Support self-hosted runner toolcache in chroot PATH resolution#3545
Conversation
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (2 files)
Coverage comparison generated by |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
There was a problem hiding this comment.
Pull request overview
This PR extends AWF chroot support for self-hosted GitHub Actions runners where language runtimes (notably Node.js) may be installed under $HOME/work/_tool, by ensuring that directory is mounted into the agent container and included in chroot PATH discovery.
Changes:
- Add an optional read-only bind mount for
${HOME}/work/_toolwhen present. - Refactor
entrypoint.shtoolcache PATH scanning to handle multiple toolcache roots. - Extend chroot PATH-ordering tests to cover discovery and fallback resolution of
nodefrom the self-hosted toolcache layout.
Show a summary per file
| File | Description |
|---|---|
| tests/chroot-path-ordering.test.sh | Adds fixtures and assertions to validate _tool/node/.../bin is appended and usable as a PATH fallback. |
| src/services/agent-volumes.ts | Conditionally mounts $HOME/work/_tool into /host... for chroot visibility. |
| src/services/agent-volumes.test.ts | Adds unit coverage for presence/absence of the optional toolcache bind mount. |
| containers/agent/entrypoint.sh | Introduces append_toolcache_bins and scans both hosted + self-hosted toolcache roots for PATH fallback entries. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 4/4 changed files
- Comments generated: 3
| @@ -786,7 +790,9 @@ if [ -d "/opt/hostedtoolcache" ]; then | |||
| done | |||
| done | |||
| done | |||
| fi | |||
| } | |||
| append_toolcache_bins "/opt/hostedtoolcache" | |||
| append_toolcache_bins "/home/runner/work/_tool" | |||
| echo "[entrypoint][ERROR] Ensure Node.js is installed on the runner and reachable from PATH inside the chroot." >&2 | ||
| echo "[entrypoint][ERROR] If using setup-node or nvm, verify the install path is present and bind-mounted into /host." >&2 | ||
| echo "[entrypoint][ERROR] Example locations include /opt/hostedtoolcache/... and $HOME/.nvm/..." >&2 | ||
| echo "[entrypoint][ERROR] Example locations include /opt/hostedtoolcache/..., /home/runner/work/_tool/..., and $HOME/.nvm/..." >&2 |
| if (fs.existsSync(runnerToolCacheDir)) { | ||
| agentVolumes.push(`${runnerToolCacheDir}:/host${runnerToolCacheDir}:ro`); |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
|
@copilot address review feedback |
Addressed all three review findings in commit
|
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
|
@copilot fix this failed ci check https://github.com/github/gh-aw-firewall/actions/runs/26246016695/job/77245065921?pr=3545 |
The The Smoke Claude CI failure (job 77245065921) is unrelated to our code changes — our changes only affect chroot mode and the |
Smoke Test Results✅ GitHub API: 2 PR entries confirmed OVERALL: PASS
|
🔥 Smoke Test: Copilot BYOK (Offline) Mode
Running in BYOK offline mode ( Overall: PASS (core BYOK path verified ✅) PR by
|
🧪 Smoke Test Results
PR: "Support self-hosted runner toolcache in chroot PATH resolution" Overall: PARTIAL — MCP ✅, pre-step outputs were not substituted (template vars literal).
|
Smoke Test Results
Overall status: FAIL Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "localhost"See Network Configuration for more information.
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — ✅ PASS
|
Smoke Codex: FAILPRs: docs: credential exclusion requires apiProxy.enabled; fix(squid): chown bind-mounted log dirs to proxy user on startup Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "registry.npmjs.org"See Network Configuration for more information.
|
Chroot Version Comparison Results
Overall: ❌ Not all versions match — Python and Node.js differ between host and chroot environments.
|
Smoke Test Results — FAIL
Overall: ❌ FAIL
|
Self-hosted runners can install Node.js under
$HOME/work/_tool, which AWF did not mount or scan inside the chroot. That leftnodeundiscoverable for Copilot-engine workflows even though the runtime was present on the host.Volume mounts
${HOME}/work/_tool.Chroot PATH discovery
containers/agent/entrypoint.shto cover both:/opt/hostedtoolcache/home/runner/work/_tool$GITHUB_PATHentries still win; discovered toolcache bins remain fallback entries.Targeted coverage
${HOME}/work/_toolmount._tool/node/.../binis discovered and usable as a fallback.