 merged PRs retrieved

fix(security): eliminate TOCTOU race conditions in ssl-bump.ts #1159 fix(security): eliminate TOCTOU race conditions in ssl-bump.ts
fix(security): stop logging partial token values #1158 fix(security): stop logging partial token values

✅ Playwright: github.com title contains "GitHub"
✅ File Write: /tmp/gh-aw/agent/smoke-test-copilot-22733677960.txt created
✅ Bash: File verified via cat

Overall: PASS

📰 BREAKING: Report filed by Smoke Copilot for issue #1151

github-actions · 2026-03-05T19:48:08Z

Node.js Build Test Results

Project	Install	Tests	Status
clsx	✅	✅	PASS
execa	✅	✅	PASS
p-limit	✅	✅	PASS

Overall: ✅ PASS

Generated by Build Test Node.js for issue #1151

github-actions · 2026-03-05T19:48:16Z

fix(security): eliminate TOCTOU race conditions in ssl-bump.ts
fix(security): stop logging partial token values
GitHub MCP review (last 2 merged PRs): ✅
safeinputs-gh PR list: ✅
Playwright title contains GitHub: ✅
Tavily search: ❌ (tool unavailable)
file write + cat: ✅
discussion comment: ✅
npm ci && npm run build: ✅
Overall status: FAIL

🔮 The oracle has spoken through Smoke Codex for issue #1151

github-actions · 2026-03-05T19:48:18Z

Bun Build Test Results

Project	Install	Tests	Status
elysia	✅	1/1	PASS
hono	✅	1/1	PASS

Overall: PASS ✅

Tested with Bun v1.3.10

Generated by Build Test Bun for issue #1151

github-actions · 2026-03-05T19:48:23Z

.NET Build Test Results

Project	Restore	Build	Run	Status
hello-world	✅	✅	✅	PASS
json-parse	✅	✅	✅	PASS

Overall: PASS

Run output

hello-world: Hello, World!

json-parse:

{
  "Name": "AWF Test",
  "Version": 1,
  "Success": true
}
Name: AWF Test, Success: True

Generated by Build Test .NET for issue #1151

github-actions · 2026-03-05T19:48:27Z

🦕 Deno Build Test Results

Project	Tests	Status
oak	1/1	✅ PASS
std	1/1	✅ PASS

Overall: ✅ PASS

Generated by Build Test Deno for issue #1151

github-actions · 2026-03-05T19:49:33Z

Java Build Test Results ✅

Project	Compile	Tests	Status
gson	✅	1/1	PASS
caffeine	✅	1/1	PASS

Overall: PASS

Generated by Build Test Java for issue #1151

github-actions · 2026-03-05T19:49:56Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.12	Python 3.12.3	❌ NO
Node.js	v24.14.0	v20.20.0	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Result: FAILED — Python and Node.js versions differ between host and chroot environments.

Tested by Smoke Chroot for issue #1151

Copilot AI review requested due to automatic review settings March 5, 2026 18:34

Copilot AI reviewed Mar 5, 2026

View reviewed changes

github-actions bot added the build-test-node label Mar 5, 2026

github-actions bot added build-test-deno build-test-dotnet build-test-cpp labels Mar 5, 2026

github-actions bot added the build-test-bun label Mar 5, 2026

github-actions bot added the smoke-copilot label Mar 5, 2026

github-actions bot added build-test-rust build-test-java labels Mar 5, 2026

github-actions bot added the build-test-go label Mar 5, 2026

github-actions bot mentioned this pull request Mar 5, 2026

[agentics] No-Op Runs #1086

Open

github-actions bot added the smoke-claude label Mar 5, 2026

Mossaka changed the title ~~fix(test): resolve integration test suite failures on main~~ fix(ci): resolve integration test suite failures on main Mar 5, 2026

fix(test): use single-quoted bash -c in all integration tests for she…

fbc0fac

…ll escaping Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Conversation

Mossaka commented Mar 5, 2026

Summary

Volume Mounts (source code fix)

API Proxy Tests (test fixes)

One-Shot Token Tests (source code + test fixes)

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Mar 5, 2026

⚠️ Coverage Regression Detected

Overall Coverage

Uh oh!

github-actions bot commented Mar 5, 2026

Build Test: Node.js Results

Uh oh!

github-actions bot commented Mar 5, 2026

.NET Build Test Results

Uh oh!

github-actions bot commented Mar 5, 2026

Build Test: Deno ✅

Uh oh!

github-actions bot commented Mar 5, 2026

C++ Build Test Results

Uh oh!

github-actions bot commented Mar 5, 2026

🧪 Bun Build Test Results

Uh oh!

github-actions bot commented Mar 5, 2026

Uh oh!

github-actions bot commented Mar 5, 2026

Uh oh!

github-actions bot commented Mar 5, 2026

Rust Build Test Results

Uh oh!

github-actions bot commented Mar 5, 2026

Java Build Test Results

Uh oh!

github-actions bot commented Mar 5, 2026

Chroot Version Comparison Results

Uh oh!

github-actions bot commented Mar 5, 2026

Go Build Test Results

Uh oh!

github-actions bot commented Mar 5, 2026

Uh oh!

github-actions bot commented Mar 5, 2026

⚠️ Coverage Regression Detected

Overall Coverage

Uh oh!

github-actions bot commented Mar 5, 2026

Go Build Test Results ✅

Uh oh!

github-actions bot commented Mar 5, 2026

🧪 Build Test: Bun

Uh oh!

github-actions bot commented Mar 5, 2026

Uh oh!

github-actions bot commented Mar 5, 2026

Java Build Test Results ☕

Uh oh!

github-actions bot commented Mar 5, 2026

Chroot Version Comparison Results

Uh oh!

github-actions bot commented Mar 5, 2026

Build Test: Deno ✅

Uh oh!

github-actions bot commented Mar 5, 2026

Build Test: Bun Results ✅

Uh oh!

github-actions bot commented Mar 5, 2026

Build Test: Node.js ✅

Uh oh!

github-actions bot commented Mar 5, 2026

Go Build Test Results

Uh oh!

github-actions bot commented Mar 5, 2026

Uh oh!