fix: skip node --version check under QEMU emulation in agent Dockerfile by lpcox · Pull Request #3136 · github/gh-aw-firewall

lpcox · 2026-05-14T13:08:53Z

Problem

The Release workflow fails at the "Build Agent Image" job when building the linux/arm64 image. Node.js 22.22.2 segfaults when running under QEMU arm64 emulation:

#11 226.2 Setting up nodejs (22.22.2-1nodesource1) ...
#11 226.3 qemu: uncaught target signal 11 (Segmentation fault) - core dumped
#11 227.1 ERROR: Node.js 22 not installed correctly

Failed run: https://github.com/github/gh-aw-firewall/actions/runs/25843758602/job/75934292564

Root Cause

The node --version verification check in the Dockerfile runs the Node.js binary during docker buildx cross-compilation. Under QEMU emulation (x86_64 host building arm64 image), the arm64 Node.js binary segfaults — this is a known QEMU/Node.js incompatibility.

Fix

Detect QEMU emulation via /dev/.buildkit_qemu_emulator (injected by BuildKit) and:

Skip the pre-install node --version check (always install fresh)
Replace the post-install node --version verification with dpkg -l nodejs package check
On native builds, behavior is unchanged

The apt-get install -y nodejs succeeding is sufficient proof the package installed correctly; the dpkg check confirms the right version was unpacked.

Node.js 22.22.2 segfaults when running under QEMU arm64 emulation (buildkit_qemu_emulator), causing the agent Docker image arm64 build to fail during the release workflow. The fix detects QEMU emulation via /dev/.buildkit_qemu_emulator and skips the node --version verification, falling back to dpkg package verification instead. The apt-get install succeeding is sufficient proof the package installed correctly. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-05-14T13:11:30Z

🔬 Smoke Test: Copilot BYOK (Offline) Mode

Test	Result
GitHub MCP connectivity	❌ 401 (unauthenticated)
GitHub.com HTTP	⚠️ Pre-step data not injected (template vars unexpanded)
File write/read	⚠️ Pre-step data not injected (template vars unexpanded)
BYOK inference (agent → api-proxy → api.githubcopilot.com)	✅

Running in BYOK offline mode (COPILOT_OFFLINE=true) via api-proxy → api.githubcopilot.com.

Overall: PARTIAL — BYOK inference works, but pre-step data was not injected and GitHub MCP is unauthenticated. Workflow needs steps.smoke-data outputs wired correctly.

/cc @lpcox

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-05-14T13:11:34Z

🔬 Smoke Test Results

Test	Status
GitHub MCP connectivity	❌ (401 — MCP token not authenticated in this run)
GitHub.com HTTP connectivity	✅ 200
File write/read	⚠️ Pre-step template vars not resolved

Overall: FAIL — GitHub MCP returned 401; pre-step smoke data was not injected into the prompt.

Author: @lpcox

📰 BREAKING: Report filed by Smoke Copilot

Copilot

Pull request overview

Updates the agent image build to avoid running the arm64 node binary during buildx cross-builds under QEMU emulation, which can segfault and break the release workflow’s linux/arm64 image build.

Changes:

Detects QEMU emulation during docker build and skips the pre-existing Node 22 presence check to force a clean install.
Replaces the post-install node --version verification with a package-based check when under QEMU.
Preserves the existing native-build verification behavior (node --version / npx --version).

Show a summary per file

File	Description
`containers/agent/Dockerfile`	Adds QEMU detection and adjusts Node.js verification logic to prevent `node --version` from running under emulation.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 1/1 changed files
Comments generated: 1

+        # Verify Node.js 22 was installed correctly (skip under QEMU — node segfaults)
+        if [ "$UNDER_QEMU" = "true" ]; then \
+            echo "Skipping node --version check (QEMU emulation detected)" && \
+            dpkg -l nodejs | grep -q "22\." || (echo "ERROR: nodejs 22 package not installed" && exit 1); \


github-actions · 2026-05-14T13:11:38Z

Smoke Test Results

❌ GitHub API: HTTP 401 authentication error
✅ Playwright: GitHub page title confirmed
✅ File verify: Smoke test file present

Overall: FAIL — 2/3 tests passed

💥 [THE END] — Illustrated by Smoke Claude

github-actions · 2026-05-14T13:12:34Z

Smoke Test Results

GitHub MCP: ❌ (mcpscripts tool missing)
GitHub.com Connectivity: ❌ (Status 000/SSL error)
File Writing: ✅
Bash Tool: ✅

Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini

github-actions · 2026-05-14T13:12:44Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	❌	N/A	❌ FAIL
Java	caffeine	❌	N/A	❌ FAIL
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 7/8 ecosystems passed — ❌ FAIL

❌ Failure Details

Java (gson, caffeine) — Both projects failed because Maven cannot download dependencies from repo.maven.apache.org (network unreachable in the sandbox environment):

Could not transfer artifact org.apache.maven.plugins:maven-resources-plugin:pom:3.4.0
from/to central (https://repo.maven.apache.org/maven2): Network is unreachable

This appears to be a network isolation issue: Maven needs access to the Maven Central repository but the sandbox does not allow outbound connections to repo.maven.apache.org. The JAVA_TOOL_OPTIONS proxy settings (squid-proxy:3128) are present but the proxy is not reachable from this environment either.

Generated by Build Test Suite for issue #3136 · ● 5.1M · ◷

github-actions · 2026-05-14T13:12:48Z

Smoke Codex: FAIL
✅ PRs: fix: skip node --version check under QEMU emulation in agent Dockerfile; fix: remove unused public exports and normalize test-only access
❌ safeinputs-gh: command unavailable
✅ Playwright: title contains GitHub
❌ Tavily: no search tool exposed
✅ File/bash: temp file verified
❌ Discussion: query tool unavailable
✅ Build: npm ci && npm run build
Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-05-14T13:13:53Z

Smoke Test Results

Check	Result
Redis PING	❌ Timeout (port 6379 unreachable)
PostgreSQL pg_isready	❌ No response (port 5432 unreachable)
PostgreSQL SELECT 1	❌ Could not connect

host.docker.internal resolves to 172.17.0.1 but both ports timed out — service containers are not accessible from this runner.

Overall: FAIL

🔌 Service connectivity validated by Smoke Services

lpcox requested a review from Mossaka as a code owner May 14, 2026 13:08

Copilot AI review requested due to automatic review settings May 14, 2026 13:08

Copilot started reviewing on behalf of lpcox May 14, 2026 13:09 View session

lpcox merged commit 5089336 into main May 14, 2026
49 of 53 checks passed

lpcox deleted the fix/agent-dockerfile-qemu-segfault branch May 14, 2026 13:11

Copilot AI reviewed May 14, 2026

View reviewed changes

github-actions Bot mentioned this pull request May 14, 2026

[aw] No-Op Runs #2911

Open

lpcox mentioned this pull request May 14, 2026

Bump AWF firewall to v0.25.46 github/gh-aw#32123

Closed

Copilot AI mentioned this pull request May 14, 2026

chore: bump AWF firewall to v0.25.46 github/gh-aw#32126

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: skip node --version check under QEMU emulation in agent Dockerfile#3136

fix: skip node --version check under QEMU emulation in agent Dockerfile#3136
lpcox merged 1 commit into
mainfrom
fix/agent-dockerfile-qemu-segfault

lpcox commented May 14, 2026

Uh oh!

Uh oh!

github-actions Bot commented May 14, 2026

Uh oh!

github-actions Bot commented May 14, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented May 14, 2026

Uh oh!

github-actions Bot commented May 14, 2026

Uh oh!

github-actions Bot commented May 14, 2026

Uh oh!

github-actions Bot commented May 14, 2026

Uh oh!

github-actions Bot commented May 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

lpcox commented May 14, 2026

Problem

Root Cause

Fix

Uh oh!

Uh oh!

github-actions Bot commented May 14, 2026

🔬 Smoke Test: Copilot BYOK (Offline) Mode

Uh oh!

github-actions Bot commented May 14, 2026

🔬 Smoke Test Results

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

github-actions Bot commented May 14, 2026

Smoke Test Results

Uh oh!

github-actions Bot commented May 14, 2026

Smoke Test Results

Uh oh!

github-actions Bot commented May 14, 2026

🏗️ Build Test Suite Results

❌ Failure Details

Uh oh!

github-actions Bot commented May 14, 2026

Uh oh!

github-actions Bot commented May 14, 2026

Smoke Test Results

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants