[test-improver] Improve tests for sys/Docker by github-actions[bot] · Pull Request #10419 · github/gh-aw-mcpg

github-actions · 2026-07-31T00:17:27Z

Summary

Improves test coverage for internal/sys/docker_test.go by adding a missing test case for the docker branch of CheckContainerRuntimeAccessible.

File Analyzed

internal/sys/docker_test.go — tests for the sys package (container detection and Docker inspection utilities)

Improvements Made

Added TestCheckContainerRuntimeAccessible_DockerBranch: The existing TestCheckContainerRuntimeAccessible test only covered:

A non-docker command that succeeds ("true")
A non-docker command that fails (/path/that/does/not/exist/podman)

It did not exercise the branch inside CheckContainerRuntimeAccessible where filepath.Base(command) == "docker" causes it to delegate to CheckDockerAccessible() rather than running the command directly.

The new test:

Sets DOCKER_HOST to a nonexistent socket path to get a deterministic false result from CheckDockerAccessible()
Calls CheckContainerRuntimeAccessible("docker") to exercise the basename check
Also covers the "/usr/local/bin/docker" absolute-path form, confirming basename extraction works correctly

Coverage

Metric	Before	After
`CheckContainerRuntimeAccessible`	88.9%	100.0%
Package total (`internal/sys`)	99.1%	100.0%

Test Output

=== RUN   TestCheckContainerRuntimeAccessible
--- PASS: TestCheckContainerRuntimeAccessible (0.00s)
=== RUN   TestCheckContainerRuntimeAccessible_DockerBranch
--- PASS: TestCheckContainerRuntimeAccessible_DockerBranch (0.00s)
=== RUN   TestCheckContainerRuntimeAccessible_PodmanWithoutDocker
--- PASS: TestCheckContainerRuntimeAccessible_PodmanWithoutDocker (0.00s)
PASS
ok  	github.com/github/gh-aw-mcpg/internal/sys	0.139s	coverage: 100.0% of statements

Generated by Test Improver · sonnet46 · 469.2 AIC · ⊞ 5.8K · ◷

Add TestCheckContainerRuntimeAccessible_DockerBranch which exercises the code path in CheckContainerRuntimeAccessible where the command basename is "docker", causing it to delegate to CheckDockerAccessible instead of running the command directly. Before: CheckContainerRuntimeAccessible = 88.9% coverage After: CheckContainerRuntimeAccessible = 100.0% coverage Package total: 99.1% → 100.0% Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Adds coverage for Docker-specific runtime accessibility checks.

Changes:

Tests docker and absolute Docker command paths.
Identified that assertions do not uniquely verify delegation.

Show a summary per file

File	Description
`internal/sys/docker_test.go`	Adds Docker-branch coverage tests.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 1/1 changed files
Comments generated: 1
Review effort level: Balanced

+func TestCheckContainerRuntimeAccessible_DockerBranch(t *testing.T) {
+	// Force a nonexistent Docker socket so CheckDockerAccessible returns false.
+	t.Setenv("DOCKER_HOST", "unix:///nonexistent/docker.sock")
+
+	// "docker" basename triggers the CheckDockerAccessible path.
+	assert.False(t, CheckContainerRuntimeAccessible("docker"),
+		"docker branch should return false when Docker socket is inaccessible")
+
+	// An absolute path with docker basename also triggers the docker branch.
+	assert.False(t, CheckContainerRuntimeAccessible("/usr/local/bin/docker"),
+		"absolute docker path should also delegate to CheckDockerAccessible")
+}


lpcox · 2026-07-31T03:39:09Z

@copilot address review feedback

Copilot · 2026-07-31T03:42:56Z

@copilot address review feedback

Addressed in 978a7fc. The Docker-branch test now adds a temporary executable named docker on PATH that exits 0, then sets a nonexistent DOCKER_HOST and asserts CheckContainerRuntimeAccessible("docker") and CheckContainerRuntimeAccessible(<absolute docker shim path>) both return false, which uniquely verifies delegation to CheckDockerAccessible.

github-actions · 2026-07-31T04:22:44Z

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	`Error [-32602]: unknown tool`	BLOCKED	✅
C	CLI	reads (issues/file via `github` CLI proxy)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated — blocked	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated — blocked	BLOCKED	✅

Overall: PASS

Full Report

Part B gateway error detail: All 7 write tool calls returned Error [-32602]: unknown tool "<toolname>" — gateway enforces read-only by not exposing write tools in the MCP tool registry.

Part D/E note: gh CLI is not authenticated in this environment (GH_TOKEN not set). All REST and GraphQL write attempts were blocked at the CLI auth layer. Combined security boundary (mcpg read-only MCP + unauthenticated token) held.

References: §30602265401

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

github-actions · 2026-07-31T04:24:30Z

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all refused: `Error [-32602]: unknown tool`	BLOCKED	✅
C	CLI	reads (issues/file via `github` bridge)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	all blocked: `gh` unauthenticated (no GH_TOKEN)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	all blocked: `gh` unauthenticated (no GH_TOKEN)	BLOCKED	✅

Overall: PASS

Notes:

Part B: Gateway enforces a 22-tool read-only allowlist; all write tools return MCP protocol error -32602 (unknown tool). This is gateway-enforced allowlist restriction, not merely backend read-only mode.
Part D/E: gh CLI has no GH_TOKEN — all REST and GraphQL writes blocked at the auth layer.
No reactions, stars, issues, comments, branches, files, or PRs were created.

References: §30602265399

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

github-actions · 2026-07-31T04:26:17Z

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all refused (unknown tool -32602)	BLOCKED	✅
C	CLI	reads (list_issues/get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	refused (gh unauthenticated)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	refused (gh unauthenticated)	BLOCKED	✅

Overall: PASS

Note: Part B write tools absent from gateway's 22-tool read-only manifest — gateway-level enforcement confirmed. Parts D&E blocked at CLI auth layer (no GH_TOKEN). Run §30602265366.

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime

github-actions Bot added automation improvement testing labels Jul 31, 2026

github-actions Bot mentioned this pull request Jul 31, 2026

rust-guard: add apply_tool_labels tests for PR review write tools and legacy aliases #10407

Merged

lpcox marked this pull request as ready for review July 31, 2026 02:24

Copilot AI review requested due to automatic review settings July 31, 2026 02:24

Copilot started reviewing on behalf of lpcox July 31, 2026 02:24 View session

Copilot AI reviewed Jul 31, 2026

View reviewed changes

This comment has been minimized.

Sign in to view

github-actions Bot added the readonly-stress-pass-gvisor label Jul 31, 2026

This comment has been minimized.

Sign in to view

github-actions Bot added the readonly-stress-pass-default label Jul 31, 2026

This comment has been minimized.

Sign in to view

github-actions Bot mentioned this pull request Jul 31, 2026

[Repo Assist] test(rust-guard): add tests for PR review write tools and legacy aliases #10401

Merged

Copilot started work on behalf of lpcox July 31, 2026 03:39 View session

test: make docker runtime test prove delegation

978a7fc

Copilot finished work on behalf of lpcox July 31, 2026 03:43

Copilot AI requested a review from lpcox July 31, 2026 03:43

lpcox merged commit c70f670 into main Jul 31, 2026
32 of 33 checks passed

lpcox deleted the test/improve-sys-docker-coverage-5a412f9da12e0c03 branch July 31, 2026 04:57

github-actions Bot mentioned this pull request Jul 31, 2026

Smoke Test: Copilot - 30632916571 #10457

Closed

This was referenced Jul 31, 2026

Smoke Test: Copilot - 30643273558 #10466

Closed

Smoke Test: Copilot - 30643891411 #10467

Closed

Smoke Test: Copilot - 30645035756 #10469

Closed

Smoke Test: Copilot - 30663797586 #10478

Closed

Navigation Menu

Uh oh!

[test-improver] Improve tests for sys/Docker - #10419

[test-improver] Improve tests for sys/Docker#10419
lpcox merged 2 commits into
mainfrom
test/improve-sys-docker-coverage-5a412f9da12e0c03

github-actions Bot commented Jul 31, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

lpcox commented Jul 31, 2026

Uh oh!

Copilot AI commented Jul 31, 2026

Uh oh!

github-actions Bot commented Jul 31, 2026

Uh oh!

github-actions Bot commented Jul 31, 2026

Uh oh!

github-actions Bot commented Jul 31, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

github-actions Bot commented Jul 31, 2026

Summary

File Analyzed

Improvements Made

Coverage

Test Output

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

lpcox commented Jul 31, 2026

Uh oh!

Copilot AI commented Jul 31, 2026

Uh oh!

github-actions Bot commented Jul 31, 2026

🔒 mcpg Read-Only Stress — gVisor

Uh oh!

github-actions Bot commented Jul 31, 2026

🔒 mcpg Read-Only Stress — default AWF

Uh oh!

github-actions Bot commented Jul 31, 2026

🔒 mcpg Read-Only Stress — docker-sbx

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants