[Test Coverage] network-policy.ts validation error branches by github-actions[bot] · Pull Request #6469 · github/gh-aw-firewall

github-actions · 2026-07-21T09:05:13Z

Adds 23 Jest unit tests covering all validation error branches in src/config/network-policy.ts.

What changed

New test file: src/config/network-policy-validation.test.ts

Uses jest.doMock + jest.resetModules() to inject invalid JSON at module load time, exercising every fail() call in the validation chain:

Validation function	Error paths covered
`asObject`	null, array, non-object inputs
`assertString`	empty string, non-string
`assertPort`	non-number, 0, >65535, float
`assertIpv4`	octet >255, wrong format
`assertCidr`	octet >255, prefix length >32
`parseHost`	unrecognized role, non-boolean `required`, non-boolean `dualHomed`
`parseHosts`	duplicate IP addresses
`parseDns`	empty/non-array `defaultUpstreamServers`
`parseLegacyIptables`	empty/non-array `blockedPorts`, duplicate ports, empty/non-array `blockedCidrs`, duplicate CIDRs

Coverage impact

src/config/network-policy.ts: 86.95% → 100% statements, 74.54% → 100% branches

No existing tests were modified.

Generated by Test Coverage Improver · 55.1 AIC · ⊞ 6.3K · ◷

Cover all error branches in the validate() call chain: - asObject: null, array, non-object inputs - assertString: empty string, non-string - assertPort: non-number, 0, >65535, float - assertIpv4: octet >255, wrong format - assertCidr: octet >255, prefix >32 - parseHost: unrecognized role, non-boolean required, non-boolean dualHomed - parseHosts: duplicate IP addresses - parseDns: empty/non-array defaultUpstreamServers - parseLegacyIptables: empty/non-array blockedPorts, duplicate ports, empty/non-array blockedCidrs, duplicate CIDRs Brings network-policy.ts from 86.95%/74.54% branches to 100%/100%. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Adds focused Jest coverage for all validation failure branches in the network policy loader.

Changes:

Mocks malformed policy JSON during module initialization.
Tests invalid objects, strings, ports, addresses, hosts, DNS, and iptables entries.

Show a summary per file

File	Description
`src/config/network-policy-validation.test.ts`	Adds 23 validation-error tests.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 1/1 changed files
Comments generated: 0
Review effort level: Medium

github-actions · 2026-07-21T16:49:51Z

📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-07-21T16:49:52Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

github-actions · 2026-07-21T16:49:53Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-07-21T16:49:54Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-07-21T16:49:56Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-07-21T16:49:56Z

✅ Smoke Gemini completed. All facets verified. 💎

Gemini smoke test completed with failures. Comment added to PR #6469.

github-actions · 2026-07-21T16:49:56Z

✅ Build Test Suite completed successfully!

github-actions · 2026-07-21T16:49:57Z

✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓

github-actions · 2026-07-21T16:49:57Z

🔑 Smoke Copilot PAT PAT auth validated. All systems operational. ✅

github-actions · 2026-07-21T16:49:58Z

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

github-actions · 2026-07-21T16:50:01Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

github-actions · 2026-07-21T16:50:06Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

github-actions · 2026-07-21T16:50:09Z

🔌 Smoke Services — All services reachable! ✅

github-actions · 2026-07-21T16:50:13Z

✅ Smoke Claude passed

github-actions · 2026-07-21T16:50:23Z

✅ Contribution Check completed successfully!

github-actions · 2026-07-21T16:50:28Z

✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓

github-actions · 2026-07-21T16:51:43Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	98.74%	99.01%	📈 +0.27%
Statements	98.69%	98.95%	📈 +0.26%
Functions	99.28%	99.40%	📈 +0.12%
Branches	94.95%	95.33%	📈 +0.38%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)
`src/config/network-policy.ts`	86.4% → 100.0% (+13.64%)	87.0% → 100.0% (+13.05%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-07-21T16:53:00Z

@lpcox — Smoke test: Copilot Network Isolation Egress Enforcement

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (api.github.com): HTTP 200
✅ Blocked domain (example.com): connection denied (403 via proxy)

Overall: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-07-21T16:53:17Z

🔬 Smoke Test Results — PAT Auth

Test	Status
GitHub MCP connectivity	✅ (MCP reachable, PR filtered by secrecy policy)
GitHub.com HTTP	⚠️ pre-step output not expanded (template vars unresolved)
File write/read	⚠️ pre-step output not expanded (template vars unresolved)

Note: steps.smoke-data.outputs.* variables were not substituted — the pre-agent step may not have run or outputs were not passed to this job.

Overall: PARTIAL — MCP auth ✅, pre-step data unavailable.

Auth mode: PAT (COPILOT_GITHUB_TOKEN)
Author: @lpcox

🔑 PAT report filed by Smoke Copilot PAT
_{Add label ready-for-aw to run again}

github-actions · 2026-07-21T16:53:32Z

Smoke Test: Copilot BYOK (Direct) Mode

✅ PASS - All tests passed

MCP Connectivity: ✅
GitHub.com Access: ✅ (api.github.com returns 200)
File Operations: ✅
BYOK Inference: ✅ (running in direct BYOK mode)

Running via COPILOT_PROVIDER_API_KEY → api-proxy sidecar → api.githubcopilot.com

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-07-21T16:53:43Z

Smoke Test: Claude Engine Validation

Check	Status
API	✅ PASS
GH	✅ PASS
File	✅ PASS

Overall result: PASS ✅

Generated by Smoke Claude for #6469 · 31.2 AIC · ⊞ 3.3K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-21T16:53:58Z

Support COPILOT_MODEL=auto in AWF validation and api-proxy resolution: ✅
Auto-allow topology-attached container hostnames in Squid ACL: ✅
Overall: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

github-actions · 2026-07-21T16:54:03Z

Smoke Test Results

Redis PING: ❌ (host.docker.internal DNS resolution failed)
PostgreSQL pg_isready: ❌ (no response)
PostgreSQL SELECT 1: ❌ (DNS resolution failed)

Overall: FAIL — host.docker.internal is not resolvable in this environment. Service containers are unreachable.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-07-21T16:54:18Z

Gemini Smoke Test Results

GitHub MCP Testing: ❌ (Access Denied)
GitHub.com Connectivity: ❌ (Failed)
File Writing Testing: ✅
Bash Tool Testing: ✅

Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini
_{Add label ready-for-aw to run again}

github-actions · 2026-07-21T16:54:20Z

Smoke Test: API Proxy OpenTelemetry Tracing

Scenario	Result	Notes
Module Loading	✅	`otel.js` loads successfully; exports: `startRequestSpan`, `setTokenAttributes`, `setBudgetAttributes`, `endSpan`, `endSpanError`, `shutdown`, `isEnabled`, and internal helpers
Test Suite	✅	39/39 tests passed in `otel.test.js` across all suites (module init, span creation, token attrs, parent context, ProxyAwareOtlpExporter, FileSpanExporter, FanOutSpanExporter, shutdown)
Env Var Forwarding	✅	`src/services/api-proxy-env-config.ts` forwards `GH_AW_OTLP_ENDPOINTS`, `GITHUB_AW_OTEL_TRACE_ID`, `GITHUB_AW_OTEL_PARENT_SPAN_ID` to the api-proxy container
Token Tracker Integration	✅	`onUsage` callback exists in `token-tracker-http.js` (line 285/343) as the OTEL hook point
OTEL Diagnostics	✅	No OTLP endpoint configured in this run; fallback file exporter (`/var/log/api-proxy/otel.jsonl`) active — graceful degradation working as expected

All 5 scenarios passed. OTEL tracing integration is fully operational.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-07-21T16:54:34Z

Looks good overall: the new tests are in the right place and satisfy the CONTRIBUTING.md requirement to include tests for new functionality.

The only missing guideline item is the PR description not referencing any related issue. CONTRIBUTING.md → Pull request requirements asks for a clear description and a reference to any related issues. If this change is tied to an issue, please link it in the PR body.

Generated by Contribution Check for #6469 · 1.76 AIC · ⊞ 23.6K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-21T16:55:07Z

@lpcox

✅ GitHub MCP testing
✅ GitHub.com connectivity
✅ File write/read
✅ BYOK inference

Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)

Overall: PASS

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)
_{Add label ready-for-aw to run again}

github-actions · 2026-07-21T16:55:19Z

🔬 Smoke Test Results

Test	Status
GitHub MCP connectivity	✅ MCP responded (PR data filtered by secrecy policy)
GitHub.com HTTP	⚠️ Pre-step template vars not expanded
File write/read	⚠️ Pre-step template vars not expanded

Overall: PARTIAL — MCP is reachable; pre-computed test data was not injected (workflow template variables unexpanded).

Author: @lpcox

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-07-21T16:55:52Z

Chroot Version Comparison Results ✅

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.13	✅
Node.js	v24.18.0	v24.18.0	✅
Go	go1.22.12	go1.22.12	✅

All runtimes match between host and chroot environments.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions · 2026-07-21T16:56:01Z

@lpcox

GitHub MCP testing: ✅ (pre-fetched data validated)
GitHub.com connectivity: ✅
Agent file I/O: ✅
Direct BYOK inference: ✅
Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)
Overall: PASS

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)
_{Add label ready-for-aw to run again}

github-actions · 2026-07-21T16:56:29Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	all passed	✅ PASS
Go	env	✅	all passed	✅ PASS
Go	uuid	✅	all passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	all passed	✅ PASS
Node.js	execa	✅	all passed	✅ PASS
Node.js	p-limit	✅	all passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for #6469 · 43.7 AIC · ⊞ 8.3K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-21T16:57:21Z

🔬 Smoke Test Results

Test	Status
GitHub MCP connectivity	✅ PASS
GitHub.com HTTP	⚠️ N/A (pre-step value unexpanded)
File write/read	⚠️ N/A (pre-step value unexpanded)
PR data fetch	⚠️ Filtered by secrecy policy

Overall: PASS (MCP operational; pre-step outputs not resolved in this context)

cc @lpcox

📰 BREAKING: Report filed by Smoke Docker Sbx
_{Add label ready-for-aw to run again}

lpcox marked this pull request as ready for review July 21, 2026 12:26

Copilot AI review requested due to automatic review settings July 21, 2026 12:26

Copilot started reviewing on behalf of lpcox July 21, 2026 12:27 View session

Copilot AI reviewed Jul 21, 2026

View reviewed changes

lpcox added the ready-for-aw label Jul 21, 2026

lpcox temporarily deployed to aoai-model July 21, 2026 16:50 — with GitHub Actions Inactive

github-actions Bot added the smoke-copilot-network-isolation Copilot network-isolation egress smoke test label Jul 21, 2026

github-actions Bot added the smoke-copilot-byok label Jul 21, 2026

github-actions Bot added the smoke-claude label Jul 21, 2026

github-actions Bot added the smoke-codex label Jul 21, 2026

lpcox temporarily deployed to aoai-model July 21, 2026 16:54 — with GitHub Actions Inactive

github-actions Bot added the smoke-copilot-byok-aoai-entra label Jul 21, 2026

lpcox temporarily deployed to aoai-model July 21, 2026 16:55 — with GitHub Actions Inactive

github-actions Bot added the smoke-chroot label Jul 21, 2026

github-actions Bot added the smoke-copilot-byok-aoai-apikey label Jul 21, 2026

github-actions Bot added the build-test label Jul 21, 2026

lpcox enabled auto-merge (squash) July 21, 2026 17:00

lpcox merged commit 434e0dd into main Jul 21, 2026
142 of 143 checks passed

lpcox deleted the test-coverage/network-policy-validation-ed1a3b7cc57ed5fc branch July 21, 2026 17:02

github-actions Bot mentioned this pull request Jul 23, 2026

fix(api-proxy): track token usage for aborted streaming responses #6517

Merged

Uh oh!

Conversation

github-actions Bot commented Jul 21, 2026

What changed

Coverage impact

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

github-actions Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 21, 2026

Uh oh!

github-actions Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 21, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

github-actions Bot commented Jul 21, 2026

Uh oh!

github-actions Bot commented Jul 21, 2026

🔬 Smoke Test Results — PAT Auth

Uh oh!

github-actions Bot commented Jul 21, 2026

Smoke Test: Copilot BYOK (Direct) Mode

Uh oh!

github-actions Bot commented Jul 21, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Jul 21, 2026

Uh oh!

github-actions Bot commented Jul 21, 2026

Smoke Test Results

Uh oh!

github-actions Bot commented Jul 21, 2026

Gemini Smoke Test Results

github-actions Bot commented Jul 21, 2026 •

edited

Loading

github-actions Bot commented Jul 21, 2026 •

edited

Loading

github-actions Bot commented Jul 21, 2026 •

edited

Loading

github-actions Bot commented Jul 21, 2026 •

edited

Loading

github-actions Bot commented Jul 21, 2026 •

edited

Loading

github-actions Bot commented Jul 21, 2026 •

edited

Loading

github-actions Bot commented Jul 21, 2026 •

edited

Loading

github-actions Bot commented Jul 21, 2026 •

edited

Loading

github-actions Bot commented Jul 21, 2026 •

edited

Loading

github-actions Bot commented Jul 21, 2026 •

edited

Loading

github-actions Bot commented Jul 21, 2026 •

edited

Loading

github-actions Bot commented Jul 21, 2026 •

edited

Loading

github-actions Bot commented Jul 21, 2026 •

edited

Loading

github-actions Bot commented Jul 21, 2026 •

edited

Loading

github-actions Bot commented Jul 21, 2026 •

edited

Loading