[Test Coverage] Add coverage for parsers, services, host-identity#5240
Conversation
Add 167 unit tests covering 9 previously untested files: parsers (dns, rate-limit, host-port, env, volume), host-identity, runner-tool-cache, services/host-path-prefix, and services/service-security. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (4 files)
Coverage comparison generated by |
There was a problem hiding this comment.
Pull request overview
This PR improves the reliability of AWF’s security- and configuration-critical logic by adding unit test coverage for previously untested parsing and service helper modules.
Changes:
- Add new unit tests for DNS, env-file, volume mount, and rate-limit CLI parsers.
- Add unit tests for host identity resolution (UID/GID + home directory) and runner tool-cache path selection.
- Add unit tests for container security hardening config and Docker-host path prefix volume translation.
Show a summary per file
| File | Description |
|---|---|
| src/services/service-security.test.ts | Adds coverage for buildContainerSecurityHardening output fields and cpu_shares edge cases. |
| src/services/host-path-prefix.test.ts | Adds coverage for bind-mount source path prefix translation, including kernel VFS and /etc/* exceptions. |
| src/runner-tool-cache.test.ts | Adds coverage for resolveRunnerToolCachePath candidate priority and directory checks. |
| src/parsers/volume-parsers.test.ts | Adds coverage for volume mount parsing/validation and filesystem error handling. |
| src/parsers/rate-limit-parsers.test.ts | Adds coverage for rate-limit config building and flag validation behaviors. |
| src/parsers/host-port-parsers.test.ts | Adds coverage for host port flag validation and auto-enable host access behavior. |
| src/parsers/env-parsers.test.ts | Adds coverage for env-file parsing semantics and KEY=VALUE parsing. |
| src/parsers/dns-parsers.test.ts | Adds coverage for DNS server parsing, DoH parsing, and localhost keyword processing. |
| src/host-identity.test.ts | Adds coverage for safe UID/GID selection and sudo-aware home directory resolution. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 9/9 changed files
- Comments generated: 3
|
✅ Copilot review passed with no inline comments. @github-actions[bot] Add the |
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
|
@copilot merge main |
…-services-identity-1cebfe1f08885a2f
Merged latest |
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 |
|
❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed... |
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓 |
|
🚀 Security Guard has started processing this pull request |
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded. |
|
✅ Build Test Suite completed successfully! |
|
🔑 Smoke Copilot PAT PAT auth validated. All systems operational. ✅ |
|
🔌 Smoke Services — All services reachable! ✅ |
|
✅ Smoke Gemini completed. All facets verified. 💎 |
|
📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅ |
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤 |
|
❌ Smoke Claude failed |
|
✅ Contribution Check completed successfully! |
|
❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed... |
🔥 Smoke Test Results
PR: [Test Coverage] Add coverage for parsers, services, host-identity Overall: PASS ✅
|
Smoke Test: Copilot BYOK (Direct Mode) ✅✅ Test 1: GitHub MCP connectivity Status: PASS
|
🔐 Smoke Test: Copilot PAT Auth — PASS
Overall: PASS · Auth mode: PAT (COPILOT_GITHUB_TOKEN) PR by
|
|
✅ chore: upgrade gh-aw to v0.80.6 and recompile workflows Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "registry.npmjs.org"See Network Configuration for more information.
|
Chroot Smoke Test Results
Overall: ❌ FAILED — Python and Node.js versions differ between host and chroot environments.
|
Smoke Test: API Proxy OpenTelemetry Tracing
All validation steps passed. The OTEL integration is fully wired: spans are created per request, token usage attributes follow GenAI semconv (
|
Smoke Test Results — FAIL
Overall: FAIL
|
🏗️ Build Test Suite Results
Overall: 7/8 ecosystems passed — ❌ FAIL ❌ Failure DetailsJava (gson, caffeine) — Maven cannot download dependencies from Maven Central: Maven requires downloading plugins and dependencies from Root cause: The
|
Smoke Test: Gemini Engine Validation
PR Titles (from git log):
Overall status: FAIL Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "localhost"See Network Configuration for more information.
|
lpcox
deleted the
test-coverage-parsers-services-identity-1cebfe1f08885a2f
branch
Adds 167 new unit tests covering 9 previously untested source files, improving coverage for security-relevant parsing and container configuration code.
Files covered
src/parsers/dns-parsers.tsparseDnsServers(IPv4/IPv6 validation, empty/invalid),parseDnsOverHttps(undefined/true/custom/non-https),processLocalhostKeyword(localhost substitution with protocol preservation, port defaults)src/parsers/rate-limit-parsers.tsbuildRateLimitConfig(enabled/disabled, all combinations, boundary errors),validateRateLimitFlags,validateEnableTokenSteeringFlagsrc/parsers/host-port-parsers.tsvalidateAllowHostPorts,applyHostServicePortsConfig(port range 1–65535, auto-enable host access, warn/info logging)src/parsers/env-parsers.tsreadEnvVarFromEnvFiles(last-file-wins, CRLF, relative paths, key regex escaping, non-string entries),parseEnvironmentVariablessrc/parsers/volume-parsers.tsparseVolumeMounts(path absolute validation, mode validation,existsSyncerror handling)src/host-identity.tsgetSafeHostUid/getSafeHostGid(root→SUDO_UID/GID fallback, system UID clamping to 1000, missinggetuid),getRealUserHome(/etc/passwdlookup, fallback chain)src/runner-tool-cache.tsresolveRunnerToolCachePath(candidate priority order,lstatSyncerror handling)src/services/host-path-prefix.tsapplyHostPathPrefixToVolumes(prefix normalization, kernel VFS passthrough/dev//sys//proc,/etc/passwd/tmpexemption, already-prefixed paths, root path)src/services/service-security.tsbuildContainerSecurityHardening(cap_drop: ALL,no-new-privileges, optionalcpu_shares)Test approach
fsmodule mocked for files exercising filesystem I/O (env-parsers,volume-parsers,host-identity,runner-tool-cache)process.getuid/process.getgidpatched viaObject.definePropertyfor UID/GID edge cases