fix(multi-device-docs-tester): Chrome SUID sandbox and server unreachable from agent container by Copilot · Pull Request #46157 · github/gh-aw

Copilot · 2026-07-17T07:05:54Z

The multi-device docs tester failed every run due to two independent networking/sandbox issues caused by the agent running inside a Docker container while pre-agent steps run on the host runner.

Chrome sandbox SUID (`chrome-sandbox` mode 0777 → 4755)

Chrome refuses to launch if chrome-sandbox is present but lacks the SUID bit. The runner ships it as 0777; the Docker bind mount preserves whatever mode is set at mount time. Fix: new pre-agent step sets 4755 on the host before the container starts.

- name: Configure Chrome sandbox
  run: |
    if [ -f /opt/google/chrome/chrome-sandbox ]; then
      sudo chmod 4755 /opt/google/chrome/chrome-sandbox
    fi

Docs server unreachable from the agent container (`127.0.0.1` → `0.0.0.0`)

The preview server was bound to 127.0.0.1:4321 (host loopback). Inside the agent container, localhost resolves to the container's own loopback — a different network namespace — so every curl http://localhost:4321/… failed. Two changes:

Server bind: --host 127.0.0.1 → --host 0.0.0.0
Agent prompt: all localhost:4321 references → host.docker.internal:4321 (same pattern used by daily-byok-ollama-test)

The pre-agent TCP readiness check retains 127.0.0.1 since that step runs on the host.

Generated by 👨‍🍳 PR Sous Chef · 6.92 AIC · ⌖ 6.49 AIC · ⊞ 7.5K · ◷
_{Comment /souschef to run again}

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · 8.96 AIC · ⌖ 7.34 AIC · ⊞ 7.5K · ◷
_{Comment /souschef to run again}

Run: https://github.com/github/gh-aw/actions/runs/29727086788

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · 2.96 AIC · ⌖ 14.1 AIC · ⊞ 5.4K · ◷
_{Comment /souschef to run again}

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · 11.7 AIC · ⌖ 13.6 AIC · ⊞ 6.9K · ◷
_{Comment /souschef to run again}

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

…e docs tester - Add pre-agent step to set chrome-sandbox SUID mode (4755) before container starts - Bind docs preview server to 0.0.0.0 so it's reachable from the agent container - Update agent prompt to use host.docker.internal:4321 instead of localhost:4321 Fixes #46149 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Pull request overview

Fixes Chrome startup and host-served documentation access from the sandboxed agent container.

Changes:

Configures Chrome’s SUID sandbox before agent startup.
Exposes Astro on all interfaces and uses host.docker.internal.
Regenerates workflow lock files and action metadata.

Show a summary per file

File	Description
`.github/workflows/daily-multi-device-docs-tester.md`	Applies sandbox and networking fixes.
`.github/workflows/daily-multi-device-docs-tester.lock.yml`	Compiles the workflow changes.
`.github/workflows/skillet.lock.yml`	Refreshes generated action metadata.
`.github/workflows/release.lock.yml`	Refreshes generated action metadata.
`.github/workflows/hourly-ci-cleaner.lock.yml`	Refreshes generated action metadata.
`.github/workflows/avenger.lock.yml`	Refreshes generated action metadata.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 6/6 changed files
Comments generated: 0
Review effort level: Medium

pelikhan · 2026-07-17T08:36:05Z

@lpcox review please

gh-aw-bot · 2026-07-17T15:13:08Z

@copilot please run the pr-finisher skill, address unresolved review feedback, investigate any failed checks listed below, refresh the branch if needed, and rerun checks once ready.

Generated by pr-sous-chef: https://github.com/github/gh-aw/actions/runs/29590499747

Generated by 👨‍🍳 PR Sous Chef · 8.3 AIC · ⌖ 10.9 AIC · ⊞ 7.5K · ◷
_{Comment /souschef to run again}

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-07-17T15:29:49Z

@copilot please run the pr-finisher skill, address unresolved review feedback, investigate any failed checks listed below, refresh the branch if needed, and rerun checks once ready.

Generated by ...

Done. Here's the summary:

✅ Reviews — No unresolved review threads on this PR.
✅ Checks (local) — make fmt, make lint, make test-unit, and make recompile all pass. Recompile produced an update to smoke-call-workflow.lock.yml which has been committed.
❓ Checks (CI) — Stale after agent push; needs human re-trigger. Prior CI run (29563473612): all 22 checks passed.
✅ Mergeable — PR is open, not draft, not behind, no conflicts.

Hand-off: CI must be re-triggered by a maintainer (close/reopen PR or push) before merge.

gh-aw-bot · 2026-07-18T13:10:47Z

@copilot please run the pr-finisher skill on #46157, confirm the branch is still up to date, and summarize any remaining maintainer action after checks are re-triggered.

Generated by 👨‍🍳 PR Sous Chef · 14.9 AIC · ⌖ 6.23 AIC · ⊞ 6K · ◷
_{Comment /souschef to run again}

github-actions · 2026-07-20T07:27:13Z

🤖 PR Triage - run 29724276600

Field	Value
Category	`bug`
Risk	Low
Score	38 / 100
Action	`batch_review`

Score breakdown: Impact 20/50 - Urgency 10/30 - Quality 8/20

Rationale: Carry-over. Chrome SUID sandbox + networking fix for multi-device-docs-tester workflow. Batch: awf-workflow-fixes.

Next: Batch review alongside similar AWF workflow fixes.

Generated by 🔧 PR Triage Agent · 45.9 AIC · ⌖ 5.33 AIC · ⊞ 5.6K · ◷

pelikhan · 2026-07-20T07:28:00Z

@copilot resolve the merge conflicts on this branch.

…docs-testing-report-2026-07-17 # Conflicts: # .github/workflows/pr-sous-chef.lock.yml # .github/workflows/pr-sous-chef.md Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-07-20T07:36:42Z

@copilot resolve the merge conflicts on this branch.

Done. Merged origin/main (12 new commits). The only conflict was in pr-sous-chef.md/.lock.yml — both sides fixed the same review-thread contract strings; took main's shorter wording. Branch is clean, make recompile and tests pass.

…6-07-17

gh-aw-bot · 2026-07-20T08:19:40Z

@copilot please run the pr-finisher skill, address any unresolved review feedback, and rerun checks once the branch is up to date.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · 2.96 AIC · ⌖ 14.1 AIC · ⊞ 5.4K · ◷
_{Comment /souschef to run again}

Copilot · 2026-07-20T08:37:42Z

@copilot please run the pr-finisher skill, address any unresolved review feedback, and rerun checks once the branch is up to date.

...

Branch is current — no new commits on origin/main since the last merge. Local validation passes.

✅ Reviews — No unresolved review threads.
✅ Checks (local) — make fmt, make lint, make test-unit all pass on HEAD 30e1ddf. Working tree clean.
❓ Checks (CI) — Stale after agent push; agent pushes do not trigger workflows. Needs a human re-trigger.
✅ Mergeable — Branch is up to date with origin/main, no conflicts.

Exact maintainer action needed: close and reopen the PR (or push from a maintainer account) to trigger CI, then approve and merge once checks pass.

…6-07-17

gh-aw-bot · 2026-07-20T11:42:52Z

@copilot please run the pr-finisher skill, address any unresolved review feedback, and rerun checks once the branch is up to date.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · 11.7 AIC · ⌖ 13.6 AIC · ⊞ 6.9K · ◷
_{Comment /souschef to run again}

…docs-testing-report-2026-07-17 Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-07-20T11:54:47Z

@copilot please run the pr-finisher skill, address any unresolved review feedback, and rerun checks once the branch is up to date.

...

Branch refreshed — merged origin/main (1 new commit: eslint require-execsync-try-catch rule). No conflicts. Local validation passes.

✅ Reviews — No unresolved review threads.
✅ Checks (local) — make fmt, make lint, make test-unit all pass on the merged HEAD.
❓ Checks (CI) — Stale after agent push; agent pushes do not trigger workflows. Needs a human re-trigger.
✅ Mergeable — Branch is up to date with origin/main, no conflicts.

Exact maintainer action needed: close and reopen the PR (or push from a maintainer account) to trigger CI, then approve and merge once checks pass.

github-actions · 2026-07-20T13:02:16Z

🤖 PR Triage

Field	Value
Category	bug
Risk	🟢 low
Priority Score	52 / 100
Action	📦 `batch_review` — batch: `awf-runtime-fixes`

Score breakdown: impact 22 + urgency 18 + quality 12

Rationale: Chrome SUID sandbox and server-unreachable fixes for multi-device-docs-tester. Small, targeted change (2 files). Non-draft. No recent CI check runs visible. Good batch candidate with other AWF runtime fixes.

Run §29743972799

Generated by 🔧 PR Triage Agent · 47.4 AIC · ⌖ 5.32 AIC · ⊞ 5.6K · ◷

gh-aw-bot · 2026-07-20T18:53:05Z

@copilot please run the pr-finisher skill, address any unresolved review feedback, and rerun checks once the branch is up to date.

Run: https://github.com/github/gh-aw/actions/runs/29769168911

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · 9.71 AIC · ⌖ 5.66 AIC · ⊞ 6.9K · ◷
_{Comment /souschef to run again}

github-actions · 2026-07-20T18:54:00Z

🤖 PR Triage (updated)

Field	Value
Category	bug
Risk	🟡 medium
Priority Score	52/100
Recommended Action	`batch_review`
Batch	awf-workflow-fixes

Score breakdown: impact 26 + urgency 18 + quality 8

Carry-over. Chrome SUID sandbox + server-unreachable fix for multi-device docs tester. AI reviewer commented. Batch with other AWF runtime fixes.

Generated by 🔧 PR Triage Agent · 34.3 AIC · ⌖ 7.71 AIC · ⊞ 5.6K · ◷

…docs-testing-report-2026-07-17 Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-07-20T19:04:04Z

@copilot please run the pr-finisher skill, address any unresolved review feedback, and rerun checks once the branch is up to date.

Run: https://github.com/github/gh-aw/actions/runs/29769168911...

Branch refreshed — merged origin/main (19 new commits). No conflicts. Local validation passes (make fmt, make lint, make test-unit all green).

✅ Reviews — No unresolved review threads.
✅ Checks (local) — All pass on the merged HEAD.
❓ Checks (CI) — Stale after agent push; agent pushes do not trigger workflows. Needs a human re-trigger.
✅ Mergeable — Branch is up to date with origin/main, no conflicts.

Exact maintainer action needed: close and reopen the PR (or push from a maintainer account) to trigger CI, then approve and merge once checks pass.

Initial plan

331fe82

Copilot AI assigned Copilot and pelikhan Jul 17, 2026

Copilot started work on behalf of pelikhan July 17, 2026 07:06 View session

Copilot AI linked an issue Jul 17, 2026 that may be closed by this pull request

🔍 Multi-Device Docs Testing Report - 2026-07-17 #46149

Closed

Copilot AI and others added 2 commits July 17, 2026 07:20

chore: plan for multi-device docs tester fixes

b5dd925

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix multi-device validation errors for testing report~~ fix(multi-device-docs-tester): Chrome SUID sandbox and server unreachable from agent container Jul 17, 2026

Copilot finished work on behalf of pelikhan July 17, 2026 07:34

Copilot AI requested a review from pelikhan July 17, 2026 07:34

pelikhan marked this pull request as ready for review July 17, 2026 08:31

Copilot AI review requested due to automatic review settings July 17, 2026 08:31

Copilot started reviewing on behalf of pelikhan July 17, 2026 08:32 View session

Copilot AI reviewed Jul 17, 2026

View reviewed changes

pelikhan added the awf label Jul 17, 2026

github-actions Bot added pr-action:batch_review pr-agent:copilot pr-priority:medium pr-risk:low pr-type:bug labels Jul 17, 2026

github-actions Bot mentioned this pull request Jul 17, 2026

[pr-sous-chef] Run report — 0 nudged, 0 skipped #46103

Closed

Copilot started work on behalf of gh-aw-bot July 17, 2026 15:13 View session

chore: recompile workflows

6c381cd

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot July 17, 2026 15:30

Copilot AI requested a review from gh-aw-bot July 17, 2026 15:30

github-actions Bot mentioned this pull request Jul 18, 2026

[pr-sous-chef] Run report — 0 nudged, 0 skipped #46313

Closed

Copilot finished work on behalf of gh-aw-bot July 20, 2026 04:57

github-actions Bot added the pr-batch:awf-workflow-fixes label Jul 20, 2026

github-actions Bot mentioned this pull request Jul 20, 2026

[PR Triage Report] PR Triage Report — 2026-07-20 (Run 29724276600) #46749

Closed

Copilot started work on behalf of pelikhan July 20, 2026 07:28 View session

Copilot AI and others added 2 commits July 20, 2026 07:34

Merge remote-tracking branch 'origin/main' into copilot/multi-device-…

086fffb

…docs-testing-report-2026-07-17 # Conflicts: # .github/workflows/pr-sous-chef.lock.yml # .github/workflows/pr-sous-chef.md Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

chore: merge origin/main and recompile lock files (12 new commits)

6f6f62d

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan July 20, 2026 07:37

Merge branch 'main' into copilot/multi-device-docs-testing-report-202…

30e1ddf

…6-07-17

Copilot started work on behalf of gh-aw-bot July 20, 2026 08:20 View session

Copilot finished work on behalf of gh-aw-bot July 20, 2026 08:38

Merge branch 'main' into copilot/multi-device-docs-testing-report-202…

d7fbf7b

…6-07-17

Copilot started work on behalf of gh-aw-bot July 20, 2026 11:43 View session

Merge remote-tracking branch 'origin/main' into copilot/multi-device-…

f3b8815

…docs-testing-report-2026-07-17 Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot July 20, 2026 11:55

github-actions Bot added the pr-batch:awf-runtime-fixes label Jul 20, 2026

github-actions Bot mentioned this pull request Jul 20, 2026

[PR Triage Report] PR Triage Report — 2026-07-20 · Run §29743972799 #46832

Open

Copilot started work on behalf of gh-aw-bot July 20, 2026 18:53 View session

Merge remote-tracking branch 'origin/main' into copilot/multi-device-…

bc56f31

…docs-testing-report-2026-07-17 Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot July 20, 2026 19:04

Uh oh!

Conversation

Copilot AI commented Jul 17, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Chrome sandbox SUID (chrome-sandbox mode 0777 → 4755)

Docs server unreachable from the agent container (127.0.0.1 → 0.0.0.0)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

pelikhan commented Jul 17, 2026

Uh oh!

gh-aw-bot commented Jul 17, 2026

Uh oh!

Copilot AI commented Jul 17, 2026

Uh oh!

gh-aw-bot commented Jul 18, 2026

Uh oh!

github-actions Bot commented Jul 20, 2026

🤖 PR Triage - run 29724276600

Uh oh!

pelikhan commented Jul 20, 2026

Uh oh!

Copilot AI commented Jul 20, 2026

Uh oh!

gh-aw-bot commented Jul 20, 2026

Uh oh!

Copilot AI commented Jul 20, 2026

Uh oh!

gh-aw-bot commented Jul 20, 2026

Uh oh!

Copilot AI commented Jul 20, 2026

Uh oh!

github-actions Bot commented Jul 20, 2026

🤖 PR Triage

Uh oh!

gh-aw-bot commented Jul 20, 2026

Uh oh!

github-actions Bot commented Jul 20, 2026

🤖 PR Triage (updated)

Uh oh!

Copilot AI commented Jul 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Jul 17, 2026 •

edited by github-actions Bot

Loading

Chrome sandbox SUID (`chrome-sandbox` mode 0777 → 4755)

Docs server unreachable from the agent container (`127.0.0.1` → `0.0.0.0`)