Refactor host iptables tests and fix follow-up CI regressions by Copilot · Pull Request #2901 · github/gh-aw-firewall

Copilot · 2026-05-11T13:51:02Z

Inspect branch state and fetch the latest main
Run baseline validation commands to capture current status
Merge main into the PR branch and resolve any conflicts minimally
Re-run relevant validation, push the merge commit, and reply on the PR comment

github-actions · 2026-05-11T15:01:14Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	87.84%	88.04%	📈 +0.20%
Statements	87.77%	87.98%	📈 +0.21%
Functions	82.78%	83.22%	📈 +0.44%
Branches	79.72%	79.80%	📈 +0.08%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
`src/container-lifecycle.ts`	87.1% → 88.2% (+1.14%)	87.5% → 88.6% (+1.11%)
`src/cli.ts`	28.0% → 98.3% (+70.32%)	28.0% → 98.4% (+70.42%)

✨ New Files (4 files)

src/cli-options.ts: 93.0% lines
src/commands/main-action.ts: 5.9% lines
src/commands/subcommands.ts: 44.7% lines
src/test-helpers/host-iptables-test-setup.ts: 100.0% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Refactors the previously monolithic host-iptables Jest test suite into several focused modules to make security-critical firewall contract coverage easier to navigate and extend.

Changes:

Split src/host-iptables.test.ts into focused test files for network, setup, host-access, cleanup, and DoH scenarios
Preserved existing mocking patterns and assertions while redistributing coverage
Removed the original monolithic test file after migrating scenarios

Show a summary per file

File	Description
src/host-iptables.test.ts	Deletes the monolithic host iptables test suite after scenarios are redistributed.
src/host-iptables-setup.test.ts	Adds focused coverage for `setupHostIptables`, IPv6 behavior, CLI proxy rules, and `isValidPortSpec`.
src/host-iptables-network.test.ts	Adds focused coverage for firewall network ensure/remove behavior.
src/host-iptables-host-access.test.ts	Adds focused coverage for host-access and gateway rule variants.
src/host-iptables-doh.test.ts	Adds focused coverage for DoH-specific setup rules.
src/host-iptables-cleanup.test.ts	Adds focused coverage for `cleanupHostIptables` including IPv6 best-effort cleanup and sysctl behavior.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 6/6 changed files
Comments generated: 5

+import { isValidPortSpec, setupHostIptables, __testing } from './host-iptables';
+import execa from 'execa';
+
+// Mock execa
+jest.mock('execa');
+const mockedExeca = execa as jest.MockedFunction<typeof execa>;
+
+// Mock getLocalDockerEnv to return a predictable env for assertions
+jest.mock('./docker-manager', () => ({
+  getLocalDockerEnv: () => process.env,
+}));
+
+// Mock logger to avoid console output during tests
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+jest.mock('./logger', () => require('./test-helpers/mock-logger.test-utils').loggerMockFactory());


+// eslint-disable-next-line @typescript-eslint/no-require-imports
+jest.mock('./logger', () => require('./test-helpers/mock-logger.test-utils').loggerMockFactory());
+
+describe('host-iptables', () => {


+    __testing._resetIpv6State();
+  });
+
+  describe('setupHostIptables with host access', () => {


+        .mockResolvedValueOnce({
+          stdout: 'fw-bridge',
+          stderr: '',
+          exitCode: 0,
+        } as any)


+      // Verify API proxy sidecar rule was added with port range
+      expect(mockedExeca).toHaveBeenCalledWith('iptables', expect.arrayContaining([
+        '-t', 'filter', '-A', 'FW_WRAPPER',
+        '-p', 'tcp', '-d', '172.30.0.30',
+      ]));


lpcox · 2026-05-11T15:20:09Z

@copilot address review feedback

Copilot · 2026-05-11T15:28:02Z

@copilot address review feedback

Addressed in 0270d4b. I extracted the shared host-iptables test bootstrap into src/test-helpers/host-iptables-test-setup.ts, gave each split suite a distinct top-level describe, replaced repeated untyped mocked execa result literals with a typed helper, and tightened the API proxy assertion to verify the expected port range.

lpcox · 2026-05-11T23:26:51Z

@copilot fix the linting errors https://github.com/github/gh-aw-firewall/actions/runs/25703009466/job/75467720960?pr=2901

Copilot · 2026-05-11T23:30:12Z

@copilot fix the linting errors https://github.com/github/gh-aw-firewall/actions/runs/25703009466/job/75467720960?pr=2901

Addressed in e8e37f7. I added a one-line markdownlint suppression in .github/workflows/security-guard.md so the required __GH_AW_EXPR_66EB691F__ placeholder remains unchanged while the Markdown Lint job passes.

lpcox · 2026-05-11T23:39:40Z

@copilot merge main

Copilot · 2026-05-11T23:44:50Z

@copilot merge main

Addressed in 5524a98. I merged the latest origin/main, resolved the container-lifecycle / docker-manager-lifecycle conflicts by preserving the api-proxy startup inspect fallback, and re-ran validation; the same existing failure remains in scripts/ci/workflow-engine-install-security.test.ts.

github-actions · 2026-05-11T23:57:21Z

Smoke Test: Copilot BYOK (Offline) Mode

❌ GitHub MCP: 401 Bad credentials (unauthenticated)
⚠️ HTTP connectivity: template vars not expanded (pre-step skipped)
⚠️ File write/read: template vars not expanded (pre-step skipped)
✅ BYOK inference: responding via api-proxy → api.githubcopilot.com (COPILOT_OFFLINE=true)

Running in BYOK offline mode (COPILOT_OFFLINE=true) via api-proxy → api.githubcopilot.com

Overall: FAIL — pre-step outputs not available; GitHub MCP unauthenticated.

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-05-11T23:57:24Z

Smoke Test Results

❌ GitHub MCP Testing (gh CLI not authenticated per system config)
✅ Playwright Testing (page title verified)
✅ File Writing Testing (test file created)
✅ Bash Tool Testing (file verified)

Status: 3/4 PASS

💥 [THE END] — Illustrated by Smoke Claude

github-actions · 2026-05-11T23:58:20Z

Smoke test: FAIL
Merged PRs: test: remove dead mockLogger export from logger test helper; refactor: reduce pid-tracker API surface and harden api-proxy startup retry handling
Queried PRs: Refactor host iptables tests and fix follow-up CI regressions; feat: replace Playwright MCP container with pre-installed @playwright/cli in agent image
GitHub MCP ❌; safeinputs-gh ❌; Playwright ✅; Tavily ❌
File write ✅; bash readback ✅; discussion comment ✅; npm build ✅
Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-05-11T23:58:28Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	ok	✅ PASS
Go	env	✅	ok	✅ PASS
Go	uuid	✅	ok	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	All passed	✅ PASS
Node.js	execa	✅	All passed	✅ PASS
Node.js	p-limit	✅	All passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for issue #2901 · ● 482.6K · ◷

github-actions · 2026-05-11T23:58:33Z

Chroot Smoke Test Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.3	❌
Node.js	v24.14.1	v20.20.2	❌
Go	go1.22.12	go1.22.12	✅

Overall: ❌ FAILED — Python and Node.js versions differ between host and chroot environments.

Tested by Smoke Chroot

github-actions · 2026-05-11T23:58:40Z

🔍 Smoke Test Results — PR #2901

Test	Result
GitHub MCP connectivity	❌ 401 auth error
GitHub.com HTTP connectivity	⚠️ Template vars not substituted
File write/read	✅ File exists with expected content

PR author: @Copilot (copilot/refactor-split-host-iptables-test)

Overall: FAIL — GitHub MCP returned 401; template substitution did not resolve SMOKE_HTTP_CODE/SMOKE_PR_DATA/SMOKE_FILE_CONTENT variables in agent prompt.

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-05-11T23:59:27Z

Smoke Test Results — FAIL

Check	Result
Redis PING	❌ Timeout (no response)
PostgreSQL pg_isready	❌ No response on port 5432
PostgreSQL SELECT 1	❌ Not attempted (pg_isready failed)

host.docker.internal is not reachable from this runner environment. Service containers are unavailable.

Overall: FAIL

🔌 Service connectivity validated by Smoke Services

Initial plan

cb7552f

Copilot AI assigned Copilot and lpcox May 11, 2026

Copilot started work on behalf of lpcox May 11, 2026 14:10 View session

Copilot AI linked an issue May 11, 2026 that may be closed by this pull request

[Refactoring] Split src/host-iptables.test.ts into focused test modules #2847

Closed

test: split host iptables modules

1c46026

Copilot AI changed the title ~~[WIP] Refactor split src/host-iptables.test.ts into focused test modules~~ Refactor host iptables tests into focused modules May 11, 2026

Copilot finished work on behalf of lpcox May 11, 2026 14:20

Copilot AI requested a review from lpcox May 11, 2026 14:20

lpcox marked this pull request as ready for review May 11, 2026 14:59

lpcox requested a review from Mossaka as a code owner May 11, 2026 14:59

Copilot AI review requested due to automatic review settings May 11, 2026 14:59

This comment has been minimized.

Sign in to view

Copilot AI reviewed May 11, 2026

View reviewed changes

This comment has been minimized.

Sign in to view

github-actions Bot added the smoke-claude label May 11, 2026

This comment has been minimized.

Sign in to view

github-actions Bot mentioned this pull request May 11, 2026

[aw] No-Op Runs #2911

Open

This comment has been minimized.

Sign in to view

github-actions Bot added the build-test label May 11, 2026

Copilot started work on behalf of lpcox May 11, 2026 15:20 View session

Copilot AI added 2 commits May 11, 2026 15:25

test: address host iptables review

10278d7

test: refine host iptables helpers

0270d4b

Copilot finished work on behalf of lpcox May 11, 2026 15:28

This comment has been minimized.

Sign in to view

Copilot started work on behalf of lpcox May 11, 2026 23:27 View session

This comment has been minimized.

Sign in to view

fix: suppress markdown lint for security guard placeholder

e8e37f7

Copilot finished work on behalf of lpcox May 11, 2026 23:30

Copilot started work on behalf of lpcox May 11, 2026 23:39 View session

This comment has been minimized.

Sign in to view

chore: merge origin/main into copilot/refactor-split-host-iptables-test

5524a98

This comment has been minimized.

Sign in to view

Copilot finished work on behalf of lpcox May 11, 2026 23:45

lpcox merged commit ef6a9f6 into main May 12, 2026
64 of 70 checks passed

lpcox deleted the copilot/refactor-split-host-iptables-test branch May 12, 2026 00:11

Conversation

Copilot AI commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Coverage Check Passed

Overall Coverage

Uh oh!

This comment has been minimized.

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

lpcox commented May 11, 2026

Uh oh!

Copilot AI commented May 11, 2026

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

lpcox commented May 11, 2026

Uh oh!

This comment has been minimized.

Copilot AI commented May 11, 2026

Uh oh!

lpcox commented May 11, 2026

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

Copilot AI commented May 11, 2026

Uh oh!

github-actions Bot commented May 11, 2026

Smoke Test: Copilot BYOK (Offline) Mode

Uh oh!

github-actions Bot commented May 11, 2026

Smoke Test Results

Uh oh!

github-actions Bot commented May 11, 2026

Uh oh!

github-actions Bot commented May 11, 2026

🏗️ Build Test Suite Results

Uh oh!

github-actions Bot commented May 11, 2026

Chroot Smoke Test Results

Uh oh!

github-actions Bot commented May 11, 2026

🔍 Smoke Test Results — PR #2901

Uh oh!

github-actions Bot commented May 11, 2026

Smoke Test Results — FAIL

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented May 11, 2026 •

edited

Loading

github-actions Bot commented May 11, 2026 •

edited

Loading