Grant Smoke Claude artifact-read permission by Copilot · Pull Request #3632 · github/gh-aw-firewall

Copilot · 2026-05-23T16:55:38Z

The scheduled Smoke Claude workflow was failing before agent execution because the agent job could not download the activation artifact. This updates the workflow permissions so the job can read Actions artifacts consistently with the other smoke workflows.

Root cause
- Smoke Claude granted contents, issues, and pull-requests access, but not actions: read.
- The failure surfaced at Download activation artifact even though the activation job had already uploaded the artifact.
Workflow change
- Added actions: read to the source workflow in .github/workflows/smoke-claude.md.
- Propagated the same permission into the compiled lockfile in .github/workflows/smoke-claude.lock.yml.
Regression coverage
- Extended scripts/ci/smoke-claude-workflow.test.ts to assert that both the source workflow and compiled workflow retain actions: read.

permissions:
  actions: read
  contents: read
  issues: read
  pull-requests: read

github-actions · 2026-05-23T17:19:09Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	96.06%	96.13%	📈 +0.07%
Statements	95.89%	95.96%	📈 +0.07%
Functions	97.96%	97.96%	➡️ +0.00%
Branches	89.60%	89.64%	📈 +0.04%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
`src/config-writer.ts`	83.0% → 85.6% (+2.54%)	83.0% → 85.6% (+2.54%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copilot

Pull request overview

Updates the Smoke Claude agentic workflow permissions so the agent job can consistently download Actions artifacts (specifically the activation artifact), aligning it with the other smoke workflows and preventing pre-agent failures.

Changes:

Add actions: read to the source workflow permissions in .github/workflows/smoke-claude.md.
Add actions: read to the compiled workflow’s agent job permissions in .github/workflows/smoke-claude.lock.yml.
Extend the CI test to assert the presence of actions: read in both source and compiled workflow files.

Show a summary per file

File	Description
scripts/ci/smoke-claude-workflow.test.ts	Adds assertions intended to prevent regressions in workflow permissions/config.
.github/workflows/smoke-claude.md	Grants `actions: read` at the source workflow level.
.github/workflows/smoke-claude.lock.yml	Grants `actions: read` to the `agent` job so artifact download can succeed.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 3/3 changed files
Comments generated: 1

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

github-actions · 2026-05-23T19:40:26Z

Smoke Test Results

✅ GitHub MCP: Retrieved PR fix(claude-token-optimizer): resolve workflow file via .lock.yml when .md lacks name field #3633 ("fix(claude-token-optimizer): resolve workflow file via .lock.yml...")
❌ GitHub.com Connectivity: Placeholder test not executed (pre-step data missing)
❌ File Write/Read: File not found at test path

Status: ⚠️ PARTIAL (MCP operational, external tests incomplete)

cc @lpcox @Copilot

📰 BREAKING: Report filed by Smoke Copilot

lpcox · 2026-05-23T20:02:49Z

@copilot recompile smoke claude

Copilot · 2026-05-23T20:13:21Z

@copilot recompile smoke claude

Recompiled smoke-claude and updated .github/workflows/smoke-claude.lock.yml in commit c8e9b76.

lpcox · 2026-05-23T20:30:26Z

@copilot compile smoke claude

Copilot · 2026-05-23T20:35:50Z

@copilot compile smoke claude

Compiled smoke-claude and ran post-processing; no file changes were produced because the lockfile is already up to date at c8e9b76.

github-actions · 2026-05-23T20:38:50Z

Smoke Test Results ✅

✅ GitHub API: 2 recent PRs verified (PR Refactor agent volume assembly into focused mount modules #3638, PR Refactor Squid config generation into focused modules #3637)
✅ GitHub check: playwright_check=✅ PASS confirmed
✅ File verification: Smoke test file exists and validates pass

Overall: All smoke test validations passed. Claude engine is ready.

💥 [THE END] — Illustrated by Smoke Claude

github-actions · 2026-05-23T20:39:11Z

✅ Smoke Test: Copilot BYOK (Offline) Mode — PASS

✅ MCP GitHub API — Retrieved PR Refactor agent volume assembly into focused mount modules #3638: "Refactor agent volume assembly into focused mount modules"
✅ GitHub.com connectivity — HTTP 200 from github.com
✅ File write/read — Verified /tmp/gh-aw/agent/smoke-test-copilot-byok-26342953577.txt content
✅ BYOK inference — Running in offline mode (COPILOT_OFFLINE=true) via api-proxy → api.githubcopilot.com

Note: Running in BYOK offline mode (COPILOT_OFFLINE=true) via api-proxy → api.githubcopilot.com

PR Author: @Copilot | Assignees: @lpcox, @Copilot

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-05-23T20:40:01Z

Merged PRs: ✅ Refactor agent volume assembly into focused mount modules; Refactor Squid config generation into focused modules
SafeInputs GH CLI: ❌ safeinputs-gh unavailable
Playwright: ✅ GitHub title verified
Tavily search: ❌ no search tool exposed
File write: ✅ /tmp/gh-aw/agent/smoke-test-codex-26342953575.txt
Bash readback: ✅
Discussion: ✅ #3654 commented
Build: ✅ npm ci && npm run build
Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-05-23T20:41:11Z

Gemini Engine Smoke Test Results

PR Titles Reviewed:

Refactor agent volume assembly into focused mount modules (Refactor agent volume assembly into focused mount modules #3638)
Refactor Squid config generation into focused modules (Refactor Squid config generation into focused modules #3637)

Test Results:

✅ GitHub MCP Testing
✅ GitHub.com Connectivity
✅ File Writing Testing
✅ Bash Tool Testing

Overall Status: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini

github-actions · 2026-05-23T20:41:51Z

Service Connectivity Test Results

❌ Redis - Connection timeout (no PONG response)
❌ PostgreSQL pg_isready - No response from server
❌ PostgreSQL SELECT 1 - Not tested (pg_isready failed)

Overall Result: ❌ FAIL

Services on host.docker.internal are not reachable from the AWF sandbox.

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-05-23T20:42:56Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	passed	✅ PASS
Go	env	✅	passed	✅ PASS
Go	uuid	✅	passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	All passed	✅ PASS
Node.js	execa	✅	All passed	✅ PASS
Node.js	p-limit	✅	All passed	✅ PASS
Rust	fd	✅	1 passed	✅ PASS
Rust	zoxide	✅	1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Summary:

✅ All 18 projects compiled/built successfully
✅ All test suites passed
✅ All ecosystems validated (Bun, C++, Deno, .NET, Go, Java, Node.js, Rust)

Generated by Build Test Suite for issue #3632 · ● 10.1M · ◷

Initial plan

1400187

Copilot AI assigned Copilot and lpcox May 23, 2026

Copilot started work on behalf of lpcox May 23, 2026 16:55 View session

Copilot AI linked an issue May 23, 2026 that may be closed by this pull request

[aw] Smoke Claude failed #3628

Open

fix: grant smoke claude workflow artifact read permission

b47d48c

Copilot AI changed the title ~~[WIP] Debug workflow failure for Smoke Claude~~ Grant Smoke Claude artifact-read permission May 23, 2026

Copilot finished work on behalf of lpcox May 23, 2026 17:00

Copilot AI requested a review from lpcox May 23, 2026 17:00

lpcox marked this pull request as ready for review May 23, 2026 17:17

Copilot AI review requested due to automatic review settings May 23, 2026 17:18

Copilot started reviewing on behalf of lpcox May 23, 2026 17:18 View session

github-actions Bot mentioned this pull request May 23, 2026

[aw] Smoke Claude failed #3639

Open

This comment has been minimized.

Sign in to view

Copilot AI reviewed May 23, 2026

View reviewed changes

Comment thread scripts/ci/smoke-claude-workflow.test.ts Outdated

github-actions Bot mentioned this pull request May 23, 2026

[aw] Smoke OpenCode failed #3641

Open

This comment has been minimized.

Sign in to view

github-actions Bot added the build-test label May 23, 2026

Potential fix for pull request finding

d58f1d5

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

This comment has been minimized.

Sign in to view

Copilot started work on behalf of lpcox May 23, 2026 20:02 View session

chore: recompile smoke-claude lock workflow

c8e9b76

Copilot finished work on behalf of lpcox May 23, 2026 20:13

Copilot started work on behalf of lpcox May 23, 2026 20:30 View session

Copilot finished work on behalf of lpcox May 23, 2026 20:36

Merge branch 'main' into copilot/debug-smoke-claude-failure

0061659

github-actions Bot added the smoke-claude label May 23, 2026

github-actions Bot added the smoke-copilot-byok label May 23, 2026

github-actions Bot added the smoke-gemini label May 23, 2026

github-actions Bot mentioned this pull request May 23, 2026

[aw] Smoke Copilot failed #3655

Open

lpcox closed this May 23, 2026

Conversation

Copilot AI commented May 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented May 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Coverage Check Passed

Overall Coverage

Uh oh!

This comment has been minimized.

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

github-actions Bot commented May 23, 2026

Smoke Test Results

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

lpcox commented May 23, 2026

Uh oh!

Copilot AI commented May 23, 2026

Uh oh!

lpcox commented May 23, 2026

Uh oh!

Copilot AI commented May 23, 2026

Uh oh!

github-actions Bot commented May 23, 2026

Smoke Test Results ✅

Uh oh!

github-actions Bot commented May 23, 2026

✅ Smoke Test: Copilot BYOK (Offline) Mode — PASS

Uh oh!

github-actions Bot commented May 23, 2026

Uh oh!

github-actions Bot commented May 23, 2026

Gemini Engine Smoke Test Results

Uh oh!

github-actions Bot commented May 23, 2026

Service Connectivity Test Results

Overall Result: ❌ FAIL

Uh oh!

github-actions Bot commented May 23, 2026

🏗️ Build Test Suite Results

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented May 23, 2026 •

edited

Loading

github-actions Bot commented May 23, 2026 •

edited

Loading