Fix network.firewall.log-level YAML indentation in smoke-copilot workflows

[Copilot]

Fix Network Firewall Codemod to Handle Nested Properties

• Fix YAML syntax errors in smoke-copilot workflows
• Fix the codemod that caused the issue
• Add test for nested firewall properties
• Handle comments and empty lines within firewall block
• Refactor to reduce code duplication
• Verify all tests pass

Root Cause

The network.firewall to sandbox.agent codemod was only removing the firewall: line but not its nested properties (like log-level: debug). This left orphaned properties at the wrong indentation level, causing YAML parsing errors.

Solution

Updated the codemod to:

1. Track when inside a firewall: block
2. Remove all nested properties (lines with greater indentation)
3. Remove comments and empty lines within the firewall block
4. Properly exit the block when encountering a line at same or less indentation
5. Extract indentation calculation to avoid duplication

Changes

1. Fixed codemod logic (pkg/cli/fix_codemods.go):

   • Added inFirewallBlock and firewallIndent tracking
   • Skip lines with greater indentation than firewall: line
   • Handle empty lines (remove from firewall block)
   • Handle comments based on indentation (remove if nested, keep if not)
   • Extracted indentation calculation to reduce duplication
   • Log removal of nested properties for debugging

2. Added comprehensive tests (pkg/cli/fix_command_test.go):

   • TestFixCommand_NetworkFirewallMigrationWithNestedProperties - tests nested properties
   • TestFixCommand_NetworkFirewallMigrationWithCommentsAndEmptyLines - tests comment/empty line handling
   • Verifies that all nested content is removed
   • Ensures the result compiles without YAML syntax errors

Validation

• ✅ All existing tests pass
• ✅ New tests pass
• ✅ smoke-copilot workflows compile successfully
• ✅ Codemod produces valid YAML that passes compilation
• ✅ Comments and empty lines within firewall block are properly removed
• ✅ Code review suggestions addressed

Original prompt

Fix https://github.com/githubnext/gh-aw/actions/runs/20200002978/job/57989663008#step:13:1

Custom agent used: debug-agentic-workflow
Debug and refine agentic workflows using gh-aw CLI tools - analyze logs, audit runs, and improve workflow performance

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[pelikhan]

@copilot this problem was created by the fix command that remove firewall: true. codemod fixes must pass compilation.

[Copilot]

@copilot this problem was created by the fix command that remove firewall: true. codemod fixes must pass compilation.

Fixed in commit d6a8edc. The codemod now properly removes nested firewall properties (like log-level: and version:) when migrating network.firewall to sandbox.agent. Added test coverage to ensure the codemod produces valid YAML that compiles successfully.