Make isNonPortableDns internal to dns-resolver

[Copilot]

isNonPortableDns was exported from src/dns-resolver.ts but had no external runtime consumers, unnecessarily widening the module API surface. This change reduces public surface area while preserving resolver behavior.

• API surface cleanup

  • Removed the export modifier from isNonPortableDns so it remains an internal helper used by filterForNetworkIsolation.

• Test alignment with public contract

  • Updated src/dns-resolver.test.ts to stop importing/testing isNonPortableDns directly.
  • Kept behavior coverage through filterForNetworkIsolation tests, which exercise the same non-portable DNS filtering paths via the public API.

// before
export function isNonPortableDns(ip: string): boolean { ... }

// after
function isNonPortableDns(ip: string): boolean { ... }

• Fixes [Export Audit] Unused export: isNonPortableDns in dns-resolver.ts #7182

[Copilot]

Pull request overview

Narrows the DNS resolver API without changing runtime behavior.

Changes:

• Makes isNonPortableDns private to dns-resolver.
• Retains behavioral coverage through public filterForNetworkIsolation tests.

Show a summary per file

File	Description
src/dns-resolver.ts	Removes the helper’s export modifier.
src/dns-resolver.test.ts	Removes direct internal-helper tests and import.

Review details

Tip

Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Balanced

[github-actions]

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

[github-actions]

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	94.12%	94.14%	📈 +0.02%
Statements	93.06%	93.08%	📈 +0.02%
Functions	93.92%	93.92%	➡️ +0.00%
Branches	86.26%	86.28%	📈 +0.02%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
src/log-directory-setup.ts	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[github-actions]

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation

[github-actions]

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

🔑 BYOK report filed by Smoke Copilot BYOK

[github-actions]

❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

[github-actions]

✅ Contribution Check completed successfully!

Contribution check complete for PR #7192: no issues found against CONTRIBUTING.md. The PR keeps the helper internal, updates tests to the public API, and already references the related issue (#7182).

Generated by Contribution Check for #7192

[github-actions]

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

📡 OTel tracing validated by Smoke OTel Tracing

[github-actions]

❌ Smoke Gemini reports failed. Facets need polishing...

💎 Faceted by Smoke Gemini

[github-actions]

📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Docker Sbx

[github-actions]

❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

[github-actions]

🔌 Smoke Services — All services reachable! ✅

🔌 Service connectivity validated by Smoke Services

[github-actions]

🚀 Security Guard has started processing this pull request

[github-actions]

✅ Build Test Suite completed successfully!

Generated by Build Test Suite for #7192

[github-actions]

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Copilot

[github-actions]

✅ Smoke Claude passed

Generated by Smoke Claude for #7192

[github-actions]

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

Warning

Firewall blocked 5 domains

The following domains were blocked by the firewall during workflow execution:

• msfeed12.pkgs.visualstudio.com
• msfeed17.pkgs.visualstudio.com
• msfeed2.pkgs.visualstudio.com
• msfeed25.pkgs.visualstudio.com
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "msfeed12.pkgs.visualstudio.com"
    - "msfeed17.pkgs.visualstudio.com"
    - "msfeed2.pkgs.visualstudio.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

[github-actions]

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

Tested by Smoke Chroot

[github-actions]

@lpcox Copilot network isolation egress smoke test results:

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (api.github.com) reachable — HTTP 200
✅ Non-allowed domain (example.com) blocked — CONNECT tunnel 403

Overall: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Copilot BYOK (Direct) Mode

• MCP: PR ci: run Firecracker live smoke on hosted Ubuntu #7194 (ci: run Firecracker live smoke on hosted Ubuntu), PR Add B21/B22/B23 self-hosted failure-mode lessons to runner-doctor catalog #7175 (Add B21/B22/B23 self-hosted failure-mode lessons) ✅
• GitHub.com connectivity (HTTP 200): ✅
• File write/read test: ✅
• BYOK inference test: ✅

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com

Overall: PASS

cc @lpcox

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Claude Engine Validation

Check	Result
API status	✅ PASS
gh check	✅ PASS
File status	✅ PASS

Overall result: PASS

Generated by Smoke Claude for #7192 · haiku45 · 36.4 AIC · ⊞ 3.6K · ◷
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Copilot Engine

PRs checked: #7194 (ci: run Firecracker live smoke on hosted Ubuntu), #7175 (Add B21/B22/B23 self-hosted failure-mode lessons)

• MCP connectivity: ✅
• GitHub.com HTTP: ✅ (200)
• File write/read: ✅

Overall: PASS

@lpcox

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: GitHub Actions Services Connectivity

• Redis PING: ❌ (DNS resolution failure for host.docker.internal)
• PostgreSQL pg_isready: ❌ (no response)
• PostgreSQL SELECT 1: ❌ (DNS resolution failure)

Overall: FAIL — host.docker.internal could not be resolved from within the AWF sandbox.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

[github-actions]

OTel Tracing Smoke Test — All scenarios passed ✅

• ✅ Scenario 1 (Module Loading): otel.js loaded successfully, isEnabled() → true, exports 15 functions (startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled, etc.)
• ✅ Scenario 2 (Test Suite): 68/68 tests passed across 3 suites (otel.test.js, otel-fanout.test.js, otel-workload-identity.test.js)
• ✅ Scenario 3 (Env Var Forwarding): env-passthrough.ts forwards GITHUB_AW_OTEL_TRACE_ID/GITHUB_AW_OTEL_PARENT_SPAN_ID to agent; api-proxy-env-config.ts forwards GH_AW_OTLP_ENDPOINTS, OTEL_EXPORTER_OTLP_ENDPOINT, and trace context to api-proxy
• ✅ Scenario 4 (Token Tracker Integration): onUsage callback confirmed in token-tracker-http.js as the OTEL hook point
• i️ Scenario 5 (OTEL Diagnostics): checked via post-step; no runtime spans expected from this validation-only run (no live proxied requests were made)

No regressions detected in OTEL tracing integration.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

[github-actions]

Chroot Version Comparison

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.13	✅ YES
Node.js	v24.18.0	v22.23.2	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Result: Not all versions matched (Node.js differs between host and chroot environment), so the smoke-chroot label was not applied.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

[github-actions]

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A (run OK)	✅ PASS
.NET	json-parse	✅	N/A (run OK)	✅ PASS
Go	color	✅	ok	✅ PASS
Go	env	✅	ok	✅ PASS
Go	uuid	✅	ok	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — PASS

Note: Java's initial mvn compile failed with Could not create local repository at /home/runner/.m2/repository (permission denied on that shared path); retried successfully with -Dmaven.repo.local=/tmp/gh-aw/agent/m2repo and all Java tests then passed. No other issues encountered across the other 7 ecosystems.

Generated by Build Test Suite for #7192 · auto · 56.4 AIC · ⊞ 11.5K · ◷
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Docker Sbx Validation

• ✅ MCP connectivity (PR list fetched)
• ✅ GitHub.com connectivity (HTTP 200)
• ✅ File write/read test

Overall: PASS

Recent PRs: #7194 "ci: run Firecracker live smoke on hosted Ubuntu", #7175 "Add B21/B22/B23 self-hosted failure-mode lessons to runner-doctor catalog"

cc @lpcox

📰 BREAKING: Report filed by Smoke Docker Sbx
_{Add label ready-for-aw to run again}

[github-actions]

fix(ci): restore Firecracker artifact executable modes
Remove unused export of ExternalRuntimeBackendFactory type
Merged PR review ✅
GH query ❌
Playwright ✅
File/bash ✅
Discussion ❌
Build ❌
Overall: FAIL

Warning

Firewall blocked 5 domains

The following domains were blocked by the firewall during workflow execution:

• msfeed12.pkgs.visualstudio.com
• msfeed17.pkgs.visualstudio.com
• msfeed2.pkgs.visualstudio.com
• msfeed25.pkgs.visualstudio.com
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "msfeed12.pkgs.visualstudio.com"
    - "msfeed17.pkgs.visualstudio.com"
    - "msfeed2.pkgs.visualstudio.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}