refactor: split host-iptables-setup.test.ts into focused test modules#5571
Conversation
There was a problem hiding this comment.
Pull request overview
This PR refactors the host-level iptables setup unit tests by splitting the previously monolithic src/host-iptables-setup.test.ts into smaller, focused test modules, improving navigability and failure isolation for the L3/L4 security boundary behavior.
Changes:
- Replaced the single large host iptables setup test file with five focused, independently-runnable test suites.
- Moved port-spec validation, CLI proxy integration, IPv6 DNS handling, and error/cleanup-path coverage into dedicated test modules.
- Slimmed
host-iptables-setup-core.test.tsto only cover core chain installation behavior.
Show a summary per file
| File | Description |
|---|---|
| src/host-iptables-setup.test.ts | Removed monolithic test file in favor of focused suites. |
| src/host-iptables-setup-core.test.ts | Retains core setupHostIptables chain installation coverage and drops unrelated cases. |
| src/host-iptables-setup-validation.test.ts | Adds focused coverage for isValidPortSpec and empty-entry parsing in allowHostPorts. |
| src/host-iptables-setup-proxy.test.ts | Adds focused coverage for cliProxyConfig gateway allow rules and bridge gateway resolution behavior. |
| src/host-iptables-setup-ipv6.test.ts | Adds focused coverage for IPv6 DNS server handling and FW_WRAPPER_V6 lifecycle behavior. |
| src/host-iptables-setup-errors.test.ts | Adds focused coverage for failure paths (DOCKER-USER creation) and cleanup resilience. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 5/5 changed files
- Comments generated: 2
- Review effort level: Low
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
|
✅ Copilot review passed with no inline comments. @copilot Add the |
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (1 files)
Coverage comparison generated by |
|
✅ Smoke Gemini completed. All facets verified. 💎 Smoke test completed with FAIL status. Connectivity and GitHub MCP tools were not available. |
|
✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓 |
|
✅ Smoke Claude passed |
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓 |
|
📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅ |
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤 |
|
🔌 Smoke Services — All services reachable! ✅ |
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded. |
|
✅ Build Test Suite completed successfully! |
|
🔑 Smoke Copilot PAT PAT auth validated. All systems operational. ✅ |
|
🚀 Security Guard has started processing this pull request |
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 |
|
❌ Contribution Check failed. Please review the logs for details. |
|
✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓 |
Smoke Test: Claude Engine Validation
Overall result: PASS
|
Smoke Test: Copilot BYOK (Direct) — PASS ✅Test Results:
Mode: Direct BYOK (COPILOT_PROVIDER_API_KEY via api-proxy sidecar) Authors:
|
|
Smoke Test Results:
Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) Overall: PASS
|
🔥 Smoke Test: Copilot PAT Auth — PASS
Overall: PASS · Auth mode: PAT (COPILOT_GITHUB_TOKEN) PR: refactor: split host-iptables-setup.test.ts into focused test modules ·
|
🧪 Smoke Test ResultsPR: refactor: split host-iptables-setup.test.ts into focused test modules
Overall: PASS (functional tests passed; file test skipped due to workflow template substitution issue)
|
|
Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra Overall: PASS
|
|
Merged PRs:
Tests: GitHub reads ✅ | Playwright ✅ | File write ✅ | Discussion ✅ | Build ✅ Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "registry.npmjs.org"See Network Configuration for more information.
|
Gemini Smoke Test Results
Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "localhost"See Network Configuration for more information.
|
Chroot Version Comparison
Result: Not all tests passed — Python and Node.js versions differ between host and chroot.
|
Smoke Test Results — FAIL
Overall: FAIL — TCP connections to ports 6379 and 5432 on
|
Smoke Test: API Proxy OpenTelemetry Tracing
Overall: All scenarios pass or match expected-pending behavior.
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — ✅ PASS
|
src/host-iptables-setup.test.ts(579 lines) mixed seven independent testing concerns for the L3/L4 security boundary, making it hard to navigate and diagnose failures in isolation.Changes
Deleted the monolithic file and replaced it with five focused modules, each independently runnable:
host-iptables-setup-core.test.ts— coresetupHostIptableschain installation (11 tests, ~301 lines of original coverage)host-iptables-setup-validation.test.ts—isValidPortSpec+ empty-entryallowHostPortsedge case (4 tests)host-iptables-setup-proxy.test.ts—cliProxyConfig/ DIFC proxy integration variant (3 tests)host-iptables-setup-ipv6.test.ts— IPv6 DNS server handling andFW_WRAPPER_V6lifecycle (3 tests)host-iptables-setup-errors.test.ts—DOCKER-USERchain creation failure + cleanup resilience (2 tests)Shared test infrastructure (
host-iptables-test-setup.ts,host-iptables-rules.test-utils.ts,host-iptables-shared.test-utils.ts) is unchanged; each new file re-imports only the helpers it uses. All 27 tests pass.